Play interactive tour

Edit tour

Windows Analysis Report Orden de Compra -SA765443,pdf.exe

Overview

General Information

Sample Name:	Orden de Compra -SA765443,pdf.exe
Analysis ID:	527111
MD5:	f7f223c7625c5c9df43af835298c1183
SHA1:	2105dc6b41d1ec220e89fb018fb1fd95b9a22d5a
SHA256:	7a356a718b0ca6272486633efb6a34c6301007f50766d8cfab60a996f2729935
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Yara detected Nanocore RAT

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sigma detected: Suspicius Add Task From User AppData Temp

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Orden de Compra -SA765443,pdf.exe (PID: 6196 cmdline: "C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe" MD5: F7F223C7625C5C9DF43AF835298C1183)

Orden de Compra -SA765443,pdf.exe (PID: 6548 cmdline: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe MD5: F7F223C7625C5C9DF43AF835298C1183)

schtasks.exe (PID: 6712 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Orden de Compra -SA765443,pdf.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe" 0 MD5: F7F223C7625C5C9DF43AF835298C1183)

Orden de Compra -SA765443,pdf.exe (PID: 4220 cmdline: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe MD5: F7F223C7625C5C9DF43AF835298C1183)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "c78d90a0-5de6-4b77-9d98-da24b367", "Group": "CHIBOY", "Domain1": "wealthgod1234.ddns.net", "Domain2": "127.0.0.1", "Port": 4693, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 4995, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x435d5:$a: NanoCore 0x4362e:$a: NanoCore 0x4366b:$a: NanoCore 0x436e4:$a: NanoCore 0x56d8f:$a: NanoCore 0x56da4:$a: NanoCore 0x56dd9:$a: NanoCore 0x6fd7b:$a: NanoCore 0x6fd90:$a: NanoCore 0x6fdc5:$a: NanoCore 0x43637:$b: ClientPlugin 0x43674:$b: ClientPlugin 0x43f72:$b: ClientPlugin 0x43f7f:$b: ClientPlugin 0x56b4b:$b: ClientPlugin 0x56b66:$b: ClientPlugin 0x56b96:$b: ClientPlugin 0x56dad:$b: ClientPlugin 0x56de2:$b: ClientPlugin 0x6fb37:$b: ClientPlugin 0x6fb52:$b: ClientPlugin
00000000.00000002.266827018.0000000002CA1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.516734883.0000000005AD0000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000005.00000002.516734883.0000000005AD0000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.514335905.000000000404D000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6952f:$a: NanoCore 0x69588:$a: NanoCore 0x695c5:$a: NanoCore 0x6963e:$a: NanoCore 0x69591:$b: ClientPlugin 0x695ce:$b: ClientPlugin 0x69ecc:$b: ClientPlugin 0x69ed9:$b: ClientPlugin 0x5f6a9:$e: KeepAlive 0x69a19:$g: LogClientMessage 0x69999:$i: get_Connected 0x59965:$j: #=q 0x59995:$j: #=q 0x599d1:$j: #=q 0x599f9:$j: #=q 0x59a29:$j: #=q 0x59a59:$j: #=q 0x59a89:$j: #=q 0x59ab9:$j: #=q 0x59ad5:$j: #=q 0x59b05:$j: #=q
00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.266922252.0000000002CDE000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x69825:$x1: NanoCore.ClientPluginHost 0x18dbed:$x1: NanoCore.ClientPluginHost 0x1c060d:$x1: NanoCore.ClientPluginHost 0x69862:$x2: IClientNetworkHost 0x18dc2a:$x2: IClientNetworkHost 0x1c064a:$x2: IClientNetworkHost 0x6d395:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x19175d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1c417d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6958d:$a: NanoCore 0x6959d:$a: NanoCore 0x697d1:$a: NanoCore 0x697e5:$a: NanoCore 0x69825:$a: NanoCore 0x18d955:$a: NanoCore 0x18d965:$a: NanoCore 0x18db99:$a: NanoCore 0x18dbad:$a: NanoCore 0x18dbed:$a: NanoCore 0x1c0375:$a: NanoCore 0x1c0385:$a: NanoCore 0x1c05b9:$a: NanoCore 0x1c05cd:$a: NanoCore 0x1c060d:$a: NanoCore 0x695ec:$b: ClientPlugin 0x697ee:$b: ClientPlugin 0x6982e:$b: ClientPlugin 0x18d9b4:$b: ClientPlugin 0x18dbb6:$b: ClientPlugin 0x18dbf6:$b: ClientPlugin
00000009.00000002.295061035.000000000323E000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x69825:$x1: NanoCore.ClientPluginHost 0x18dbed:$x1: NanoCore.ClientPluginHost 0x1c060d:$x1: NanoCore.ClientPluginHost 0x69862:$x2: IClientNetworkHost 0x18dc2a:$x2: IClientNetworkHost 0x1c064a:$x2: IClientNetworkHost 0x6d395:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x19175d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1c417d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6958d:$a: NanoCore 0x6959d:$a: NanoCore 0x697d1:$a: NanoCore 0x697e5:$a: NanoCore 0x69825:$a: NanoCore 0x18d955:$a: NanoCore 0x18d965:$a: NanoCore 0x18db99:$a: NanoCore 0x18dbad:$a: NanoCore 0x18dbed:$a: NanoCore 0x1c0375:$a: NanoCore 0x1c0385:$a: NanoCore 0x1c05b9:$a: NanoCore 0x1c05cd:$a: NanoCore 0x1c060d:$a: NanoCore 0x695ec:$b: ClientPlugin 0x697ee:$b: ClientPlugin 0x6982e:$b: ClientPlugin 0x18d9b4:$b: ClientPlugin 0x18dbb6:$b: ClientPlugin 0x18dbf6:$b: ClientPlugin
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x48602:$x1: NanoCore.ClientPluginHost 0x4863f:$x2: IClientNetworkHost 0x4bb27:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x56880:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x9eb05:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xa9e8e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x48326:$a: NanoCore 0x48336:$a: NanoCore 0x4839e:$a: NanoCore 0x483ad:$a: NanoCore 0x485ae:$a: NanoCore 0x485c2:$a: NanoCore 0x48602:$a: NanoCore 0x52eea:$a: NanoCore 0x52efc:$a: NanoCore 0x52f38:$a: NanoCore 0x9b16f:$a: NanoCore 0x9b181:$a: NanoCore 0x9b1bd:$a: NanoCore 0xa64f8:$a: NanoCore 0xa650a:$a: NanoCore 0xa6546:$a: NanoCore 0x4834a:$b: ClientPlugin 0x483f7:$b: ClientPlugin 0x485cb:$b: ClientPlugin 0x4860b:$b: ClientPlugin 0x52f05:$b: ClientPlugin
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xdea9:$x1: NanoCore.ClientPluginHost 0xdec3:$x2: IClientNetworkHost 0x2f97b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3a632:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3350:$a: NanoCore 0x33ac:$a: NanoCore 0x342b:$a: NanoCore 0xde13:$a: NanoCore 0xde6c:$a: NanoCore 0xdea9:$a: NanoCore 0xdf22:$a: NanoCore 0xe4d4:$a: NanoCore 0xe527:$a: NanoCore 0xe560:$a: NanoCore 0xe5d3:$a: NanoCore 0x2c39a:$a: NanoCore 0x2c3aa:$a: NanoCore 0x2c405:$a: NanoCore 0x2c414:$a: NanoCore 0x36c9c:$a: NanoCore 0x36cae:$a: NanoCore 0x36cea:$a: NanoCore 0x46f55:$a: NanoCore 0x46f68:$a: NanoCore 0x46f9a:$a: NanoCore
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x128d0:$x1: NanoCore.ClientPluginHost 0x1290d:$x2: IClientNetworkHost 0x15ef4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x20d17:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x68fd0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x74359:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x125d1:$a: NanoCore 0x125e1:$a: NanoCore 0x1266c:$a: NanoCore 0x1267b:$a: NanoCore 0x1287c:$a: NanoCore 0x12890:$a: NanoCore 0x128d0:$a: NanoCore 0x1d381:$a: NanoCore 0x1d393:$a: NanoCore 0x1d3cf:$a: NanoCore 0x6563a:$a: NanoCore 0x6564c:$a: NanoCore 0x65688:$a: NanoCore 0x709c3:$a: NanoCore 0x709d5:$a: NanoCore 0x70a11:$a: NanoCore 0x1260b:$b: ClientPlugin 0x126c5:$b: ClientPlugin 0x12899:$b: ClientPlugin 0x128d9:$b: ClientPlugin 0x1d39c:$b: ClientPlugin
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xa02d:$x1: NanoCore.ClientPluginHost 0xa047:$x2: IClientNetworkHost 0x2aee5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3595b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x9f97:$a: NanoCore 0x9ff0:$a: NanoCore 0xa02d:$a: NanoCore 0xa0a6:$a: NanoCore 0xa658:$a: NanoCore 0xa6ab:$a: NanoCore 0xa6e4:$a: NanoCore 0xa757:$a: NanoCore 0x11962:$a: NanoCore 0x11975:$a: NanoCore 0x119a7:$a: NanoCore 0x17690:$a: NanoCore 0x176a3:$a: NanoCore 0x176d5:$a: NanoCore 0x271df:$a: NanoCore 0x27b3b:$a: NanoCore 0x27b81:$a: NanoCore 0x27b90:$a: NanoCore 0x31fc5:$a: NanoCore 0x31fd7:$a: NanoCore 0x32013:$a: NanoCore
Click to see the 60 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
14.2.Orden de Compra -SA765443,pdf.exe.3299750.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
14.2.Orden de Compra -SA765443,pdf.exe.3299750.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.5ad0000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.5ad0000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
9.2.Orden de Compra -SA765443,pdf.exe.322a178.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5cf:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5fc:$x2: IClientNetworkHost
14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5cf:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6aa:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5e9:$s5: IClientLoggingHost
14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d585:$a: NanoCore 0x2d59a:$a: NanoCore 0x2d5cf:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d341:$b: ClientPlugin 0x2d35c:$b: ClientPlugin
5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24170:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x2419d:$x2: IClientNetworkHost
14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24170:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2524b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x2418a:$s5: IClientLoggingHost
14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28799:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287c6:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28799:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29874:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287b3:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28799:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287c6:$x2: IClientNetworkHost
14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28799:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29874:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287b3:$s5: IClientLoggingHost
14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.Orden de Compra -SA765443,pdf.exe.2cca178.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24170:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x2419d:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24170:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2524b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x2418a:$s5: IClientLoggingHost
5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.Orden de Compra -SA765443,pdf.exe.3034bbc.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
5.2.Orden de Compra -SA765443,pdf.exe.3034bbc.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x42a9b:$c: ProjectData 0x7dbde:$c: ProjectData 0x10a82:$d: DESCrypto 0x434a2:$d: DESCrypto
0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x134555:$x1: NanoCore.ClientPluginHost 0x166f75:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x134592:$x2: IClientNetworkHost 0x166fb2:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1380c5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x16aae5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x1342bd:$a: NanoCore 0x1342cd:$a: NanoCore 0x134501:$a: NanoCore 0x134515:$a: NanoCore 0x134555:$a: NanoCore 0x166cdd:$a: NanoCore 0x166ced:$a: NanoCore 0x166f21:$a: NanoCore 0x166f35:$a: NanoCore 0x166f75:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x13431c:$b: ClientPlugin 0x13451e:$b: ClientPlugin 0x13455e:$b: ClientPlugin
9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x134555:$x1: NanoCore.ClientPluginHost 0x166f75:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x134592:$x2: IClientNetworkHost 0x166fb2:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1380c5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x16aae5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x1342bd:$a: NanoCore 0x1342cd:$a: NanoCore 0x134501:$a: NanoCore 0x134515:$a: NanoCore 0x134555:$a: NanoCore 0x166cdd:$a: NanoCore 0x166ced:$a: NanoCore 0x166f21:$a: NanoCore 0x166f35:$a: NanoCore 0x166f75:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x13431c:$b: ClientPlugin 0x13451e:$b: ClientPlugin 0x13455e:$b: ClientPlugin
0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x42a9b:$c: ProjectData 0x7dbde:$c: ProjectData 0x10a82:$d: DESCrypto 0x434a2:$d: DESCrypto
Click to see the 116 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe, ProcessId: 6548, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

System Summary:

Sigma detected: Suspicius Add Task From User AppData Temp

Show sources

Source: Process started

Author: frack113: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe, ParentImage: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe, ParentProcessId: 6548, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp, ProcessId: 6712

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "c78d90a0-5de6-4b77-9d98-da24b367", "Group": "CHIBOY", "Domain1": "wealthgod1234.ddns.net", "Domain2": "127.0.0.1", "Port": 4693, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 4995, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.514335905.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR

Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack	Avira: Label: TR/NanoCore.fadte
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 4x nop then jmp 0129A224h	0_2_0129A060
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 4x nop then jmp 0129A224h	0_2_0129A053
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 4x nop then jmp 0169A224h	9_2_0169A060
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 4x nop then jmp 0169A224h	9_2_0169A050

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: wealthgod1234.ddns.net
Source: Malware configuration extractor	URLs: 127.0.0.1

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: wealthgod1234.ddns.net

Source: Joe Sandbox View

ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG

Source: Joe Sandbox View

IP Address: 185.140.53.12 185.140.53.12

Source: global traffic

TCP traffic: 192.168.2.7:49756 -> 185.140.53.12:4693

Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	String found in binary or memory: http://www.chinhdo.com
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: wealthgod1234.ddns.net

Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.266021612.0000000000F5B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.514335905.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.Orden de Compra -SA765443,pdf.exe.3299750.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.Orden de Compra -SA765443,pdf.exe.5ad0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.Orden de Compra -SA765443,pdf.exe.3034bbc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.516734883.0000000005AD0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.Orden de Compra -SA765443,pdf.exe.3299750.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.Orden de Compra -SA765443,pdf.exe.3299750.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.Orden de Compra -SA765443,pdf.exe.5ad0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.5ad0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.Orden de Compra -SA765443,pdf.exe.3034bbc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.Orden de Compra -SA765443,pdf.exe.3034bbc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.516734883.0000000005AD0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.516734883.0000000005AD0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_0129A060	0_2_0129A060
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_01298410	0_2_01298410
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_0129B4C8	0_2_0129B4C8
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_0129E188	0_2_0129E188
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_0129A053	0_2_0129A053
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_0752F338	0_2_0752F338
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_07522113	0_2_07522113
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_0752D978	0_2_0752D978
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_07523ADF	0_2_07523ADF
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_07523AF0	0_2_07523AF0
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_07523890	0_2_07523890
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 0_2_075238A0	0_2_075238A0
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 5_2_0555E471	5_2_0555E471
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 5_2_0555E480	5_2_0555E480
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 5_2_0555BBD4	5_2_0555BBD4
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_0169A060	9_2_0169A060
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_01698410	9_2_01698410
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_0169B4C8	9_2_0169B4C8
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_0169E188	9_2_0169E188
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_0169A050	9_2_0169A050
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_0757D978	9_2_0757D978
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_07572113	9_2_07572113
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_07573ADF	9_2_07573ADF
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_07573AF0	9_2_07573AF0
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_07573890	9_2_07573890
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 9_2_075738A0	9_2_075738A0
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 14_2_0197E480	14_2_0197E480
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 14_2_0197E471	14_2_0197E471
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Code function: 14_2_0197BBD4	14_2_0197BBD4

Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.265515025.00000000008EC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBinaryAssemblyIn.exeP vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.266827018.0000000002CA1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameTransactionalFileManager.dllf# vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.266021612.0000000000F5B000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dll@ vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000000.260346348.0000000000D7C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBinaryAssemblyIn.exeP vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.516882135.00000000066A0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.293137418.0000000000E3C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBinaryAssemblyIn.exeP vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dll@ vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameTransactionalFileManager.dllf# vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe, 0000000E.00000000.292208495.0000000000F2C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBinaryAssemblyIn.exeP vs Orden de Compra -SA765443,pdf.exe
Source: Orden de Compra -SA765443,pdf.exe	Binary or memory string: OriginalFilenameBinaryAssemblyIn.exeP vs Orden de Compra -SA765443,pdf.exe

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

File read: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Jump to behavior

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe "C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe"
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe "C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe" 0
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Orden de Compra -SA765443,pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmp62E7.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/5@16/1

Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{c78d90a0-5de6-4b77-9d98-da24b3672291}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_01

Source: Orden de Compra -SA765443,pdf.exe, ue000.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Orden de Compra -SA765443,pdf.exe.860000.0.unpack, ue000.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.Orden de Compra -SA765443,pdf.exe.860000.0.unpack, ue000.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.Orden de Compra -SA765443,pdf.exe.cf0000.5.unpack, ue000.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.Orden de Compra -SA765443,pdf.exe.cf0000.0.unpack, ue000.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.Orden de Compra -SA765443,pdf.exe.cf0000.3.unpack, ue000.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Orden de Compra -SA765443,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: initial sample

Static PE information: section name: .text entropy: 7.72977166234

Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Show sources

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (67).png

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

File opened: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.322a178.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.2cca178.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.266827018.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266922252.0000000002CDE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295061035.000000000323E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.266827018.0000000002CA1000.00000004.00000001.sdmp, Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.266827018.0000000002CA1000.00000004.00000001.sdmp, Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe TID: 6200	Thread sleep time: -32640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe TID: 6232	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe TID: 6860	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe TID: 6868	Thread sleep time: -34498s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe TID: 6916	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe TID: 5872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Window / User API: threadDelayed 4239	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Window / User API: threadDelayed 5280	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Window / User API: foregroundWindowGot 870	Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 32640	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 34498	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Memory written: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Memory written: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Process created: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Jump to behavior

Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.512339089.0000000001A40000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.516849356.00000000065AB000.00000004.00000010.sdmp	Binary or memory string: Program Manager
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.512339089.0000000001A40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.512339089.0000000001A40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.512339089.0000000001A40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.514335905.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: Orden de Compra -SA765443,pdf.exe, 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Orden de Compra -SA765443,pdf.exe, 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Orden de Compra -SA765443,pdf.exe, 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Orden de Compra -SA765443,pdf.exe, 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Orden de Compra -SA765443,pdf.exe, 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b4629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.427b7f6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.4284c55.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.428062c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.405062c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4069618.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Orden de Compra -SA765443,pdf.exe.4054c55.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4386a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3d02698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Orden de Compra -SA765443,pdf.exe.4262698.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orden de Compra -SA765443,pdf.exe.3e26a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.514335905.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Orden de Compra -SA765443,pdf.exe PID: 4220, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection112	Masquerading11	Input Capture21	Security Software Discovery11	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol21	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.2.Orden de Compra -SA765443,pdf.exe.66b0000.8.unpack	100%	Avira	TR/NanoCore.fadte	Download File
5.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.Orden de Compra -SA765443,pdf.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.0.Orden de Compra -SA765443,pdf.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.Orden de Compra -SA765443,pdf.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.2.Orden de Compra -SA765443,pdf.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.0.Orden de Compra -SA765443,pdf.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.Orden de Compra -SA765443,pdf.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

Source	Detection	Scanner	Label	Link
wealthgod1234.ddns.net	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
wealthgod1234.ddns.net	2%	Virustotal		Browse
wealthgod1234.ddns.net	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.chinhdo.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
127.0.0.1	0%	Virustotal		Browse
127.0.0.1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wealthgod1234.ddns.net	185.140.53.12	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
wealthgod1234.ddns.net	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
127.0.0.1	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.tiro.com	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.fonts.com	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.chinhdo.com	Orden de Compra -SA765443,pdf.exe, 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Orden de Compra -SA765443,pdf.exe, 00000000.00000002.270115374.0000000006C02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.140.53.12	wealthgod1234.ddns.net	Sweden		209623	DAVID_CRAIGGG	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	527111
Start date:	23.11.2021
Start time:	11:58:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Orden de Compra -SA765443,pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/5@16/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 1% (good quality ratio 0.4%) Quality average: 26.6% Quality standard deviation: 36%
HCA Information:	Successful, ratio: 90% Number of executed functions: 73 Number of non-executed functions: 5
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:59:21	API Interceptor	921x Sleep call for process: Orden de Compra -SA765443,pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.140.53.12	Hemotronik Nov Acil PO_76565,pdf.exe	Get hash	malicious	Browse
	SOMECO Nov Acil PO_76565,pdf.exe	Get hash	malicious	Browse
	Sifari#U015fin t#U0259sdiq edilm#U0259si _ T#U0259cili,pdf.exe	Get hash	malicious	Browse
	AWB # 2617429350,pdf.exe	Get hash	malicious	Browse
	AWB # 2617429350,pdf.exe	Get hash	malicious	Browse
	C.GNew pedido WJO-001,pdf.exe	Get hash	malicious	Browse
	DHL_119040 re#U00e7u,pdf (2).exe	Get hash	malicious	Browse
	Confirmaci#U00f3n de pedido nuevo-5309,pdf.exe	Get hash	malicious	Browse
	Urgente RFQ_AP65425652_032421,pdf.exe	Get hash	malicious	Browse
	Urgent RFQ_AP65425652_03242,pdf.exe	Get hash	malicious	Browse
	vmw7WdkJ6k.exe	Get hash	malicious	Browse
	CONTRACT PMA1911003.exe	Get hash	malicious	Browse
	003663-37399.exe	Get hash	malicious	Browse
	BingUpdate.exe	Get hash	malicious	Browse
	Documents RF V23665.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	purchase order 0112.exe	Get hash	malicious	Browse	185.140.53.137
	9mMANDmw9O.exe	Get hash	malicious	Browse	91.193.75.190
	TR0398734893 50601251.exe	Get hash	malicious	Browse	185.140.53.131
	swift.xls	Get hash	malicious	Browse	91.193.75.212
	SOA_0009877890.exe	Get hash	malicious	Browse	185.244.30.58
	8UYr1od7iW.exe	Get hash	malicious	Browse	91.193.75.148
	928272_Payment_Receipt.vbs	Get hash	malicious	Browse	185.140.53.3
	N2K18_Payment_Copy.vbs	Get hash	malicious	Browse	185.140.53.3
	U2M19O_Payment_Copy.vbs	Get hash	malicious	Browse	185.140.53.3
	J3m1a_Payment_Copy.vbs	Get hash	malicious	Browse	185.140.53.3
	18-11-21 Statement.xlsx	Get hash	malicious	Browse	91.193.75.148
	bWKXCwatmt.exe	Get hash	malicious	Browse	91.193.75.148
	17-11-21 STATEMENT.xlsx	Get hash	malicious	Browse	91.193.75.148
	Copy of Complaint report-1st Nov21 to 16th Nov21.xlsx	Get hash	malicious	Browse	91.193.75.148
	UTYHFG03983765367839837653.exe	Get hash	malicious	Browse	185.140.53.131
	IkGcQX45T8.exe	Get hash	malicious	Browse	91.193.75.148
	vcjjMWSZx8.exe	Get hash	malicious	Browse	185.140.53.138
	000876543234567.exe	Get hash	malicious	Browse	185.244.30.58
	Dhl_Shipment_one.exe	Get hash	malicious	Browse	185.140.53.137
	PO.E210115.exe	Get hash	malicious	Browse	185.244.30.252

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Orden de Compra -SA765443,pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp62E7.tmp Download File
Process:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1323
Entropy (8bit):	5.12284374389714
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0kxtn:cbk4oL600QydbQxIYODOLedq3Jj
MD5:	38A67D49BD1B250B49E9E6A7ECD6CD14
SHA1:	4FDD0D9B3F3E4E5B48CA231343324E30951BE2E3
SHA-256:	6DD0B3C0DFA7950B1DEDA930882F3E84912932021A76F853561BA640816D4251
SHA-512:	86DB3AF07E0180504DCBFCE1FC1BC7F6A00F12BD8AF76774382E3B4CEF4BD5ED9FBDEE8089F772AA075B973257C922C4E89C279B4E09362173794617B7BF60AC
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	128
Entropy (8bit):	6.527114648336088
Encrypted:	false
SSDEEP:	3:XrURGizD7cnRH5/ljRAaTlKYrI1Sj9txROIsxcMek2:X4LDAn1rplKTYBROIsxek2
MD5:	0A9C5EAE8756D6FC90F59D8D71A79E1E
SHA1:	0F7D6AAED17CD18DC614535ED26335C147E29ED7
SHA-256:	B1921EA14C66927397BAF3FA456C22B93C30C3DE23546087C0B18551CE5001C5
SHA-512:	78C2F399AC49C78D89915DFF99AC955B5E0AB07BAAD61B07B0CE073C88C1D3A9F1D302C2413691B349DD34441B0FF909C08A4F71E2F1B73F46C1FF308BC7CF9A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P.OT....g.t......'7......)..8zII..K/....n3...3.5.......&.7].)..wL...:}g...@...mV.....JUP...w

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:0keIt:0A
MD5:	94B41CFEE4E2B49BD4C1E82A95852AF4
SHA1:	4BB08756493EB9A0E663E0688E451841BC9BE9CD
SHA-256:	42CE8F756A9AF3726B6EFDA3823B0DBB539AB1EDF322B08B807E4ADD86A819E7
SHA-512:	96A9FC234C38C2D983CE8EED8823EF3F9E2E907B6EE967DEF3981F7ED6E351654F58B98B5877A3620D2FC84C0171EB9DA92BC3B0EA8B030ABCD78B8CE90423BF
Malicious:	true
Reputation:	low
Preview:	.>.....H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.608288146260291
Encrypted:	false
SSDEEP:	3:oN0naRRqXIgq9EDDJ:oNcSRqXIFED9
MD5:	FC28A690D1E29EEEC388DFB51CCB3449
SHA1:	D20184CB0468F8BA3D1481A9BD72CB8956FB10AA
SHA-256:	5DC03F18C097ACE50982402ED7A9829F8ECDAEAFC6E048147E5AA871DEEF845F
SHA-512:	B1B8A12EC1EAB4634BE96CD46D1B24AA2B1797E531EAB965DE4BE752CB0B1CED61713FDF4B635F76B10F92A3E9AE62C6D7087F9BD4E5758BF6062E31AB165C07
Malicious:	false
Preview:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.69147440283363
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Orden de Compra -SA765443,pdf.exe
File size:	577536
MD5:	f7f223c7625c5c9df43af835298c1183
SHA1:	2105dc6b41d1ec220e89fb018fb1fd95b9a22d5a
SHA256:	7a356a718b0ca6272486633efb6a34c6301007f50766d8cfab60a996f2729935
SHA512:	0238b920a0f2afc3df08c5634573037eaf649464f0324afc3a1bc1ca1aafe858bb31e75feb1c487cdbf6a8496a5128c21fda112fe439c45299f10d853a0ed290
SSDEEP:	12288:sglS4oq0RueU5AzUJCjKs7pw2i/FB8r7S5Ud3EWtD00UxZ:NlSoEfUAWE7UFS3cUWWC0Ux
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..............0......D........... ........@.. .......................@............@................................

File Icon


Icon Hash:	c49a0894909c6494

Static PE Info

General
Entrypoint:	0x48a81e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x619CB29F [Tue Nov 23 09:21:35 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a7cc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0x4200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x92000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x88824	0x88a00	False	0.853445934355	data	7.72977166234	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8c000	0x4200	0x4200	False	0.455669981061	data	5.72908968706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x92000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x8c190	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x8c5f8	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 1134929317, next used block 44344484
RT_ICON	0x8d6a0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON	0x8fc48	0x30	data
RT_VERSION	0x8fc78	0x388	data
RT_MANIFEST	0x90000	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	(C) 2009
Assembly Version	1.1.0.0
InternalName	BinaryAssemblyIn.exe
FileVersion	1.1.0.0
CompanyName	Joseph Magnin
LegalTrademarks
Comments	Dental
ProductName	GitHub ValidationEngine
ProductVersion	1.1.0.0
FileDescription	GitHub ValidationEngine
OriginalFilename	BinaryAssemblyIn.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
11/23/21-11:59:33.326172	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54640	8.8.8.8	192.168.2.7
11/23/21-11:59:39.867599	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	58739	8.8.8.8	192.168.2.7
11/23/21-11:59:52.949500	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	59762	8.8.8.8	192.168.2.7
11/23/21-12:00:21.346042	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50781	8.8.8.8	192.168.2.7
11/23/21-12:00:28.959265	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50452	8.8.8.8	192.168.2.7
11/23/21-12:00:49.940231	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	49247	8.8.8.8	192.168.2.7
11/23/21-12:00:56.951611	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	56064	8.8.8.8	192.168.2.7
11/23/21-12:01:11.033668	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	61457	8.8.8.8	192.168.2.7
11/23/21-12:01:18.086716	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	58367	8.8.8.8	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2021 11:59:33.337551117 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:33.574400902 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:33.574518919 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:33.633510113 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:33.868426085 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:33.868505955 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:33.993396997 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.055079937 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.130394936 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.130495071 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.330420017 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.442317009 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.531650066 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.760502100 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.760591030 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.905227900 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.905368090 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.921463013 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.921520948 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.925437927 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.925528049 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.925600052 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.930630922 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.930704117 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.936819077 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.936903000 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.940973043 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.941088915 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.951020956 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.951116085 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.954480886 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.954556942 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:34.976289034 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:34.976392984 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.032165051 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.113380909 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.119410992 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.119518042 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.129333019 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.197905064 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.197951078 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.197987080 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.197997093 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.198024035 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.198055029 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.198061943 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.198100090 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.198120117 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.210349083 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.210514069 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.210557938 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.233959913 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.233982086 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.234052896 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.291506052 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.291533947 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.291549921 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.291565895 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.291627884 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.291671038 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.296436071 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.296473980 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.296596050 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.313451052 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.313713074 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.324222088 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.324258089 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.324328899 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.342457056 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.406476974 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.406502008 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.406573057 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.462531090 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.518480062 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.518520117 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.518544912 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.518567085 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.518570900 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.518615007 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.518876076 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.518922091 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.518953085 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.519022942 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.519084930 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.519128084 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584332943 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584371090 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584398031 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584419966 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584444046 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584465027 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584486961 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584532022 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.584549904 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.584611893 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.589833021 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.589958906 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.595310926 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.596344948 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.596997976 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.617321014 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.667851925 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.667939901 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.668329954 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719425917 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719513893 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719546080 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719630003 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719686985 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.719710112 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719717026 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.719758987 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.719783068 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719866037 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719919920 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.719950914 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.719996929 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.720057964 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.720165968 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.720272064 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.720349073 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.744195938 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.790559053 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.790905952 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.800347090 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800379992 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800421000 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.800453901 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800472021 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.800532103 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.800534010 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800595999 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.800638914 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800658941 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800687075 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.800704002 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.800859928 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800884962 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.800950050 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.801386118 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.801412106 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.801461935 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.803257942 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.803327084 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.807745934 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.807843924 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.817425013 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.818320036 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.820210934 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.820354939 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.823364973 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.823483944 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.835339069 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.835468054 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.840878963 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.840987921 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.850466967 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.850537062 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.916702986 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.916733027 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.916810036 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.916881084 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.917051077 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917109013 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.917232037 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917285919 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.917301893 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917346954 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.917489052 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917515039 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917526960 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.917537928 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917555094 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917567015 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.917572021 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.917587996 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.917618990 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.927913904 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.928025961 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:35.929297924 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:35.929369926 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.052478075 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.052520990 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.052551985 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.052596092 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.052650928 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.052779913 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.052808046 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.052839994 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.052872896 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.053262949 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.053288937 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.053337097 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.053349972 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.053456068 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.053477049 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.053514004 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.053525925 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.054092884 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.054163933 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.138453960 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138485909 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138503075 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138519049 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138535023 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138562918 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.138626099 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.138720036 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138737917 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138777971 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.138823986 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138825893 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.138885021 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.138916969 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138932943 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.138969898 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.139036894 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:36.271034002 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.271044970 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.271064997 CET	4693	49756	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:36.271161079 CET	49756	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:39.871402979 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:40.089073896 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:40.089343071 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:40.090125084 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:40.354482889 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:40.416238070 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:40.416507959 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:40.653007030 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:40.698328018 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:40.809173107 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.068948030 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.069040060 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.352387905 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.376501083 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.380783081 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.380951881 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.440730095 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.496968031 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.508793116 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.508824110 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.508846045 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.508884907 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.508905888 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.508925915 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.508966923 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.509069920 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.509104013 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.557801962 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.744402885 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.744436979 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.744524002 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.745982885 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.767411947 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.767446995 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.767579079 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.776305914 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.777512074 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.834456921 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.834485054 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.834590912 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.834615946 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.834630013 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.834656954 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.834682941 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.834690094 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.835063934 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.838093996 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.891012907 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.908685923 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.929506063 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.929546118 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.929565907 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.929586887 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.929619074 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.929661036 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.929686069 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.929693937 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.931049109 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.931078911 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.931252003 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.937869072 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.939445019 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:41.945373058 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:41.945564032 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.017472982 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.017751932 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.052243948 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.052381039 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.064306021 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064356089 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064387083 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064409018 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064429998 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064429998 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.064451933 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064455032 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.064467907 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064479113 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.064483881 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064498901 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064507961 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.064512968 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064527988 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064542055 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.064543962 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064559937 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.064585924 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.064800978 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.070749044 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.070982933 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.082843065 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.083045006 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.083869934 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.083980083 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.088095903 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.088272095 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.119785070 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.119982958 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.130438089 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.130501986 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.130870104 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.132349968 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.135288954 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:42.142179966 CET	4693	49757	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:42.146658897 CET	49757	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:46.221600056 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:46.429569960 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:46.429680109 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:46.430362940 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:46.689488888 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:46.729135990 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:46.752135038 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:46.949522972 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:46.949700117 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.208344936 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.208652020 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.476319075 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.505497932 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.520163059 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.520486116 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.529215097 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.529275894 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.529445887 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.565443039 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.565471888 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.565490961 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.565534115 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.565561056 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.565606117 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.570403099 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.577533960 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.577615976 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.719465017 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.738508940 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.738634109 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.744627953 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.744656086 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.744790077 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.763840914 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.768834114 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.768909931 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.782958031 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.794433117 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.794493914 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.799537897 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.801400900 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.801496983 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.807460070 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.820565939 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.820635080 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.821731091 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.832396030 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.832458019 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.861568928 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.861594915 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.861612082 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.861629963 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.861665964 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.861680984 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.861701965 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.868400097 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.868474007 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.881244898 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.931448936 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.933590889 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.958401918 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.958441973 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.958503962 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.958515882 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.958571911 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.958601952 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.958681107 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.994394064 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.994430065 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.994451046 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:47.994519949 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:47.994580030 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.000438929 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.002469063 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.002572060 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.011609077 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.014590025 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.021600008 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.027601957 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.027631044 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.030632019 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.081619024 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.082089901 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.082110882 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.082200050 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.082216978 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.082222939 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.082283020 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.085635900 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.085663080 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.085680008 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.085802078 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.097522020 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.097547054 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.097768068 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.101221085 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.101598978 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.111512899 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.111537933 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.111660957 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.117418051 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.117619038 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.127458096 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.127626896 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.176515102 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.176544905 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.176604033 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.176686049 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.176894903 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.176944971 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.180214882 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.180284023 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.206250906 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.206321001 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.206787109 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.206809998 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.206839085 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.206866026 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.212990046 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.213020086 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.213037014 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.213066101 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.213093042 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.219182014 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.219289064 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.220716000 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.232805014 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.232875109 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.236357927 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.265438080 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.266619921 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.268631935 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.268659115 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.268712997 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.277679920 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.277708054 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.277765036 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.282269001 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.282743931 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.282812119 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.305422068 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.319660902 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.319844007 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.327630043 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.338001013 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.338027000 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.338073969 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.347600937 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.347625971 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.347706079 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.359635115 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.361206055 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.419513941 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419555902 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419622898 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419636965 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.419646025 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419698000 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.419720888 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419744015 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419785976 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.419915915 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419939041 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.419981003 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.421634912 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.441443920 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.441750050 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.441824913 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.445538044 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.447613955 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.474464893 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.474500895 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.474528074 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.474623919 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.479624033 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.480957031 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.481045961 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.492629051 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.492661953 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.492743969 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.525573969 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.525810003 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.577665091 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.577699900 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.577717066 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.577739000 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.577826977 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.577843904 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.577867985 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.577915907 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.577924967 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.577960968 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.577982903 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.578031063 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.578092098 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.578114986 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.578155041 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.597637892 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.597671032 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.597794056 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.619581938 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.619617939 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.619638920 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.619690895 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.667726994 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.677938938 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.677974939 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.677990913 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.678010941 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.678142071 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.678247929 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.678272009 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.678383112 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.690519094 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.690552950 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.690679073 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.692368031 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.719424009 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.719459057 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.719579935 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.720411062 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.720479965 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.721924067 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.740487099 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.740814924 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.740886927 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.750943899 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.751040936 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.757616997 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.760632992 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.763180017 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.766452074 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.772718906 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.772825956 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.789407969 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.789439917 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.789500952 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.789541006 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.795727968 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.797020912 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.818459034 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.818490028 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.818506956 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.818610907 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.830125093 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.830303907 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.833749056 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.845009089 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.845139980 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.848531961 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.858675003 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.858772993 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.871581078 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.876702070 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.876738071 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.876760006 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.876828909 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.876883984 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.879740953 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.879846096 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.892457008 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.892493010 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.892596006 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.923659086 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.923692942 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.923798084 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.936510086 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.936551094 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.936585903 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.936640024 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.936690092 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.948431969 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.948476076 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.948571920 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.948610067 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.958117962 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.958280087 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.972588062 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.972642899 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.972680092 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.972740889 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.981736898 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.981770992 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.981898069 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:48.988456964 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.988483906 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:48.988568068 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.009645939 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.009680033 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.009763956 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.015738010 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.015820026 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.017505884 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.017627954 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.036653996 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.036703110 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.036777973 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.036832094 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.049694061 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.050728083 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.050836086 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.051690102 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.053004026 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.081044912 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.081082106 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.081218958 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.082128048 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.083688974 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.091732979 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.095714092 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.108500004 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.108531952 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.108545065 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.108680964 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.119539022 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.119709969 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.146697998 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.146737099 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.146749020 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.146903038 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.168565989 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.168593884 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.168606043 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.168725014 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.191710949 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.191741943 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.191873074 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.199287891 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.199407101 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.207707882 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.211608887 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.211707115 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.211755037 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.217811108 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.219738960 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.223754883 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.225735903 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.225862980 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.230865955 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.231745005 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:49.257906914 CET	4693	49760	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:49.259752035 CET	49760	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:52.950897932 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:53.144049883 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:53.144608974 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:53.212939978 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:53.464095116 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:53.567861080 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:53.568245888 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:53.789769888 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:53.965014935 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.016496897 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.286365986 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.286434889 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.523102045 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.564590931 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.589380980 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.589571953 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.589607954 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.589926004 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.590028048 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.594213009 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.594436884 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.594489098 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.608683109 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.609256983 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.609347105 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.625735998 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.625761032 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.625842094 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.823457956 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.823498964 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.823559046 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.827361107 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.836368084 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.838382959 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.857348919 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.857384920 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.857480049 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.863400936 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.863435030 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.863502026 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.885422945 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.886375904 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.886406898 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.886526108 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.889333010 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.889848948 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.909300089 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.909401894 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.909538031 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.910228968 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.919763088 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.923197985 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.928435087 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.932296038 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.932404995 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:54.941340923 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.944648981 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:54.947385073 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.028348923 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.028412104 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.028429985 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.028487921 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.062638998 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.065287113 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.065316916 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.065398932 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.065502882 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.065521955 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.065557957 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.065699100 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.069025993 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.069155931 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.072983027 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.074340105 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.077764988 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.077852964 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.081425905 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.082247019 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.092228889 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.092861891 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.092924118 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.093185902 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.117780924 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.117810965 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.117822886 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.117984056 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.129513025 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.129537106 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.129699945 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.141732931 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.143640041 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.199340105 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.199440002 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.199579954 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.199599028 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.199640989 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.199666977 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.200387001 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.200403929 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.200445890 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.200478077 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.208219051 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.208242893 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.208264112 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.208312988 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.208355904 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.218509912 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.218600988 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.224643946 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.224752903 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.234095097 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.234216928 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.237029076 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.237123966 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.254512072 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.258369923 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.269371986 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.269515038 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.279616117 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.279650927 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.279803038 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.291049004 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.291232109 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.307508945 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.307542086 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.307697058 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.336364031 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.336509943 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.336934090 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.336966038 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.336996078 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.337019920 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.341507912 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.344258070 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.360302925 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.361865044 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.366739988 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.370439053 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.374579906 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.374820948 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:55.382338047 CET	4693	49761	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:55.382416964 CET	49761	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:59.142322063 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:59.348650932 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:59.351639032 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:59.352686882 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:59.596661091 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:59.656657934 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:59.657004118 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 11:59:59.860675097 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 11:59:59.903036118 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.028037071 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.265872002 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.266062975 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.490549088 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.490710020 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.491096973 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.491183043 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.491221905 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.491241932 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.491257906 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.491274118 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.491312027 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.508546114 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.508646011 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.517874002 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.517906904 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.517945051 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.517966986 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.517976999 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.518011093 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.527435064 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.527770996 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.551625013 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.802512884 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.856221914 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.871711016 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.871756077 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.871781111 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.871805906 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.871829033 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.871853113 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.871876955 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.871898890 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.871906996 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.871992111 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.872039080 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.877861023 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.897943020 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.898022890 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.995522976 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.995573044 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.995690107 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.996428013 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.996463060 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.996486902 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.996536016 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.996561050 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.996572971 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.996592045 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.996700048 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:00.996753931 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:00.996886015 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.043761969 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.060499907 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.412743092 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.412769079 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.412839890 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.517438889 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517472982 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517488003 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517610073 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.517811060 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517841101 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517858982 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517877102 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.517919064 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.517940044 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517975092 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.517985106 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.518023968 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.518098116 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.518146038 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.518168926 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.518203020 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.518217087 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.518244028 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.528171062 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.580801010 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.580882072 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.580924988 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.580987930 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581017017 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581017017 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581041098 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581065893 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581228971 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581285954 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581351042 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581379890 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581404924 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581432104 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581475973 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581631899 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581697941 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581752062 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581803083 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.581829071 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.581897020 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.624516964 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.624548912 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.624563932 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.624579906 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.624630928 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.624646902 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.624691963 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.624701977 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.624933958 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.625000954 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.628489017 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.628810883 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.655455112 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.655502081 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.655575991 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.655685902 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.655747890 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.710473061 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.710779905 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.711347103 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.711478949 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.711527109 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.712718010 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.801471949 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.801512957 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:01.804761887 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.804785013 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:01.890774965 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.060249090 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.234941006 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.236093044 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.238593102 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.238702059 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.244533062 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.244555950 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.244668961 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.308474064 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.308569908 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.317411900 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.320883989 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.378643036 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.378827095 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.379410982 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.379435062 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.379493952 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.379518986 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.379564047 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.379575014 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.379760027 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.379811049 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.385544062 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.385571003 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.385622978 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.385649920 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.385660887 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.385709047 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.437525034 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.437647104 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.446482897 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.446505070 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.446554899 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.446605921 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.446619034 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.446624041 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.446695089 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.446913004 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.446962118 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.447115898 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.447153091 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.447174072 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.447201967 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.447244883 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.447279930 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.447367907 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.457396030 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.458861113 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.461683989 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.461771011 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.470459938 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.470575094 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.523663044 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.523880005 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.561521053 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.561661005 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.562467098 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.562486887 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.562551022 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.562562943 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.562619925 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.562634945 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.562675953 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.562836885 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.562892914 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.634434938 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.634464979 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.634592056 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.634685993 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.634705067 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.634726048 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.634742022 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.634763956 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.634783030 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.634783983 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.634809971 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.634830952 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.634905100 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.634952068 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.635057926 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.635093927 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.635109901 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.635148048 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.635171890 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.635212898 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.635247946 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.635288954 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.635435104 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.635452986 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.635483980 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.635523081 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.710424900 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.710625887 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.721358061 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.721491098 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.721498013 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.721508026 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.721563101 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.721673012 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.721719027 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:02.721762896 CET	4693	49762	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:02.721806049 CET	49762	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:06.154740095 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:06.361052990 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:06.361242056 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:06.361999989 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:06.608690023 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:06.676279068 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:06.676697016 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:06.878109932 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:06.919328928 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:07.218756914 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:07.456346035 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:07.757924080 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.004594088 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.088066101 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.088099003 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.089277029 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.095300913 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.097450018 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.098031044 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.099349976 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.124403954 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.124442101 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.124545097 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.125343084 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.127671957 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.131292105 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.137293100 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.141374111 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.294380903 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.305314064 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.309026957 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.364517927 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.364551067 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.364681005 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.404434919 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404474020 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404491901 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404508114 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404639959 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.404664993 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404791117 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404867887 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404886007 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.404925108 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.404969931 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.409370899 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.414391994 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.415384054 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.427321911 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.430425882 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.431415081 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.440596104 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.497539043 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.519073009 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.519115925 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.519136906 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.519275904 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.585925102 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.585968971 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.585990906 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.586014986 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.586117029 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.586148977 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.588669062 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.589143038 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.589246988 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.589386940 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.590446949 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.590559006 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.602473974 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.616152048 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.616300106 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.625787020 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.637571096 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.637732029 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.650033951 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.650078058 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.650203943 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.659265041 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.666457891 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.666623116 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.668323040 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.680835962 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.681035042 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.685688972 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.700201035 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.700237036 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.700325012 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.712574959 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.712748051 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.715751886 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.716871023 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.716967106 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.729119062 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.733252048 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.733346939 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.733484030 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.733541965 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.741645098 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.741734982 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.748043060 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.748086929 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.748162985 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.757277012 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.757409096 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.767206907 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.767311096 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.841324091 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.841413975 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.841459990 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.841511011 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.875458002 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.875585079 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.879467964 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.879527092 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.879558086 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.879586935 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.879617929 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.879646063 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.907366037 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.907398939 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.907458067 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.958817005 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.958908081 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.959126949 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.959178925 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.959224939 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.959274054 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.959352016 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.959379911 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.964380026 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.964530945 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.968378067 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.968460083 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:08.999403000 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:08.999526978 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.004405022 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.004445076 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.004518986 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.004550934 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.010314941 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.010397911 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.037467003 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.037612915 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.052372932 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.052407026 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.052450895 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.052479982 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.069808006 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.069839001 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.069904089 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.069931984 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.085076094 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.085196018 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.088459015 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.088488102 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.088541985 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.088566065 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.091165066 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.091279030 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.109494925 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.109700918 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.112483978 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.112514973 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.112591028 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.121505022 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.121654987 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.129473925 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.129558086 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.132493973 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.132602930 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.138226032 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.144506931 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.144637108 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.153469086 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.153568983 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.156476021 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.156615019 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.177453995 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.177489996 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.177627087 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.180399895 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.180533886 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.183485031 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.183666945 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.191848040 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.192022085 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.207803011 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.207879066 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.207973003 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.208003998 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.211146116 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.211293936 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.237566948 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.237607002 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.237629890 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.237817049 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.237863064 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.243861914 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.256576061 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.256679058 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.265022039 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.277560949 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.277595997 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.277712107 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.289499044 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.289673090 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.313505888 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.313556910 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.313711882 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.373523951 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.385818958 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.385853052 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.385870934 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.385891914 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.385936975 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.385998011 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.387254953 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.387281895 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.387803078 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.389440060 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.389537096 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.401514053 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.401556015 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.401715994 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.413521051 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.433525085 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.433747053 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.433850050 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.449363947 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.449408054 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.449429989 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.449568987 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.459641933 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.469532013 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.469574928 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.469724894 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.481511116 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.481703043 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.487541914 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.497507095 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.497684956 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.501487970 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.517128944 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.517342091 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.521507025 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.521548986 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.521683931 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.529520035 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.537513018 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.537699938 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.541476965 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.548413992 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.548453093 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.548465967 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.548594952 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.561528921 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.561737061 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.612955093 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.612991095 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.613004923 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.613022089 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.613143921 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.613152981 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.613164902 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.613189936 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.613213062 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.631556034 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.631598949 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.631748915 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.633008003 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.637464046 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.637641907 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.645035028 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.645441055 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.645558119 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.665132046 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.665177107 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.665333986 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.747966051 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787051916 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787111998 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787132978 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787154913 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787179947 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787204027 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787280083 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.787328959 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.787471056 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787498951 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787523031 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787544012 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.787597895 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.787838936 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787863016 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787888050 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.787950039 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.789485931 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.789520025 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.789618015 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.797543049 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.797734022 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.810467958 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.810504913 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.810523987 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.810606003 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.821544886 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.821727037 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.849560022 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.849601030 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.849752903 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.901650906 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.902009964 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.902038097 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.902060986 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.902131081 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.902163029 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.903239012 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.903274059 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.903297901 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.903399944 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.913577080 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:09.913790941 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:09.921303988 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.020531893 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.020574093 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.020596981 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.020714045 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.020739079 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.020746946 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.020761967 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.020802021 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.021459103 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.021553040 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.095232010 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.101614952 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.101653099 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.101807117 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.112389088 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.112586021 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.115430117 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.137346029 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.137384892 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.137408018 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.137545109 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.137593985 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.150437117 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.151050091 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.151180983 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.178199053 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.178246021 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.178270102 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.178430080 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.181354046 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.181525946 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.191262960 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.196960926 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.244333982 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.244370937 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.244395971 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.244440079 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.244460106 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.244478941 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.244538069 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.244651079 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.254417896 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.259306908 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.259402990 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.262902975 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.268049955 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.268177986 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.276551962 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.276578903 CET	4693	49767	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:10.276647091 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:10.276705980 CET	49767	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:14.347265005 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:14.733982086 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:14.734178066 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:14.734853983 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:15.205987930 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:15.278207064 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:15.461637020 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:15.513701916 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:15.844357014 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:15.844439030 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:16.083537102 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.138768911 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:16.280101061 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:16.569562912 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.569668055 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:16.808294058 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.924519062 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.933891058 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.936162949 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:16.955595970 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.960108995 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.960176945 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:16.984600067 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.984644890 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.984704018 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:16.990124941 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.996180058 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:16.999969959 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.002880096 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.016278028 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.016372919 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.136698961 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.156413078 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.156447887 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.156546116 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.168317080 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.168380022 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.195677042 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.242686033 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.242743969 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.242783070 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.242820978 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.242858887 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.242901087 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.242938995 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.249399900 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.249531984 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.249644041 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.252381086 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.267540932 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.267630100 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.267760038 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.279906034 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.282418966 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.284008980 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.284147978 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.288381100 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.288516045 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.294512033 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.296936035 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.303384066 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.303477049 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.427633047 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.427782059 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.428224087 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.428303957 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.442730904 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.442756891 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.442832947 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.447941065 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.448035002 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.458018064 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.460227013 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.465150118 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.466129065 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.470302105 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.470419884 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.479644060 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.479758978 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.535959005 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.536062002 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.536067963 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.536115885 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.536144018 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.536156893 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.536190987 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.536195993 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.536206007 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.536233902 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.536243916 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.536293983 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.540210962 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.540396929 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.553165913 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.553251982 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.560372114 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.560447931 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.564276934 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.564367056 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.588393927 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.588500977 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.601413965 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.601519108 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.601592064 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.601646900 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.605027914 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.605165005 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.613035917 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.613214970 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.621709108 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.622181892 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.633760929 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.633970022 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.639343023 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.640553951 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.661947012 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.662013054 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.662084103 CET	4693	49770	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:17.662184000 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:17.662226915 CET	49770	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:21.347268105 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:21.548585892 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:21.548716068 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:21.549225092 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:21.788239956 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:22.031085968 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:22.031389952 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:22.350730896 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:22.374435902 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:22.769115925 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:22.773015022 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.110682011 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.263407946 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.267087936 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.267164946 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.270719051 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.326905012 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.372400999 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.372478962 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.372533083 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.372648954 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.399813890 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.399849892 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.399871111 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.399893999 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.400614023 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.409621954 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.947491884 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.947556019 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.947654009 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.950678110 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.962397099 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.962457895 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.962507010 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.962558031 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.984563112 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.984623909 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.984692097 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.984692097 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.984791040 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.984801054 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.989315987 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.989440918 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.991360903 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.991444111 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.997322083 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:23.997383118 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:23.998801947 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.007411957 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.007551908 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.058373928 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.058537960 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.060453892 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.060494900 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.060539961 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.060580969 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.060622931 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.060666084 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.060704947 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.060734034 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.060741901 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.060745001 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.060750008 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.060781002 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.060813904 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.064749002 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.064832926 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.157054901 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.166906118 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.167045116 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.170619965 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.217600107 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.228928089 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247390032 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247499943 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247513056 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.247571945 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247625113 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.247634888 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247724056 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247778893 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.247812033 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247874022 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.247931004 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.248025894 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.259326935 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.259433031 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.261326075 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.267613888 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.267775059 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.274847031 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.278311014 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.282723904 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.296369076 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.296397924 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.298717976 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.298846006 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.302707911 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.310698032 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.310730934 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.310868025 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.324374914 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.324421883 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.324589014 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.324785948 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.324893951 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.332987070 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.338792086 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.338917017 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.340354919 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.357510090 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.357566118 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.357665062 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.359261036 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.359338999 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.375225067 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.460887909 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.460994959 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.494805098 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.494904041 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.523699045 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.523823023 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.528374910 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.528516054 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.544321060 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.544415951 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.550818920 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.550915003 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.553060055 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.553133011 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.554761887 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.554841042 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.565021038 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.565113068 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.568382025 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.568413019 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.568461895 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.568490982 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.570473909 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.570553064 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.589770079 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.589809895 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.589927912 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.590042114 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.600680113 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.600792885 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.602768898 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.602961063 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.629048109 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.629182100 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.635531902 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.635656118 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.697139025 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.697264910 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.707341909 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.707384109 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.707411051 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.707434893 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.707459927 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.707464933 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.707484007 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.707492113 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.707498074 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.707511902 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.707542896 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.707561970 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.710225105 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.710310936 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.716526985 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.716567039 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.716636896 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.716741085 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.725569010 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.725843906 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.808530092 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.808568001 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.808589935 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.808614016 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.808636904 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.808641911 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.808645964 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.808679104 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.808710098 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.808751106 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.808922052 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.808974028 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:24.809067011 CET	4693	49777	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:24.809111118 CET	49777	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:28.961154938 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:29.160974979 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:29.161111116 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:29.199053049 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:29.468245029 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:29.528832912 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:29.529117107 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:29.730161905 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:29.730254889 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:29.970055103 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.216069937 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.687127113 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.710460901 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.710556984 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.710589886 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.710623980 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.710707903 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.717339993 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.717363119 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.717379093 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.717432976 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.717454910 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.719283104 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.727407932 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.727731943 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.729346037 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.743115902 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:30.743288994 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.765845060 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:30.888427019 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.123327017 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.123354912 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.123487949 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.144371033 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.144503117 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.196392059 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.197259903 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.245748043 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.245778084 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.245819092 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.245841980 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.245862961 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.245888948 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.245950937 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.246041059 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.246081114 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.246141911 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.246299982 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.246557951 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.246591091 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.246630907 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.246697903 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.328464031 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.328500032 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.328526020 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.328552008 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.328577995 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.328577995 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.328598022 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.328628063 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.328696012 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.328722954 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.328861952 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.328890085 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.329086065 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.347399950 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.347619057 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.352242947 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.364331007 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.367640972 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.368391991 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.385956049 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.386020899 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.386627913 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.409370899 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.409440994 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.409459114 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.459311008 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.459588051 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.463258982 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.511444092 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.511481047 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.511796951 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.589333057 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.589359045 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.589437962 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.589473009 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.589514971 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.591378927 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.592179060 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592233896 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592363119 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592359066 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.592597961 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592686892 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592742920 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592762947 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.592839956 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592869997 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592879057 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.592941046 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.592976093 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.593240976 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.593614101 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.602556944 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.611397028 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.611423969 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.611546993 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.618458033 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.618660927 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.671385050 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.671411037 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.671427965 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.671518087 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.671566010 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.671596050 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.671618938 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.671669960 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.671742916 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.671780109 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.671905994 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.672066927 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.675666094 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.679394007 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.679691076 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.690289021 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.695230961 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.695317984 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.713793993 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.713820934 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.713947058 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.715271950 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.735346079 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.735369921 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.735428095 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.737350941 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.737409115 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.744266987 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.750276089 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.750351906 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.763247013 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.763299942 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.763458014 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.773495913 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.781434059 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.781456947 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.781471968 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.781572104 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.781600952 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.784260035 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.784472942 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.788242102 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.789176941 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.795284986 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.795380116 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.798913956 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.799139977 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.813417912 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.815229893 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.815268040 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.815325975 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.815372944 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.825972080 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.827245951 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.834369898 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.834431887 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.847290993 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.851311922 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.866381884 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.866405010 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.866457939 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.866478920 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.866496086 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.866538048 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.873694897 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.873771906 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.884315014 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.884346962 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.884465933 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.884490013 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.895334959 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.895412922 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.895481110 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.895951986 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.905344963 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.905502081 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:31.911252975 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:31.911461115 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.003357887 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.003385067 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.003470898 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.003540039 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.003617048 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.003669977 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.003674984 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.003690004 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.003773928 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.003850937 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.004018068 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.004070044 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.004079103 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.004209995 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.004261971 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.053332090 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.053421021 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.053441048 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.053497076 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.053513050 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.053570986 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.053575993 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.053590059 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.053713083 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.054049969 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.086307049 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.089204073 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.089458942 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.089526892 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.089674950 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.089692116 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.089737892 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.089744091 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.089801073 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.091010094 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.148263931 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.148389101 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.148698092 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.148808002 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.148893118 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.148902893 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.149523973 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.196310043 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.196407080 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.196448088 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.196604967 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.196661949 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.196717024 CET	4693	49784	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:32.196729898 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.196748972 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:32.197640896 CET	49784	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:35.928270102 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:36.136976004 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:36.137058973 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:36.154191017 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:36.411814928 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:36.571841002 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:36.572091103 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:36.777898073 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:36.813054085 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.069875956 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.070020914 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.328145981 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.379297972 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.386459112 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.387927055 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.437488079 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.437519073 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.437536001 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.437551975 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.437588930 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.437632084 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.437710047 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.437747955 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.437798977 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.441525936 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.441549063 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.441884041 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.581814051 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.587419033 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.587546110 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.590272903 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.594352007 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.594453096 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.638400078 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.659311056 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.659365892 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.659382105 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.662409067 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.662529945 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.675714970 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.677226067 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.677316904 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.687376976 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.690332890 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.690392971 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.705252886 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.712313890 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.712382078 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.718632936 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.723613024 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.723728895 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.734745979 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.781225920 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.799335957 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.799362898 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.799379110 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.799444914 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.799495935 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.799551010 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.800446987 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.802495003 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.802565098 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.805260897 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.812411070 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.812500954 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.819740057 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.828587055 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.870368004 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.870443106 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.914283991 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.914407015 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.914436102 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.914437056 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.914488077 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.914494991 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.914573908 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.914638042 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.914657116 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.914674997 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.914752007 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.977469921 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977500916 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977518082 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977550030 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977560997 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.977590084 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977618933 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.977684021 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.977710009 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977742910 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977758884 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.977787971 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.977874041 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.977953911 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.984368086 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.984437943 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.987267971 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.987333059 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:37.998251915 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:37.998385906 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.003221989 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.003307104 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.015398979 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.015481949 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.019670010 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.019762993 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.028295994 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.028394938 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.122391939 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.122421980 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.122440100 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.122490883 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.122531891 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.122548103 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.122596025 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.122693062 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.122751951 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.122761011 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.122806072 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.122814894 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.122848988 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.123091936 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.123121977 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.123142958 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.123173952 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.123205900 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.171612978 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.171685934 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.180263996 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.180361032 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.213445902 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.213485003 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.213510990 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.213521004 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.213532925 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.213562965 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.213617086 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.213673115 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.213737011 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.213953018 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.213985920 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.214010954 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.214025974 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.214060068 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.214090109 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.214113951 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.214139938 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.214164972 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.214189053 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.214215994 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.214231014 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.214270115 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.297089100 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297441006 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297477961 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297532082 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.297545910 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297597885 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.297635078 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297657967 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297705889 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.297758102 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297784090 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.297835112 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.297864914 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.343961000 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.372385979 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382230043 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382258892 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382273912 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382292032 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382308006 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382325888 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382338047 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.382340908 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382373095 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.382400036 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.382424116 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382566929 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382585049 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382610083 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.382742882 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.382786989 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.457972050 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.458018064 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.458043098 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.458075047 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.458642960 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.458720922 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.458723068 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.459023952 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.459109068 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.459125996 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.459199905 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.459243059 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.459485054 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.459518909 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.459558010 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.532789946 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.532834053 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.532911062 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.533478975 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533505917 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533524036 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533540010 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533560038 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533560038 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.533582926 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533605099 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533615112 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.533621073 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533638954 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533648014 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.533655882 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533673048 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.533680916 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.533708096 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.535516024 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.535604000 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.546756029 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.548321962 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.548409939 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.561373949 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.561440945 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.561506987 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.628314972 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669240952 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669296980 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.669305086 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669523954 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669555902 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669586897 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.669620991 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669661045 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.669709921 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669730902 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669823885 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669868946 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.669944048 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.669989109 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.670067072 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.718801022 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.730276108 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.730315924 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.730339050 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.730376959 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.730428934 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.730483055 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760344028 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760387897 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760411978 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760447979 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.760492086 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760495901 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.760571957 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760658979 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760813951 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760859013 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.760914087 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760934114 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.760941982 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.760982037 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.761012077 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.763297081 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.763398886 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.770309925 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.780314922 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.780354023 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.780404091 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.797363043 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.797432899 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.797465086 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.797472000 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.797523975 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.800273895 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.804425001 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.805044889 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.815350056 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.815388918 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.815447092 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.826339006 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.826376915 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.826486111 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.836271048 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.838231087 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.838921070 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.839353085 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.842372894 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.842493057 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.852370024 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.855396986 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.855496883 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.861597061 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.862360954 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.862431049 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.868343115 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.875752926 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.882268906 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.882328987 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.937731028 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.937771082 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.937814951 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.937844038 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.937875032 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.937903881 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.937933922 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.937951088 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.938075066 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.938169003 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.938222885 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.938262939 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.938270092 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.938349962 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.938425064 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:38.947340012 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:38.949285030 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.018656015 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018697023 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018721104 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018727064 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.018747091 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018773079 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018790007 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.018798113 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018822908 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018846035 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018852949 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.018872023 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018884897 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.018913984 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.018949986 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.018996954 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.019165993 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.019212008 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.019218922 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.019268990 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108036041 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108072042 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108093023 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108130932 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108174086 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108300924 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108325958 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108366013 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108455896 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108577013 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108620882 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108680964 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108702898 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108724117 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108742952 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108764887 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108804941 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108895063 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108920097 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.108938932 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.108966112 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.109050035 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.109131098 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.109163046 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.109170914 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.109204054 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.109247923 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.109384060 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.109447956 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.118340015 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.118416071 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.122263908 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.122339010 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.124283075 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.125226974 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.133460999 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.134984016 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.143513918 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.143556118 CET	4693	49812	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:39.143614054 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:39.143959045 CET	49812	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:43.091671944 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:43.288561106 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:43.288723946 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:43.289259911 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:43.781716108 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:44.169698954 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:44.169729948 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:44.169833899 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:44.200341940 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:44.200372934 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:44.200452089 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:44.428246021 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:44.428307056 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:44.625354052 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:44.672483921 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:44.876862049 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.131601095 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.350172997 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.638709068 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.680665016 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.710618019 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.710789919 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.760683060 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.760746956 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.760767937 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.760793924 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.760814905 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.760837078 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.760910988 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.762692928 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.829756975 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.829793930 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.829940081 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.876395941 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.916683912 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.917969942 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.928659916 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.928750038 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.932619095 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.932862997 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.936378956 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.936492920 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:45.945596933 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.945627928 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:45.947501898 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:46.006618977 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.006649971 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.006671906 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.006695032 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.006736040 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:46.006788015 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:46.006834984 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.006859064 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.008605957 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:46.068411112 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.068445921 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.068511009 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.068536043 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.068602085 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:46.068703890 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:46.068761110 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.068787098 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.068829060 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:46.068916082 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.068938971 CET	4693	49820	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:46.069005013 CET	49820	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:49.941371918 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:50.289433956 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:50.289625883 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:50.290394068 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:50.548408985 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:50.664335966 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:50.664860964 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:50.851435900 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:50.876924038 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.129302025 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.229306936 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.517138958 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.553154945 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.594903946 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.600548029 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.600578070 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.600601912 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.600649118 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.600723028 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.600745916 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.600769997 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.600774050 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.600821018 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.605118036 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.613143921 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.613264084 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.621118069 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.673033953 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.797233105 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.805203915 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.808238029 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.817197084 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.821175098 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.821245909 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.825165033 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.833178043 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.833679914 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.837157965 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.849189043 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.849293947 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.854341030 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.854378939 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.854401112 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.854456902 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.869182110 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.869271040 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.873186111 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.873215914 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.873337984 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.876909018 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.877146006 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.877757072 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.961189032 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.961342096 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.977694035 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.977721930 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.977745056 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.977766991 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:51.977778912 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:51.977847099 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.029205084 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.029306889 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.041054964 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.041086912 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.041189909 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.091653109 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.091684103 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.091701031 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.091743946 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.091758966 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.091774940 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.091794968 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.091839075 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.093142033 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.093236923 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.113624096 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.113658905 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.113681078 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.113743067 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.113765955 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.117187023 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.117218018 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.117295027 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.125196934 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.125339031 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.129189968 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.130188942 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.137201071 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.137319088 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.152803898 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.152844906 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.152895927 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.152946949 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.155472040 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.155545950 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.162869930 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.162969112 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.226502895 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.226543903 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.226669073 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.226701021 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.226727009 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.226742983 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.226810932 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.226835966 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.226854086 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.239975929 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.240014076 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.240094900 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.287480116 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.287539005 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.287564993 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.287662029 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.287820101 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.288139105 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.319556952 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.319591045 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.319607973 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.319669962 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.360625029 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.362404108 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.362441063 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.362477064 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.362528086 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.362540960 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.362576008 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.362680912 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.362757921 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.363128901 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.371958017 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.372000933 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.372117996 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.378225088 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.382787943 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.385190964 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.392512083 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.396445036 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.397207022 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.400542974 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.404735088 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.405185938 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.416497946 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.419881105 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.421778917 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.421874046 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.438441992 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.438472986 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.438569069 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.439358950 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.439865112 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.444468021 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.444499969 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.444582939 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.463846922 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.467442989 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.467561960 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.469444036 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.479553938 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.479707956 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.483620882 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.491265059 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.491360903 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.502911091 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.502969027 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.502995968 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.503078938 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.513816118 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.515363932 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.515491962 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.549681902 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.549731016 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.549760103 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.549784899 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.549812078 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.549849987 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.549902916 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.575937033 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.576060057 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.576328993 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.576359987 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.576426983 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.580409050 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.584563971 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.584645033 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.591578007 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.596435070 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.600775957 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.655865908 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.655909061 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.656012058 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.656014919 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.656116962 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.656157970 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.656383038 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.656460047 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.656537056 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.662549019 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.662590981 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.662612915 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.662636042 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.662655115 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.662703037 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.682416916 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.735655069 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.736428976 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.736460924 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.736536026 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.736541033 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.736628056 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.736671925 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.736675024 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.736751080 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.736793041 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.736835003 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.736977100 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.737023115 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.737032890 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.737116098 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.737155914 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.753670931 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.753700972 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.753762960 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.754297972 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.764235020 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.764333963 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.766865969 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.783442974 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.783474922 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.783518076 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.792398930 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.792463064 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.843497038 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.843528986 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.843564987 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.843604088 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.843633890 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.843673944 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.856400967 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.863435030 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.863600016 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.875466108 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.876365900 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.876461029 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.877060890 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.885404110 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.885550022 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.896383047 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.896532059 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.908454895 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.908535004 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.914402008 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.914535046 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.924341917 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.924437046 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.943428040 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.943469048 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.943546057 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.943563938 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.950803995 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.950957060 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.954524040 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.954638958 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.960020065 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.960136890 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.982410908 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.982492924 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:52.999520063 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:52.999610901 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.011507988 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.011548996 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.011570930 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.011636019 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.011688948 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.013736010 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.013838053 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.031486034 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.031687975 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.092463017 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.092571974 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.141541004 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.141573906 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.141596079 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.141617060 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.141625881 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.141638041 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.141689062 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.141729116 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.141772985 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.141885996 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.141935110 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.142071009 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.142093897 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.142122030 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.142160892 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.142163038 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.142205000 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.142215967 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.142368078 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.142393112 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.142417908 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.215420008 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215455055 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215475082 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215511084 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.215538025 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.215547085 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215586901 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.215609074 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215648890 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.215728045 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215770960 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.215787888 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215830088 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.215925932 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.215966940 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.216032982 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.216053963 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.216072083 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.216105938 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.216188908 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.216212034 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.216233015 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.216269970 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.225562096 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.225606918 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.225697994 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.236038923 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.236129999 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.332889080 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.333033085 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.342530966 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.342572927 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.342587948 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.342612028 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.342674017 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.342683077 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.342742920 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.495520115 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.495668888 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:53.508100033 CET	4693	49822	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:53.508198023 CET	49822	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:56.953125954 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:57.164691925 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:57.164803982 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:57.165637970 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:57.417701006 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:57.526204109 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:57.526506901 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:57.708144903 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:57.751668930 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:57.877249956 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.108272076 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.108463049 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.348150969 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.461529016 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.486416101 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.486442089 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.486546040 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.507396936 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.507440090 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.507535934 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.509241104 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.530061007 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.530111074 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.530150890 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.530188084 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.530198097 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.530236006 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.579946995 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.716706038 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.767422915 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.790566921 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.790637016 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.790680885 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.790721893 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.790749073 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.790749073 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.790770054 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.791380882 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.795336008 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.801769018 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.802004099 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.869467974 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.869503021 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.869518995 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.869537115 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.869635105 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.869667053 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.875565052 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.877660990 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.912368059 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.912478924 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.919332981 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.919400930 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.926431894 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.926544905 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.950568914 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.950721979 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.961608887 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.961756945 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.970442057 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.970582962 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.981380939 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.981471062 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:58.997143984 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:58.997684002 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.002489090 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.002615929 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.039864063 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.040000916 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.059721947 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.059806108 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.059905052 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.059943914 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.066519022 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.066596985 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.083893061 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.083987951 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.084314108 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.084368944 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.100459099 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.100585938 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.130475044 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.130534887 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.130630970 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.130672932 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.142704010 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.142801046 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.152539968 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.152673006 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.161432028 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.161537886 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.164377928 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.164484024 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.185493946 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.185596943 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.199384928 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.199497938 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.265439034 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.265472889 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.265582085 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.265604973 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.266325951 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.266350031 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.266352892 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.268404961 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.268517017 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.298675060 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.333869934 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.333956957 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.371361971 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.371412992 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.371471882 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.371500015 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.371604919 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.371651888 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.371722937 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.371747017 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.371768951 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.371789932 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.371789932 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.371830940 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.384362936 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.384401083 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.384530067 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.389892101 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.391855001 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.392038107 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.401360989 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.401382923 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.401444912 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.419377089 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.419405937 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.419492006 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.421768904 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.421788931 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.421875000 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.425306082 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.429795980 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.429938078 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.447838068 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.449709892 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.449732065 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.449821949 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.460470915 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.460495949 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.460560083 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.489412069 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.489438057 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.489527941 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.491782904 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.491847038 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.494304895 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.494324923 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.494414091 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.545494080 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.545519114 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.545531034 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.545542955 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.545598984 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.545629025 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.545635939 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.593511105 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.593537092 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.593632936 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.593758106 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.593818903 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.634919882 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673474073 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673501015 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673557043 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.673578024 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673636913 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.673717976 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673736095 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673790932 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.673800945 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673818111 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.673872948 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.674297094 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.674314976 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.674375057 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.724320889 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.724625111 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.724641085 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.724693060 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.724983931 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725002050 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725044012 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.725131035 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725142956 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725194931 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.725244045 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725260973 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725315094 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.725344896 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725362062 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725385904 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725413084 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.725574970 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.725619078 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.729557991 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.764884949 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.765039921 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.821049929 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.846724033 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.846776009 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.846815109 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.846884966 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.846899986 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.846942902 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.846986055 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.847002983 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.847032070 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.847062111 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.847136974 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.847332954 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.847374916 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.847469091 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.847531080 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.851905107 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.852062941 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.864835978 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.882457972 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.886518955 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.886672020 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.964318991 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964346886 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964381933 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964401960 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964436054 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.964459896 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.964627981 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964644909 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964667082 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.964701891 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.964783907 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964804888 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964827061 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.964869976 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.964946032 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964967966 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.964988947 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.965022087 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.965173960 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.965189934 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.965212107 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.965245008 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.965383053 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.965405941 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.965425014 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.965456963 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.965504885 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.965519905 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.965542078 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.965606928 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.967829943 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.967907906 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.973860025 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.973982096 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.979432106 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.979456902 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.979525089 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.979621887 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:00:59.986778021 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:00:59.986852884 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.006346941 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.006376982 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.007060051 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.017896891 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.018030882 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.033035040 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.033068895 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.033088923 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.033132076 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.033174038 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.045867920 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.045943022 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.052400112 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.052479029 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.052942038 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.053005934 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.057326078 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.057522058 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.064495087 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.064598083 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.066632986 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.066777945 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.084933043 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.084960938 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.085024118 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.086404085 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.086436033 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.086483002 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.086499929 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.097862005 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.097986937 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.147356987 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.147382975 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.147397995 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.147424936 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.147428989 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.147463083 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.147486925 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.147645950 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.147661924 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.147706985 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.149835110 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.149907112 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.159301996 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.159333944 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.159475088 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.159501076 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.168201923 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.168281078 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.173278093 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.173357964 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.179697990 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.179770947 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:00.182276964 CET	4693	49828	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:00.182346106 CET	49828	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:04.005636930 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:04.226382017 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:04.226613045 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:04.239988089 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:04.491339922 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:04.628310919 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:04.628568888 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:04.867089033 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:04.877952099 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.161947966 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.162373066 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.598426104 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.598757029 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.598815918 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.598877907 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.598901033 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.598942041 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.598995924 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.599003077 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.642940998 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.704453945 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.704490900 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.704606056 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.704823971 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.705512047 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.705607891 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.705873013 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.752356052 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.897557020 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.897588968 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.897686005 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.897696972 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.897762060 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.897809029 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.900417089 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.900595903 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.900685072 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.906502008 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.919442892 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.919553041 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.924892902 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.939488888 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.939627886 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:05.952682018 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:05.952781916 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.024889946 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.025012016 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.201800108 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.201833963 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.201931000 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.216412067 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.216586113 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.240433931 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.240542889 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.246418953 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.246507883 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.251887083 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.252023935 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.262423992 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.262502909 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.273525953 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.273597002 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.292440891 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.292522907 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.300990105 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.301095009 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.380901098 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.380930901 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.380947113 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.380963087 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.380979061 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.380994081 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.381006002 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.381032944 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.381092072 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.438510895 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.438540936 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.438558102 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.438596964 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.438632965 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.439234972 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.439300060 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.497648001 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.497694969 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.497713089 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.497730017 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.497731924 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.497819901 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.497827053 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.500626087 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.541795969 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.541843891 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.541868925 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.541892052 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.542112112 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.542143106 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.545007944 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.545072079 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.674643993 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.674665928 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.674789906 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.702526093 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.702555895 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.703861952 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.704011917 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.776550055 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.776571035 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.776681900 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.776736975 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.776753902 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.776802063 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.776809931 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.776828051 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.776896000 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.777009964 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.777028084 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.777117014 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.777249098 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.777267933 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.777314901 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.777450085 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.777467012 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.777527094 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.858453989 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.858479977 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.858629942 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.860979080 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.908767939 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.908998966 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.909019947 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.909035921 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.909051895 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.909068108 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.909082890 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.909112930 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.909215927 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.925013065 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.981920004 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.982142925 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.982614994 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.982635975 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.982652903 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.982670069 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.982706070 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.982754946 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:06.982767105 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:06.982820988 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.024348021 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.024369955 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.024409056 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.024425983 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.024477959 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.024523973 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.064410925 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.064435005 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.064512014 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.073348045 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073375940 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073391914 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073409081 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073422909 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073441982 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073461056 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073466063 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.073477030 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.073513031 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.073554993 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.152719021 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.152868032 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.186499119 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.186528921 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.186623096 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.186640978 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.186638117 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.186657906 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.186662912 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.186702967 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.186744928 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.186809063 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.187021017 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.187037945 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.187055111 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.187064886 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.187078953 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.187093019 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.190485954 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.191101074 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.240942955 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.240973949 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.240993023 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.241009951 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.241025925 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.241043091 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.241059065 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.241075039 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.241095066 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.241169930 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.286565065 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.286593914 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.286667109 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.329797983 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.329823971 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.329839945 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.329941988 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.330005884 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.334470034 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.334652901 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.376717091 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.376750946 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.376770020 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.376785994 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.376801968 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.376889944 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.376995087 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.378509998 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.378532887 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.378606081 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:07.390595913 CET	4693	49850	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:07.390736103 CET	49850	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:11.035574913 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:11.236233950 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:11.236341000 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:11.236845016 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:11.490616083 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:11.545380116 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:11.545705080 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:11.781019926 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:11.830967903 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:11.972636938 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.200917006 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.201030016 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.427257061 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.487265110 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.509449005 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.509476900 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.509493113 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.509536982 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.509577036 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.519253016 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.521286964 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.521344900 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.533261061 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.537364960 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.537517071 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.539239883 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.558770895 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.558976889 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.717341900 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.755371094 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.755408049 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.755600929 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.759576082 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.759712934 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.764307022 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.815509081 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.816304922 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.816354036 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.816394091 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.816483974 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.817384005 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.817456961 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.822355032 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.849431038 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.849464893 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.849553108 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.869401932 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.869447947 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.869513988 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.889276028 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.889307976 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.889374971 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.915441036 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.915491104 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.915606976 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:12.919460058 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.933480024 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:12.933593988 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.019409895 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.078274012 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.078573942 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.079368114 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.079402924 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.079416037 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.079555035 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.131478071 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.131510019 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.131525040 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.131540060 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.131653070 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.137243986 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.137356997 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.153812885 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.153995037 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.255532026 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.255561113 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.255574942 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.255723953 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.340970039 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.341001987 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.341020107 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.341038942 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.341056108 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.341092110 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.341131926 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.341427088 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.341572046 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.341697931 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.347028017 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.359049082 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.361044884 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.370383978 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.371023893 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.421375036 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.458381891 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.458406925 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.458421946 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.458545923 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.458580971 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.538367033 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.538392067 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.538408995 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.538553953 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.538758039 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.538929939 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.538963079 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.539024115 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.551569939 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.551599026 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.551675081 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.556380987 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.556792021 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.587106943 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.587153912 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.587219954 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.587255001 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.589467049 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.589505911 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.591222048 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.609421968 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.609448910 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.609541893 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.609630108 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.679075956 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.679327965 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.679346085 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.679447889 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.682019949 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.682104111 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.685416937 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.685441971 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.685672998 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.697422981 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.697457075 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.697525978 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.755772114 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.755805969 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.755826950 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.755847931 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.755882978 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.755938053 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.758445024 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.785501957 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.785533905 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.785599947 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.790597916 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.790671110 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.834453106 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.834491968 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.834570885 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.841063023 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.845290899 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.845319033 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.845382929 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.857439995 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.857568979 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.918342113 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.918374062 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.918508053 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.918555975 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.918579102 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.918661118 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.919048071 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.919075966 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.919120073 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.923058987 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.930896044 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.931044102 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.933903933 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.966394901 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.966429949 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.966450930 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.966470957 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:13.966550112 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:13.967467070 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.018719912 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.019598961 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.047856092 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.047885895 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.047903061 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.047950983 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.047981024 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.047993898 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.048034906 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.048098087 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.048218966 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.048238039 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.048274040 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.048285961 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.048304081 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.048331022 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.048381090 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.051326990 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.051390886 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.051414013 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.051457882 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.083945990 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.084064960 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.091427088 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.091454983 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.091499090 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.099076033 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.099174023 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.111093998 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.111234903 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.114069939 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.114156008 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.129002094 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.129028082 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.129132032 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.145384073 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.145508051 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.153230906 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.153340101 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.223115921 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.223144054 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.223160982 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.223179102 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.223297119 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.227099895 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.227137089 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.227150917 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.227164030 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.227287054 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.295558929 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.295588017 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.295604944 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.295620918 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.295631886 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.295639992 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.295691967 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.305222034 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.305300951 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.369224072 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.369261026 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.369288921 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.369314909 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.369323015 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.369350910 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.369358063 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.369379997 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.373394012 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.373418093 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.373505116 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.424329042 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.424364090 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.424381018 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.424402952 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.424424887 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.424446106 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.424478054 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.424535990 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.482721090 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.482757092 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.482773066 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.482795954 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.482827902 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.482852936 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.482858896 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.482920885 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.489088058 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.489182949 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:14.494081020 CET	4693	49851	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:14.494189978 CET	49851	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:18.088432074 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:18.309478998 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:18.309602976 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:18.310165882 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:18.816958904 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:18.817243099 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:18.819091082 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:18.862847090 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:19.345344067 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:19.345448971 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:19.623678923 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:19.624540091 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:20.056956053 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.259604931 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.259638071 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.259650946 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.259668112 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.259680033 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.259696007 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.259844065 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:20.263394117 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.263443947 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.263529062 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.263597012 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:20.269299030 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:20.270673990 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.779783964 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.779830933 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.779895067 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.779898882 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.780076981 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.780144930 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.827399969 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.827467918 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.827507019 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.827698946 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.859241009 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.859337091 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.875641108 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.875667095 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.875683069 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.875699997 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.875715971 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.875730991 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.875782013 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.875799894 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.875884056 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.875893116 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.876177073 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.926426888 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.926493883 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.926542997 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.926562071 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:21.926615953 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:21.926718950 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:22.800995111 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:22.803174019 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.251924038 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.251955986 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.252717972 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.290961981 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.290988922 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.291259050 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.314974070 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.326941013 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.327213049 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.329981089 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.335891962 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.338831902 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.347897053 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.366003990 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.366235971 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.453835011 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.453864098 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.453886032 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.453902006 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.453918934 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.453933954 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.454054117 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.454080105 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.455848932 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.458925009 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.465092897 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.470982075 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.474023104 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.479868889 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.483802080 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.487262011 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.487289906 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.487559080 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.499901056 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.507353067 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.556097984 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.600960016 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.601907969 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.601933002 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.601949930 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.602211952 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.602227926 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.602339983 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.602418900 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.602437973 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.602454901 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.602829933 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.602850914 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.603893995 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.604948997 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.609082937 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:23.615938902 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:23.666853905 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:24.969439983 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969471931 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969492912 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969535112 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969563961 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:24.969600916 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:24.969604969 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969738960 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969760895 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969785929 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:24.969883919 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.969942093 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:24.991553068 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.992429018 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:24.992502928 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.012402058 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.031362057 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.031404018 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.031491041 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.035362959 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.035401106 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.037363052 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.058132887 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.058312893 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.058430910 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.059607983 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.060442924 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.073137999 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.080110073 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.080226898 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.106445074 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.114016056 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.114115000 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.126940012 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.126976967 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.127065897 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.132812023 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.138350010 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.138464928 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.143985033 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.148513079 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.149049044 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.149564028 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.174320936 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.174357891 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.174380064 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.174572945 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.174603939 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.175339937 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.186389923 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.186465979 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.196579933 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.196613073 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.196722031 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.201550007 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.206412077 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.206512928 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.214533091 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.219475985 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.222501993 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.223556995 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.244358063 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.244507074 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.246090889 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.247344017 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.247488976 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.261476040 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.265346050 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.265433073 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.266582012 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.277683020 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.277895927 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.290077925 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.290106058 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.290291071 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.319802046 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.319834948 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.320597887 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.322045088 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.326077938 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.326159954 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.943145037 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.954519987 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.954657078 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:25.959137917 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.965322018 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:25.965449095 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.044209003 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.065696001 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.065723896 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.065738916 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.065757036 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.065819979 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.068087101 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.068108082 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.068209887 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.148165941 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.184607983 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.184637070 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.184648991 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.184660912 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.184720039 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.186094999 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.186446905 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.236500025 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.236527920 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.236603022 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.239237070 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.239294052 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.239388943 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.254121065 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.264266968 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.264394999 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.283467054 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.311395884 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.311424971 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.311531067 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.330384016 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.330495119 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.335263968 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.357249975 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.357409954 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.372386932 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.401387930 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.401417017 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.401535034 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.439457893 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.439485073 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.439603090 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.486294031 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.486320972 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.486444950 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.503362894 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.520327091 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.520503044 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.530302048 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.558474064 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.559259892 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.581576109 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.591366053 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.591483116 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.604377985 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.628449917 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.628580093 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.638392925 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.666333914 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.666460991 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.668303013 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.669388056 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.669486046 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.701355934 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.708277941 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.708300114 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.708399057 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.719300985 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.719381094 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.728725910 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.769754887 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.788247108 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.798316956 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.798422098 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.802265882 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.816409111 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.816535950 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.836288929 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.841653109 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.841778994 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.843269110 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.850301027 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.850402117 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.863646030 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.910383940 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.927294016 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.927329063 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.927414894 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.927433014 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.927460909 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.927519083 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.927567005 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.927586079 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.927634954 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.939311028 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.941678047 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.941761017 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.952244997 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.955759048 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.955842018 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.969644070 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.979377031 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.979516983 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:26.993731022 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.997349024 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:26.997466087 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.007330894 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.020348072 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.020385981 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.020415068 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.023219109 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.023385048 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.037705898 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.050292969 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.050426006 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.060607910 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.079324007 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.079348087 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.079503059 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.083199024 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.083285093 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.175781012 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.178406000 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.178426981 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.178505898 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.178637981 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.178704977 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.178723097 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.178807974 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.178837061 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.178867102 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.179042101 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.179116011 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.183312893 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.200721979 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.200754881 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.200963020 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.214509964 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.214621067 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.225980997 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.227684975 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.227765083 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.239114046 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.251513004 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.251624107 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.263659954 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.274513960 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.274630070 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.285408020 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.332362890 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.377466917 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.377491951 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.377602100 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.535046101 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:27.782222986 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.932207108 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:27.953555107 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:28.161828041 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:28.168889999 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:28.466595888 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:28.466681004 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:28.677522898 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:28.677620888 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:28.868330002 CET	4693	49852	185.140.53.12	192.168.2.7
Nov 23, 2021 12:01:28.869260073 CET	49852	4693	192.168.2.7	185.140.53.12
Nov 23, 2021 12:01:29.128470898 CET	4693	49852	185.140.53.12	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2021 11:59:33.304900885 CET	54640	53	192.168.2.7	8.8.8.8
Nov 23, 2021 11:59:33.326172113 CET	53	54640	8.8.8.8	192.168.2.7
Nov 23, 2021 11:59:39.846254110 CET	58739	53	192.168.2.7	8.8.8.8
Nov 23, 2021 11:59:39.867599010 CET	53	58739	8.8.8.8	192.168.2.7
Nov 23, 2021 11:59:46.156789064 CET	58717	53	192.168.2.7	8.8.8.8
Nov 23, 2021 11:59:46.177053928 CET	53	58717	8.8.8.8	192.168.2.7
Nov 23, 2021 11:59:52.927398920 CET	59762	53	192.168.2.7	8.8.8.8
Nov 23, 2021 11:59:52.949500084 CET	53	59762	8.8.8.8	192.168.2.7
Nov 23, 2021 11:59:59.120119095 CET	54329	53	192.168.2.7	8.8.8.8
Nov 23, 2021 11:59:59.140615940 CET	53	54329	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:06.133011103 CET	59451	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:06.153048038 CET	53	59451	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:14.324692011 CET	64569	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:14.345205069 CET	53	64569	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:21.321403027 CET	50781	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:21.346041918 CET	53	50781	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:28.937688112 CET	50452	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:28.959264994 CET	53	50452	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:35.907048941 CET	58820	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:35.926978111 CET	53	58820	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:43.069562912 CET	60983	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:43.087691069 CET	53	60983	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:49.920238972 CET	49247	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:49.940231085 CET	53	49247	8.8.8.8	192.168.2.7
Nov 23, 2021 12:00:56.928706884 CET	56064	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:00:56.951611042 CET	53	56064	8.8.8.8	192.168.2.7
Nov 23, 2021 12:01:03.983671904 CET	63744	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:01:04.004245996 CET	53	63744	8.8.8.8	192.168.2.7
Nov 23, 2021 12:01:11.011229992 CET	61457	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:01:11.033668041 CET	53	61457	8.8.8.8	192.168.2.7
Nov 23, 2021 12:01:18.065009117 CET	58367	53	192.168.2.7	8.8.8.8
Nov 23, 2021 12:01:18.086715937 CET	53	58367	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 23, 2021 11:59:33.304900885 CET	192.168.2.7	8.8.8.8	0xfe0d	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:39.846254110 CET	192.168.2.7	8.8.8.8	0x6ab8	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:46.156789064 CET	192.168.2.7	8.8.8.8	0x5df9	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:52.927398920 CET	192.168.2.7	8.8.8.8	0x1e6a	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:59.120119095 CET	192.168.2.7	8.8.8.8	0x4104	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:06.133011103 CET	192.168.2.7	8.8.8.8	0x8c5d	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:14.324692011 CET	192.168.2.7	8.8.8.8	0x4d13	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:21.321403027 CET	192.168.2.7	8.8.8.8	0xfab1	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:28.937688112 CET	192.168.2.7	8.8.8.8	0xc73e	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:35.907048941 CET	192.168.2.7	8.8.8.8	0x2e41	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:43.069562912 CET	192.168.2.7	8.8.8.8	0x6ff	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:49.920238972 CET	192.168.2.7	8.8.8.8	0x6285	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:56.928706884 CET	192.168.2.7	8.8.8.8	0xd645	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:01:03.983671904 CET	192.168.2.7	8.8.8.8	0xf269	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:01:11.011229992 CET	192.168.2.7	8.8.8.8	0xd872	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)
Nov 23, 2021 12:01:18.065009117 CET	192.168.2.7	8.8.8.8	0x2040	Standard query (0)	wealthgod1234.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 23, 2021 11:59:33.326172113 CET	8.8.8.8	192.168.2.7	0xfe0d	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:39.867599010 CET	8.8.8.8	192.168.2.7	0x6ab8	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:46.177053928 CET	8.8.8.8	192.168.2.7	0x5df9	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:52.949500084 CET	8.8.8.8	192.168.2.7	0x1e6a	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 11:59:59.140615940 CET	8.8.8.8	192.168.2.7	0x4104	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:06.153048038 CET	8.8.8.8	192.168.2.7	0x8c5d	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:14.345205069 CET	8.8.8.8	192.168.2.7	0x4d13	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:21.346041918 CET	8.8.8.8	192.168.2.7	0xfab1	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:28.959264994 CET	8.8.8.8	192.168.2.7	0xc73e	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:35.926978111 CET	8.8.8.8	192.168.2.7	0x2e41	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:43.087691069 CET	8.8.8.8	192.168.2.7	0x6ff	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:49.940231085 CET	8.8.8.8	192.168.2.7	0x6285	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:00:56.951611042 CET	8.8.8.8	192.168.2.7	0xd645	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:01:04.004245996 CET	8.8.8.8	192.168.2.7	0xf269	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:01:11.033668041 CET	8.8.8.8	192.168.2.7	0xd872	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)
Nov 23, 2021 12:01:18.086715937 CET	8.8.8.8	192.168.2.7	0x2040	No error (0)	wealthgod1234.ddns.net	185.140.53.12	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 6196 Parent PID: 6008

General

Start time:	11:59:13
Start date:	23/11/2021
Path:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe"
Imagebase:	0x860000
File size:	577536 bytes
MD5 hash:	F7F223C7625C5C9DF43AF835298C1183
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.266827018.0000000002CA1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.266922252.0000000002CDE000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.268195690.0000000003CA9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 6548 Parent PID: 6196

General

Start time:	11:59:22
Start date:	23/11/2021
Path:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Imagebase:	0xcf0000
File size:	577536 bytes
MD5 hash:	F7F223C7625C5C9DF43AF835298C1183
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000000.262435507.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.516892703.00000000066B0000.00000004.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000000.261948516.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.512725162.0000000003001000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000000.263642925.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000002.516734883.0000000005AD0000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000005.00000002.516734883.0000000005AD0000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000000.262924739.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.514335905.000000000404D000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000002.507112354.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6712 Parent PID: 6548

General

Start time:	11:59:27
Start date:	23/11/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp62E7.tmp
Imagebase:	0x170000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6728 Parent PID: 6712

General

Start time:	11:59:29
Start date:	23/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 6864 Parent PID: 1104

General

Start time:	11:59:31
Start date:	23/11/2021
Path:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe" 0
Imagebase:	0xdb0000
File size:	577536 bytes
MD5 hash:	F7F223C7625C5C9DF43AF835298C1183
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000009.00000002.294956289.0000000003201000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.296236042.0000000004209000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000009.00000002.295061035.000000000323E000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 4220 Parent PID: 6864

General

Start time:	11:59:35
Start date:	23/11/2021
Path:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Orden de Compra -SA765443,pdf.exe
Imagebase:	0xea0000
File size:	577536 bytes
MD5 hash:	F7F223C7625C5C9DF43AF835298C1183
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.310703445.0000000004239000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000000.289660204.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.309326840.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000000.290829502.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.310601454.0000000003231000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000000.292078484.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000000.291488537.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 6196 Parent PID: 6008 Orden de Compra -SA765443,pdf.exeCOMMON

Executed Functions

Function 0129B4C8, Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

D, xrefs: 0129B4E6

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID: D
API String ID: 0-185221428
Opcode ID: 697dc390df70e4a4ef229f0fbf996bcfec6c77d79c0db0e1ae80f7450cfac446
Instruction ID: 659023a25d123942409c24fdc756b9fcc4414164b95ee7d91179a2b3dccd95ad
Opcode Fuzzy Hash: 697dc390df70e4a4ef229f0fbf996bcfec6c77d79c0db0e1ae80f7450cfac446
Instruction Fuzzy Hash: 64B1D074D24209CFDF04CFA9E485AEDBBF6BF89300F289129D809BB255D770A985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07522113, Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b13bed22d93b209d4d19bcdfee4cbf611edd00dec9b3b33086cd4a7bfb719c1
Instruction ID: 978c114eb76cdac98e22d0ee7b69823c5099ac38c907605a527ff2771bd4cbe6
Opcode Fuzzy Hash: 5b13bed22d93b209d4d19bcdfee4cbf611edd00dec9b3b33086cd4a7bfb719c1
Instruction Fuzzy Hash: 7952FA74A011288FCB64DF64C899ADDBBB6BF89300F1185E9D509AB355DF30AE81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01298410, Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59db4e4c428faad4eb5c2b7aca0535458b4d27057cd15e5fe2501776446a9c46
Instruction ID: 6514aaa15b05aa8c4852493184fe713a72420d5bcb0cd5576400cd2e3e296a94
Opcode Fuzzy Hash: 59db4e4c428faad4eb5c2b7aca0535458b4d27057cd15e5fe2501776446a9c46
Instruction Fuzzy Hash: FD22DF7492522CCFDB24CF68C885BEDBBB1BF4A304F1491A9D509AB261DB749E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0129A060, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ce26368d1d9e3e9a3325172d067a3d7e05f78a9c48603b9287027a0fcb212b
Instruction ID: b1889dbfc646984d18634ed744e30bc8f07d287c774486547c7886ecab636dce
Opcode Fuzzy Hash: 73ce26368d1d9e3e9a3325172d067a3d7e05f78a9c48603b9287027a0fcb212b
Instruction Fuzzy Hash: 2702557091560ACFEB00DF9DC988AEDFBB6BF48308F29C164D508AB255D7749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0129A053, Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d59cdd98496387428539a3c2419f009f027148dbb3df62ba42be992f2c81e3
Instruction ID: 31e4b48a939df69cf9f81fa5ae8dfdfe97b2330d49dc670e1e9bdf112e8b658b
Opcode Fuzzy Hash: 15d59cdd98496387428539a3c2419f009f027148dbb3df62ba42be992f2c81e3
Instruction Fuzzy Hash: D9F1457491160ACFEB00DF9DC988AEDFBB6BF48308F29C164D508AB255D7749985CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0752F338, Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd926bc1a8811f3e749fddb3ebd006ab6b08915632d660338ce409fc235effe6
Instruction ID: 63a235dff43424f7abf754f01533cd7102a88844dc8aefa1cf4af6a62da20a3b
Opcode Fuzzy Hash: dd926bc1a8811f3e749fddb3ebd006ab6b08915632d660338ce409fc235effe6
Instruction Fuzzy Hash: B3C1CDB17006168FEB29DB75D464BAEB3F6BF8A700F14446ED1468B2E0DB34E902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0752D978, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0b49600c244e9b60f5d834165bc740e48866930a0a0998dda6e9d30ef75008
Instruction ID: 5fe44d6b73479a5c7c6af897265863e2e03b203f8b8414f0920afd0b8fb63d8e
Opcode Fuzzy Hash: 1f0b49600c244e9b60f5d834165bc740e48866930a0a0998dda6e9d30ef75008
Instruction Fuzzy Hash: EBC1D6B5B003269FCB18CF65C490AE9B7B2BF86304F258459D414AB3E5DB71EC42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0752B238, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0752B46E

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 97a267e058191ac0d77d927f07403dfb50c369a76679b4342b658744a585353f
Instruction ID: d0ccc904837e68c864c0c50cec17a1537be3efcfcc2c5e6097e161406fbebdc6
Opcode Fuzzy Hash: 97a267e058191ac0d77d927f07403dfb50c369a76679b4342b658744a585353f
Instruction Fuzzy Hash: 429150B1D00229DFDF10CFA5C8817DDBBB2BF49314F1485AAD849A7280EB749986DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0129F8F8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0129FA0A

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 17ef4af7de9e4024916623301b69d1bf5ce8c053be072efb001343a466c29812
Instruction ID: b2ab1a7fd6fa33ef942788ced8ae0aa226f08e3c55a5379acaee031f359069b9
Opcode Fuzzy Hash: 17ef4af7de9e4024916623301b69d1bf5ce8c053be072efb001343a466c29812
Instruction Fuzzy Hash: B441CEB1D10309AFDF14CF9AC984ADEBFB5BF48314F24812AE919AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01293E70, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01295851

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a8a0264ad9262f11e870b67c0483d2417dea032f5a61db6bf085f1e341db6219
Instruction ID: 0626cfaa298eacfc6f0a2dbd24f69b575ed944e9586f67e699ac1cdf271cbecf
Opcode Fuzzy Hash: a8a0264ad9262f11e870b67c0483d2417dea032f5a61db6bf085f1e341db6219
Instruction Fuzzy Hash: 4E410F70D10718CBDB24DFA9C884BDEBBB5BF88304F20846AD408AB251DBB16946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01295797, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01295851

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8eea704c9bd5ea07d0f3f221aae05da5ee2b3f79cd16f56773543609da944108
Instruction ID: f73fb8a1398cae56fa894f1ffa52895f51b86fdb7b0315b30838567646d4ebd5
Opcode Fuzzy Hash: 8eea704c9bd5ea07d0f3f221aae05da5ee2b3f79cd16f56773543609da944108
Instruction Fuzzy Hash: 65410271D00718CADF25DFA9C884BDEBBB5BF58304F24846AD408BB251DB74694ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 0752AFB0, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0752B040

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b48e896d5ac5b306638d00e36cf0500722e021c148790df43dbd2f0c210a4672
Instruction ID: 2a1608bc8542b8d14184e4c4b705b35ba53492507aba3a3d3a7879985a186b07
Opcode Fuzzy Hash: b48e896d5ac5b306638d00e36cf0500722e021c148790df43dbd2f0c210a4672
Instruction Fuzzy Hash: 842126B59003599FCB10CFA9C884BEEBBF5FF48314F10882AE958A7240D7789955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0752AE18, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0752AE96

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 9bb5cbdbd90e87881d41492be0b06f5d25dec9849f1ff2db410e225827a96212
Instruction ID: 6cc2d39b2270d12f1db84d33a8090dc85add797164e5a7220c64156c548aca2c
Opcode Fuzzy Hash: 9bb5cbdbd90e87881d41492be0b06f5d25dec9849f1ff2db410e225827a96212
Instruction Fuzzy Hash: 2E216AB19003099FDB10CFA9C4847EEBBF4AF88214F14842ED918A7240CB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0752B0A0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0752B120

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d02aa711497c3f883a307831cae2a20512cd78eab381444fd7298e7916b44703
Instruction ID: 79270c08f30dd5a3f53e0d5b7f380b07d3bc0da6942bfc26e2d6e8aee3bde841
Opcode Fuzzy Hash: d02aa711497c3f883a307831cae2a20512cd78eab381444fd7298e7916b44703
Instruction Fuzzy Hash: 702116B19003599FCF10CFA9C8806EEFBF5FF48314F50882AE558A7240D7749955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0752AEF0, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0752AF5E

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b284feee4e24230b4e9d4f2c8c6876e1903b9beae9eae7c6bce2c61a5aad67d3
Instruction ID: 8e781ac8039df1acc18b351c216ea17a1a9e779bf220b6aaea2868c682c75519
Opcode Fuzzy Hash: b284feee4e24230b4e9d4f2c8c6876e1903b9beae9eae7c6bce2c61a5aad67d3
Instruction Fuzzy Hash: AE1159759002099BCB10CFA9C8446EEBBF5AB88314F14881AE515A7250C775A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0752AD68, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0752ADCA

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7eb5a5ab8681a9c56b052336debddf7d167892c59808ae63352a1fd086ff5c40
Instruction ID: 7466c0a7e5e9fe9e83ef3eef37e604481632e84247bad422042ae317ae93fe60
Opcode Fuzzy Hash: 7eb5a5ab8681a9c56b052336debddf7d167892c59808ae63352a1fd086ff5c40
Instruction Fuzzy Hash: E61136B19003498BDB10DFAAC4447EEFBF9AB88224F14882AD519B7240CB74A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0129FAB4, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0129FF30,?,?,?,?), ref: 0129FFA5

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 20252c8dc09aa41307c584a014191af0b96c801c10606dde7fd4925b283bddd0
Instruction ID: 164f790bfac51cebf1fc4198970793cef760d36f7c39d19da06e023ad9a51359
Opcode Fuzzy Hash: 20252c8dc09aa41307c584a014191af0b96c801c10606dde7fd4925b283bddd0
Instruction Fuzzy Hash: 6B11F2B59103099FDB10CF99D589BEEBBF8EB49324F10841AE959B7340D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0752E218, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0752E275

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 83e659831d16e73e4bc2966ce182a0a2782c7f5b639c200f63f1eb1e54a36685
Instruction ID: aa74b714ba988b7aa913c6cccaa45b37357848008acb62bd676437d79612e83b
Opcode Fuzzy Hash: 83e659831d16e73e4bc2966ce182a0a2782c7f5b639c200f63f1eb1e54a36685
Instruction Fuzzy Hash: A61103B5800349DFDB10CF99C489BDEBBF8FB48324F10841AE555A7200C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0129E188, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266272444.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f617e13f770afd25fb99eff74c9b99f7e2879f93c001946f0bc818d99489c5c1
Instruction ID: a18b8c1732dcb0e522a156c3be4506f172ece825b237846feefce1d1d728957f
Opcode Fuzzy Hash: f617e13f770afd25fb99eff74c9b99f7e2879f93c001946f0bc818d99489c5c1
Instruction Fuzzy Hash: 1F12C5F1611B468FD334CF6AF89C1897BA1B795328B904308D3652BAD8D7B5B14ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 07523890, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd8be95b7d3c961511835eb17afb45abfd7fbbef6ff7f5122ce9dc5846abfa2
Instruction ID: bbf949138b4bf38c4e7294bb116b14ff2fc0e4a88e5eef7cedfe735d17b5b517
Opcode Fuzzy Hash: cfd8be95b7d3c961511835eb17afb45abfd7fbbef6ff7f5122ce9dc5846abfa2
Instruction Fuzzy Hash: 11514D70A102598FDB89EFB6D4426EE7FF2EB89308F04C869D044EB264DF7499058F81

Uniqueness

Uniqueness Score: -1.00%

Function 075238A0, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0b5a46cf390c326c56182ad2ede018fcce012fd4f1933300ca9ce7961bc40a
Instruction ID: 23a625cf2174c0dcaa151f402c49c4f553f6e61d642b41fb69bec6b039f19d6a
Opcode Fuzzy Hash: 9f0b5a46cf390c326c56182ad2ede018fcce012fd4f1933300ca9ce7961bc40a
Instruction Fuzzy Hash: 46512B70A102198FDB89EFB6D4526DE7FF6EB89308F04C869E005EB264DF7499058F91

Uniqueness

Uniqueness Score: -1.00%

Function 07523ADF, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2b80080a629b8baa389bb36d7534601ed3a2f1528eee5b5fc2fa6a901d3f25
Instruction ID: 2a039594c5f85a846c95e2b556d4236daecda5b74a1ce224462e6b35dfa4a839
Opcode Fuzzy Hash: 0e2b80080a629b8baa389bb36d7534601ed3a2f1528eee5b5fc2fa6a901d3f25
Instruction Fuzzy Hash: 064174B1D056588BEB5CCF6B8D406C9FBF7AFC5200F14C1BA891CAB255EB3045868F54

Uniqueness

Uniqueness Score: -1.00%

Function 07523AF0, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274185925.0000000007520000.00000040.00000001.sdmp, Offset: 07520000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351fe3f03821c664f852ab8b1a323c796ab4bd8c2d3324d8e2c226c8b635b326
Instruction ID: 37c779c41a12f301e3bff32e5f4eb7d1cd9ece6bbf8ad00a23c264c761d0ec06
Opcode Fuzzy Hash: 351fe3f03821c664f852ab8b1a323c796ab4bd8c2d3324d8e2c226c8b635b326
Instruction Fuzzy Hash: 964152B1D016288BEB5CCF6B8D406CAFAF7AFC9300F14C1BA851CAB254DB3049868F54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 6548 Parent PID: 6196 Orden de Compra -SA765443,pdf.exeCOMMON

Executed Functions

Function 0555B6C0, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0555B730
GetCurrentThread.KERNEL32 ref: 0555B76D
GetCurrentProcess.KERNEL32 ref: 0555B7AA
GetCurrentThreadId.KERNEL32 ref: 0555B803

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8543a5770e94185d29affd32e0740410857552c191794602b20e7f38b32db853
Instruction ID: b4d8802fedd1538bf7dedd57323df4b1bd23460164af9380e83f3618916fba4d
Opcode Fuzzy Hash: 8543a5770e94185d29affd32e0740410857552c191794602b20e7f38b32db853
Instruction Fuzzy Hash: 925155B4900649CFDB10CFA9D5887EEBBF0BB88324F24845AE41AA7350DB749845CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0555B6D0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0555B730
GetCurrentThread.KERNEL32 ref: 0555B76D
GetCurrentProcess.KERNEL32 ref: 0555B7AA
GetCurrentThreadId.KERNEL32 ref: 0555B803

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c5ed8ab3dacb0f1cf9ec19df4dd2c7068c859458566b962525953bb862894119
Instruction ID: a8f022577b1b5b6cda4a0efc5bad6144a88278f2d7c8f2284cd4f477fd1e4bfc
Opcode Fuzzy Hash: c5ed8ab3dacb0f1cf9ec19df4dd2c7068c859458566b962525953bb862894119
Instruction Fuzzy Hash: AA5146B4900649CFDB10CFA9D5487EEBBF1BB88324F20845AE419A7350DB745845CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06812F80, Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.516949149.0000000006810000.00000040.00000001.sdmp, Offset: 06810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3c228fd7eda2763c945c2cc177d2579133b0e51bb2ce925874b78608eb82f6
Instruction ID: d9196eba4e15c9251ecf8dd716cca6f62182c42492d3fa56144ac845dcc1ea36
Opcode Fuzzy Hash: cb3c228fd7eda2763c945c2cc177d2579133b0e51bb2ce925874b78608eb82f6
Instruction Fuzzy Hash: 5A816A71D00209DFDB10CFA9C880ADEFBB5FF48304F14852AE915EB250DB719949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055593E8, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0555962E

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 968e19b61daff7c3bc6f3da8bceade128be2cfa97f143c631521e6f3e1072ce3
Instruction ID: cd55c1bc60a08d212a004cf141443ed8d50782dfa418c147b4c99c67b144dece
Opcode Fuzzy Hash: 968e19b61daff7c3bc6f3da8bceade128be2cfa97f143c631521e6f3e1072ce3
Instruction Fuzzy Hash: 5B714770A10B05CFD764CF69C0557AABBF5BF88214F00892ED88AD7A50DB79E805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0555FB20, Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0555FD0A

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3e41332737861c0add2b9a290590985c49ef4ad32c3ce0408afa1824ba6f7d14
Instruction ID: 08bb63b22faae922c6bfd9953102855dabb30553458616ca3ccfa493bb830893
Opcode Fuzzy Hash: 3e41332737861c0add2b9a290590985c49ef4ad32c3ce0408afa1824ba6f7d14
Instruction Fuzzy Hash: A76169B1D043489FCB11CFA9D890ACEBFB1BF49314F28815EE814AB252D7359846CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0555FB98, Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0555FD0A

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 024cabfc7149b694b0271bc825b4e115b7fd7b0d36c239b77be2cdcfed9a0947
Instruction ID: 236dc0c84eaf11d8ebd6642500777b73a2e9205f7f06f52b59cdc55071b447c0
Opcode Fuzzy Hash: 024cabfc7149b694b0271bc825b4e115b7fd7b0d36c239b77be2cdcfed9a0947
Instruction Fuzzy Hash: F751F1B1D04249AFDF11CFA9C894ADEBFB6BF48314F19816AE808AB221D7759845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0681302C, Relevance: 1.6, APIs: 1, Instructions: 141networkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 06813160

Memory Dump Source

Source File: 00000005.00000002.516949149.0000000006810000.00000040.00000001.sdmp, Offset: 06810000, based on PE: false

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: 1d1990d91803d495ddc630453ee04fcf33f2f02221ceaf0fb186048942513f29
Instruction ID: dcaca4db93855effe724d7651ced8e5865194c2126740fd33606781a1621cddb
Opcode Fuzzy Hash: 1d1990d91803d495ddc630453ee04fcf33f2f02221ceaf0fb186048942513f29
Instruction Fuzzy Hash: EE512471D002199FDF14CFA9C880ADEBBB5FF48314F24852AE814EB250DB74A946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06811A0C, Relevance: 1.6, APIs: 1, Instructions: 140networkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 06813160

Memory Dump Source

Source File: 00000005.00000002.516949149.0000000006810000.00000040.00000001.sdmp, Offset: 06810000, based on PE: false

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: 1dee67008beb5b795f09a9c588154b37f8d19fdd14a4f19730ff25dc9359bd02
Instruction ID: 261dfa6a9f5dd3a01e4e86c43f0ffd338e832dfc96e2daa3062e6017690544bf
Opcode Fuzzy Hash: 1dee67008beb5b795f09a9c588154b37f8d19fdd14a4f19730ff25dc9359bd02
Instruction Fuzzy Hash: 4B513470D002189FDF14CFA9C880ADEBBB9FF48304F14852AE804EB240DB74A946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0555FBF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0555FD0A

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0b0eddc275642755c1e1b850910e431ea3d6161f359e94b5ca4494f84a5a6d24
Instruction ID: 8bc8c96dd0c159d0c993bf0adec55833a4defaae2fae156517edf538e8f68868
Opcode Fuzzy Hash: 0b0eddc275642755c1e1b850910e431ea3d6161f359e94b5ca4494f84a5a6d24
Instruction Fuzzy Hash: A541BFB1D00309DFDB14CFA9C894ADEBBB5BF88314F24852AE819AB210D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0555BCF9, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0555BD87

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 041aa8836f063a3ea088ad05aa3f696a58730d559379ff0abe9ec551805d4d81
Instruction ID: c7d9d77638188e6dd470d59243b31b825b4bd292bac4204eec8131d2a57adec3
Opcode Fuzzy Hash: 041aa8836f063a3ea088ad05aa3f696a58730d559379ff0abe9ec551805d4d81
Instruction Fuzzy Hash: 292103BA900208DFDB10CFA9D584AEEBBF4FB48320F14841AE855B7210C378A945CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0555BD00, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0555BD87

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4b051b22af075909e453af32413d8f97cbab6f09bee754cec53a086527e6ccea
Instruction ID: 8f6d097ac869e017aab6ce28788164ff1cbb1c8a67fda8afe493319a641c18e3
Opcode Fuzzy Hash: 4b051b22af075909e453af32413d8f97cbab6f09bee754cec53a086527e6ccea
Instruction Fuzzy Hash: FD21C6B5900209DFDB10CF99D584AEEBBF8FB48324F14841AE955A7310D378A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05558768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,055596A9,00000800,00000000,00000000), ref: 055598BA

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 05405e51cbf651e71355e22ded009e3f672e0a507e976379d53a04f71ed473c7
Instruction ID: 598ec93fc3122935b1921e3909ac3702c477ab05ab461f2b1780347cf1795be3
Opcode Fuzzy Hash: 05405e51cbf651e71355e22ded009e3f672e0a507e976379d53a04f71ed473c7
Instruction Fuzzy Hash: 0B11C2B6900209DBDB10CF9AD444AEEBBF4BB88324F14842AD955A7600C779A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05559849, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,055596A9,00000800,00000000,00000000), ref: 055598BA

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6145ad3ffe790fdc2364acf161f43d1bc0c5ad2924c17b55ac62be129d2b028d
Instruction ID: b5066de1d1ec8ecbe39df5ff89c82cdc87e9329b554c3f8bf45f1bac59d0d1c2
Opcode Fuzzy Hash: 6145ad3ffe790fdc2364acf161f43d1bc0c5ad2924c17b55ac62be129d2b028d
Instruction Fuzzy Hash: B211D3B69002099FDB10CF9AD444ADEFBF4BB88324F14842AD855B7600C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 055595C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0555962E

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ce0824b7f7a384f9c18d794f0155f64093cbe7f3c52ea1d8734b164e177e6db5
Instruction ID: 6f9f9fc2453284ac07a208891ebbde4d4767443c59861cf347cda8edfee473f2
Opcode Fuzzy Hash: ce0824b7f7a384f9c18d794f0155f64093cbe7f3c52ea1d8734b164e177e6db5
Instruction Fuzzy Hash: 9B11D2B5D00649CFDB10CF9AC444ADEFBF4BB88224F14841AD859A7600D379A54ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0555FE38, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0555FE9D

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f3dc7a48403850959ee22c15922c38b299d6d0ef277ac847566b1387a9f3591e
Instruction ID: 77574640f22c42130be537ee733ec81b36df1949f58ea38ef03a25e36cef0c0f
Opcode Fuzzy Hash: f3dc7a48403850959ee22c15922c38b299d6d0ef277ac847566b1387a9f3591e
Instruction Fuzzy Hash: 0711F2B59002099FDB10CF99D589BDEBBF8FB48724F24841AD855B7241C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0555FE40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0555FE9D

Memory Dump Source

Source File: 00000005.00000002.516309861.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: c5b9f437105aa348328073663a19c27d6e01fffbe6fe0ad50e30d44a2efdc93c
Instruction ID: d9da676982acbeb536ac5f3710320f32922552ed4fb1b73f7327341fc3f7d0b0
Opcode Fuzzy Hash: c5b9f437105aa348328073663a19c27d6e01fffbe6fe0ad50e30d44a2efdc93c
Instruction Fuzzy Hash: 2B1103B59002098FDB10CF99D584BDEBBF8FB48324F10841AD855A7200C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0154D3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.511843951.000000000154D000.00000040.00000001.sdmp, Offset: 0154D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc6aa656eb875866b713c3d8286f18b39b9d049f10c99cb5314aa1430c00780
Instruction ID: 1ff0e4c68719fd7d0f7fa047d40c94ca8dd7a72453edd837dd91c68f1da233c1
Opcode Fuzzy Hash: 5dc6aa656eb875866b713c3d8286f18b39b9d049f10c99cb5314aa1430c00780
Instruction Fuzzy Hash: AE210671500240DFDB05DF94D8C0BAABBB5FB94728F24C969E8090F247C376E856C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0154D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.511843951.000000000154D000.00000040.00000001.sdmp, Offset: 0154D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5add36972aaf47d722c298e685bd319386aef3c1132fda439fb11b49caa13e1
Instruction ID: 109615fc8efa59c6a6331804a74e9807e3ab044f9fdc6d254581d9c315a5e0b0
Opcode Fuzzy Hash: d5add36972aaf47d722c298e685bd319386aef3c1132fda439fb11b49caa13e1
Instruction Fuzzy Hash: 4A21F471504240DFDB05DF94D8C0BAABFB5FB9472CF248969D9090E246C736E856CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0155D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.511926589.000000000155D000.00000040.00000001.sdmp, Offset: 0155D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7f6eeda3127b073fd5017e29975518a06cc4c25653c8f4baeef5f2f15a6165
Instruction ID: dd8d862f019d59b779d4e35179d606f4359f1369957e6ffd5fb0cd744bff587f
Opcode Fuzzy Hash: 3b7f6eeda3127b073fd5017e29975518a06cc4c25653c8f4baeef5f2f15a6165
Instruction Fuzzy Hash: 98210376504200DFDB55DF94D8D0B2ABBB5FB84354F20C96ADC094F256D33AD807CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0155D005, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.511926589.000000000155D000.00000040.00000001.sdmp, Offset: 0155D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093a6878098e5a75cec8497834c9fa15edcd2be0e93012a21ac3e71b51c1bd4c
Instruction ID: 2fe3b1006fb727ead83511185582471bdb5bff2860c7b2582307ee7e8ff613ab
Opcode Fuzzy Hash: 093a6878098e5a75cec8497834c9fa15edcd2be0e93012a21ac3e71b51c1bd4c
Instruction Fuzzy Hash: 7021B3755083809FCB03CF24D994B15BFB1FB46214F28C5DAD8498F2A7D33A9816CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0154D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.511843951.000000000154D000.00000040.00000001.sdmp, Offset: 0154D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction ID: d4121a0468279cc3c8ee2c5ce6a14a2ac70f47a4663ea2d001527f5a36de045a
Opcode Fuzzy Hash: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction Fuzzy Hash: D7119D76504280CFDB12CF54D5C4B5ABF71FB94328F2486A9D9050A656C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0154D3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.511843951.000000000154D000.00000040.00000001.sdmp, Offset: 0154D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction ID: b3b1d45d77e380fbbb12d2c53add6403c9fc28f87543e163d976e897b26eca47
Opcode Fuzzy Hash: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction Fuzzy Hash: 4111AF76504280CFCB12CF54D5C4B5ABF71FB94324F24C6A9D8490F656C37AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 6864 Parent PID: 1104 Orden de Compra -SA765443,pdf.exeCOMMON

Executed Functions

Function 0757B238, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0757B46E

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a3a5b4c2e15bca510afb9ac52c84bfca805b826bfbec55e8c0e7157f6a672f70
Instruction ID: a322d79e05dbc7e187bacc3ae2faa0ca1dedcddec40c98a3c73b303b8720d3b1
Opcode Fuzzy Hash: a3a5b4c2e15bca510afb9ac52c84bfca805b826bfbec55e8c0e7157f6a672f70
Instruction Fuzzy Hash: 7A913DB1D00219CFDF10CFA5D881BEEBBB2BF48314F14856AD859A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0169F8F8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0169FA0A

Memory Dump Source

Source File: 00000009.00000002.294143738.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a671a5cfa737feb86246a29ebaca83625f1cc3596ec2b0e94b3f3c4361efd9c5
Instruction ID: 7773d7debdf845353567eefb09ead981246d134ab606294d0aa7be8e11b750f2
Opcode Fuzzy Hash: a671a5cfa737feb86246a29ebaca83625f1cc3596ec2b0e94b3f3c4361efd9c5
Instruction Fuzzy Hash: 81418CB1D002099BDB14CF9AC884ADEBBB5BF88314F25852AE919AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01695794, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01695851

Memory Dump Source

Source File: 00000009.00000002.294143738.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 28ab85649ade1ab5560ab1b4fbe692fdcb0665768a0551d6da679a0fa2f87e2a
Instruction ID: 459b10410302a6fb36855274109c1736c6582339afe3cd1567bd5240797c731d
Opcode Fuzzy Hash: 28ab85649ade1ab5560ab1b4fbe692fdcb0665768a0551d6da679a0fa2f87e2a
Instruction Fuzzy Hash: 9E411271C00228CBDF24DFA9C944BDEBBB9BF49304F20846AD409BB250DB74694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 01693E70, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01695851

Memory Dump Source

Source File: 00000009.00000002.294143738.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5f407a78ef5617956a494784419240622d51027af62e06a7e37a967d133c0d7e
Instruction ID: d5330090e8e4c27e09e527f55e99f897a47ba78dc613bdbd645f490974640e66
Opcode Fuzzy Hash: 5f407a78ef5617956a494784419240622d51027af62e06a7e37a967d133c0d7e
Instruction Fuzzy Hash: 3A410170C00728CBDB24DFA9C944BDEBBB9BF89304F60846AD409AB251DB756946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0757AFB0, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0757B040

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 936240e6c73401b7ce47e5183ffd4edf3dc7f1dc87853f4c7182a43692d35466
Instruction ID: 065e79bc45eb61104c503ec98e3d2675bc797e416692aaebfbab5dce1d8a80b1
Opcode Fuzzy Hash: 936240e6c73401b7ce47e5183ffd4edf3dc7f1dc87853f4c7182a43692d35466
Instruction Fuzzy Hash: 6C212CB5900349DFCB10CFA9C884BEEBBF5FF48314F10842AE914A7240D7749954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0757AE18, Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 0757AE96

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d7924b1cc325e25a2b3047b694c359b1a6de47ae24d107ba86641ab793612cdb
Instruction ID: 596f96dd9d2f1a2f1f534d87b7d48ea696625ece067d378c838d964c93d3edd4
Opcode Fuzzy Hash: d7924b1cc325e25a2b3047b694c359b1a6de47ae24d107ba86641ab793612cdb
Instruction Fuzzy Hash: 77212CB1D003098FDB10DFA9C4847EEBBF5EF88214F54842ED959A7240DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0757B0A0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0757B120

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4249f38c74e653b5fe310d83ccc334b9331dfa538d2d2e29ecdc7c76cff7e3b4
Instruction ID: a20a9f0be0312c175904a1933a52b3978dcbeb8455134cf85dac8b485058cef2
Opcode Fuzzy Hash: 4249f38c74e653b5fe310d83ccc334b9331dfa538d2d2e29ecdc7c76cff7e3b4
Instruction Fuzzy Hash: AD2116B19003499FCB10DFA9C880AEEFBF5FF48314F50882AE518A7240D774A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0757AEF0, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0757AF5E

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4196bc5da4acc31129d344c91afd978726cc9130e5725e0469fbfe90ea6a1eff
Instruction ID: d9498cc3535250a490120bf39b3775cf1394974453277a937613fbf553a1f5af
Opcode Fuzzy Hash: 4196bc5da4acc31129d344c91afd978726cc9130e5725e0469fbfe90ea6a1eff
Instruction Fuzzy Hash: 3A1167B59002099FCB10DFA9C8447EFBBF9EF88324F14881AE515A7200C775A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0757AD68, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0757ADCA

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c4924bc7fc68cfec68326f29885931f1a20ad7b7ba2717698600575b193f5327
Instruction ID: 811a8a57bfdea9088a740095bd972226ffe5776a70ecef84f21170dc67113be3
Opcode Fuzzy Hash: c4924bc7fc68cfec68326f29885931f1a20ad7b7ba2717698600575b193f5327
Instruction Fuzzy Hash: AC114CB1D003498FDB10DFAAC4447EFFBF9AF88224F14882AD515A7240CB74A944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0757FC48, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0757FCA0

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 354c863bef0c5714e112bc3af0a1b2e445359cca6b4f9d6877828bf6859e9d83
Instruction ID: c4e4a3ac44cf0e3c46bbe20fc8c09162de24885faaca82e6962e6a4c76eeeb70
Opcode Fuzzy Hash: 354c863bef0c5714e112bc3af0a1b2e445359cca6b4f9d6877828bf6859e9d83
Instruction Fuzzy Hash: EA1106B5800609CFCB10DF99D544BEEBBF8EB48324F14882AD954A7240D778A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0169FF48, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0169FFA5

Memory Dump Source

Source File: 00000009.00000002.294143738.0000000001690000.00000040.00000001.sdmp, Offset: 01690000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d8902bd90b8f29f3aaa17f8637983a52f9ce157c94c95c5af06cef336b521fae
Instruction ID: ea31817e58834816d1b0a8b01b81b1becd835a059545550697bfea778b6edfa2
Opcode Fuzzy Hash: d8902bd90b8f29f3aaa17f8637983a52f9ce157c94c95c5af06cef336b521fae
Instruction Fuzzy Hash: 0D11D3B59002499FDB10DF99D884BDEFBF8EB88324F14845AD955A7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0757E218, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0757E275

Memory Dump Source

Source File: 00000009.00000002.299589030.0000000007570000.00000040.00000001.sdmp, Offset: 07570000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 661c790e6cb55e8f413146461d737b665b444c482dced46a17fdf8b380b74b0b
Instruction ID: 12608e99f8bb023183bfdf04722dcb0748bf1f4b17e20e3fe34255e6af5c3723
Opcode Fuzzy Hash: 661c790e6cb55e8f413146461d737b665b444c482dced46a17fdf8b380b74b0b
Instruction Fuzzy Hash: B311D0B5800349DFDB10DF9AD885BEEBBF8FB48324F14885AE954A7600C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015FD550, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293924189.00000000015FD000.00000040.00000001.sdmp, Offset: 015FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d13fea6d89ec8cc2c72bfa85e6964b35067815f86e32a1762e230dd376f76ee
Instruction ID: 0ce0a79e8b26764a24c4d1e54c59b0325d94a7ee9e714e3e3049fbd0a64d606e
Opcode Fuzzy Hash: 0d13fea6d89ec8cc2c72bfa85e6964b35067815f86e32a1762e230dd376f76ee
Instruction Fuzzy Hash: 0021F4B1504240DFDB15DF94D9C4B2ABFB5FB88318F24896DEA090F206C336D856C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 015FD464, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293924189.00000000015FD000.00000040.00000001.sdmp, Offset: 015FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b6f28d4c16e028ece7e94dcc846c1b7d04b2f71b8cdb369d415eb08c047268
Instruction ID: 0250c7ae8db7d314b8a57b07862583f3c0b2bec05487d193c2ff64fff9d42d11
Opcode Fuzzy Hash: 71b6f28d4c16e028ece7e94dcc846c1b7d04b2f71b8cdb369d415eb08c047268
Instruction Fuzzy Hash: 37210672500240DFDB05CF94D8C8B6ABBB5FB84318F24C96DD9090F206C336E856C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0160D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293966307.000000000160D000.00000040.00000001.sdmp, Offset: 0160D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074256fbdd78ded145dae6c37bc469af1ef29932552cb0aa60d0fe8e4b452277
Instruction ID: a8fadf8b615622bd2e125c87d00417666fa4259ee3e742d984eee4b356f982b0
Opcode Fuzzy Hash: 074256fbdd78ded145dae6c37bc469af1ef29932552cb0aa60d0fe8e4b452277
Instruction Fuzzy Hash: 76210375604200DFDB1ACF94D8C0B27BBA5EB84354F20CA69D84E4B386C33AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0160D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293966307.000000000160D000.00000040.00000001.sdmp, Offset: 0160D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc022b4f5e10bc8ee84bb05d64881ba97dab587a5e193e0e1b2ff0aef0544f14
Instruction ID: 3d6ef6b33880e4393ee0e74cf592d02deeaa64ac1903c9e13080c653a02b5bdb
Opcode Fuzzy Hash: cc022b4f5e10bc8ee84bb05d64881ba97dab587a5e193e0e1b2ff0aef0544f14
Instruction Fuzzy Hash: 062192755093808FCB17CF64D990716BF71EB46214F28C6DAD8498F697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 015FD45F, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293924189.00000000015FD000.00000040.00000001.sdmp, Offset: 015FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction ID: 44fb0abb8dc90abdfb8800b90086d3a43088dfcf6ab2653940c1fcc67b13a797
Opcode Fuzzy Hash: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction Fuzzy Hash: B2119D76504280CFCB12CF54D5C4B1ABF71FB84324F2486A9D9050F656C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 015FD54B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293924189.00000000015FD000.00000040.00000001.sdmp, Offset: 015FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction ID: d0dd74bb8a99de4f64cba4351ef2f747e937fe60a59ce4b0e69823af1062e9b9
Opcode Fuzzy Hash: 11772b62ccc9d22d83b62afd0a891c4d6e4a6fe74df51c0b93359674bc6ca424
Instruction Fuzzy Hash: 64118C76504280CFCB12CF54D584B1ABF71FB84224F2486ADD9080B657C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015FD731, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293924189.00000000015FD000.00000040.00000001.sdmp, Offset: 015FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b8227d460cef370dd0509d1895e6217b1df80bae0662ae8a61d37509917295
Instruction ID: 2fc03d571df6d324a82431f9a7f6b2e7f15f2e8520c50da07fbe59ae6d9ad6fe
Opcode Fuzzy Hash: 03b8227d460cef370dd0509d1895e6217b1df80bae0662ae8a61d37509917295
Instruction Fuzzy Hash: 4E01F7724093C49AE7104AA5CC807ABBBECFF80274F18885EEE041F242D378A844C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 015FD730, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.293924189.00000000015FD000.00000040.00000001.sdmp, Offset: 015FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178a6001335acbfe39470df6c0f7cd0955f82f765e5c462a275e39d7c2dc54f9
Instruction ID: f288c412df9edda2c2c729e7625eb85880a90561f439485c6dfe013ed34f4098
Opcode Fuzzy Hash: 178a6001335acbfe39470df6c0f7cd0955f82f765e5c462a275e39d7c2dc54f9
Instruction Fuzzy Hash: C0F062724053849AE7118A59CC84BA7FFE8EB81674F18C55EEE085F286C379A844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Orden de Compra -SA765443,pdf.exe PID: 4220 Parent PID: 6864 Orden de Compra -SA765443,pdf.exeCOMMON

Executed Functions

Function 0197FB00, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

)e]-, xrefs: 0197FC26
)e]-, xrefs: 0197FC46

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID:
String ID: )e]-$)e]-
API String ID: 0-1154289601
Opcode ID: 7f9af70c7666abe46e0e97ba98fd2d759e16bd9d0f09353b8f830c936e9ab16e
Instruction ID: 2b4119a6acdbed355d09a85a54a9e3f5d35c91d11145280fc97baba2a940e7fc
Opcode Fuzzy Hash: 7f9af70c7666abe46e0e97ba98fd2d759e16bd9d0f09353b8f830c936e9ab16e
Instruction Fuzzy Hash: DA916F71C083899FCF06CFA5D890ADDBFB5BF4A310F19819AE858AB262C7349845DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0197D9E8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON

Download Yara Rule

Strings

)e]-, xrefs: 0197FC26
)e]-, xrefs: 0197FC46

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID:
String ID: )e]-$)e]-
API String ID: 0-1154289601
Opcode ID: 5b97af99c7acf8dddf2d0eef56bfc29bbeadbc41e2b03a21d960409e0f97c4ae
Instruction ID: 3e5ef5dc4cf6e3d2b8b56d6fd39cc28fff669444e76143d308e1e283cd467374
Opcode Fuzzy Hash: 5b97af99c7acf8dddf2d0eef56bfc29bbeadbc41e2b03a21d960409e0f97c4ae
Instruction Fuzzy Hash: 1951FFB1D04348DFDB15CFAAD880ADEBFB5BF49314F24852AE819AB211D7709845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0197DA04, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0197FD0A

Strings

)e]-, xrefs: 0197FC26
)e]-, xrefs: 0197FC46

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: CreateWindow
String ID: )e]-$)e]-
API String ID: 716092398-1154289601
Opcode ID: c1bb415ea09be530524141cd4469957df87d834b39a2c42494695882e931f994
Instruction ID: 87e14df2c079d7aea7a5437d7e7283d0d4a3a7ba588eee91ba18a1afcc99d216
Opcode Fuzzy Hash: c1bb415ea09be530524141cd4469957df87d834b39a2c42494695882e931f994
Instruction Fuzzy Hash: 9B519FB1D00309DFDB14CF9AD884ADEBBB5BF88314F64852AE829BB210D7749945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 019793E8, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0197962E

Strings

)e]-, xrefs: 019795E7

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: HandleModule
String ID: )e]-
API String ID: 4139908857-4171778319
Opcode ID: c08d899027380ee51d43ebe0f445d685c33d67416ff0bb6db1071ec1fbb9d15e
Instruction ID: 68c5c98fb3859950e5457df1035e8599db2d962cf5f1662018f40f8ef6d9628e
Opcode Fuzzy Hash: c08d899027380ee51d43ebe0f445d685c33d67416ff0bb6db1071ec1fbb9d15e
Instruction Fuzzy Hash: 31715470A00B058FD724DF6AD44579ABBF5FF88619F008A2ED58AD7A40DB34E805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0197BCF9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0197BCC6,?,?,?,?,?), ref: 0197BD87

Strings

)e]-, xrefs: 0197BD1F

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: )e]-
API String ID: 3793708945-4171778319
Opcode ID: db86438fad594fa47ba6b73ff0f1b637e197f65d0ce0f5097d4f880e6d75dd46
Instruction ID: a071cd9c03f390a44f6eee3ab232e4e3d0868ea8d575ea791edebec69f3f378a
Opcode Fuzzy Hash: db86438fad594fa47ba6b73ff0f1b637e197f65d0ce0f5097d4f880e6d75dd46
Instruction Fuzzy Hash: 9721D2B59002489FDB10CFAAD884ADEFFF8EB48324F15841AE959A7210D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0197A14C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0197BCC6,?,?,?,?,?), ref: 0197BD87

Strings

)e]-, xrefs: 0197BD1F

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: )e]-
API String ID: 3793708945-4171778319
Opcode ID: 70e8ecdc30adeac6f042156524a6e4912d9c6580ec042944737ad1be724cfd95
Instruction ID: 32852611fd7ecbf5e9a428da97e2d9f4e6036798b14e55824857d59b6a460aaa
Opcode Fuzzy Hash: 70e8ecdc30adeac6f042156524a6e4912d9c6580ec042944737ad1be724cfd95
Instruction Fuzzy Hash: 5721E5B5900248DFDB10CF9AD884AEEBFF9EB48310F14841AE959A7310D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01979849, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,019796A9,00000800,00000000,00000000), ref: 019798BA

Strings

)e]-, xrefs: 0197986F

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: )e]-
API String ID: 1029625771-4171778319
Opcode ID: f24eee45c9a056073c141592557bdcf891b35c8be71b93d07198b5ee9b4931c1
Instruction ID: e28627f507ba42b59e3ad90adaeb025571d73e9c58b5a0b25bbcdc51c9f17233
Opcode Fuzzy Hash: f24eee45c9a056073c141592557bdcf891b35c8be71b93d07198b5ee9b4931c1
Instruction Fuzzy Hash: 1F1103B6900209DFDB10CF9AD444ADEFBF8EF48324F14842EE519A7600C374A949CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 01978768, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,019796A9,00000800,00000000,00000000), ref: 019798BA

Strings

)e]-, xrefs: 0197986F

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: )e]-
API String ID: 1029625771-4171778319
Opcode ID: e8655ac14d58a8b46d636109d8dfbce805ab53d46fc0f98f4c44bfb40cd9a2ac
Instruction ID: c05c179aee4975268ff45e347e9d5dad6011a328574b5a9342ee80c9edbdaa67
Opcode Fuzzy Hash: e8655ac14d58a8b46d636109d8dfbce805ab53d46fc0f98f4c44bfb40cd9a2ac
Instruction Fuzzy Hash: 4211D6B6900249DFDB14CF9AD444ADEFBF8EB48324F14842ED519B7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0197FE38, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0197FE28,?,?,?,?), ref: 0197FE9D

Strings

)e]-, xrefs: 0197FE5A

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: LongWindow
String ID: )e]-
API String ID: 1378638983-4171778319
Opcode ID: 3fd10fe7c42973c7ae5ac64bd091f1ec45c3a91e30b4f02b784a98e79e08a8c2
Instruction ID: c17a87ba734d9342251df31a5fb179511ec2d5d3a4d1880355bd162f3df7a8f9
Opcode Fuzzy Hash: 3fd10fe7c42973c7ae5ac64bd091f1ec45c3a91e30b4f02b784a98e79e08a8c2
Instruction Fuzzy Hash: 0F1102B5800209DFDB10CF9AD484BDEFBF8EB48724F10881AE868B3601C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 019795C8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0197962E

Strings

)e]-, xrefs: 019795E7

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: HandleModule
String ID: )e]-
API String ID: 4139908857-4171778319
Opcode ID: 0461b1de636efc7c8163b765fd7a75af2bda0ca51e3fccd9c14c2258305844e8
Instruction ID: e4d71a0306f9c2e762ae0550cc38d7922bd6599a0b97264b65220fcbb9c953e1
Opcode Fuzzy Hash: 0461b1de636efc7c8163b765fd7a75af2bda0ca51e3fccd9c14c2258305844e8
Instruction Fuzzy Hash: 5C11D2B5D006498FDB14DF9AD444BDEFBF8EF88224F14851AD419A7600C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0197DA3C, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0197FE28,?,?,?,?), ref: 0197FE9D

Strings

)e]-, xrefs: 0197FE5A

Memory Dump Source

Source File: 0000000E.00000002.310465229.0000000001970000.00000040.00000001.sdmp, Offset: 01970000, based on PE: false

Similarity

API ID: LongWindow
String ID: )e]-
API String ID: 1378638983-4171778319
Opcode ID: ccd5932751878a8c7f17d5be6aafa7e58a399654ee1070545860dca604f9ed67
Instruction ID: 500d587e106e2971f7c1c24239cc6bfc8f9842ef0221a32c9c7751230a22c5b6
Opcode Fuzzy Hash: ccd5932751878a8c7f17d5be6aafa7e58a399654ee1070545860dca604f9ed67
Instruction Fuzzy Hash: 4911E6B59002489FDB10DF9AD484BDEBBF8EB48724F148419E919B7301C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 016FD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.310234162.00000000016FD000.00000040.00000001.sdmp, Offset: 016FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c1ac46215d4a8bbdad9e6b13961dab071e0b8c2fe2dcc941ffe599ced4168f
Instruction ID: 784f63830d9992608da56f1f70004bde82ca5019d17d02bcfa03f96039591475
Opcode Fuzzy Hash: 69c1ac46215d4a8bbdad9e6b13961dab071e0b8c2fe2dcc941ffe599ced4168f
Instruction Fuzzy Hash: CC212575504300DFDB15DF94D8C0B26BBA5FB84354F20C96DD9094B346C33AE847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 016FD006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.310234162.00000000016FD000.00000040.00000001.sdmp, Offset: 016FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c8133b6a2da4cfdd5932f5ca4497889a2aa34a9c0aa36c36f9e104090cad0c
Instruction ID: ffa24178283e31c6483a8c7fc652540359c30b4d6c38c89b0c583af58f35b6eb
Opcode Fuzzy Hash: a2c8133b6a2da4cfdd5932f5ca4497889a2aa34a9c0aa36c36f9e104090cad0c
Instruction Fuzzy Hash: 55218E755093808FCB13CF24D990B15BF71EB46214F28C5EAD9498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Orden de Compra -SA765443,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

System Summary:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior