Play interactive tour

Edit tour

Analysis Report 7SlKt2Puui.exe

Overview

General Information

Sample Name:	7SlKt2Puui.exe
Analysis ID:	397893
MD5:	9013a8b3f9a8adecf2ff25377f525748
SHA1:	b066eb77a5000579f3836291bfb2c2c334c8a84e
SHA256:	a21b6b2e6336efdfe470806c0d615ede9acacd44ab317ce7e4c59cfb8de1619f
Tags:	exeRaccoonStealer
Infos:
Most interesting Screenshot:

Detection

Raccoon

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Raccoon Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to steal Internet Explorer form passwords

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

7SlKt2Puui.exe (PID: 6912 cmdline: 'C:\Users\user\Desktop\7SlKt2Puui.exe' MD5: 9013A8B3F9A8ADECF2FF25377F525748)

cmd.exe (PID: 6652 cmdline: cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\7SlKt2Puui.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 5624 cmdline: timeout /T 10 /NOBREAK MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

cleanup

Malware Configuration

Threatname: Raccoon Stealer

{"RC4_key2": "d2190a1675e0673d0823ae5c7f64e90c", "C2 url": "https://telete.in/tomarsjsmith3", "Bot ID": "0edc595f7019893efa9faa3afd9ed6df6023e92c", "RC4_key1": "$Z2s`ten\\@bE9vzR"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 7SlKt2Puui.exe PID: 6912	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 1.2.7SlKt2Puui.exe.400000.0.unpack

Malware Configuration Extractor: Raccoon Stealer {"RC4_key2": "d2190a1675e0673d0823ae5c7f64e90c", "C2 url": "https://telete.in/tomarsjsmith3", "Bot ID": "0edc595f7019893efa9faa3afd9ed6df6023e92c", "RC4_key1": "$Z2s`ten\\@bE9vzR"}

Multi AV Scanner detection for domain / URL

Show sources

Source: telete.in

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: 7SlKt2Puui.exe

Virustotal: Detection: 33%

Perma Link

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: 7SlKt2Puui.exe PID: 6912, type: MEMORY

Machine Learning detection for sample

Show sources

Source: 7SlKt2Puui.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040CC56 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,	1_2_0040CC56
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040ED62 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,CryptUnprotectData,LocalFree,	1_2_0040ED62
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040D35A __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,	1_2_0040D35A
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00427411 CryptAcquireContextA,CryptCreateHash,lstrlenW,CryptHashData,CryptGetHashParam,wsprintfW,lstrcatW,wsprintfW,lstrcatW,CryptDestroyHash,CryptReleaseContext,lstrlenW,CryptUnprotectData,LocalFree,	1_2_00427411
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004275E4 lstrlenW,lstrlenW,lstrlenW,CredEnumerateW,CryptUnprotectData,LocalFree,CredFree,	1_2_004275E4
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040DDA5 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,CryptUnprotectData,	1_2_0040DDA5
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040C07D __EH_prolog,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,LocalAlloc,BCryptDecrypt,BCryptCloseAlgorithmProvider,BCryptDestroyKey,	1_2_0040C07D
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0041E578 __EH_prolog,_strlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,PK11_FreeSlot,	1_2_0041E578

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Unpacked PE file: 1.2.7SlKt2Puui.exe.400000.0.unpack

Source: 7SlKt2Puui.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 195.201.225.248:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.105.210.195:443 -> 192.168.2.4:49738 version: TLS 1.2

Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.1.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\gfx\angle\targets\libEGL\libEGL.pdb source: libEGL.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libprldap\prldap60.pdb source: prldap60.dll.1.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb source: IA2Marshal.dll.1.dr
Source:	Binary string: C:\coselu88\cez-yizuyine80_zesudu_peyihubitigufajuzad doseka.pdbpo.pdb source: 7SlKt2Puui.exe
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.1.dr
Source:	Binary string: ucrtbase.pdb source: ucrtbase.dll.1.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.1.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.1.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb source: nssckbi.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: 7SlKt2Puui.exe, 00000001.00000002.698110075.000000006D469000.00000002.00020000.sdmp, mozglue.dll.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.1.dr
Source:	Binary string: C:\coselu88\cez-yizuyine80_zesudu_peyihubitigufajuzad doseka.pdb source: 7SlKt2Puui.exe
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: api-ms-win-crt-private-l1-1-0.dll.1.dr
Source:	Binary string: po.pdb source: 7SlKt2Puui.exe
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\ipc\win\handler\AccessibleHandler.pdb source: AccessibleHandler.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: nssdbm3.dll.1.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapihook\build\MapiProxy.pdb source: MapiProxy_InUse.dll.1.dr
Source:	Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.1.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.1.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb66 source: nssckbi.dll.1.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3.dll.1.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb<< source: IA2Marshal.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: 7SlKt2Puui.exe, 00000001.00000002.698110075.000000006D469000.00000002.00020000.sdmp, mozglue.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.1.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.1.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.1.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapiDLL\mozMapi32.pdb source: mozMapi32.dll.1.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.1.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.1.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\config\external\lgpllibs\lgpllibs.pdb source: lgpllibs.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: nssdbm3.dll.1.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\crashreporter\injector\breakpadinjector.pdb source: breakpadinjector.dll.1.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.1.dr

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0043BD9C FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,

1_2_0043BD9C

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_004329EE __EH_prolog,GetLogicalDriveStringsA,

1_2_004329EE

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://telete.in/tomarsjsmith3

Source: Joe Sandbox View

IP Address: 195.201.225.248 195.201.225.248

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: unknown

DNS traffic detected: queries for: telete.in

Source: softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: softokn3.dll.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: nssckbi.dll.1.dr	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://ocsp.accv.es0
Source: softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3.dll.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://policy.camerfirma.com0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://repository.swisssign.com/0
Source: softokn3.dll.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: softokn3.dll.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: softokn3.dll.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.accv.es00
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.chambersign.org1
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: mozglue.dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: softokn3.dll.1.dr	String found in binary or memory: http://www.mozilla.com0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.quovadis.bm0
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: sqlite3.dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: nssckbi.dll.1.dr	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 7SlKt2Puui.exe, 00000001.00000003.686368240.0000000000AAC000.00000004.00000001.sdmp	String found in binary or memory: https://birdmilk.top//l/f/uDxHDnkBuI_ccNKogidJ/b0a4288ab8cefd834adcc7f60dc85cae472bc38cusM
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: nssckbi.dll.1.dr	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: nssckbi.dll.1.dr	String found in binary or memory: https://repository.luxtrust.lu0
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 7SlKt2Puui.exe, 00000001.00000003.680986715.0000000000AA8000.00000004.00000001.sdmp, 7SlKt2Puui.exe, 00000001.00000003.681029690.000000004C88D000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 7SlKt2Puui.exe, 00000001.00000003.680986715.0000000000AA8000.00000004.00000001.sdmp, 7SlKt2Puui.exe, 00000001.00000003.681029690.000000004C88D000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: nssckbi.dll.1.dr	String found in binary or memory: https://www.catcert.net/verarrel
Source: nssckbi.dll.1.dr	String found in binary or memory: https://www.catcert.net/verarrel05
Source: softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1xVPfvJcrg.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 195.201.225.248:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.105.210.195:443 -> 192.168.2.4:49738 version: TLS 1.2

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: 7SlKt2Puui.exe PID: 6912, type: MEMORY

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0043C37D: DeviceIoControl,GetLastError,

1_2_0043C37D

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004340EE	1_2_004340EE
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0043454A	1_2_0043454A
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040C67C	1_2_0040C67C
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0041E71E	1_2_0041E71E
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040CC56	1_2_0040CC56
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040ED62	1_2_0040ED62
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00432F99	1_2_00432F99
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0043AFB9	1_2_0043AFB9
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040D35A	1_2_0040D35A
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0041D384	1_2_0041D384
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00429796	1_2_00429796
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004277AD	1_2_004277AD
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0041DD64	1_2_0041DD64
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0040DDA5	1_2_0040DDA5
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004400A5	1_2_004400A5
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0044614A	1_2_0044614A
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00458109	1_2_00458109
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00448112	1_2_00448112
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0041C274	1_2_0041C274
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00458229	1_2_00458229
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004282DB	1_2_004282DB
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00420358	1_2_00420358
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00440360	1_2_00440360
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0043A467	1_2_0043A467
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004164BE	1_2_004164BE
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004149DE	1_2_004149DE
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004869E8	1_2_004869E8
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_00440A90	1_2_00440A90

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: String function: 004656A0 appears 102 times
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: String function: 0043DE20 appears 32 times

Source: sqlite3.dll.1.dr

Static PE information: Number of sections : 18 > 10

Source: 7SlKt2Puui.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7SlKt2Puui.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7SlKt2Puui.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7SlKt2Puui.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7SlKt2Puui.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7SlKt2Puui.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 7SlKt2Puui.exe, 00000001.00000002.693335306.00000000008E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs 7SlKt2Puui.exe
Source: 7SlKt2Puui.exe, 00000001.00000002.697270839.000000004BAB0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 7SlKt2Puui.exe
Source: 7SlKt2Puui.exe, 00000001.00000002.698063835.000000004C905000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7SlKt2Puui.exe
Source: 7SlKt2Puui.exe, 00000001.00000002.698132773.000000006D472000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll8 vs 7SlKt2Puui.exe
Source: 7SlKt2Puui.exe, 00000001.00000002.698642427.000000006D5AB000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenss3.dll8 vs 7SlKt2Puui.exe
Source: 7SlKt2Puui.exe, 00000001.00000002.693372133.00000000008F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs 7SlKt2Puui.exe

Source: 7SlKt2Puui.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 7SlKt2Puui.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/67@2/3

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_004276D8 CoCreateInstance,StrStrIW,CoTaskMemFree,CoTaskMemFree,

1_2_004276D8

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

File created: C:\Users\user\AppData\LocalLow\sqlite3.dll

Jump to behavior

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Mutant created: \Sessions\1\BaseNamedObjects\uiabfqwfuuser
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_01

Source: 7SlKt2Puui.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, sqlite3.dll.1.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);<
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: sqlite3.dll.1.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: 7SlKt2Puui.exe

Virustotal: Detection: 33%

Source: unknown	Process created: C:\Users\user\Desktop\7SlKt2Puui.exe 'C:\Users\user\Desktop\7SlKt2Puui.exe'
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\7SlKt2Puui.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\7SlKt2Puui.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK	Jump to behavior

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager

Jump to behavior

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 7SlKt2Puui.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.1.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\gfx\angle\targets\libEGL\libEGL.pdb source: libEGL.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libprldap\prldap60.pdb source: prldap60.dll.1.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb source: IA2Marshal.dll.1.dr
Source:	Binary string: C:\coselu88\cez-yizuyine80_zesudu_peyihubitigufajuzad doseka.pdbpo.pdb source: 7SlKt2Puui.exe
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: 7SlKt2Puui.exe, 00000001.00000002.698512852.000000006D570000.00000002.00020000.sdmp, nss3.dll.1.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.1.dr
Source:	Binary string: ucrtbase.pdb source: ucrtbase.dll.1.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.1.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.1.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb source: nssckbi.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: 7SlKt2Puui.exe, 00000001.00000002.698110075.000000006D469000.00000002.00020000.sdmp, mozglue.dll.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.1.dr
Source:	Binary string: C:\coselu88\cez-yizuyine80_zesudu_peyihubitigufajuzad doseka.pdb source: 7SlKt2Puui.exe
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: api-ms-win-crt-private-l1-1-0.dll.1.dr
Source:	Binary string: po.pdb source: 7SlKt2Puui.exe
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\ipc\win\handler\AccessibleHandler.pdb source: AccessibleHandler.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: nssdbm3.dll.1.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapihook\build\MapiProxy.pdb source: MapiProxy_InUse.dll.1.dr
Source:	Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.1.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.1.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb66 source: nssckbi.dll.1.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3.dll.1.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb<< source: IA2Marshal.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: 7SlKt2Puui.exe, 00000001.00000002.698110075.000000006D469000.00000002.00020000.sdmp, mozglue.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.1.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.1.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.1.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapiDLL\mozMapi32.pdb source: mozMapi32.dll.1.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.1.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.1.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\config\external\lgpllibs\lgpllibs.pdb source: lgpllibs.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: nssdbm3.dll.1.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.1.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\crashreporter\injector\breakpadinjector.pdb source: breakpadinjector.dll.1.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.1.dr

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Unpacked PE file: 1.2.7SlKt2Puui.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.xozoxew:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Unpacked PE file: 1.2.7SlKt2Puui.exe.400000.0.unpack

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_004317EB LoadLibraryA,GetProcAddress,FreeLibrary,

1_2_004317EB

Source: 7SlKt2Puui.exe	Static PE information: section name: .xozoxew
Source: sqlite3.dll.1.dr	Static PE information: section name: /4
Source: sqlite3.dll.1.dr	Static PE information: section name: /19
Source: sqlite3.dll.1.dr	Static PE information: section name: /31
Source: sqlite3.dll.1.dr	Static PE information: section name: /45
Source: sqlite3.dll.1.dr	Static PE information: section name: /57
Source: sqlite3.dll.1.dr	Static PE information: section name: /70
Source: sqlite3.dll.1.dr	Static PE information: section name: /81
Source: sqlite3.dll.1.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0046C54A pushad ; retf		1_2_0046C701
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0046C702 pushad ; retf		1_2_0046C701

Source: initial sample

Static PE information: section name: .text entropy: 7.80824497107

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll	Jump to dropped file

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0041DD64 __EH_prolog,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0041DD64

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll	Jump to dropped file

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Registry key enumerated: More than 152 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\7SlKt2Puui.exe TID: 7104	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5940	Thread sleep count: 91 > 30			Jump to behavior

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0043BD9C FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,

1_2_0043BD9C

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_004329EE __EH_prolog,GetLogicalDriveStringsA,

1_2_004329EE

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0043454A __EH_prolog,_strftime,GetUserDefaultLCID,GetLocaleInfoA,GetUserNameA,GetUserNameA,GetComputerNameA,GetUserNameA,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayDevicesA,EnumDisplayDevicesA,EnumDisplayDevicesA,

1_2_0043454A

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Source: 7SlKt2Puui.exe, 00000001.00000002.697270839.000000004BAB0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 7SlKt2Puui.exe, 00000001.00000002.697270839.000000004BAB0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 7SlKt2Puui.exe, 00000001.00000002.697270839.000000004BAB0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 7SlKt2Puui.exe, 00000001.00000002.697270839.000000004BAB0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0043E057 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0043E057

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_004317EB LoadLibraryA,GetProcAddress,FreeLibrary,

1_2_004317EB

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0044488D mov eax, dword ptr fs:[00000030h]

1_2_0044488D

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0040C282 __EH_prolog,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

1_2_0040C282

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0043E057 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0043E057
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0043E1B9 SetUnhandledExceptionFilter,	1_2_0043E1B9
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_004442B1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004442B1
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: 1_2_0043E3CB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0043E3CB

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK

Jump to behavior

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: __EH_prolog,_strftime,GetUserDefaultLCID,GetLocaleInfoA,GetUserNameA,GetUserNameA,GetComputerNameA,GetUserNameA,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayDevicesA,EnumDisplayDevicesA,EnumDisplayDevicesA,	1_2_0043454A
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: __EH_prolog,CoInitialize,GetUserDefaultLCID,GetLocaleInfoA,Sleep,Sleep,GetUserNameA,Sleep,_strlen,_strlen,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,CreateThread,GetModuleHandleA,FreeLibrary,WaitForSingleObject,lstrlenA,GetEnvironmentVariableA,ShellExecuteA,ShellExecuteA,CoUninitialize,	1_2_00429796
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: GetLocaleInfoW,	1_2_004601DC
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: EnumSystemLocalesW,	1_2_00456227
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: EnumSystemLocalesW,	1_2_004602CE
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: EnumSystemLocalesW,	1_2_00460283
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: EnumSystemLocalesW,	1_2_00460369
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_004603F4
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: GetLocaleInfoW,	1_2_00460647
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0046076D
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: GetLocaleInfoW,	1_2_00456854
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: GetLocaleInfoW,	1_2_00460873
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00460942

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_0043E273 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_0043E273

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

1_2_0043454A

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_00433F30 __EH_prolog,GetUserNameA,GetTimeZoneInformation,std::ios_base::_Ios_base_dtor,

1_2_00433F30

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: 1_2_004277AD GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,_memcmp,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,_memcmp,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,StrStrIW,lstrlenW,lstrlenW,FreeLibrary,

1_2_004277AD

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: 7SlKt2Puui.exe PID: 6912, type: MEMORY

Contains functionality to steal Internet Explorer form passwords

Show sources

Source: C:\Users\user\Desktop\7SlKt2Puui.exe

Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2

1_2_0043261D

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings	Jump to behavior
Source: C:\Users\user\Desktop\7SlKt2Puui.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Jump to behavior

Remote Access Functionality:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: 7SlKt2Puui.exe PID: 6912, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Application Shimming1	Process Injection11	Masquerading1	OS Credential Dumping2	System Time Discovery2	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Application Shimming1	Virtualization/Sandbox Evasion1	Credentials In Files1	Security Software Discovery21	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Application Layer Protocol12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information3	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing22	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery26	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7SlKt2Puui.exe	33%	Virustotal		Browse
7SlKt2Puui.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	3%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.7SlKt2Puui.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1127993		Download File

Domains

Source	Detection	Scanner	Label	Link
birdmilk.top	0%	Virustotal		Browse
telete.in	12%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://birdmilk.top//l/f/uDxHDnkBuI_ccNKogidJ/b0a4288ab8cefd834adcc7f60dc85cae472bc38cusM	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
birdmilk.top	34.105.210.195	true	false	0%, Virustotal, Browse	unknown
telete.in	195.201.225.248	true	true	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://telete.in/tomarsjsmith3	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	1xVPfvJcrg.1.dr	false		high
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fedir.comsign.co.il/crl/ComSignCA.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.1.dr	false		high
https://duckduckgo.com/ac/?q=	1xVPfvJcrg.1.dr	false		high
http://crl.chambersign.org/chambersroot.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es/legislacion_c.htm0U	nssckbi.dll.1.dr	false		high
http://www.certicamara.com/dpc/0Z	nssckbi.dll.1.dr	false		high
https://repository.luxtrust.lu0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.accv.es0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.thawte.com0	softokn3.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com0	softokn3.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.chambersign.org1	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1xVPfvJcrg.1.dr	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.firmaprofesional.com/cps0	nssckbi.dll.1.dr	false		high
http://www.diginotar.nl/cps/pkioverheid0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.swisssign.com/0	nssckbi.dll.1.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	1xVPfvJcrg.1.dr	false		high
http://crl.securetrust.com/SGCA.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	1xVPfvJcrg.1.dr	false		high
https://www.catcert.net/verarrel	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	softokn3.dll.1.dr	false		high
http://www.certplus.com/CRL/class2.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	nssckbi.dll.1.dr	false		high
http://www.quovadisglobal.com/cps0	nssckbi.dll.1.dr	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	nssckbi.dll.1.dr	false		high
http://crl.chambersign.org/chambersignroot.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.catcert.net/verarrel05	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://birdmilk.top//l/f/uDxHDnkBuI_ccNKogidJ/b0a4288ab8cefd834adcc7f60dc85cae472bc38cusM	7SlKt2Puui.exe, 00000001.00000003.686368240.0000000000AAC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es00	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ocsp.quovadisoffshore.com0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pkioverheid.nl/policies/root-policy-G20	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.cert.fnmt.es/dpcs/0	nssckbi.dll.1.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	1xVPfvJcrg.1.dr	false		high
http://cps.chambersign.org/cps/chambersignroot.html0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	sqlite3.dll.1.dr	false		high
http://policy.camerfirma.com0	nssckbi.dll.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	1xVPfvJcrg.1.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.201.225.248	telete.in	Germany		24940	HETZNER-ASDE	true
34.105.210.195	birdmilk.top	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	397893
Start date:	26.04.2021
Start time:	15:02:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7SlKt2Puui.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/67@2/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 112 Number of non-executed functions: 55
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 40.88.32.150, 92.122.145.220, 52.147.198.201, 13.88.21.125, 20.82.210.154, 92.122.213.247, 92.122.213.194, 8.241.126.249, 8.241.78.126, 8.241.78.254, 8.252.5.126, 8.238.35.254, 52.155.217.156, 20.54.26.129, 20.50.102.62 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, dual-a-0001.dc-msedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:03:58	API Interceptor	4x Sleep call for process: 7SlKt2Puui.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
195.201.225.248	http://telete.in	Get hash	malicious	Browse	telete.in/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
telete.in	ZA4AjogHLo.exe	Get hash	malicious	Browse	195.201.225.248
	oMHveSc3hh.exe	Get hash	malicious	Browse	195.201.225.248
	0KuDEDABFO.exe	Get hash	malicious	Browse	195.201.225.248
	miOnrvnXK0.exe	Get hash	malicious	Browse	195.201.225.248
	Rh74sODsWE.exe	Get hash	malicious	Browse	195.201.225.248
	dSQUdo6EjO.exe	Get hash	malicious	Browse	195.201.225.248
	usVhwck8lN.exe	Get hash	malicious	Browse	195.201.225.248
	MR98F1zzeo.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.31585.exe	Get hash	malicious	Browse	195.201.225.248
	4nMkjOOavk.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.30921.exe	Get hash	malicious	Browse	195.201.225.248
	vmKNuRfDkr.exe	Get hash	malicious	Browse	195.201.225.248
	R1yuWGEa6T.exe	Get hash	malicious	Browse	195.201.225.248
	9iEyLNL02a.exe	Get hash	malicious	Browse	195.201.225.248
	c36Z8AtYmu.exe	Get hash	malicious	Browse	195.201.225.248
	filename.exe	Get hash	malicious	Browse	195.201.225.248
	kokvQi6t3N.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.30216.exe	Get hash	malicious	Browse	195.201.225.248
	riqZtDR8j7.exe	Get hash	malicious	Browse	195.201.225.248
	iIEubyMSNa.exe	Get hash	malicious	Browse	195.201.225.248

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	t.exe	Get hash	malicious	Browse	148.251.185.164
	t0RfFDpZcp.rtf	Get hash	malicious	Browse	188.34.163.189
	t0RfFDpZcp.rtf	Get hash	malicious	Browse	188.34.163.189
	5gqEecd9kP.exe	Get hash	malicious	Browse	168.119.226.10
	IX5fpIEXJD.exe	Get hash	malicious	Browse	168.119.226.10
	afDQft6no7.exe	Get hash	malicious	Browse	168.119.226.10
	ZA4AjogHLo.exe	Get hash	malicious	Browse	195.201.225.248
	078KEIINV2021.exe	Get hash	malicious	Browse	213.133.104.4
	V1NzYOO8DX.exe	Get hash	malicious	Browse	95.216.186.40
	RykzV2Bdm0.exe	Get hash	malicious	Browse	88.99.66.31
	uZsSt27ljW.exe	Get hash	malicious	Browse	135.181.123.17
	1QdgB9Fzkr.exe	Get hash	malicious	Browse	168.119.226.10
	9paqej8Ylo.exe	Get hash	malicious	Browse	78.47.21.153
	oMHveSc3hh.exe	Get hash	malicious	Browse	88.99.66.31
	78kOrRdWh9.exe	Get hash	malicious	Browse	78.47.21.153
	4dTnSl6Sep.exe	Get hash	malicious	Browse	168.119.226.10
	DO0WQCeOtV.exe	Get hash	malicious	Browse	168.119.226.10
	WyrTHHtX7y.exe	Get hash	malicious	Browse	78.46.90.54
	stesta.exe	Get hash	malicious	Browse	116.203.98.109
	jWeEqpx4ts.exe	Get hash	malicious	Browse	176.9.20.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	ZTuZr7UXKB.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	ZA4AjogHLo.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	7iqFc3DymH.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	V1NzYOO8DX.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	LYyR4s55ga.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	Ftbf1ZqULE.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	XNXkvaIarc.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	oMHveSc3hh.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	0KuDEDABFO.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	B9ECF028C9852A52CD1006E34AF3ACB7F5A6A486796AB.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	7CED0B0A92826F1C1E453A75081436AFEF64CE3825885.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	miOnrvnXK0.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	Rh74sODsWE.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	dSQUdo6EjO.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	usVhwck8lN.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	MR98F1zzeo.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	reinsurance_security_agreement_canada_nosleep.js	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	reinsurance_security_agreement_canada_nosleep.js	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	15b65ccfeced9c5ae3359db9d3a0e68ad0201912b65a0.dll	Get hash	malicious	Browse	34.105.210.195 195.201.225.248
	ls7y1NUlhZ.exe	Get hash	malicious	Browse	34.105.210.195 195.201.225.248

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	ZA4AjogHLo.exe	Get hash	malicious	Browse
	V1NzYOO8DX.exe	Get hash	malicious	Browse
	oMHveSc3hh.exe	Get hash	malicious	Browse
	0KuDEDABFO.exe	Get hash	malicious	Browse
	miOnrvnXK0.exe	Get hash	malicious	Browse
	Rh74sODsWE.exe	Get hash	malicious	Browse
	dSQUdo6EjO.exe	Get hash	malicious	Browse
	usVhwck8lN.exe	Get hash	malicious	Browse
	MR98F1zzeo.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.31585.exe	Get hash	malicious	Browse
	4nMkjOOavk.exe	Get hash	malicious	Browse
	vmKNuRfDkr.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.46113648.15223.exe	Get hash	malicious	Browse
	filename.exe	Get hash	malicious	Browse
	riqZtDR8j7.exe	Get hash	malicious	Browse
	iIEubyMSNa.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.11439.exe	Get hash	malicious	Browse
	8amcrqPHLs.exe	Get hash	malicious	Browse
	Vok7h8vQau.exe	Get hash	malicious	Browse
	2fr18s8lrd.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\fLSulZLP2LP.zip Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	1190
Entropy (8bit):	7.519155299251266
Encrypted:	false
SSDEEP:	24:9/YnbAKvPpzuEXpvyy64EHDdp46/uyt1Uux/:9/YnMKpLXpv1eDdp46/htaQ/
MD5:	CABB6A6B9552D7F005ED9D88532F346B
SHA1:	64C587AFE04A9A2A3FC225AC0E9F4791C3DCD224
SHA-256:	D8AD79C1AE0CBC638E9E849D80CF986ABA81C8723B1FB7BB1D809DD85B803749
SHA-512:	890FDEE74C6972AF8D8EABD5C3AB8234979D6B444E261C1D1A6EB16C4A1A8D0AA8610EFAD739FE9D7695BF0FEBB3B238945FDC6B1064273E2E673114AFAD4383
Malicious:	false
Reputation:	low
Preview:	PK.........x.RH.._...........browsers/cookies/Google Chrome_Default.txtUT.....`..`..`%..r.0...5..hCR.a.E.."J}.N....WBu..~}.=..T...<j';~..........4...^.2..y...V...~..h....\|.2 }...9L@J..D=.F...^'......u.............i.%o.J1B...Fr..._.!.%..`....e:....Q;.~....x{.....O.PK.........x.R........Q.......System Info.txtUT.....`..`..`uS.n.0.}....h..6..OKnmw.JR....7.`dCo..!@/.EH.3g.gnk...............y..9.:W..J...,...1p.s...8......@V..#.'<..0/.".<8[n.......0..\|.xb...`..d..1..a.-.B.'Qr.......]...J.{.L.0...O..^:5.A+...t....!.A.L...w..u.......)..Y.e.....0/v.v...>.......{.:....'lL.?../M........S~.!.c.Q.=...N..o...^..e.. d....<.u..<..G.f4.k.lq.."6..]d......(.j....$+k.:..u..6...J..cx..^..:..U......v9...A.Y..N\|.g.0.q..r}..d..Y.`9.....9.Ne=c.Z..@...m....3...0....N.N.....CX...g.+.H..7Z.......]...y....%NI.........".......,".q.)...V..x.KY..X..#.....to.AaO...g.G.g...e.yp.....O._.._.QB.8c....b.wJRW.ca..*..3:o.{.<...iR;.S.p.Y......}..C..h.+.g.....

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123344
Entropy (8bit):	6.504957642040826
Encrypted:	false
SSDEEP:	1536:DkO/6RZFrpiS7ewflNGa35iOrjmwWTYP1KxBxZJByEJMBrsuLeLsWxcdaocACs0K:biRZFdBiussQ1MBjq2aocts03/7FE
MD5:	F92586E9CC1F12223B7EEB1A8CD4323C
SHA1:	F5EB4AB2508F27613F4D85D798FA793BB0BD04B0
SHA-256:	A1A2BB03A7CFCEA8944845A8FC12974482F44B44FD20BE73298FFD630F65D8D0
SHA-512:	5C047AB885A8ACCB604E58C1806C82474DC43E1F997B267F90C68A078CB63EE78A93D1496E6DD4F5A72FDF246F40EF19CE5CA0D0296BBCFCFA964E4921E68A2F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ZA4AjogHLo.exe, Detection: malicious, Browse Filename: V1NzYOO8DX.exe, Detection: malicious, Browse Filename: oMHveSc3hh.exe, Detection: malicious, Browse Filename: 0KuDEDABFO.exe, Detection: malicious, Browse Filename: miOnrvnXK0.exe, Detection: malicious, Browse Filename: Rh74sODsWE.exe, Detection: malicious, Browse Filename: dSQUdo6EjO.exe, Detection: malicious, Browse Filename: usVhwck8lN.exe, Detection: malicious, Browse Filename: MR98F1zzeo.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.31585.exe, Detection: malicious, Browse Filename: 4nMkjOOavk.exe, Detection: malicious, Browse Filename: vmKNuRfDkr.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.46113648.15223.exe, Detection: malicious, Browse Filename: filename.exe, Detection: malicious, Browse Filename: riqZtDR8j7.exe, Detection: malicious, Browse Filename: iIEubyMSNa.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.11439.exe, Detection: malicious, Browse Filename: 8amcrqPHLs.exe, Detection: malicious, Browse Filename: Vok7h8vQau.exe, Detection: malicious, Browse Filename: 2fr18s8lrd.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.Z.............x.......x.......x......=z......=z......=z.......x.......x..........z.../{....../{....../{....../{b...../{......Rich............PE..L...C@.\.........."!.................b.......0......................................~p....@.................................p...........h...........................0...T................... ...........@............0..$............................text...7........................... ..`.orpc........ ...................... ..`.rdata...y...0...z..................@..@.data...............................@....rsrc...h...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26064
Entropy (8bit):	5.981632010321345
Encrypted:	false
SSDEEP:	384:KuAjyb0Xc6JzVuLoW2XDOc3TXg1hjsvDG8A3OPLon07zS:BEygs6RV6oW2Xd38njiDG8Mj
MD5:	A7FABF3DCE008915CEE4FFC338FA1CE6
SHA1:	F411FB41181C79FBA0516D5674D07444E98E7C92
SHA-256:	D368EB240106F87188C4F2AE30DB793A2D250D9344F0E0267D4F6A58E68152AD
SHA-512:	3D2935D02D1A2756AAD7060C47DC7CABBA820CC9977957605CE9BBB44222289CBC451AD331F408317CF01A1A4D3CF8D9CFC666C4E6B4DB9DDD404C7629CEAA70
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S......U...U...U...U...U..T...U..T...U..T...U..T...U5.T...U...U!..U..T...U..T...U...U...U..T...URich...U........PE..L...<@.\.........."!.........8......0........0.......................................7....@..........................=......0>..x....`...............H..........<...09..T............................9..@............0...............................text...f........................... ..`.orpc........ ...................... ..`.rdata.......0......................@..@.data...@....P.......(..............@....rsrc........`.......*..............@..@.reloc..<............D..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70608
Entropy (8bit):	5.389701090881864
Encrypted:	false
SSDEEP:	768:3n8PHF564hn4wva3AVqH5PmE0SjA6QM0avrDG8MR43:38th4wvaQVE5PRl0xs
MD5:	5243F66EF4595D9D8902069EED8777E2
SHA1:	1FB7F82CD5F1376C5378CD88F853727AB1CC439E
SHA-256:	621F38BD19F62C9CE6826D492ECDF710C00BBDCF1FB4E4815883F29F1431DFDA
SHA-512:	A6AB96D73E326C7EEF75560907571AE9CAA70BA9614EB56284B863503AF53C78B991B809C0C8BAE3BCE99142018F59D42DD4BCD41376D0A30D9932BCFCAEE57A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.....K...K...K.g.K...K4}.J...K4}.J...K4}.J...K4}.J...K...J...K...J...K...K...K&\|.J...K&\|.J...K&\|uK...K&\|.J...KRich...K........PE..L...J@.\.........."!.................$.......0...............................0............@.........................0z.......z...........v................... .......u..T...........................Hv..@............0...............................orpc...t........................... ..`.text........ ...................... ..`.rdata...Q...0...R..................@..@.data................j..............@....rsrc....v.......x...t..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117712
Entropy (8bit):	6.598338256653691
Encrypted:	false
SSDEEP:	3072:9b9ffsTV5n8cSQQtys6FXCVnx+IMD6eN07e:P25V/QQs6WTMex7e
MD5:	A436472B0A7B2EB2C4F53FDF512D0CF8
SHA1:	963FE8AE9EC8819EF2A674DBF7C6A92DBB6B46A9
SHA-256:	87ED943D2F06D9CA8824789405B412E770FE84454950EC7E96105F756D858E52
SHA-512:	89918673ADDC0501746F24EC9A609AC4D416A4316B27BF225974E898891699B630BB18DB32432DA2F058DC11D9AF7BAF95D067B29FB39052EE7C6F622718271B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..y7.{7.{7.{..x+>.{..~+I.{...+%.{.x+$.{..+'.{.~+..{..z+4.{7.zA.{..~+>.{..{+6.{...6.{..y+6.{Rich7.{........PE..L....@.\.........."!................t........0.......................................S....@.........................P...P.......(...................................`...T...............................@............0..D............................text............................... ..`.rdata...l...0...n... ..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.808908775107082
Encrypted:	false
SSDEEP:	6144:6cYBCU/bEPU6Rc5xUqc+z75nv4F0GHrIraqqDL6XPSed:67WRCB7zl4F0I4qn6R
MD5:	60ACD24430204AD2DC7F148B8CFE9BDC
SHA1:	989F377B9117D7CB21CBE92A4117F88F9C7693D9
SHA-256:	9876C53134DBBEC4DCCA67581F53638EBA3FEA3A15491AA3CF2526B71032DA97
SHA-512:	626C36E9567F57FA8EC9C36D96CBADEDE9C6F6734A7305ECFB9F798952BBACDFA33A1B6C4999BA5B78897DC2EC6F91870F7EC25B2CEACBAEE4BE942FE881DB01
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....@.\.........."!.........f...............................................p............@.........................p...P............@..x....................P......0...T...............................@...............8............................text...d........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132048
Entropy (8bit):	6.627391684128337
Encrypted:	false
SSDEEP:	3072:qgXCFTvwqiiynFa6zqeqQZ06DdEH4sq9gHNaIkIQhEwe:qdvwqMFbOePIP/zkIQ2h
MD5:	5A49EBF1DA3D5971B62A4FD295A71ECF
SHA1:	40917474EF7914126D62BA7CDBF6CF54D227AA20
SHA-256:	2B128B3702F8509F35CAD0D657C9A00F0487B93D70336DF229F8588FBA6BA926
SHA-512:	A6123BA3BCF9DE6AA8CE09F2F84D6D3C79B0586F9E2FD0C8A6C3246A91098099B64EDC2F5D7E7007D24048F10AE9FC30CCF7779171F3FD03919807EE6AF76809
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q...?S..?S..?S..S..?S\|.>R..?S;..S..?S\|.<R..?S\|.:R..?S\|.;R..?S..>R..?S..>S..?Sn.;R.?Sn.?R..?Sn..S..?Sn.=R..?SRich..?S........................PE..L....@.\.........."!.........f...... ........................................0............@.............................................x.................... ......p...T..............................@...............\............................text...:........................... ..`.rdata...@.......B..................@..@.data...l...........................@....rsrc...x...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20432
Entropy (8bit):	6.337521751154348
Encrypted:	false
SSDEEP:	384:YxfML3ALxK0AZEuzOJKRsIFYvDG8A3OPLonw4S:0fMmxFyO4RpGDG8MjS
MD5:	4FE544DFC7CDAA026DA6EDA09CAD66C4
SHA1:	85D21E5F5F72A4808F02F4EA14AA65154E52CE99
SHA-256:	3AABBE0AA86CE8A91E5C49B7DE577AF73B9889D7F03AF919F17F3F315A879B0F
SHA-512:	5C78C5482E589AF7D609318A6705824FD504136AEAAC63F373E913DA85FA03AF868669534496217B05D74364A165D7E08899437FCC0E3017F02D94858BA814BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..j..j..j...j..j^..k..j^..k..j^..k..j^..k..j...k..j..j..jL..k..jL..k..jL.bj..jL..k..jRich..j........................PE..L....<.\.........."!................Y........0...............................p......r.....@..........................5.......6.......P..x............2.......`..x....0..T...........................(1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc...x....P.......,..............@..@.reloc..x....`.......0..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55760
Entropy (8bit):	6.738700405402967
Encrypted:	false
SSDEEP:	1536:LxsBS3Q6j+37mWT7DT/GszGrn7iBCmjFCOu:LxTBcmWT7X/Gszen7icmjFtu
MD5:	56E982D4C380C9CD24852564A8C02C3E
SHA1:	F9031327208176059CD03F53C8C5934C1050897F
SHA-256:	7F93B70257D966EA1C1A6038892B19E8360AADD8E8AE58E75EBB0697B9EA8786
SHA-512:	92ADC4C905A800F8AB5C972B166099382F930435694D5F9A45D1FDE3FEF94FAC57FD8FAFF56FFCFCFDBC61A43E6395561B882966BE0C814ECC7E672C67E6765A
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........l...l...l.......l..~....l..9...l..~....l..~....l..~....l.......l..l....l...l...l...l...l..l....l..l....l..l....l..l..l..l....l..Rich.l..........................PE..L...z@.\.........."!.........2......................................................t.....@...........................................x...............................T...............................@............................................text.............................. ..`.rdata..>...........................@..@.data...............................@....rodata.8...........................@..@.rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22480
Entropy (8bit):	6.528357540966124
Encrypted:	false
SSDEEP:	384:INZ9mLVDAffJJKAtn0mLAb8X3FbvDG8A3OPLonzvGb:4mx+fXvn4YFrDG8MKb
MD5:	96B879B611B2BBEE85DF18884039C2B8
SHA1:	00794796ACAC3899C1FB9ABBF123FEF3CC641624
SHA-256:	7B9FC6BE34F43D39471C2ADD872D5B4350853DB11CC66A323EF9E0C231542FB9
SHA-512:	DF8F1AA0384A5682AE47F212F3153D26EAFBBF12A8C996428C3366BEBE16850D0BDA453EC5F4806E6A62C36D312D37B8BBAFF549968909415670C9C61A6EC49A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N{.N{.N{.6..N{.F,z.N{.F,x.N{.F,~.N{.F,..N{..z.N{.T-z.N{.Nz..N{.T-~.N{.T-{.N{.T-..N{.T-y.N{.Rich.N{.........................PE..L...aA.\.........."!.........(............... ...............................p......~.....@..........................%..........d....P..x............:.......`.......!..T............................"..@............ ...............................text... ........................... ..`.rdata....... ......................@..@.data........@.......2..............@....rsrc...x....P.......4..............@..@.reloc.......`.......8..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.784614237836286
Encrypted:	false
SSDEEP:	3072:Z6s2DIGLXlNJJcPoN0j/kVqhp1qt/TXTv7q1D2JJJvPhrSeXZ5dR:MszGLXlNrE/kVqhp12/TXTjSD2JJJvPt
MD5:	EAE9273F8CDCF9321C6C37C244773139
SHA1:	8378E2A2F3635574C106EEA8419B5EB00B8489B0
SHA-256:	A0C6630D4012AE0311FF40F4F06911BCF1A23F7A4762CE219B8DFFA012D188CC
SHA-512:	06E43E484A89CEA9BA9B9519828D38E7C64B040F44CDAEB321CBDA574E7551B11FEA139CE3538F387A0A39A3D8C4CBA7F4CF03E4A3C98DB85F8121C2212A9097
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...{>.\.........."!.....z...................................................@......j.....@A........................@...t.......,.... ..x....................0..l.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..l....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\msvcp140.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nss3.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245136
Entropy (8bit):	6.766715162066988
Encrypted:	false
SSDEEP:	24576:ido5Js2a56/+VwJebKj5KYFsRjzx5ZxKV6D1Z4Go/LCiytoxq2Zwn5hCM4MSRdY8:Q2aY4w6aozx5ZWMM7yew8MSRK1y
MD5:	02CC7B8EE30056D5912DE54F1BDFC219
SHA1:	A6923DA95705FB81E368AE48F93D28522EF552FB
SHA-256:	1989526553FD1E1E49B0FEA8036822CA062D3D39C4CAB4A37846173D0F1753D5
SHA-512:	0D5DFCF4FB19B27246FA799E339D67CD1B494427783F379267FB2D10D615FFB734711BAB2C515062C078F990A44A36F2D15859B1DACD4143DCC35B5C0CEE0EF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.4.'.Z.'.Z.'.Z.....3.Z...[.%.Z.B..#.Z...Y.*.Z..._.-.Z...^.,.Z...[./.Z..[.$.Z.'.[...Z..^.-.Z..Z.&.Z...&.Z..X.&.Z.Rich'.Z.........................PE..L....@.\.........."!.........................................................@......Q.....@................................x=..T.......p........................\|......T...........................h...@............................................text............................... ..`.rdata...Q.......R..................@..@.data...tG...`..."...>..............@....rsrc...p............`..............@..@.reloc...\|.......~...d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336336
Entropy (8bit):	7.0315399874711995
Encrypted:	false
SSDEEP:	6144:8bndzEL04gF85K9autIMyEhZ/V3psPyHa9tBe1:8bndzEL04pnutIMyAp2z9tBe1
MD5:	BDAF9852F588C86B055C846B53D4C144
SHA1:	03B739430CF9EADE21C977B5B416C4DD94528C3B
SHA-256:	2481DA1C459A2429A933D19AD6AE514BD2AE59818246DDB67B0EF44146CED3D8
SHA-512:	19D9A952A3DF5703542FA52A5A780C2E04D6A132059F30715954EAC40CD1C3F3B119A29736D4A911BE85086AFE08A54A7482FA409DFD882BAC39037F9EECD7EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pi.Pi.Pi.(..Pi.F2h.Pi.F2j.Pi.F2l.Pi.F2m.Pi.0h.Pi.T3h.Pi.Ph.Pi.T3m.Pi.T3i.Pi.T3..Pi.T3k.Pi.Rich.Pi.........PE..L....@.\.........."!.........`......q........................................@...........@.............................P.......d.......x.......................t)..p...T..............................@............................................text.............................. ..`.rdata..>...........................@..@.data....N.......L..................@....rsrc...x...........................@..@.reloc..t).......*..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639527605275762
Encrypted:	false
SSDEEP:	1536:YvNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41Pc:+NGVOiBZbcGmxXMcBqmzoCUZoZebHPAT
MD5:	94919DEA9C745FBB01653F3FDAE59C23
SHA1:	99181610D8C9255947D7B2134CDB4825BD5A25FF
SHA-256:	BE3987A6CD970FF570A916774EB3D4E1EDCE675E70EDAC1BAF5E2104685610B0
SHA-512:	1A3BB3ECADD76678A65B7CB4EBE3460D0502B4CA96B1399F9E56854141C8463A0CFCFFEDF1DEFFB7470DDFBAC3B608DC10514ECA196D19B70803FBB02188E15E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L....@.\.........."!.........0...............0......................................*q....@......................... ?......(@.......`..x............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..D....0... ..................@..@.data........P.......>..............@....rsrc...x....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\pY4zE3fX7h.zip Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	2828315
Entropy (8bit):	7.998625956067725
Encrypted:	true
SSDEEP:	49152:tiGLaX5/cgbRETlc0EqgSVAx07XZiEi4qiefeEJGt5ygL0+6/qax:t9OX9alwJSVP1fnefekGt5CP
MD5:	1117CD347D09C43C1F2079439056ADA3
SHA1:	93C2CE5FC4924314318554E131CFBCD119F01AB6
SHA-256:	4CFADA7EB51A6C0CB26283F9C86784B2B2587C59C46A5D3DC0F06CAD2C55EE97
SHA-512:	FC3F85B50176C0F96898B7D744370E2FF0AA2024203B936EB1465304C1C7A56E1AC078F3FDF751F4384536602F997E745BFFF97F1D8FF2288526883185C08FAF
Malicious:	false
Preview:	PK.........znN<..{r....i......nssdbm3.dll...\|...8...N..Y..6.$J.....$1...D .a.....jL.V..C...N.;....}./............$...Z,T.R.qc...Ec.=................;..{..s....p.`..A.?M.....W!.....a..?N...~e.A..W.o.....[.}...,...;.+\....Jw.\|...k.......<yR.^.E.o.nxs.c...=V....,..F....cu.....w.O..[..u.{..<.w....7P...{..K~..E..w...c...z^..[Z....6.G.V.2..+.n4......1M.......w{f..nJL..{. d......M..+.. ......./.)..$X!......L..K.`.M...w.I..LA8r.IX...r...87..}........<.].r.....TWm......b6/._....a..W.lB...3.n.._...j....o.Mz.._Q........8....K............gr..L..H...v....6[...4I...{.1g..<..>M..$G.&Y........-.....O..9\...,t..W.m.X ..Y.3....S<#}.".>.0RBg,...lh.s..o.....r.p8...)..3..K.v....ds.n3.+]....+....krMu._.Y\..../8T......&.BC.".u..;..e.k u$......~`.{.!.M...\W.Y.37+nQ.Z.*...3\G..5d....Z.hVL..Z.\|k.5...XF.Y..lVVW..C..\|.....b..\.Z...m. ..0...P.F8{].U.p..RW,n...MM.....s..._@..>Q.. ...N.>.T?WM....)9B.............mVW.......b.6{..\|!......O....M....>.>.$\.%..L.zF.l...3

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24016
Entropy (8bit):	6.532540890393685
Encrypted:	false
SSDEEP:	384:TQJMOeAdiNcNUO3qgpw6MnTmJk0llEEHAnDl3vDG8A3OPLondJJs2z:KMaNqb6MTmVllEK2p/DG8MlsQ
MD5:	6099C438F37E949C4C541E61E88098B7
SHA1:	0AD03A6F626385554A885BD742DFE5B59BC944F5
SHA-256:	46B005817868F91CF60BAA052EE96436FC6194CE9A61E93260DF5037CDFA37A5
SHA-512:	97916C72BF75C11754523E2BC14318A1EA310189807AC8059C5F3DC1049321E5A3F82CDDD62944EA6688F046EE02FF10B7DDF8876556D1690729E5029EA414A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:`wq[.$q[.$q[.$x#.$s[.$.9.%s[.$.9.%p[.$.9.%{[.$.9.%z[.$S;.%s[.$.8.%t[.$q[.$=[.$.8.%t[.$.8.%p[.$.8.$p[.$.8.%p[.$Richq[.$........PE..L....@.\.........."!..... ... .......%.......0...............................p......./....@..........................5......p7..x....P..x............@.......`..$...`1..T............................1..@............0..,............................text...2........ .................. ..`.rdata.......0.......$..............@..@.data...4....@.......4..............@....rsrc...x....P.......8..............@..@.reloc..$....`.......<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.437762295038996
Encrypted:	false
SSDEEP:	192:aPgr1ZCb2vGJ7b20qKvFej7x0KDWpH3vUA397Ae+PjPonZwC7Qm:aYpZPGJP209F4vDG8A3OPLonZwC7X
MD5:	F3A355D0B1AB3CC8EFFCC90C8A7B7538
SHA1:	1191F64692A89A04D060279C25E4779C05D8C375
SHA-256:	7A589024CF0EEB59F020F91BE4FE7EE0C90694C92918A467D5277574AC25A5A2
SHA-512:	6A9DB921156828BCE7063E5CDC5EC5886A13BD550BA8ED88C99FA6E7869ECFBA0D0B7953A4932EB8381243CD95E87C98B91C90D4EB2B0ACD7EE87BE114A91A9E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s6.7W..7W..7W..>/..5W...5..5W...5..6W...5..>W...5..<W...7..4W..7W..*W...4..6W...4`.6W...4..6W..Rich7W..................PE..L....B.\.........."!......................... ...............................`.......r....@..................................$..P....@..x............".......P.. .... ..T............................ ..@............ ..h............................text...P........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...x....@......................@..@.reloc.. ....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.54005414297208
Encrypted:	false
SSDEEP:	3072:8Af6suip+I7FEk/oJz69sFaXeu9CoT2nIVFetBW3D2xkEMk:B6POsF4CoT2OeYMzMk
MD5:	4E8DF049F3459FA94AB6AD387F3561AC
SHA1:	06ED392BC29AD9D5FC05EE254C2625FD65925114
SHA-256:	25A4DAE37120426AB060EBB39B7030B3E7C1093CC34B0877F223B6843B651871
SHA-512:	3DD4A86F83465989B2B30C240A7307EDD1B92D5C1D5C57D47EFF287DC9DAA7BACE157017908D82E00BE90F08FF5BADB68019FFC9D881440229DCEA5038F61CD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....@.\.........."!.........b...............................................P.......\|....@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ucrtbase.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\vcruntime140.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\machineinfo.txt Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	1105
Entropy (8bit):	5.280497211893236
Encrypted:	false
SSDEEP:	24:DlAP4H/l3ezy53Net5ITLdBqhKQa7pCGik/R8RAuLTvqzh:BAA93d3NetGRBgUCGik/R0As0h
MD5:	10C30BC9E516DD423ACDD22DCD4E4075
SHA1:	3B9B96C5E6DC89442A635E73542C091FB8D76764
SHA-256:	4411A7C6D8CB4B9CCBDAD04428E55484BCC13E793AB1B72C0459CFE2B645ECD0
SHA-512:	41CF85A7A5786FF70B1D6AFCF2AE5E2FEB7C91496DEB79057645B86231D908884591F876638BF7E1F93294ABDCEE343462E1F5F8734AD950FAA26218C7D00AE5
Malicious:	false
Preview:	Raccoon \| 1.7.3...Build compile date: Sat Feb 27 21:25:06 2021...Launched at: 2021.04.26 - 13:05:33 GMT...Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user...Running on a desktop......-------------...... - Cookies: 1... - Passwords: 0... - Files: 0......System Information:... - System Language: English... - System TimeZone: +1 hrs... - IP: 84.17.52.3... - Location: 47.431702, 8.575900 \| Zurich, Zurich, Switzerland (8152)... - ComputerName: 830021... - Username: user... - Windows version: NT 10.0... - Product name: Windows 10 Pro... - System arch: x64... - CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)... - RAM: 8191 MB (5446 MB used)... - Screen resolution: 1280x1024... - Display devices:....0) Microsoft Basic Display Adapter......-------------......Installed Apps: ....Adobe Acrobat Reader DC (19.012.20035)....Adobe Refresh Manager (1.8.0)....Google Chrome (85.0.4183.121)....Google Update Helper (1.3.35.451)....Java 8 Update 211 (8.0.2110.12)....Java Auto Updat

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\Desktop\7SlKt2Puui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

\Device\Null Download File
Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.300553674183507
Encrypted:	false
SSDEEP:	3:hYFEHgARcWmFsFJQZtctFst3g4t32vov:hYFE1mFSQZi3MXt3X
MD5:	F74899957624A2837F2F86E8E62E92D4
SHA1:	1FCDAC5DEC5B0B1E00CF0247DA2A5F18566F1431
SHA-256:	507992A303C447D1D40D36E2E5163A237077B94F23A7089AC90A2F08682AE9BC
SHA-512:	E3FD14728633614B6552A75C15079AC8B04C0E8B3F49535B522C73312B1C812E30A934099AB18B507A0B4878068987D5545E90FA3747F7E7B10360EE324DB435
Malicious:	false
Preview:	..Waiting for 10 seconds, press CTRL+C to quit ..... 9.. 8.. 7.. 6.. 5.. 4.. 3.. 2.. 1.. 0..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.486952699068212
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	7SlKt2Puui.exe
File size:	606720
MD5:	9013a8b3f9a8adecf2ff25377f525748
SHA1:	b066eb77a5000579f3836291bfb2c2c334c8a84e
SHA256:	a21b6b2e6336efdfe470806c0d615ede9acacd44ab317ce7e4c59cfb8de1619f
SHA512:	7668f8d9c699215c193413ef46061643f0c57742ea0af45a9e1255f0ac2f4c26337cd84c9e75c656037df839d415461b2528c066519de1da1c834c71db5490f8
SSDEEP:	12288:jxcxfyH0NhCm46o2eR0hoC0c4vq6vRLhQYRWrHpa:V/HWUB6403Nwv9hRWrJa
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...`..^...

File Icon


Icon Hash:	c4f4b0c8e248f0f0

Static PE Info

General
Entrypoint:	0x40628c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5EABD460 [Fri May 1 07:48:48 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3855fccc656232f4e1f7569ec166b0f9

Entrypoint Preview

Instruction
call 00007F02B8A13347h
jmp 00007F02B8A0EFDEh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F02B8A0F186h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F02B8A0F1B0h
test ecx, 00000003h
jne 00007F02B8A0F151h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F02B8A0F14Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F02B8A0F194h
test ah, ah
je 00007F02B8A0F186h
test eax, 00FF0000h
je 00007F02B8A0F175h
test eax, FF000000h
je 00007F02B8A0F164h
jmp 00007F02B8A0F12Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00475338h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F02B8A0F16Eh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x79194	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x470000	0x19580	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x75230	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x78050	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75000	0x1e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x73b36	0x73c00	False	0.849455402943	data	7.80824497107	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x75000	0x4cc4	0x4e00	False	0.40875400641	COM executable for DOS	5.45686563822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7a000	0x3f3cdc	0x1a00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.xozoxew	0x46e000	0x1001	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x470000	0x19580	0x19600	False	0.47185768165	data	5.4404439791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x486758	0x2	data	Spanish	Chile
CUZOPECADUDONAGUJOVENEKOCUZEVO	0x4843a8	0x6c5	ASCII text, with very long lines, with no line terminators	Spanish	Chile
DAKALAMOXITILAWOZEXUGELE	0x485cf0	0x3d8	ASCII text, with very long lines, with no line terminators	Spanish	Chile
FUCUTI	0x484a70	0x127b	ASCII text, with very long lines, with no line terminators	Spanish	Chile
WIPUJAXECUMAWEYENANIWOFOPOPA	0x4860c8	0x5c6	ASCII text, with very long lines, with no line terminators	Spanish	Chile
RT_CURSOR	0x486760	0x130	data	Spanish	Chile
RT_CURSOR	0x486890	0xf0	data	Spanish	Chile
RT_CURSOR	0x486980	0x10a8	dBase III DBT, version number 0, next free block index 40	Spanish	Chile
RT_CURSOR	0x487a58	0xea8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Spanish	Chile
RT_CURSOR	0x488900	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Spanish	Chile
RT_ICON	0x470b00	0xea8	data	English	United States
RT_ICON	0x4719a8	0x8a8	data	English	United States
RT_ICON	0x472250	0x6c8	data	English	United States
RT_ICON	0x472918	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x472e80	0x25a8	data	English	United States
RT_ICON	0x475428	0x10a8	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x4764d0	0x988	data	English	United States
RT_ICON	0x476e58	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x477338	0xea8	data	English	United States
RT_ICON	0x4781e0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 5083694, next used block 13497278	English	United States
RT_ICON	0x478a88	0x6c8	data	English	United States
RT_ICON	0x479150	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x4796b8	0x25a8	data	English	United States
RT_ICON	0x47bc60	0x10a8	data	English	United States
RT_ICON	0x47cd08	0x988	data	English	United States
RT_ICON	0x47d690	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x47db70	0xea8	data	English	United States
RT_ICON	0x47ea18	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 8549961, next used block 327941	English	United States
RT_ICON	0x47f2c0	0x6c8	data	English	United States
RT_ICON	0x47f988	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x47fef0	0x25a8	data	English	United States
RT_ICON	0x482498	0x10a8	data	English	United States
RT_ICON	0x483540	0x988	data	English	United States
RT_ICON	0x483ec8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_STRING	0x489318	0x266	data	Spanish	Chile
RT_ACCELERATOR	0x486690	0x78	data	Spanish	Chile
RT_GROUP_CURSOR	0x487a28	0x30	data	Spanish	Chile
RT_GROUP_CURSOR	0x4891a8	0x22	data	Spanish	Chile
RT_GROUP_ICON	0x4772c0	0x76	data	English	United States
RT_GROUP_ICON	0x47daf8	0x76	data	English	United States
RT_GROUP_ICON	0x484330	0x76	data	English	United States
RT_VERSION	0x4891d0	0x144	data	Spanish	Chile
None	0x486718	0xa	data	Spanish	Chile
None	0x486728	0xa	data	Spanish	Chile
None	0x486708	0xa	data	Spanish	Chile
None	0x486738	0xa	data	Spanish	Chile
None	0x486748	0xa	data	Spanish	Chile

Imports

DLL

Import

KERNEL32.dll

FileTimeToDosDateTime, SetThreadContext, lstrlenA, SetLocalTime, BuildCommDCBAndTimeoutsA, FreeLibrary, CallNamedPipeA, SystemTimeToTzSpecificLocalTime, SetWaitableTimer, SetUnhandledExceptionFilter, LoadLibraryExW, GetNumberOfConsoleMouseButtons, GlobalSize, GetProfileSectionA, WriteConsoleInputA, GetComputerNameW, GetProcessPriorityBoost, WriteFile, GetCommandLineA, TlsSetValue, GlobalAlloc, LoadLibraryW, GetConsoleMode, TerminateThread, Sleep, GetSystemPowerStatus, SetSystemTimeAdjustment, SetVolumeMountPointA, DeleteVolumeMountPointW, GetFileAttributesA, Beep, GetBinaryTypeA, GetTimeZoneInformation, lstrcatA, GetACP, DisconnectNamedPipe, InterlockedExchange, GetStdHandle, OpenMutexW, GetHandleInformation, GetLastError, GetCurrentDirectoryW, SetLastError, HeapSize, CreateNamedPipeA, MoveFileW, LocalAlloc, BuildCommDCBAndTimeoutsW, SetCommMask, GetOEMCP, CreateIoCompletionPort, DebugBreakProcess, CreateMutexA, VirtualProtect, GetSystemTime, GetVolumeInformationW, SetEnvironmentVariableA, CompareStringW, DeleteFileA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, HeapReAlloc, HeapAlloc, GetStartupInfoW, RaiseException, RtlUnwind, HeapFree, GetModuleHandleW, GetProcAddress, TlsGetValue, TlsAlloc, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, GetCurrentThread, DeleteCriticalSection, LeaveCriticalSection, FatalAppExitA, EnterCriticalSection, HeapCreate, HeapDestroy, VirtualFree, VirtualAlloc, ExitProcess, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, IsValidCodePage, InitializeCriticalSectionAndSpinCount, SetConsoleCtrlHandler, LoadLibraryA, GetTimeFormatA, GetDateFormatA, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, LCMapStringA, WideCharToMultiByte, LCMapStringW, GetLocaleInfoW, CompareStringA, GetModuleHandleA

USER32.dll

GetWindowInfo

Version Infos

Description	Data
ProductVersus	1.8.37.29
FileVerus	1.0.52.18
Translations	0x0286 0x00be

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Chile
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2021 15:03:56.331404924 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:56.401154995 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.401252985 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:56.405504942 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:56.475251913 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.478666067 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.478718042 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.478743076 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.478869915 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:56.484327078 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:56.554487944 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.627983093 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:56.738431931 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.750787020 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.750828028 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.750864983 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.750886917 CEST	443	49736	195.201.225.248	192.168.2.4
Apr 26, 2021 15:03:56.750993967 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:56.751022100 CEST	49736	443	192.168.2.4	195.201.225.248
Apr 26, 2021 15:03:57.141021967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:57.194391012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.194489002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:57.195338964 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:57.248517990 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.249526024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.249569893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.249597073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.250109911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:57.263313055 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:57.318809986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.318892002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.326822996 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:57.329425097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:57.380084991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:57.382889032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.246601105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.269045115 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:58.323283911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946877956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946897984 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946914911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946930885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946947098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946958065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:58.946964025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946980953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.946996927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.947005033 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:58.947017908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.947045088 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:58.947590113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:58.947633982 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000097036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000113964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000130892 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000145912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000163078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000179052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000197887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000215054 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000245094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000358105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000375032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000395060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000403881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000413895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000430107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000442028 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000447989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000464916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000480890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000488997 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000515938 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000606060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000624895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000642061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000650883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000658035 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000690937 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.000951052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.000996113 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053394079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053421021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053436995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053452969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053468943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053479910 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053488016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053504944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053509951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053533077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053543091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053553104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053571939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053587914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053597927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053606987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053625107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053641081 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053641081 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053661108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053670883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053682089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053697109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053700924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053718090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053726912 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053735971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053752899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053762913 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053800106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053915977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053939104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053957939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053973913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.053987026 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.053991079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054009914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054018021 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054028034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054044008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054052114 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054080009 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054264069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054281950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054299116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054317951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054337025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054347038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054353952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054372072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054382086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054388046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054433107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054439068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054446936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054465055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054481983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054501057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.054521084 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.054557085 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.106910944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.106935024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.106950998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.106967926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.106983900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.106997013 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107000113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107017040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107049942 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107100964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107120037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107136965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107153893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107165098 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107183933 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107206106 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107223988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107239008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107250929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107259989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107278109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107280016 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107306957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107323885 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107323885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107342958 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107358932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107374907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107394934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107402086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107413054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107420921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107430935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107469082 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107474089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107491970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107498884 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107510090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107527018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107534885 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107543945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107559919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107563019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107578993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107600927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107601881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107620001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107636929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107654095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107670069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107678890 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107685089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107702971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107718945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107737064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107748985 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.107754946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.107779980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.121445894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121469975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121488094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121504068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121519089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.121562004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.121587038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121604919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121624947 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121643066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.121728897 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.121738911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.161995888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162019014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162034988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162084103 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.162142992 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.162194014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162213087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162257910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162264109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.162275076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162316084 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.162374020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162393093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162436008 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.162491083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162508011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162524939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162550926 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.162656069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162673950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162689924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.162703991 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.162738085 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163037062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163058043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163075924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163091898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163108110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163125038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163129091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163141966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163158894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163176060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163175106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163194895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163206100 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163213968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163232088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163235903 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163249016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163265944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163284063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163286924 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163300991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163317919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163335085 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163338900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163357019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163367987 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163372993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163391113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163398981 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163408995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163424015 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163425922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163444042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.163465977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.163500071 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.171701908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.171726942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.171823978 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.176697016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176714897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176731110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176747084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176763058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176772118 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.176781893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176799059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176819086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.176822901 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.176851034 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.176877022 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.177951097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215322971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215346098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215418100 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.215488911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215507984 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215527058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215540886 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.215544939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215564966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215580940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215590000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.215634108 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.215778112 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215795040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215816021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215826035 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.215836048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215869904 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.215888977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215905905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.215934038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216514111 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216533899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216573954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216583014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216603041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216619968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216626883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216638088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216660023 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216667891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216686010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216716051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216726065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216733932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216764927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216798067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216814995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216830969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216845989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216850042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216869116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216876984 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216886044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216903925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216921091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216933966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216950893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216953993 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.216969013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.216989040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.217006922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.217011929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.217025042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.217041969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.217051029 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.217091084 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.225095987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.225117922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.225133896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.225164890 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.225199938 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.230031013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230048895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230066061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230082989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230098963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230114937 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230132103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230164051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.230195999 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.230218887 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.230225086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268588066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268615961 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268632889 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268650055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268666029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268682003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268711090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268734932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268750906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268754005 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268768072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268779993 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268785000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268785954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268805027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268811941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268822908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268851995 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268860102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268893003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268908978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268927097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268944025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268950939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268955946 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.268961906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268979073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.268997908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269015074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269022942 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269027948 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269032001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269049883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269066095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269081116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269095898 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269100904 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269221067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269239902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269241095 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269258022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269274950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269289970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269305944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269344091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269355059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269397974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269418001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269434929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269454956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269463062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269469976 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269474030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269491911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269504070 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269824982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269843102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269855022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269866943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269881964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269895077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269906998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269910097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269922018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269939899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269958973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269969940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.269975901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.269998074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270015955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270032883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270050049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270066023 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270066023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270071983 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270086050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270102978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270121098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270129919 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270136118 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270140886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270160913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270179033 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270190001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270195007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270196915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270215034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270231962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270250082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270266056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270272970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270278931 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270287037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270306110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270322084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270338058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270349026 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270354033 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270354986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270373106 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270390034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270402908 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270406008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270409107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270426989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270445108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270459890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270477057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270477057 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270482063 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270493984 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270509958 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270528078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270543098 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270544052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270550013 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270566940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270585060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270601034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270618916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270629883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270634890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270636082 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270653009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270668983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.270692110 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270698071 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.270746946 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.271264076 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.271626949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.271644115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.272002935 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.274930000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.278275013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283215046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283236027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283252954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283269882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283287048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283303022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283318996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283339024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283349991 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.283356905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283366919 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.283373117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.283402920 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.283411026 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.321959972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.321978092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.321995020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322016001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322145939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322268963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322382927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322402954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322418928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322436094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322452068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322453976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322464943 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322474003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322491884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322509050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322530031 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322546959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322560072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322566032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322566986 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322582006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322599888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322612047 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322622061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322639942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322657108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322673082 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322674036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322693110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322709084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322726011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322738886 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322741985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322753906 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322762966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322781086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322782993 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322798014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322814941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322830915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322848082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322865009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322880030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322900057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.322911024 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.322962046 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.323641062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323662043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323678970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323693991 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.323694944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323714018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323726892 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.323740005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323757887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323775053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323792934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323795080 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.323811054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323827028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323841095 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.323843956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323863029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323884010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323904037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323919058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323921919 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.323929071 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.323937893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323960066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323975086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.323992014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324007988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324007988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324014902 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324026108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324043036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324059963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324064016 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324081898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324100018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324122906 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324130058 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324249029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324269056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324286938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324301004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324304104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324322939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324341059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324361086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324363947 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324383020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324400902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324400902 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324419022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324436903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324454069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324460983 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324470043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324486971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324506044 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324507952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324510098 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324527025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324543953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324559927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324575901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324588060 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324593067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324610949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324626923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324631929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324647903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324665070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.324697018 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324703932 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.324883938 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.328011036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.328030109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.328047037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.328063965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.328079939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.328099012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.328115940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.328120947 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.328145981 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.330008984 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336457014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336488962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336508036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336524963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336540937 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336558104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336560011 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336575985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336596012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336612940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336632013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336651087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336652040 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336658001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336668015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336684942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336702108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336704969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336719036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336735964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336752892 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336766005 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336771011 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336772919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336791992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336807013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336823940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336828947 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336833954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336843967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336859941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336878061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336894989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336915016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336927891 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336932898 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.336932898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336951971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336967945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336985111 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.336999893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337013006 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337018013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337019920 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337034941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337055922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337070942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337088108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337104082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337120056 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337121010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337125063 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337138891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337156057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337172985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337193012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337207079 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337210894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337210894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337232113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337248087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337265015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337281942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337297916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337301970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337307930 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337315083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337335110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337353945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337363005 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337367058 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337371111 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337410927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337420940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337428093 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337429047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337446928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337464094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337481022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337496996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337515116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337517023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337519884 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337537050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337553024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337570906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337585926 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337589025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337591887 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337606907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337622881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337641001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337650061 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337655067 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337662935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337681055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337697983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337716103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337732077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337739944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337744951 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337748051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337766886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337783098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337802887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337811947 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337821007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337825060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337842941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337858915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337860107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337863922 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337876081 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337892056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337908030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337912083 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337917089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337924957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337944984 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337961912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337977886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337991953 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.337994099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.337997913 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338011980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338028908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338044882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338047028 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338052034 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338063002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338083029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338099957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338115931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338121891 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338125944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338134050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338150024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338165045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338181019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338191032 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338197947 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338198900 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338217974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338236094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338246107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338251114 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338252068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338269949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338287115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338301897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338318110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338330984 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338334084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338337898 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338356018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338373899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338388920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338396072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338399887 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338406086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338423014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.338447094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.338453054 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.339797020 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.345751047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.345769882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.348529100 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.376976967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.376993895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377064943 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377264977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377283096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377300024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377317905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377337933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377353907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377356052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377362013 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377373934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377403975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377415895 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377423048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377440929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377455950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377471924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377476931 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377482891 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377490044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377511024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377527952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377545118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377551079 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377557039 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377569914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377590895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377608061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377620935 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377624989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377625942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377645016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377661943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377677917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377692938 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377696991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377700090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.377717972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.377722979 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378319025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378339052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378355026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378371954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378390074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378406048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378412962 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378424883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378423929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378442049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378473043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378489971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378508091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378514051 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378520012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378537893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378555059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378571987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378576040 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378582001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378597975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378617048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378633022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378649950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378668070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378684044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378698111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378700972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378705025 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378719091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378740072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378757000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378762007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378768921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378773928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378791094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.378810883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.378815889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379520893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379561901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379578114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379592896 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379595995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379615068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379631042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379646063 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379647970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379651070 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379667044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379687071 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379703999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379722118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379734993 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379739046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379741907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379757881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379775047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379789114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379806042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379806995 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379812002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379826069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379844904 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379862070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379874945 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379879951 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379880905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379899025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379915953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379930973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379947901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379961967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.379967928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.379968882 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.381138086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.383224964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383244038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383260965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383276939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383285046 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.383297920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383316040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383332968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383349895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.383373976 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.383378029 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.384841919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.384871006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.384887934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.384907007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.384916067 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.384926081 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.384943962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.384973049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393345118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393373013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393415928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393428087 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393433094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393452883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393481016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393497944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393510103 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393515110 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393517971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393548012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393584013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393603086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393610954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393619061 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393620014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393639088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393656015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393673897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393687963 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393692970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393692970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393718004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393731117 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393737078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393755913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393771887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393790007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393805027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393805027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393810034 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393824100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393845081 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393861055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393872023 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393877029 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393877983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393898964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393917084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393933058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393946886 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393951893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393953085 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.393970013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.393990040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394009113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394026041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394026995 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394032955 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394042969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394058943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394074917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394092083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394105911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394109011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394109964 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394129992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394150019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394165039 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394166946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394172907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394185066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394206047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394222021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394238949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394257069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394278049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394287109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394294977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394299984 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394316912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394332886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394349098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394352913 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394359112 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394366026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394382000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394397974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394417048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394433975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394443035 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394448996 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394452095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394469976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394485950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394500971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394517899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394534111 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394535065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394542933 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394555092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394572020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394593000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394598961 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394610882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394628048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394644022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394659996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394675016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394676924 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394685030 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394696951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394715071 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.394774914 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.394783974 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.395159960 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.395766973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395785093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395802021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395818949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395834923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395850897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395869970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395884991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:03:59.395915985 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:03:59.395977974 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:01.321659088 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:01.375386000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970808029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970839024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970850945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970864058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970882893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970901966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970920086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970922947 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:01.970937967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970957041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970973969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:01.970998049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:01.971025944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024238110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024275064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024286985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024300098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024317980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024333954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024349928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024359941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024365902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024386883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024396896 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024408102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024421930 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024442911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024461031 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024477959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024497032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024513006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024528980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024529934 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024549961 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024563074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024585962 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024629116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024646044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024666071 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024683952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.024692059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.024723053 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080159903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080197096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080214024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080230951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080248117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080264091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080284119 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080303907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080322027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080341101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080357075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080373049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080389977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080394030 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080410004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080427885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080430031 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080444098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080451965 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080461979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080481052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080481052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080497026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080514908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080530882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080538988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080554008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080565929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080571890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080586910 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080589056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080602884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080619097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080631971 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080638885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080656052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080667973 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080674887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080693007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080693007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080712080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080727100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080735922 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080744028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080769062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080801010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080820084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080837011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080843925 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080853939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080869913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080878973 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080924988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.080967903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.080985069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.081001043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.081017017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.081048965 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.081074953 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.135947943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.135981083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.135998011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136013985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136034966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136068106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136070013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136087894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136109114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136110067 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136137009 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136161089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136600971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136626005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136641026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136657953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136673927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136686087 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136715889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136754036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136771917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136786938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136805058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136805058 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136822939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136840105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136842012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136852980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136867046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136884928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136885881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136898994 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136913061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136914968 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136948109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136967897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.136971951 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.136986017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137006044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137027979 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137121916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137140036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137157917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137165070 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137176991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137193918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137208939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137216091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137224913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137254000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137259007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137276888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137279034 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137294054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137310982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137327909 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137331009 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137343884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137362957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137370110 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137379885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137401104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137415886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137438059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137443066 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137456894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137474060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137484074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137492895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137511015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137522936 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137528896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137545109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137562037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137562990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137583971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137593031 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137602091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137618065 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137634039 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137650013 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137650013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137669086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137685061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137687922 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137701988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137722015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137739897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137751102 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137756109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137773037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137787104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137789965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137808084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137816906 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137825966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137841940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137852907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137862921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137877941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137881041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137897968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137908936 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137917995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137934923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137944937 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137950897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137968063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.137980938 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.137984991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.138005018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.138015032 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.138021946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.138036013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.138046026 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.138071060 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.138349056 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.163407087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.163439989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.163502932 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189323902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189354897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189371109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189398050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189419031 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189435959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189449072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189452887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189471006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189487934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189503908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189511061 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189521074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189538002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189548969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189558029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189575911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189591885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189615011 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189788103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189806938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189824104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189841986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189842939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189860106 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189877987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189881086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189896107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189913034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189933062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.189933062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189966917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.189990997 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190080881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190104008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190119028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190135956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190145969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190152884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190176964 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190176964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190198898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190216064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190232038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190246105 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190248013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190285921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190295935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190313101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190370083 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190429926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190448046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190464973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190480947 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190498114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190498114 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190515041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190534115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190543890 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190551043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190572023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190591097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190598965 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190634012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190634012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190653086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190670013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190686941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190701962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190718889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190721989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190752983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190758944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.190769911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.190836906 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191322088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191348076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191365957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191379070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191391945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191407919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191422939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191438913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191452980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191469908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191483974 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191485882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191503048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191520929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191536903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191544056 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191554070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191566944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191570997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191586971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191601992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191611052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191618919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191632986 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191634893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191654921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191663980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191704988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191725016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191740990 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191755056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191765070 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191772938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191791058 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191792011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191809893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191848993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191874981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191875935 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191886902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191905022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191935062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191951036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191961050 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191965103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191978931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.191991091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.191992044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192009926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192028999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192034006 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192048073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192065001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192075014 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192082882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192101002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192101955 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192122936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192127943 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192140102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192152977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192158937 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192179918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192198992 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192202091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192219019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192234993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192246914 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192255020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192271948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192281961 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192287922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192303896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192315102 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192322969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192342043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192349911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192359924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192374945 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192377090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192394972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192408085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192410946 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192426920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192444086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192459106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192460060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192476988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192492962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192493916 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192509890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192526102 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192527056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192548037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.192552090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192576885 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.192747116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.208975077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209007978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209022045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209041119 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209057093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209074020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209078074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209090948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209110975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209129095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209140062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209146023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209162951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209180117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209181070 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209197998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209199905 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209214926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209230900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209252119 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209255934 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209270000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209290028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209299088 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209306955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209326029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209326982 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209342003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209352970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209357977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209374905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209400892 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209408045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209429026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209440947 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209446907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209464073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209480047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209482908 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209496021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209511995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209528923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209530115 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209546089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209559917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209564924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209583998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209592104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209602118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.209630966 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.209657907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.217633009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.217665911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.217711926 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.237667084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.237718105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.237772942 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243093014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243150949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243174076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243196011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243223906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243227005 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243252039 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243278980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243288040 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243309975 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243314981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243345976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243367910 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243371964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243400097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243417025 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243429899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243457079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243484974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243505001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243511915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243535042 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243546963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243577957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243593931 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243604898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243632078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243659973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243664980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243686914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243704081 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243716002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243741989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243758917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243774891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243807077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243818998 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243834019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243864059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243875980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243891954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243918896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243933916 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.243947983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243976116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.243992090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244009018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244040012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244055033 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244067907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244096994 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244111061 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244126081 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244153023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244175911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244180918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244220018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244236946 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244246960 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244275093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244287968 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244303942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244337082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244348049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244369030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244395971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244410038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244424105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244452000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244467974 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244479895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244508982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244527102 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244537115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244570971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244581938 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244602919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244630098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244649887 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244657993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244685888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244700909 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244713068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244741917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244755983 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244770050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244803905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244815111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244834900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244863033 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244880915 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244891882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244920969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244954109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244962931 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.244972944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244991064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.244998932 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245014906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245035887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245039940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245054960 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245074034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245083094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245094061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245111942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245124102 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245131016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245150089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245162010 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245171070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245192051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245203972 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245208025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245228052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245235920 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245245934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245261908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245271921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245281935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245296001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245299101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245323896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245342970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245351076 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245362043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245379925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245394945 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245420933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245434046 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245439053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245460987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245479107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245481014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245500088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245517015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245526075 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245537996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245553970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245570898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245582104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245589972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245610952 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245611906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245632887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245645046 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245651007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245668888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245683908 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245687962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245706081 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245723963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245726109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245740891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245755911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245763063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245781898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245794058 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245801926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245820045 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245820999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245841980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245858908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245877028 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245877981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245897055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245907068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245918989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245938063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245948076 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245955944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245975018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.245980024 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.245994091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246011972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246028900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246032953 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246047974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246068954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246069908 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246088028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246098995 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246105909 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246124029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246136904 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246141911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246160030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246176958 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246177912 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246193886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246206999 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246217012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246231079 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246236086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246253967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246270895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246282101 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246289968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246308088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246311903 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246326923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246345043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246351957 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246366978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246387005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246402025 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246402979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246423006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246440887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246449947 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246460915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246479034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246484995 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246498108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246506929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246520996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246541023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246551037 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246560097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246577024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246587038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246596098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246613026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246615887 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246629953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246649981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246671915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246671915 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246691942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246711016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246711969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246730089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246747017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246757030 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246764898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246783972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246794939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246802092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246823072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246824026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246845961 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246846914 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246864080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246882915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246895075 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246901035 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246918917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246927023 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246936083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246954918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246967077 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.246975899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.246994972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.247001886 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.247030020 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.247416019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.258249998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258282900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258299112 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258318901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258337975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258341074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.258357048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258373976 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.258374929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258394003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258409977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258416891 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.258428097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258445024 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.258445024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258467913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258476019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.258483887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.258517027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.264036894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.307760000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307791948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307809114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307826042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307845116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307861090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307878017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307893991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307915926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307934999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307941914 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.307950020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307962894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.307967901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.307976961 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.307982922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.308026075 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317008972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317039967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317056894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317075968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317092896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317109108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317116976 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317126036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317145109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317162037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317171097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317182064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317200899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317215919 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317218065 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317239046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317248106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317255974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317269087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317281008 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317286968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317306042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317322969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317337036 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317338943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317357063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317373991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317392111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317408085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317414045 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317426920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317449093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317461014 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317466974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317481041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317501068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317501068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317518950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317537069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317553997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317557096 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317570925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317584991 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317593098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317611933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317616940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317630053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317646980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317648888 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317663908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317682028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317693949 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317699909 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317713976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317735910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317744970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317755938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317773104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317780972 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317790985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317810059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317817926 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317827940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317848921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317864895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317874908 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317887068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317907095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317907095 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317925930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317934990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317945957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317962885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317980051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.317984104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.317997932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318016052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318036079 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318036079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318058014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318070889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318078041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318095922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318113089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318113089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318133116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318149090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318150043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318167925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318183899 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318187952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318207026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318213940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318223953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318243027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318249941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318260908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318278074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318278074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318295956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318315029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318329096 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318334103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318353891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318368912 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318370104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318387985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318397999 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318401098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318423986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318434000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318444014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318460941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318473101 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318479061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318497896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318500042 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318514109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318525076 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318532944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318548918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318567038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318569899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318588972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318604946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318620920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318624973 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318639994 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318653107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318654060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318671942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318689108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318692923 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318711042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318722963 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318731070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318748951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318759918 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318766117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318784952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318794012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318814993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318824053 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318831921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318852901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318869114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318872929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318890095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318905115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318912029 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318922043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318938971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318943977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318957090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318968058 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.318974972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.318993092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319004059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319010019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319031000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319047928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319057941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319065094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319081068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319088936 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319098949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319117069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319118977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319133043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319152117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319163084 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319170952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319190979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319209099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319216013 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319226980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319242954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319259882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319276094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319276094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319293976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319315910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319329977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319334030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319351912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319360971 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319365978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319382906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319397926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319400072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319415092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319428921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319432020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319453955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319462061 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319473982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319490910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319494009 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319509983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319525957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319530010 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319544077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319561005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319576979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319587946 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319595098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319612980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319629908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319644928 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319648027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319664955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319675922 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319680929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319699049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319705963 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319717884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319739103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319742918 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319756985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319773912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319789886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319804907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319814920 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319818020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319834948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319853067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319870949 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319873095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319891930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319907904 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319910049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319927931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319937944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319945097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319962025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319977999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.319979906 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.319994926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320014954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320015907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320034027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320045948 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320046902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320065022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320080042 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320080996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320099115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320111990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320115089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320132971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320141077 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320153952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320173025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320173979 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320190907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320202112 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320209026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320225954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320241928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320254087 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.320259094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320271969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.320312977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.321187019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.357402086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357434988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357455015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357470989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357481003 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.357487917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357506990 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357527018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357527971 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.357544899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357563019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357582092 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.357582092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357601881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357614994 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.357619047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357634068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.357654095 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.357692957 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.395720005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395751953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395766020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395777941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395790100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395803928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395817041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395828962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395842075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395853996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395863056 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.395867109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395883083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395894051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395908117 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.395936966 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.395945072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395963907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395977974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.395991087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396004915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396018982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396038055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396044970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396054029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396068096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396080971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396094084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396097898 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396110058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396120071 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396136999 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396140099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396171093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396173000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396188974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396210909 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396224976 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396229029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396246910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396255016 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396261930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396275043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396287918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396300077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396313906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396331072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396332026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396351099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396365881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396370888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396404028 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396425009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396429062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396445036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396457911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396492004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396508932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396508932 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396522999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396542072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396552086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396560907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396579981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396579981 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396598101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396620989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396631002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396637917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396651983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396665096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396671057 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396681070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396697998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396708012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396714926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396737099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396754980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396758080 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396773100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396785021 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396790981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396810055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396812916 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396827936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396846056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396858931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396881104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396897078 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396898985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396919966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396938086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396948099 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396956921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396974087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.396979094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.396994114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397001982 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397012949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397034883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397042990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397054911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397073030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397079945 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397089005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397104979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397111893 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397123098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397140980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397157907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397166967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397178888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397197008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397207975 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397213936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397233963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397242069 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397255898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397264957 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397274017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397294044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397303104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397314072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397335052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397345066 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397351027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397368908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397401094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397406101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397424936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397434950 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397442102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397459030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397473097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397478104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397495985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397516966 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397516966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397537947 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397545099 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397556067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397574902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397578955 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397593975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397608995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397625923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397635937 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397644043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397658110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397675037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397677898 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397692919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397706985 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397711992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397731066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397733927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397752047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397759914 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397772074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397792101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397800922 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397810936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397828102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397842884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397845030 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397861004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397876978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397880077 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397898912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397907972 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397917986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397934914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397952080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397955894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397968054 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.397973061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.397991896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398005962 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398008108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398026943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398036003 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398049116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398065090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398067951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398085117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398094893 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398102999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398117065 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398139000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398153067 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398158073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398175955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398194075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398195982 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398211956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398221970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398228884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398247004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398252010 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398264885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398276091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398286104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398304939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398318052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398318052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398336887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398355007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398365974 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398371935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398391008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398399115 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398408890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398422956 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398432016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398452044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398462057 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398468971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398488045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398504019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398521900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398535967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398540974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398541927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398555040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398566008 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398576975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398597002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398614883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398622990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398633003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398652077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398664951 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398668051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398685932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398701906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398714066 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398721933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398736000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398741961 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398760080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398767948 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398777962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398789883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398792028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398808956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398824930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398837090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398843050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398864985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398876905 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398891926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398902893 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398910046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398931026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398941994 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398951054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398967981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.398982048 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.398987055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399003983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399022102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399034977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.399036884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399054050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399074078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399094105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399104118 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.399111986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399132013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399149895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399151087 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.399167061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399182081 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.399185896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399204969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399205923 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.399225950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399245024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399254084 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.399265051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399279118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.399306059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.399354935 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.403666019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.406394958 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406425953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406439066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406454086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406471968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406486988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406497002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.406507015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406524897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406541109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.406542063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406562090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406582117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406594038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.406599998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406615019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.406649113 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.406687975 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.413001060 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.474822044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.474858999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.474884987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.474895954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.474910975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.474936008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.474955082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.474955082 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.474980116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.474997997 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475004911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475034952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475058079 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475059986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475085974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475100040 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475114107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475132942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475150108 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475157022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475183964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475194931 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475208998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475238085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475250006 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475265026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475291014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475302935 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475317001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475342989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475368023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475378036 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475388050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475415945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475440979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475460052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475469112 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475483894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475497007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475511074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475533962 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475537062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475553989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475565910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475593090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475603104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475620031 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475646019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475657940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475672960 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475698948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475708961 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475723982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475749016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475759983 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475776911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475797892 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475812912 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475825071 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475851059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475862026 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475879908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475905895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475914955 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475931883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475960016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.475967884 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.475990057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476017952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476027012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476046085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476072073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476080894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476099968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476126909 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476134062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476154089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476181030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476190090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476212025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476239920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476248980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476265907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476293087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476303101 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476320028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476346970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476356030 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476373911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476401091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476413012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476430893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476458073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476469994 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476485014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476511002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476522923 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476536989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476562977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476574898 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476592064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476619005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476633072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476650953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476677895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476690054 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476703882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476730108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476739883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476757050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476782084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476793051 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476805925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476833105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476843119 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476865053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476891994 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476901054 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476917982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476944923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476953983 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.476970911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.476994991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477013111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477019072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477046013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477056980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477072954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477099895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477112055 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477125883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477144957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477160931 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477171898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477199078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477202892 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477219105 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477226019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477252960 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477264881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477292061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477319002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477332115 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477343082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477372885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477391005 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477421045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477448940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477459908 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477474928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477500916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477511883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477523088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477546930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477559090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477569103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477591038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477607012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477615118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477638006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477653027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477659941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477680922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477695942 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477704048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477726936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477746964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477771044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477796078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477814913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477819920 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477826118 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477835894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477842093 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477861881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477876902 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477885008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477916956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477925062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477940083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477962017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.477982998 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.477988005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478012085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478028059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478034019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478060007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478074074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478084087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478106022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478122950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478127956 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478146076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478163004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478168964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478193998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478207111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478215933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478241920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478254080 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478267908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478290081 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478305101 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478311062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478333950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478348017 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478355885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478379965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478395939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478414059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478430986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478451967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478455067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478481054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478498936 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478508949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478537083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478550911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478562117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478586912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478600979 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478612900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478638887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478650093 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478662968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478688002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478703976 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478715897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478743076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478754997 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478760958 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478786945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478795052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478811026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478835106 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478847027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478863001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478885889 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478899002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478914976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478940964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478950977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.478966951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.478993893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479006052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479017973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479042053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479057074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479067087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479094028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479109049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479123116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479142904 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479150057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479161978 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479176998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479192019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479203939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479229927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479233980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479249954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479255915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479281902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479286909 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479307890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479340076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479345083 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479362011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479376078 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479387999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479412079 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479413986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479429007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479439974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479464054 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479464054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479492903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479505062 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479521036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479545116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479549885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479576111 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479597092 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479602098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479619026 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479625940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479650974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479654074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479675055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479688883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479695082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479720116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479720116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.479753017 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.479762077 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.480340004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.534763098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534785986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534806967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534818888 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.534832001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534857035 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.534889936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534898996 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.534914970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534936905 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.534951925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534961939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.534981966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.534997940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535011053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.535027981 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535038948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.535053015 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535065889 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.535079002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535094023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.535104990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535121918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.535134077 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535161018 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535170078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.535211086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.535933018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.535970926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.536007881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.536047935 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.553704977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.553730965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.553755045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.553778887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.553777933 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.553812981 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.553857088 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.554066896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.554092884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.554115057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.554119110 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.554153919 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.588485956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588515043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588540077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588582993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588604927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588613987 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.588628054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588651896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588671923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588675022 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.588696957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588706017 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.588721991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588748932 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.588748932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588790894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.588816881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588843107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588871956 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.588912010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588957071 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.588964939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.589133978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.589158058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.589179039 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.589179993 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.589202881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.589226961 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.607038975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.607064009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.607086897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.607098103 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.607115030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.607147932 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.607429028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.607464075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.607486963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.607491970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.607542992 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.641974926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.642011881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.642025948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.642043114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.642059088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.642075062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.642093897 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.642137051 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.643886089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.643923998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.643940926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.643958092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.643980980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644006014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644012928 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644023895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644042015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644088030 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644093990 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644112110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644129038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644140005 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644149065 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644166946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644184113 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644185066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644203901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644221067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644223928 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644237995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644253969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644256115 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644273043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644292116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644299984 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644310951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644326925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644337893 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644342899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644361019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644371986 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644376993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644393921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644402981 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644434929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644439936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644458055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644474983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644484997 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644491911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644509077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644525051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644535065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644556999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644575119 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644577980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644592047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644608974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644612074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644624949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644640923 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644643068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644660950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644669056 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644678116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644697905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644706011 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644717932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644735098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644750118 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644752026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644769907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644785881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644790888 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644803047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644819975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644826889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644841909 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644859076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644859076 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644877911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644885063 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644895077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644912004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644927025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644931078 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644944906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644962072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.644973040 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.644984007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645001888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645004988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645020008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645036936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645037889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645054102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645070076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645076990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645087004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645103931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645118952 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645123959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645152092 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645152092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645170927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645180941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645191908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645210028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645226002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645226955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645246983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645263910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645267963 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645282030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645298004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645299911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645318985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645328999 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645339012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645359039 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645370007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645375967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645411015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645426989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645427942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645447016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645453930 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645466089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645483971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645498037 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645499945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645522118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645539999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645540953 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645558119 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645567894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645576000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645593882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645610094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645612955 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645627022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645643950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645654917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645663977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645683050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645685911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645700932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645716906 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645718098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645735979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645745993 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645752907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645771027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645783901 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645788908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645808935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645827055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645834923 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645844936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645864010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645867109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645883083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645894051 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645900965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645920038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645936966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645939112 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.645956993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645976067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645992041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.645998955 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646009922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646027088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646038055 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646043062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646060944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646070004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646075964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646096945 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646099091 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646116018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646132946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646148920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646157980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646166086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646183014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646199942 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646202087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646219969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646228075 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646240950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646258116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646265984 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646276951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646294117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646296024 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646311045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646326065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646327972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646347046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646362066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646363020 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646384001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646401882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646419048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646420002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646435022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646437883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646454096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646462917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646471024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646488905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646505117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646513939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646524906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646543980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646559000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646559000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646575928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646591902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646595001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646609068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646625996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646629095 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646642923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646660089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646662951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646682978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646686077 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646699905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646718025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646733046 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646733046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646750927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646766901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646778107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646784067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646805048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646809101 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646823883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646840096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646841049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646857977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646874905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646876097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646891117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646903038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646908045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646924973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646945000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646953106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.646965027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646981955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.646991968 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647001028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647020102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647022963 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647037029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647053957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647057056 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647068977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647069931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647092104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647109032 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647113085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647130013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647136927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647147894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647166014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647167921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647182941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647200108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647201061 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647217035 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647227049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647238016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647255898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647265911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647272110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647289991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647308111 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647310019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647322893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647341013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647344112 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647357941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647358894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647380114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647383928 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647398949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647417068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647432089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647433043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647449970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647465944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647475004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647481918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647500038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647516966 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647519112 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647537947 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647553921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647556067 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647571087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647588015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647602081 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647604942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647622108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647638083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647643089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647666931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647685051 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647685051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647701979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647712946 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647717953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647727013 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647736073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647752047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647768974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647773027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647787094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647808075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647814989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647825003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647841930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647861004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647861004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647882938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647901058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647902966 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647917986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647934914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647944927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647954941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647973061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.647986889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.647989035 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648005962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648020983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648025990 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.648036957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648053885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648068905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648078918 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.648088932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648107052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648117065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.648123026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.648160934 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.648189068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.649043083 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.660429001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660448074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660465956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660481930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660499096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660500050 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.660543919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660556078 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.660563946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660583019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660598040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660613060 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.660619020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.660653114 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.660681009 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.661371946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.661412001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.661425114 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.661451101 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.695574045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.695591927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.695643902 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.695672035 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.697297096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.697329998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.697350025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.697370052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.697372913 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.697406054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.697422028 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.697460890 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.698148966 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.698210001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701240063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701266050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701284885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701294899 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701302052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701318979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701324940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701359987 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701416016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701432943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701450109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701458931 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701466084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701483965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701495886 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701504946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701523066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701530933 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701539993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701553106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701558113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701576948 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701589108 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701594114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701612949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701623917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701630116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701651096 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701664925 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701668978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701685905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701700926 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701704025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701723099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701738119 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701739073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701756954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701766968 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701772928 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701802015 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701819897 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.701971054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.701988935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702013016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702030897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702033043 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702048063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702066898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702078104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702084064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702100992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702109098 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702119112 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702131033 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702136040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702157974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702172041 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702177048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702193975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702209949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702213049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702227116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702243090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702250004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702260017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702276945 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702280045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702301979 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702308893 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702320099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702332973 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702337980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702354908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702373028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702377081 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702392101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702409029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702425003 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702425957 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702447891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702456951 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702466011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702482939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702483892 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702496052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702501059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702519894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702537060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702549934 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702554941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702573061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702589035 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702594042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702613115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702620029 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702631950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702641010 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702651024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702668905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702677011 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702687025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702704906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702714920 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702723026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702739000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702742100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.702764034 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.702792883 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.703938961 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.704005003 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.713726997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713757038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713768959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713784933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713800907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713820934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713840008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713855028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.713874102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.714083910 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.714582920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.714611053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.714629889 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.714653969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.714703083 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.750581980 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.750639915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.750665903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.750690937 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.750715017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.750739098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.750765085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.750869989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.750914097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.750916958 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.754575014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.754731894 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.754755974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.754782915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.754806995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.754820108 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.754827023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.754863024 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.754910946 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755184889 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755215883 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755239010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755260944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755260944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755285025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755285978 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755309105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755330086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755331993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755356073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755359888 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755382061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755404949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755415916 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755428076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755450010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755454063 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755472898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755479097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755496025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755518913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755521059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755563021 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755774975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755805016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755831003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755856037 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755856991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755882025 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755882978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755907059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.755913973 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755939960 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.755964041 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756236076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756266117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756289005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756292105 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756316900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756316900 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756341934 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756345034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756371021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756370068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756395102 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756397009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756421089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756422043 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756444931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756460905 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756472111 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756493092 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756498098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756525993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756535053 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756551027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756572008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756572962 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756593943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756613016 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756619930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756642103 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756644011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756666899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756675005 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756692886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756711960 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756722927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756747961 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756748915 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756772995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756788969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756800890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756822109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756829977 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756843090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756865025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756866932 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756892920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756903887 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756920099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756936073 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756947994 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.756972075 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.756983995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757000923 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757014036 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757041931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757067919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757091999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757101059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757117987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757142067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757165909 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757189035 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757195950 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757220030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757237911 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757244110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757267952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757287979 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757292032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757317066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757339001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757339954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757364988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757397890 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757407904 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757435083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757457972 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757462978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757488012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757512093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757535934 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757539034 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757560015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757575989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757586956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757612944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757622957 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757637024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757663012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757667065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757688046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757705927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757713079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757740021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757765055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757790089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757795095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757819891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757827997 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757841110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757858992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757863998 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757879972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757896900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757910967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757915020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757932901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757951021 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.757953882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757972956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.757991076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758002996 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758009911 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758027077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758044004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758052111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758063078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758080006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758080006 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758101940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758111000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758121014 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758137941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758140087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758157969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758174896 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758176088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758196115 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758208990 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758219004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758229971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758249044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758249044 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758269072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758272886 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758296013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758322001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758327007 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758347034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758368015 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758373022 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758399963 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758421898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758423090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758446932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758469105 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758471012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758495092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758517981 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758522034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758546114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758569002 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758574009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758599997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758625031 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758625984 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758650064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758673906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758682966 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758697987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758719921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758722067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758749008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758776903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758780956 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758802891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758826017 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758826971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758853912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758877039 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758900881 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758919001 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.758927107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758951902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.758979082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759005070 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.759006023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759033918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759036064 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.759068012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759092093 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.759094954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759121895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759144068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759166002 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.759170055 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.759217978 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.767544985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767573118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767587900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767606974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767623901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767641068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767657995 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767674923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767679930 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.767693043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767728090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.767750978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767754078 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.767770052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767788887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.767810106 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.768049955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.768068075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.768085003 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.768100023 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.768131018 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.778068066 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.804244041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804290056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804316044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804339886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804363012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804372072 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.804388046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804414034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804438114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804440022 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.804450989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.804462910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.804490089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808094025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808121920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808183908 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808221102 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808243990 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808274031 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808307886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808331013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808357954 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808357954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808398008 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808531046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808556080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808576107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808598042 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808602095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808628082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808650017 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808655977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808681965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808700085 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808705091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808731079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808748960 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808756113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808783054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808803082 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808809042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808834076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808854103 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808861971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808898926 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808907986 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.808923006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808948040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808975935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.808995962 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.809032917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.809156895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.809185028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.809206009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.809225082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.809242010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.809243917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.809259892 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.809284925 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.809308052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.809992075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.810022116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.810075998 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.812426090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812453032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812469959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812488079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812508106 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812525988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812527895 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.812546015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812561989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.812586069 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.812674999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812727928 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.812792063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812813997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812841892 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812863111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.812869072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812905073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812925100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812948942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812966108 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.812968969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.812990904 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813007116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813010931 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813035011 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813061953 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813065052 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813131094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813224077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813246012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813266039 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813286066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813292980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813308001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813328981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813333988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813354015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813365936 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813375950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813419104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813430071 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813441992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813467026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813492060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813505888 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813538074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813560009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813580990 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813581944 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813602924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813604116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813626051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813648939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813659906 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813673019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813698053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813708067 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813724041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813738108 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813746929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813770056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813793898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813800097 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813817024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813838959 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813842058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813867092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813904047 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813908100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813935041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813956976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.813960075 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.813981056 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814002037 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814004898 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814026117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814035892 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814049959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814074993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814100027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814100981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814125061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814142942 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814145088 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814167023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814187050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814188957 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814209938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814230919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814234018 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814251900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814270973 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814279079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814308882 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814325094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814332962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814358950 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814384937 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814404011 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814409018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814431906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814436913 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814455032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814477921 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814481974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814505100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814529896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814542055 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814553976 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814577103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814580917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814603090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814625025 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814678907 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814702988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814723969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814728975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814754009 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814778090 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814781904 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814810038 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814825058 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814835072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814860106 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814886093 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814909935 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814929008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814937115 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.814954042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.814980030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815001965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815021992 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815026999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815049887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815058947 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815073967 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815098047 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815099955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815125942 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815149069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815162897 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815176010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815201044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815207958 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815227032 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815238953 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815249920 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815275908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815293074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815298080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815323114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815340996 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815346956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815367937 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815390110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815406084 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815414906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815442085 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815442085 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815464020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815483093 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815484047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815510988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815527916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815540075 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815550089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815570116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815576077 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815599918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815622091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815624952 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815642118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815665007 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815665960 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815682888 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815700054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815710068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815717936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815740108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815752983 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815759897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815778017 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815779924 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815799952 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815815926 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815823078 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815841913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815861940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815879107 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815885067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815912008 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815917969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815942049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815963030 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.815964937 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.815987110 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816006899 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816014051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816034079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816056967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816060066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816082001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816102028 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816102982 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816123962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816147089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816167116 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816168070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816193104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816204071 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816217899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816226959 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816240072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816260099 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816284895 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816302061 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816309929 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816327095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816349983 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816351891 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816375017 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816376925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816400051 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816421986 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816422939 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816446066 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816468954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816471100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816493034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816518068 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816518068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816545010 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816560984 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816566944 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816589117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816612005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816629887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816637039 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816654921 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816678047 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816679955 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816704035 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816704988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816724062 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816737890 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816744089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816762924 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816776037 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816781998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816807985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816812038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816827059 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816843987 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816848040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816867113 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816884995 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816896915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816919088 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816920996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816945076 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816967964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.816972017 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.816991091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.817014933 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.817014933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.817037106 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.817059040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.817061901 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.817085028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.817109108 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.817286968 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.821229935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821254015 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821276903 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821343899 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.821357965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821429014 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.821449041 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821474075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821501970 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821523905 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.821523905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821548939 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.821578026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821630001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821681023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821698904 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.821706057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821733952 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.821753025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.821964025 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.823559046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.823596001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.823610067 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.823623896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.823679924 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.823719025 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.830012083 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.857758045 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.857789040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.857815981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.857892036 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.857894897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.857924938 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.857952118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.857961893 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.857985973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.858015060 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.861594915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.861664057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.861712933 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.861712933 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.861762047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.861790895 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.861819983 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.861879110 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.861870050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.861932993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862056971 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862251997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862310886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862359047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862370014 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862406969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862456083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862502098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862514019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862550974 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862555027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862598896 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862653971 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862704992 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862705946 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862752914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862752914 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862801075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862848997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862894058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.862898111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862945080 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.862946987 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863003016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863058090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863111019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863116980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.863157988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863158941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.863208055 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863255978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863301992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863306999 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.863347054 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.863351107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863401890 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863456964 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863507986 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.863509893 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.863557100 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.863559008 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.865669012 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.865739107 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.865788937 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.865839958 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.865845919 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.865878105 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.865900993 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.865955114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866002083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866029978 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866051912 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866082907 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866123915 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866172075 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866221905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866226912 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866271019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866271973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866328001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866378069 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866424084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866426945 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866467953 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866477013 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866528988 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866576910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866624117 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866626024 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866668940 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.866677999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866735935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866787910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.866835117 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870101929 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870131016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870223045 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870349884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870374918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870393991 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870414019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870414019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870439053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870459080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870467901 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870482922 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870502949 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870517969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870527029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870536089 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870551109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870570898 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870574951 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870592117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870613098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870615959 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870634079 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870655060 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870675087 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870675087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870702028 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870712996 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870724916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870735884 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870747089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870767117 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870785952 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870786905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870806932 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870827913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870830059 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870847940 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870867968 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870872021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870896101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870914936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870935917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870939970 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.870959044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870979071 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.870987892 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871001005 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871011972 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871021986 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871042967 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871047020 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871069908 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871087074 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871089935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871112108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871133089 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871135950 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871153116 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871174097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871176004 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871193886 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871212959 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871220112 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871243000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871262074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871265888 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871283054 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871304035 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871304989 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871325016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871345997 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871350050 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871366978 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871390104 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871392965 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871417046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871437073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871457100 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871459961 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871479034 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871498108 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871503115 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871520042 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871527910 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871540070 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871565104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871575117 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871587992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871601105 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871608019 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871629000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871649027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871649027 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871670961 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871690989 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871691942 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871711016 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871733904 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871736050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871759892 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871773958 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871779919 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871802092 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871820927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871840000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871840954 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871860027 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871886969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871886969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871906996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871911049 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871927977 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871947050 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871951103 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871972084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.871989012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.871994972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872014999 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872034073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872044086 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.872066975 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872085094 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.872101068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872138023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872163057 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872183084 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872184038 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.872208118 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872226000 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.872230053 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872252941 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872261047 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.872275114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872292995 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.872296095 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.872325897 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.873164892 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.876851082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.876887083 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.876929998 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.876952887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.876972914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.876976013 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.876995087 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.877016068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.877024889 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.877037048 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.877058029 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.877060890 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.877080917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.877105951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.877118111 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.877155066 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.911535025 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.911621094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.911676884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.911729097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.911784887 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.911814928 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.911839962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.911870003 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.911902905 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.915554047 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.915612936 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.915663004 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.915713072 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.915747881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.915760040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.915812969 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.915813923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.915862083 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.916076899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.916129112 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.917753935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.917810917 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.917855978 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.917865992 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.917903900 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.917923927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.917989969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918046951 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918052912 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.918092012 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.918100119 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918154001 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918207884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918256044 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.918298960 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918343067 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.918350935 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918416023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918471098 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.918517113 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.921964884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.921992064 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922015905 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922070026 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922070980 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.922102928 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.922440052 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922466040 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922491074 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922565937 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.922574997 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.922698021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922725916 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922749996 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922775984 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922777891 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.922802925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922816992 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.922828913 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.922873020 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.925292969 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.925319910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.925396919 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927118063 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927148104 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927174091 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927203894 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927231073 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927243948 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927258968 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927284956 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927298069 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927311897 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927325964 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927337885 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927350044 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927366018 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927571058 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927603006 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927622080 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927630901 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927656889 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927659988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927686930 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927710056 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927714109 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927742958 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927769899 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927788019 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927798033 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927826881 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927829981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927859068 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927882910 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927887917 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927911043 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927937984 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927962065 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.927963972 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.927992105 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928000927 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928020000 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928045988 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928052902 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928080082 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928100109 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928107023 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928134918 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928160906 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928179026 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928188086 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928215981 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928221941 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928244114 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928260088 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928278923 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928306103 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928328991 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928332090 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928359985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928375006 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928386927 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928412914 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928440094 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928457975 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928467035 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928494930 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928495884 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928525925 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928550959 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928551912 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928577900 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928605080 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928627968 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928632021 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928658962 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928668022 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928688049 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928703070 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928719044 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928745985 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928771973 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928772926 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.928791046 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:02.928816080 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:02.989902973 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:04.146213055 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:04.146245003 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:04.200812101 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:04.200835943 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:05.165661097 CEST	443	49738	34.105.210.195	192.168.2.4
Apr 26, 2021 15:04:05.208786964 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:08.674751043 CEST	49738	443	192.168.2.4	34.105.210.195
Apr 26, 2021 15:04:08.675339937 CEST	49736	443	192.168.2.4	195.201.225.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2021 15:03:42.777262926 CEST	59123	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:42.852906942 CEST	53	59123	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:43.292565107 CEST	54531	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:43.342832088 CEST	53	54531	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:44.059814930 CEST	49714	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:44.108567953 CEST	53	49714	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:44.765732050 CEST	58028	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:44.824537992 CEST	53	58028	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:44.833693027 CEST	53097	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:44.882222891 CEST	53	53097	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:45.620790958 CEST	49257	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:45.669965029 CEST	53	49257	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:46.391395092 CEST	62389	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:46.448539972 CEST	53	62389	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:47.299882889 CEST	49910	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:47.360019922 CEST	53	49910	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:48.334276915 CEST	55854	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:48.385741949 CEST	53	55854	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:49.311964035 CEST	64549	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:49.360523939 CEST	53	64549	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:53.816991091 CEST	63153	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:53.865655899 CEST	53	63153	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:54.652297020 CEST	52991	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:54.703710079 CEST	53	52991	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:55.638578892 CEST	53700	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:55.687712908 CEST	53	53700	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:56.255561113 CEST	51726	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:56.320442915 CEST	53	51726	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:56.534154892 CEST	56794	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:56.591233015 CEST	53	56794	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:56.760967016 CEST	56534	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:57.139281034 CEST	53	56534	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:57.331068993 CEST	56627	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:57.382558107 CEST	53	56627	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:58.190527916 CEST	56621	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:58.241760969 CEST	53	56621	8.8.8.8	192.168.2.4
Apr 26, 2021 15:03:59.223326921 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:03:59.271759987 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:00.490263939 CEST	64078	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:00.543813944 CEST	53	64078	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:01.400749922 CEST	64801	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:01.449379921 CEST	53	64801	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:02.230144978 CEST	61721	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:02.279304028 CEST	53	61721	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:03.411248922 CEST	51255	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:03.466219902 CEST	53	51255	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:17.097748995 CEST	61522	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:17.157955885 CEST	53	61522	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:23.330996990 CEST	52337	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:23.395725965 CEST	53	52337	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:38.268105030 CEST	55046	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:38.326971054 CEST	53	55046	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:42.749458075 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:42.865964890 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:45.222438097 CEST	49285	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:45.309201956 CEST	53	49285	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:45.867177963 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:45.977751970 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:46.461749077 CEST	60875	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:46.521826982 CEST	53	60875	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:47.041548014 CEST	56448	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:47.114907980 CEST	53	56448	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:47.147670984 CEST	59172	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:47.206475019 CEST	53	59172	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:47.819072962 CEST	62420	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:47.876405001 CEST	53	62420	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:48.378581047 CEST	60579	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:48.448719025 CEST	53	60579	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:49.285855055 CEST	50183	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:49.348332882 CEST	53	50183	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:50.278465986 CEST	61531	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:50.336437941 CEST	53	61531	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:50.779663086 CEST	49228	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:50.839047909 CEST	53	49228	8.8.8.8	192.168.2.4
Apr 26, 2021 15:04:57.592858076 CEST	59794	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:04:57.651648998 CEST	53	59794	8.8.8.8	192.168.2.4
Apr 26, 2021 15:05:33.583980083 CEST	55916	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:05:33.633198977 CEST	53	55916	8.8.8.8	192.168.2.4
Apr 26, 2021 15:05:35.183190107 CEST	52752	53	192.168.2.4	8.8.8.8
Apr 26, 2021 15:05:35.231925964 CEST	53	52752	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 26, 2021 15:03:56.255561113 CEST	192.168.2.4	8.8.8.8	0x15ad	Standard query (0)	telete.in	A (IP address)	IN (0x0001)
Apr 26, 2021 15:03:56.760967016 CEST	192.168.2.4	8.8.8.8	0xabcb	Standard query (0)	birdmilk.top	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 26, 2021 15:03:56.320442915 CEST	8.8.8.8	192.168.2.4	0x15ad	No error (0)	telete.in		195.201.225.248	A (IP address)	IN (0x0001)
Apr 26, 2021 15:03:57.139281034 CEST	8.8.8.8	192.168.2.4	0xabcb	No error (0)	birdmilk.top		34.105.210.195	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 26, 2021 15:03:56.478718042 CEST	195.201.225.248	443	192.168.2.4	49736	CN=telecut.in CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Apr 19 07:26:43 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Sun Jul 18 07:26:43 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Apr 26, 2021 15:03:56.478718042 CEST	195.201.225.248	443	192.168.2.4	49736	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		ce5f3254611a8c095a3d821d44539877
Apr 26, 2021 15:03:57.249569893 CEST	34.105.210.195	443	192.168.2.4	49738	CN=birdmilk.top CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Fri Apr 23 18:00:34 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Thu Jul 22 18:00:34 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Apr 26, 2021 15:03:57.249569893 CEST	34.105.210.195	443	192.168.2.4	49738	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		ce5f3254611a8c095a3d821d44539877

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7SlKt2Puui.exe PID: 6912 Parent PID: 5820

General

Start time:	15:03:50
Start date:	26/04/2021
Path:	C:\Users\user\Desktop\7SlKt2Puui.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\7SlKt2Puui.exe'
Imagebase:	0x400000
File size:	606720 bytes
MD5 hash:	9013A8B3F9A8ADECF2FF25377F525748
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6652 Parent PID: 6912

General

Start time:	15:04:05
Start date:	26/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\7SlKt2Puui.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5952 Parent PID: 6652

General

Start time:	15:04:05
Start date:	26/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 5624 Parent PID: 6652

General

Start time:	15:04:06
Start date:	26/04/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /T 10 /NOBREAK
Imagebase:	0xc10000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 7SlKt2Puui.exe PID: 6912 Parent PID: 5820 7SlKt2Puui.exeCOMMON

Executed Functions

Function 00429796, Relevance: 170.9, APIs: 49, Strings: 45, Instructions: 6397threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042979B
CoInitialize.OLE32(00000000), ref: 004297B7

Part of subcall function 00432DF7: OpenMutexA.KERNEL32 ref: 00432E48
Part of subcall function 00432DF7: CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00432E55

CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042FBE0

Part of subcall function 00435AE5: GetCurrentProcess.KERNEL32(00000008,?,?,?), ref: 00435AF7
Part of subcall function 00435AE5: OpenProcessToken.ADVAPI32(00000000), ref: 00435AFE
Part of subcall function 00435AE5: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00435B18
Part of subcall function 00435AE5: GetLastError.KERNEL32 ref: 00435B22
Part of subcall function 00435AE5: GlobalAlloc.KERNEL32(00000040,00000000), ref: 00435B32
Part of subcall function 00435AE5: GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 00435B46
Part of subcall function 00435AE5: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00435B5A
Part of subcall function 00435AE5: GlobalFree.KERNEL32 ref: 00435B7A

GetUserDefaultLCID.KERNEL32(00001001,?,000000FF), ref: 004297FB
GetLocaleInfoA.KERNEL32(00000000), ref: 00429802

Part of subcall function 00435B8A: __EH_prolog.LIBCMT ref: 00435B8F
Part of subcall function 00435B8A: CreateToolhelp32Snapshot.KERNEL32 ref: 00435BF0
Part of subcall function 00435B8A: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00435C0A
Part of subcall function 00435B8A: OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,00000000), ref: 00435C7E
Part of subcall function 00435B8A: OpenProcessToken.ADVAPI32(00000000,000F01FF,?,?,?,00000000), ref: 00435C90
Part of subcall function 00435B8A: DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?,?,?,00000000), ref: 00435CAB
Part of subcall function 00435B8A: CloseHandle.KERNEL32(?,?,?,00000000), ref: 00435CB8
Part of subcall function 00435B8A: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 00435CCB

Part of subcall function 004143F8: __EH_prolog.LIBCMT ref: 004143FD

Part of subcall function 004147F6: __EH_prolog.LIBCMT ref: 004147FB

Part of subcall function 00430F27: __EH_prolog.LIBCMT ref: 00430F2C
Part of subcall function 00430F27: WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,00488B48,00000000), ref: 00430F75
Part of subcall function 00430F27: WinHttpConnect.WINHTTP(00000000,00000000,000001BB,00000000,?,?,?,?,00488B48,00000000), ref: 00431044

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Sleep.KERNEL32(00001388,004889F4,00000000,0047734B), ref: 00429D9B

Part of subcall function 00430F27: WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00800100,?,?,?,?,00488B48,00000000), ref: 0043111B
Part of subcall function 00430F27: _strlen.LIBCMT ref: 004311BB
Part of subcall function 00430F27: _strlen.LIBCMT ref: 004311C5
Part of subcall function 00430F27: WinHttpSendRequest.WINHTTP(00000000,Content-Type: text/plain; charset=UTF-8,000000FF,?,00000000,00000000,00000000,?,?,?,00488B48,00000000), ref: 004311DC
Part of subcall function 00430F27: WinHttpReceiveResponse.WINHTTP(00000000,00000000,?,?,?,00488B48,00000000), ref: 004311EE
Part of subcall function 00430F27: WinHttpQueryDataAvailable.WINHTTP(00000000,?,?,?,?,00488B48,00000000), ref: 00431206
Part of subcall function 00430F27: WinHttpReadData.WINHTTP(00000000,00000000,?,?,?,?,?,?,?,?,00488B48,00000000), ref: 0043123B

GetUserNameA.ADVAPI32(?,00000101), ref: 00429F74
Sleep.KERNEL32(00007530), ref: 0042A151
_strlen.LIBCMT ref: 0042A27F
_strlen.LIBCMT ref: 0042A2A2
CreateThread.KERNEL32(00000000,00000000,Function_00016038,00000000,00000000,00000000), ref: 0042A4EC
CreateThread.KERNEL32(00000000,00000000,Function_00018470,00000000,00000000,00000000), ref: 0042A4FE
CreateThread.KERNEL32(00000000,00000000,Function_000164BE,00000000,00000000,00000000), ref: 0042A510
CreateThread.KERNEL32(00000000,00000000,Function_00016D60,00000000,00000000,00000000), ref: 0042A522
CreateThread.KERNEL32(00000000,00000000,Function_00017485,00000000,00000000,00000000), ref: 0042A534
CreateThread.KERNEL32(00000000,00000000,Function_000180A9,00000000,00000000,00000000), ref: 0042A546
CreateThread.KERNEL32(00000000,00000000,Function_00017C56,00000000,00000000,00000000), ref: 0042A558
CreateThread.KERNEL32(00000000,00000000,Function_000189A5,00000000,00000000,00000000), ref: 0042A56A
CreateThread.KERNEL32(00000000,00000000,Function_00018F2B,00000000,00000000,00000000), ref: 0042A57C
CreateThread.KERNEL32(00000000,00000000,Function_000195D7,00000000,00000000,00000000), ref: 0042A5A0
CreateThread.KERNEL32(00000000,00000000,Function_00019460,00000000,00000000,00000000), ref: 0042A5AC

Part of subcall function 00426BA4: __EH_prolog.LIBCMT ref: 00426BA9

CreateThread.KERNEL32(00000000,00000000,Function_00027CE5,00000000,00000000,00000000), ref: 0042A7D8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0042A7E1
CreateThread.KERNEL32(00000000,00000000,Function_00020C16,?,00000000,00000000), ref: 0042AB7E

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0040B384: __EH_prolog.LIBCMT ref: 0040B389

CreateThread.KERNEL32(00000000,00000000,Function_0003217A,00000000,00000000,00000000), ref: 0042AB8D
CreateThread.KERNEL32(00000000,00000000,Function_00028BB8,00000000,00000000,00000000), ref: 0042AB9F
CreateThread.KERNEL32(00000000,00000000,Function_000182C1,00000000,00000000,00000000), ref: 0042A58E

Part of subcall function 0042FD79: __EH_prolog.LIBCMT ref: 0042FD7E

Strings

G, xrefs: 0042C8F7
", xrefs: 0042BDC5
*, xrefs: 0042B007
0z, xrefs: 0042A83C, 0042A899, 0042DE02, 0042DFD4, 0042E611, 0042E64E, 0042E6F2, 0042E892, 0042E8CE, 0042E9A5, 0042E9F1, 0042EA96, 0042EB4B, 0042EF1C, 0042F053, 0042F82E
:, xrefs: 0042E33F
`, xrefs: 00429F7C
M, xrefs: 0042F660
^, xrefs: 0042F27A
_id, xrefs: 0042EBF0
r, xrefs: 0042AF25
4, xrefs: 0042F5B9
>, xrefs: 0042AC33
J, xrefs: 0042D54F
[, xrefs: 0042D6D9
&, xrefs: 0042CA17
o, xrefs: 0042CD4C
2, xrefs: 0042B111
], xrefs: 0042EC50
|, xrefs: 0042ABBB
a, xrefs: 0042B820
POST, xrefs: 0042A0DD
m, xrefs: 0042E050
6, xrefs: 0042DA24
qSVdAbi/K2pP5PzejMhd4MMaF7jGSNG6wYALuFuSEQ== , xrefs: 00429AF8
5, xrefs: 0042B1E2
w, xrefs: 0042A933, 0042AAB0, 0042ACB8, 0042AEF5, 0042B0E1, 0042B2AA, 0042B323, 0042B41A, 0042B48D, 0042B4E3, 0042C170, 0042C188, 0042C1A0, 0042C1B8, 0042C1D0, 0042C1EF, 0042D0E5, 0042D177, 0042D256, 0042DDAA, 0042DFC9, 0042DFE3, 0042E5BA, 0042E701, 0042E794, 0042E79F, 0042E7AE, 0042E7D9, 0042E928, 0042EAA5, 0042EB40, 0042EB5A, 0042EB89, 0042EC38, 0042ED4B, 0042EEC4, 0042EFB6, 0042F0ED, 0042F17A, 0042F1BA, 0042F51C, 0042F7E3, 0042F7EE, 0042F7FD, 0042F9B8, 0042FAB5, 0042FAC0, 0042FACB, 0042FAD6, 0042FAE1, 0042FAEC, 0042FAF7, 0042FB02, 0042FB18, 0042FB23, 0042FB2E, 0042FB4C, 0042FB57, 0042FB62, 0042FB6D, 0042FB83, 0042FB8E, 0042FB99, 0042FBA4, 0042FBAF, 0042FBBA, 0042FBC5, 0042FBD0, 0042FBDB
\, xrefs: 0042F859
f, xrefs: 0042D263
u, xrefs: 0042BB0C
h, xrefs: 0042C3BD
:, xrefs: 0042A9D9
N, xrefs: 0042C098
7, xrefs: 0042AAC2
H, xrefs: 0042FA12
g, xrefs: 0042BC73
$, xrefs: 0042C553
GET, xrefs: 00429D22, 00429DBC
G, xrefs: 0042BECC
!, xrefs: 0042ED58
n, xrefs: 0042F1F8
, xrefs: 0042FB39
!, xrefs: 0042D3A3
8TRNEv68MSMMsaGCwJRA7MtUWrHKSJCozZdftEvMRuIPXUlK1SoaaA== , xrefs: 00429B0E
", xrefs: 0042F53D
d2190a1675e0673d0823ae5c7f64e90c , xrefs: 00429B21

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Create$Thread$H_prolog$Http$Open$Token$Process_strlen$DataDeallocateGlobalInformationMutexNameRequestSleepUser$AllocAvailableCloseConnectConvertCurrentDefaultDuplicateEnvironmentErrorFileFirstFreeHandleInfoInitializeLastLocaleModuleObjectProcess32QueryReadReceiveResponseSendSingleSnapshotStringToolhelp32UninitializeVariableWait_strcat
String ID: !$!$"$"$$$&$*$2$4$5$6$7$8TRNEv68MSMMsaGCwJRA7MtUWrHKSJCozZdftEvMRuIPXUlK1SoaaA== $:$:$>$G$G$GET$H$J$M$N$POST$[$\$]$^$_id$`$a$d2190a1675e0673d0823ae5c7f64e90c $f$g$h$m$n$o$qSVdAbi/K2pP5PzejMhd4MMaF7jGSNG6wYALuFuSEQ== $r$u$|$0z$w$
API String ID: 1560218325-951242176
Opcode ID: d740b8653fc83de3a18c9921da26888f49a9911ed4041a2c728cd7493ea1421a
Instruction ID: 6a5b26fca737ead17ee50acb2e05f2bc041a7c7e166469291b9e45d5ed6a0f30
Opcode Fuzzy Hash: d740b8653fc83de3a18c9921da26888f49a9911ed4041a2c728cd7493ea1421a
Instruction Fuzzy Hash: 47C39E34A052689ECB25EB61CCA2BEDBB749F25304F4404DEE459732C2DA781F89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00432F99, Relevance: 71.1, APIs: 37, Strings: 3, Instructions: 1112registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00432F9E

Part of subcall function 00435F13: __EH_prolog.LIBCMT ref: 00435F18

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,00000000,0000000A,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040), ref: 00433093
RegCloseKey.ADVAPI32(?,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004330A0
RegEnumKeyExW.KERNEL32 ref: 004330CF
wsprintfW.USER32 ref: 004330F7
RegOpenKeyExW.KERNEL32(80000002,?,00000000,00020019,?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 00433116
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000800,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 00433191
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000800,?,?,?,?,?,00000000,?), ref: 00433330
RegCloseKey.ADVAPI32(?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 0043340C
RegCloseKey.ADVAPI32(?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 0043342B
RegCloseKey.ADVAPI32(?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 00433430
RegCloseKey.ADVAPI32(?,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 00433435
RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 0043344C
RegEnumKeyExW.KERNEL32 ref: 0043347A
wsprintfW.USER32 ref: 004334A2
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004334C1
RegQueryValueExA.ADVAPI32(?,?,00000000,000F003F,?,00000800,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 0043353C
RegQueryValueExA.ADVAPI32(?,?,00000000,000F003F,?,00000800,?,?,?,?,?,00000000,?), ref: 004336DB
RegCloseKey.ADVAPI32(?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004337B7
RegCloseKey.ADVAPI32(?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004337D6
RegCloseKey.ADVAPI32(?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004337DB
RegCloseKey.ADVAPI32(?,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004337E0
RegOpenKeyExW.KERNEL32(80000003,0047C858,00000000,00020019,?,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004337FA
RegCloseKey.ADVAPI32(?,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 0043380A
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00433834
RegEnumKeyExW.KERNEL32 ref: 0043387F
wsprintfW.USER32 ref: 004338AA
RegOpenKeyExW.KERNEL32(80000003,?,00000000,00020019,?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 004338CC
RegEnumKeyExW.KERNEL32 ref: 0043390B
wsprintfW.USER32 ref: 0043393B
RegOpenKeyExW.ADVAPI32(80000003,?,00000000,00020019,?,?,?,?,?,?,?,?,?,00435734,00000000,00000012), ref: 0043395D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00435734,00000000,00000012,00000040,00000001), ref: 0043396D
RegQueryValueExA.ADVAPI32(?,A8F2E4F3,00000000,000F003F,?,00000800,?,?,?,?,?,?,?,?,00435734,00000000), ref: 004339EC
RegQueryValueExA.ADVAPI32(?,?,00000000,000F003F,?,00000800,?,?,?,?,?,00000000,?), ref: 00433B90
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00435734,00000000,00000012,00000040,00000001), ref: 00433C7C
RegCloseKey.ADVAPI32(?,?,?,?,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 00433CA8
RegCloseKey.ADVAPI32(?,?,?,?,00000000,00489E00,00435734,00000000,00000012,00000040,00000001), ref: 00433EA7

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0043305B, 004330E6, 00433442, 00433491, 00433892
?, xrefs: 00433080
%s\%s, xrefs: 004330F1, 0043349C, 004338A4, 00433935

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Close$Open$QueryValue$Enumwsprintf$H_prolog$EnvironmentIos_base_dtorVariable_strcatstd::ios_base::_
String ID: %s\%s$?$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2335028583-978129254
Opcode ID: 76d9fa8fb312ac9ec830c9ab1d7f281ad2d7fa1636bac253d09e40b045941a91
Instruction ID: 8e000bb393db40f08c7f870bb4e6960db29eebeec0d79d00726b5036027e59b5
Opcode Fuzzy Hash: 76d9fa8fb312ac9ec830c9ab1d7f281ad2d7fa1636bac253d09e40b045941a91
Instruction Fuzzy Hash: EFA2C070D0025D9BEF21CFA5CD80BEEBBB9AF19304F1091AAE445B7241DB741B89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004277AD, Relevance: 61.7, APIs: 30, Strings: 5, Instructions: 422stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 004277F5
LoadLibraryW.KERNEL32(vaultcli.dll), ref: 00427819
GetProcAddress.KERNEL32(00000000,?), ref: 00427866
GetProcAddress.KERNEL32(00000000,?), ref: 004278A2
GetProcAddress.KERNEL32(00000000,?), ref: 004278D9
GetProcAddress.KERNEL32(00000000,?), ref: 00427915
GetProcAddress.KERNEL32(00000000,?), ref: 00427951
GetProcAddress.KERNEL32(00000000,?), ref: 0042798A
_memcmp.LIBVCRUNTIME ref: 00427A3A
lstrlenW.KERNEL32(?), ref: 00427A4D
lstrcpyW.KERNEL32(00000000,?), ref: 00427A68
lstrlenW.KERNEL32(?), ref: 00427A75
lstrcpyW.KERNEL32(00000000,?), ref: 00427A94
lstrlenW.KERNEL32(?), ref: 00427AA1
lstrcpyW.KERNEL32(00000000,?), ref: 00427AC5
lstrlenW.KERNEL32(?), ref: 00427AF9
lstrcpyW.KERNEL32(00000000,?), ref: 00427B1A
StrStrIW.SHLWAPI(?,Internet Explorer), ref: 00427C31
lstrlenW.KERNEL32(00000000), ref: 00427C3C
lstrlenW.KERNEL32(?), ref: 00427C4C
FreeLibrary.KERNEL32(00000000), ref: 00427CDA

Strings

|, xrefs: 00427933
vaultcli.dll, xrefs: 00427814
eXet, xrefs: 0042792C
Internet Explorer, xrefs: 00427C2B
}eVt, xrefs: 00427925

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProclstrlen$lstrcpy$Library$FreeLoadVersion_memcmp
String ID: Internet Explorer$eXet$vaultcli.dll$|$}eVt
API String ID: 545859571-953820470
Opcode ID: 52566f773e3262fa649fa5bca9872a8fc832fe373e195e95bec5fc1b3091d5c9
Instruction ID: 813cc636c5194993da5562ea99a54769f87ceadaccfdaaac2d7757d78eb8095a
Opcode Fuzzy Hash: 52566f773e3262fa649fa5bca9872a8fc832fe373e195e95bec5fc1b3091d5c9
Instruction Fuzzy Hash: D0F19071D002289FEF14DFA9EC49BEEBBB8AF49304F00446AE405E7211EB789945CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDA5, Relevance: 51.8, APIs: 13, Strings: 16, Instructions: 1078libraryloaderencryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040DDAA
GetProcAddress.KERNEL32(?,?), ref: 0040DDF0
GetProcAddress.KERNEL32(?,?), ref: 0040DE20
GetProcAddress.KERNEL32(?,?), ref: 0040DE6C
GetProcAddress.KERNEL32(?,?), ref: 0040DEA2
GetProcAddress.KERNEL32(?,?), ref: 0040DED5
GetProcAddress.KERNEL32(?,?), ref: 0040DF08
GetProcAddress.KERNEL32(?,?), ref: 0040DF37
GetProcAddress.KERNEL32(?,?), ref: 0040DF77
wsprintfA.USER32 ref: 0040DFD8

Part of subcall function 00432540: __EH_prolog.LIBCMT ref: 00432545

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040E7E9
LocalFree.KERNEL32(?,?,?), ref: 0040E851

Part of subcall function 0040C07D: __EH_prolog.LIBCMT ref: 0040C082
Part of subcall function 0040C07D: BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040C0E8
Part of subcall function 0040C07D: BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040C106
Part of subcall function 0040C07D: BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040C127
Part of subcall function 0040C07D: LocalAlloc.KERNEL32(00000040,?), ref: 0040C17E
Part of subcall function 0040C07D: BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040C1A9

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040E8D0

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Strings

UCBrowser, xrefs: 0040E0C2
BYTE, xrefs: 0040DE80
3"?3, xrefs: 0040DEE9
cu, xrefs: 0040DF57
PR?|, xrefs: 0040E100
&, xrefs: 0040ECC2
X^YI, xrefs: 0040EA5A
ydu#, xrefs: 0040DF49
6EGZ, xrefs: 0040DE2B
vzl, xrefs: 0040E1AD
Opera, xrefs: 0040E4A3
|ppt, xrefs: 0040E195
360Browser, xrefs: 0040E0D9
GRGV, xrefs: 0040E5FA
iEBS, xrefs: 0040DE3B
r($(, xrefs: 0040EC6F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$Crypt$H_prolog$DataDeallocateLocalUnprotect$AlgorithmAllocDecryptFreeGenerateOpenPropertyProviderSymmetric_strcatwsprintf
String ID: &$3"?3$360Browser$6EGZ$BYTE$GRGV$Opera$PR?|$UCBrowser$X^YI$cu$iEBS$r($($vzl$ydu#$|ppt
API String ID: 2223174271-605082037
Opcode ID: 7820ff91f173cf0a602404d0227a8b567ecc38a3894a64800cbd585172664f57
Instruction ID: 372f1163d7acd778f0001ccb322b24e597c4f6b319b08f2d196d54ea3c7923e6
Opcode Fuzzy Hash: 7820ff91f173cf0a602404d0227a8b567ecc38a3894a64800cbd585172664f57
Instruction Fuzzy Hash: 53A2DE30D04298DADF25DBA5CD51BEDBBB0AF19304F1045AEE409B7292EB745B88CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED62, Relevance: 51.6, APIs: 14, Strings: 15, Instructions: 813libraryloaderencryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040ED67
GetProcAddress.KERNEL32(?,?), ref: 0040EDB3
GetProcAddress.KERNEL32(?,?), ref: 0040EDE3
GetProcAddress.KERNEL32(?,?), ref: 0040EE20
GetProcAddress.KERNEL32(?,?), ref: 0040EE65
GetProcAddress.KERNEL32(?,?), ref: 0040EE98
GetProcAddress.KERNEL32(?,?), ref: 0040EECB
GetProcAddress.KERNEL32(?,?), ref: 0040EEFA
GetProcAddress.KERNEL32(?,?), ref: 0040EF3A
wsprintfA.USER32 ref: 0040EFAE

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040F617
LocalFree.KERNEL32(?,?,?), ref: 0040F676
LocalFree.KERNEL32(?), ref: 0040F72B

Part of subcall function 0040C07D: __EH_prolog.LIBCMT ref: 0040C082
Part of subcall function 0040C07D: BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040C0E8
Part of subcall function 0040C07D: BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040C106
Part of subcall function 0040C07D: BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040C127
Part of subcall function 0040C07D: LocalAlloc.KERNEL32(00000040,?), ref: 0040C17E
Part of subcall function 0040C07D: BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040C1A9

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040F6F0

Part of subcall function 0040BED4: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,?,?,?,?,?,00000000,00000000,?), ref: 0040BEE7
Part of subcall function 0040BED4: DeleteFileTransactedA.KERNEL32 ref: 0040BEFE
Part of subcall function 0040BED4: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,?,?,?,00418431,00000012,00000000), ref: 0040BF09

Strings

UCBrowser, xrefs: 0040F0E0
|ap&, xrefs: 0040EDF5
~n+M, xrefs: 0040F116
Jfap, xrefs: 0040EDFC
gdlb, xrefs: 0040F146
zFIJ, xrefs: 0040EF13
Opera, xrefs: 0040F2E8
V@8, xrefs: 0040F408, 0040F323
360Browser, xrefs: 0040F0F5
;.;*, xrefs: 0040F440
YDF+, xrefs: 0040F12E
D, xrefs: 0040F8AF
)4, xrefs: 0040F18F
V@, xrefs: 0040EF1A
%VTI, xrefs: 0040EF03

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$Crypt$Local$DataFreeH_prologTransactionUnprotect$AlgorithmAllocCommitCreateDeallocateDecryptDeleteFileGenerateOpenPropertyProviderSymmetricTransactedwsprintf
String ID: V@8$%VTI$)4$360Browser$;.;*$D$Jfap$Opera$UCBrowser$V@$YDF+$gdlb$zFIJ$|ap&$~n+M
API String ID: 3167390917-3413178868
Opcode ID: e84ea58ce16c99053e38e786396b540ce584feb626fcaa8aee69e298887a24c9
Instruction ID: 403e4eba6151f97a255844422af888bc01136a9722557a7e4f5a7a38d9ff956a
Opcode Fuzzy Hash: e84ea58ce16c99053e38e786396b540ce584feb626fcaa8aee69e298887a24c9
Instruction Fuzzy Hash: 5072CE3090425CDECF21DBA4DD91AEDBBB0AF19304F5040AEE44977291DB781B88CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041E71E, Relevance: 48.6, APIs: 7, Strings: 20, Instructions: 1319COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041E723
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000001,00000000), ref: 0041E758

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0040B384: __EH_prolog.LIBCMT ref: 0040B389

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

NSS_Init.NSS3(?,?,?,?,?,?), ref: 0041E8BA

Part of subcall function 0040B8F6: ___std_fs_copy_file@12.LIBCPMT ref: 0040B91A

NSS_Shutdown.NSS3(?,00000001,?,00000001,?,?,?), ref: 0041FC13

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

sqlite3_finalize.NSS3(?), ref: 0041EF02
sqlite3_close.NSS3(?), ref: 0041EF0F
__fread_nolock.LIBCMT ref: 0041F119

Part of subcall function 00424736: __EH_prolog.LIBCMT ref: 0042473B

Part of subcall function 00422A2B: __EH_prolog.LIBCMT ref: 00422A30

Part of subcall function 00422AB3: __EH_prolog.LIBCMT ref: 00422AB8

Part of subcall function 0041E578: __EH_prolog.LIBCMT ref: 0041E57D
Part of subcall function 0041E578: _strlen.LIBCMT ref: 0041E5EA
Part of subcall function 0041E578: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,00001FA0,00000000,00000000), ref: 0041E5F2
Part of subcall function 0041E578: PK11_GetInternalKeySlot.NSS3(?,00000000,00000001,?,00001FA0,00000000,00000000,?,logins,logins), ref: 0041E600
Part of subcall function 0041E578: PK11_FreeSlot.NSS3(?,?,00001FA0,00000000,00000000,?,logins,logins), ref: 0041E6D9

Part of subcall function 00432CBB: __EH_prolog.LIBCMT ref: 00432CC0

Strings

h`, xrefs: 0041F827
ai, xrefs: 0041F25F
|t, xrefs: 0041F737
O!;, xrefs: 0041EE6A
6, xrefs: 0041F2BC
1ulp, xrefs: 0041EF5A
logins, xrefs: 0041F193, 0041F1AC
*nwk, xrefs: 0041E9A0
-%, xrefs: 0041F34F
q, xrefs: 0041EF64
xvql, xrefs: 0041EF4E
]K, xrefs: 0041F78D
j, xrefs: 0041E9A7
ThunderBird, xrefs: 0041F1F8
F )4, xrefs: 0041F6C0
cmjw, xrefs: 0041E997
Profiles, xrefs: 0041E76A
0X_CD^Q]U, xrefs: 0041F22D
A'.3, xrefs: 0041F92D
%, xrefs: 0041FB8F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$DeallocateK11_Slot$BinaryCryptFolderFreeInitInternalPathShutdownString___std_fs_copy_file@12__fread_nolock_strcat_strlensqlite3_closesqlite3_finalize
String ID: 6$%$*nwk$-%$0X_CD^Q]U$1ulp$A'.3$F )4$O!;$Profiles$ThunderBird$]K$ai$cmjw$h`$j$logins$q$xvql$|t
API String ID: 2586454776-2522462997
Opcode ID: ad3de48eff40e7da4e2f471ddaa5e8ddcce4c3746a8ddbc05dd70ca7d555207a
Instruction ID: 646d5f1a04de618f8b087dff6c198600034923e6260ce1c4522971e5f2d4eaa7
Opcode Fuzzy Hash: ad3de48eff40e7da4e2f471ddaa5e8ddcce4c3746a8ddbc05dd70ca7d555207a
Instruction Fuzzy Hash: FDD29970D042A88ADB25DF68C990BEDBBB1AF19304F5041EED44967282DB785FC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD64, Relevance: 33.8, APIs: 15, Strings: 4, Instructions: 588libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041DD69

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

SetCurrentDirectoryA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00000000), ref: 0041DF34

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 0041DBBB: __EH_prolog.LIBCMT ref: 0041DBC0

LoadLibraryA.KERNEL32(00000000,?,00000000,00000000), ref: 0041E21B
GetProcAddress.KERNEL32(00000000,?), ref: 0041E26A
GetProcAddress.KERNEL32(00000000,?), ref: 0041E2A8
GetProcAddress.KERNEL32(00000000,?), ref: 0041E2E4
GetProcAddress.KERNEL32(00000000,35352866), ref: 0041E326
GetProcAddress.KERNEL32(00000000,?), ref: 0041E35A
GetProcAddress.KERNEL32(00000000,?), ref: 0041E388
GetProcAddress.KERNEL32(00000000,00001C1E), ref: 0041E3CC
GetProcAddress.KERNEL32(00000000,?), ref: 0041E3FD
GetProcAddress.KERNEL32(00000000,494C5153), ref: 0041E43D
GetProcAddress.KERNEL32(00000000,?), ref: 0041E472
GetProcAddress.KERNEL32(00000000,?), ref: 0041E4A2
GetProcAddress.KERNEL32(00000000,0F0A1715), ref: 0041E4E4

Strings

f(55SQLI, xrefs: 0041E42F
xitx, xrefs: 0041E451
m=,9&vgr, xrefs: 0041E1C0
7, xrefs: 0041E486

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$H_prolog$CurrentDirectoryEnvironmentLibraryLoadVariable_strcat
String ID: 7$f(55SQLI$m=,9&vgr$xitx
API String ID: 1501777685-2607330756
Opcode ID: fffe26c087be16d062484252b8140898c5217f82d54217d4e1899b497921f1bf
Instruction ID: 5efc2964c04d15d28bbdc5ca2417e3c3c1bd17cdc23c260038c37d870b4691cd
Opcode Fuzzy Hash: fffe26c087be16d062484252b8140898c5217f82d54217d4e1899b497921f1bf
Instruction Fuzzy Hash: F1322570E00288DFCB10DFB9E9547EEBBB1AF19304F50496ED841A7292DB780985CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D35A, Relevance: 32.2, APIs: 11, Strings: 7, Instructions: 698libraryloaderencryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D35F
GetProcAddress.KERNEL32(?,?), ref: 0040D3AC
GetProcAddress.KERNEL32(?,?), ref: 0040D3E0
GetProcAddress.KERNEL32(?,?), ref: 0040D41D
GetProcAddress.KERNEL32(?,?), ref: 0040D457
GetProcAddress.KERNEL32(?,?), ref: 0040D48A
GetProcAddress.KERNEL32(?,?), ref: 0040D4B9
GetProcAddress.KERNEL32(?,?), ref: 0040D4F9

Part of subcall function 00411440: __EH_prolog.LIBCMT ref: 00411445

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

wsprintfA.USER32 ref: 0040D56D

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0040B8F6: ___std_fs_copy_file@12.LIBCPMT ref: 0040B91A

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Part of subcall function 00432540: __EH_prolog.LIBCMT ref: 00432545

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040DB5C
LocalFree.KERNEL32(?,?,?), ref: 0040DBBF

Part of subcall function 004122A1: __EH_prolog.LIBCMT ref: 004122A6

Part of subcall function 0041302F: __EH_prolog.LIBCMT ref: 00413034

Strings

~, xrefs: 0040D674
Opera, xrefs: 0040D84D
zxe`}l:Vz}ly, xrefs: 0040D410
sq|0, xrefs: 0040D8B4
Cdqd, xrefs: 0040D8BD
u, xrefs: 0040D8C4
?LNS, xrefs: 0040D4C2

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$H_prolog$Deallocate$CryptDataEnvironmentFreeLocalUnprotectVariable___std_fs_copy_file@12_strcatwsprintf
String ID: zxe`}l:Vz}ly$?LNS$Cdqd$Opera$sq|0$u$~
API String ID: 2073996898-3628959740
Opcode ID: 892f0ef1e489e34871d2105ab9bd89b741ccb9a9645033749a7b33c37f5bf44f
Instruction ID: 898b83c8df81449fe01e70780c0951cc4b85c73d304e82cf38c1e4b90ee8496d
Opcode Fuzzy Hash: 892f0ef1e489e34871d2105ab9bd89b741ccb9a9645033749a7b33c37f5bf44f
Instruction Fuzzy Hash: 2B52AF30C04258DECF15DBA5DD51AEDBBB4AF19304F1040AEE449B7292EB785B88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00427411, Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 169encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,00000000,?,00000000), ref: 00427436
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,00000000,?,00000000), ref: 00427457
lstrlenW.KERNEL32(?,?,00000000), ref: 00427466
CryptHashData.ADVAPI32(00000000,?,00000000,00000000,?,00000000), ref: 00427479
CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000,?,00000000), ref: 0042749C
wsprintfW.USER32 ref: 004274D8
lstrcatW.KERNEL32(00000000,?), ref: 004274E6
wsprintfW.USER32 ref: 00427506
lstrcatW.KERNEL32(00000000,?), ref: 00427514
CryptDestroyHash.ADVAPI32(00000000,?,00000000), ref: 0042751D
CryptReleaseContext.ADVAPI32(?,00000000,?,00000000), ref: 00427528
lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 0042756F
CryptUnprotectData.CRYPT32(?,00000000,cwB,00000000,00000000,00000001,?), ref: 00427592
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004275CB

Strings

cwB, xrefs: 00427589, 0042758C
%02X, xrefs: 004274D2, 00427500
Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00427542

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Crypt$Hash$ContextDatalstrcatlstrlenwsprintf$AcquireCreateDestroyFreeLocalParamReleaseUnprotect
String ID: %02X$Software\Microsoft\Internet Explorer\IntelliForms\Storage2$cwB
API String ID: 1004607082-1792555230
Opcode ID: 75638dbdb1075a0201cfbe5d5637ece7d7aa70289a3438baa7d9417f6eef8ec2
Instruction ID: 1578eafc90fa4369f07e1acb79b25626abcff7d22ec86f6c574a25bb0ddb6a71
Opcode Fuzzy Hash: 75638dbdb1075a0201cfbe5d5637ece7d7aa70289a3438baa7d9417f6eef8ec2
Instruction Fuzzy Hash: 9B514071A00219AFEB119FA4DC45FEFB7BCEF05701F14402AF511F2251EA789A548B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0043454A, Relevance: 27.4, APIs: 13, Strings: 2, Instructions: 1181COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043454F

Part of subcall function 004340EE: __EH_prolog.LIBCMT ref: 004340F3
Part of subcall function 004340EE: RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020119,?,?,?,00000000), ref: 00434191
Part of subcall function 004340EE: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000000), ref: 004341DF
Part of subcall function 004340EE: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 004341E8

_strftime.LIBCMT ref: 0043467E
GetUserDefaultLCID.KERNEL32(00001001,?,00000100,?,?,?,?,?), ref: 004346A6
GetLocaleInfoA.KERNEL32(00000000), ref: 004346AD
GetUserNameA.ADVAPI32(?,?), ref: 004348E6
GetComputerNameA.KERNEL32 ref: 00434F88
GetUserNameA.ADVAPI32(00000001,00000101), ref: 00434FFD

Part of subcall function 004361D4: __EH_prolog.LIBCMT ref: 004361D9

GetSystemInfo.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,00000000,00000012,00000040,00000001), ref: 0043531D
GlobalMemoryStatusEx.KERNEL32(?,?,?,00000000,00000012,00000040,00000001), ref: 0043540D
GetSystemMetrics.USER32 ref: 00435597
GetSystemMetrics.USER32 ref: 004355C1
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000000), ref: 0043564D
EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000000), ref: 004356A7

Strings

@, xrefs: 00435402
Sat Feb 27 21:25:06 2021, xrefs: 00434744

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prologNameSystemUser$DevicesDisplayEnumInfoMetrics$CloseComputerDefaultGlobalLocaleMemoryOpenQueryStatusValue_strftime
String ID: @$Sat Feb 27 21:25:06 2021
API String ID: 3096134203-514000933
Opcode ID: df27e5044c505d16368d1363ceb059a2a89dfa3b8209105ea31b4170cd4bed2d
Instruction ID: 5d191105e8b00ce633bafd7b15662d37c91273c5253c57f606f37077cfd7677c
Opcode Fuzzy Hash: df27e5044c505d16368d1363ceb059a2a89dfa3b8209105ea31b4170cd4bed2d
Instruction Fuzzy Hash: B9B2F430E042A88BDF25DB74C9517EDBB71AF99304F1095EED4496B242DB381F89CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC56, Relevance: 25.0, APIs: 10, Strings: 4, Instructions: 489libraryloaderencryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CC5B
GetProcAddress.KERNEL32(?,?), ref: 0040CCA4
GetProcAddress.KERNEL32(?,?), ref: 0040CCD4
GetProcAddress.KERNEL32(?,?), ref: 0040CD11
GetProcAddress.KERNEL32(?,?), ref: 0040CD4B
GetProcAddress.KERNEL32(?,?), ref: 0040CD7E
GetProcAddress.KERNEL32(?,?), ref: 0040CDAD
GetProcAddress.KERNEL32(?,011C1E6D), ref: 0040CDED

Part of subcall function 00411440: __EH_prolog.LIBCMT ref: 00411445

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

wsprintfA.USER32 ref: 0040CE4F

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0040B8F6: ___std_fs_copy_file@12.LIBCPMT ref: 0040B91A

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040D0A8

Part of subcall function 00413298: __EH_prolog.LIBCMT ref: 0041329D

Strings

)g|d, xrefs: 0040D101
4., xrefs: 0040D1ED
QPG/, xrefs: 0040D192
5, xrefs: 0040D199

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$H_prolog$Deallocate$CryptDataEnvironmentUnprotectVariable___std_fs_copy_file@12_strcatwsprintf
String ID: )g|d$4.$5$QPG/
API String ID: 740930325-2301880639
Opcode ID: f315ff52a786353694b250e6da2bf3aff65f970575e898e40b62e3d8834bf361
Instruction ID: 0e5721f7104cde5f8c366842c76d6b3f14cc1caa07c2b7b889adf7fe9116307c
Opcode Fuzzy Hash: f315ff52a786353694b250e6da2bf3aff65f970575e898e40b62e3d8834bf361
Instruction Fuzzy Hash: 72120430D04288CFDF11DFA8DD51AEEBBB1AF19304F1081AEE44577292DB785A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0043AFB9, Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

UT, xrefs: 0043B295
/, xrefs: 0043B052

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: b5464781fe5a84c38e0820faa2308cc712eaa3a686132a5c15f37ccbcbfa9213
Instruction ID: d5bc426ad4ff36db7af9ee8f4f475d7f14c34b6c46971f1595f92b0e7f54685e
Opcode Fuzzy Hash: b5464781fe5a84c38e0820faa2308cc712eaa3a686132a5c15f37ccbcbfa9213
Instruction Fuzzy Hash: 1102AC716087819FD725DF65C4807ABB7E4EF98308F04182EEA9587381E738D858CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004275E4, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97stringencryptionCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0042760A
lstrlenW.KERNEL32(00000002), ref: 0042761B
CredEnumerateW.SECHOST(Microsoft_WinInet_*,00000000,00000000,?), ref: 00427644
CryptUnprotectData.CRYPT32(?,00000000,0000004A,00000000,00000000,00000001,?), ref: 0042768A
LocalFree.KERNEL32(?), ref: 004276B4
CredFree.ADVAPI32(?), ref: 004276CD

Strings

abe2869f-9b47-4cd9-a358-c22904dba7f7, xrefs: 004275F8
J, xrefs: 00427624
Microsoft_WinInet_*, xrefs: 0042763F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CredFreelstrlen$CryptDataEnumerateLocalUnprotect
String ID: J$Microsoft_WinInet_*$abe2869f-9b47-4cd9-a358-c22904dba7f7
API String ID: 186292201-3120203912
Opcode ID: a2c1c6675d907e7ed93ce40bf0830536f8be206b907d5269860cc2d1a81c6dec
Instruction ID: e9744e87c18d4c16be1a614e149dafcf262180cb7a373d00189d583a9b129092
Opcode Fuzzy Hash: a2c1c6675d907e7ed93ce40bf0830536f8be206b907d5269860cc2d1a81c6dec
Instruction Fuzzy Hash: D0314675E00618ABCB20CFA9D844EEFBBB9FB84710F54416AE901E3240E7759A01CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041D384, Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 406timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C67E: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0041C86D,00000002,00000000,00000000,00000000,?,?,0041C9A3,?,00000000,00000000), ref: 0041C6B1

_strcat.LIBCMT ref: 0041D4F5
_strcat.LIBCMT ref: 0041D570
SystemTimeToFileTime.KERNEL32(?,000007BC), ref: 0041D6C5
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0041D6E5

Strings

\..\, xrefs: 0041D51F
/..\, xrefs: 0041D557
/../, xrefs: 0041D546
\../, xrefs: 0041D535

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileTime$_strcat$LocalPointerSystem
String ID: /../$/..\$\../$\..\
API String ID: 3418985325-3885502717
Opcode ID: 223ea3b2e7493aa1b9c55a1565bb4c555bba8161fd5844735ba3e0f3b5986458
Instruction ID: 344a52dda1a3dfc27ceb2ea5b45130a1686a83912786a16b2a3951bc4c820ed3
Opcode Fuzzy Hash: 223ea3b2e7493aa1b9c55a1565bb4c555bba8161fd5844735ba3e0f3b5986458
Instruction Fuzzy Hash: 69E1D3B19087419BC315CF28C4816EBBBE1AF89314F14492FE4E9CB341D739E985CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C67C, Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 379memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C681
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,?,00000018,00000003,w,?,?), ref: 0040C94A
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,00000018,00000003,w,?,?,?,?,?,?), ref: 0040C951

Strings

-zLAAHY^, xrefs: 0040CA7C
4, xrefs: 0040C6C3
w, xrefs: 0040C80E

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$FreeH_prologProcess
String ID: -zLAAHY^$4$w
API String ID: 3114893737-646599091
Opcode ID: ef56d705579ee179b80ce3bbf8ed6c41fe074db6d82925d11a613ba46c700fdb
Instruction ID: 46668249d0d926f8e343837e6423b7dbf03d18e4d3b24f2e675b4351ba5b7c57
Opcode Fuzzy Hash: ef56d705579ee179b80ce3bbf8ed6c41fe074db6d82925d11a613ba46c700fdb
Instruction Fuzzy Hash: AFF1AE31C04258CADB25DBA5CD91BEDBBB4AF18304F1082AAD449B7291EB741B89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0043261D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,00000100,00000100,00000000,00000000,?), ref: 00432665
RegQueryValueExW.KERNEL32(00000100,?,00000000,00000000,00000000,?), ref: 00432684
RegQueryValueExW.KERNEL32(00000100,?,00000000,00000000,00000000,?), ref: 004326BF
RegCloseKey.ADVAPI32(00000100), ref: 004326E0

Part of subcall function 004436E1: _free.LIBCMT ref: 004436F4

Strings

Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00432663

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: QueryValue$CloseOpen_free
String ID: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 3744367872-680441574
Opcode ID: 335ac8bf1613e5fca8c227e01b6a20043519dfb87b8bd28c1b3440d276047ed6
Instruction ID: 2fd72cda511239906602c7fff3dd8c1df72fbdad8ccc635aba3b9ae971a40643
Opcode Fuzzy Hash: 335ac8bf1613e5fca8c227e01b6a20043519dfb87b8bd28c1b3440d276047ed6
Instruction Fuzzy Hash: E8319372600209BBEF209F50DD86FAB7768EF48754F108026FC04AA251E3B5DD548B69

Uniqueness

Uniqueness Score: -1.00%

Function 004276D8, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0046AAC0,00000000,00000015,0046AAE0,?), ref: 004276F8
StrStrIW.SHLWAPI(?,0047B744), ref: 00427749
CoTaskMemFree.OLE32(?), ref: 00427767
CoTaskMemFree.OLE32(?), ref: 00427775

Strings

(, xrefs: 0042772D

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FreeTask$CreateInstance
String ID: (
API String ID: 2903366249-3887548279
Opcode ID: f09e6cfb1d33c7561c3484832f848f677ccb786872d055719738f29cfff9ae59
Instruction ID: c7e64b30cce064be94e6f6fa338e57aedc41ff10ee7f362aa19eccce3ea91335
Opcode Fuzzy Hash: f09e6cfb1d33c7561c3484832f848f677ccb786872d055719738f29cfff9ae59
Instruction Fuzzy Hash: C6211974A14219EFDB04DFA5E884D9EB7B9FF88705B50806AE405E7260EB74AD40CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0040C282, Relevance: 7.8, APIs: 5, Instructions: 285memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C287
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0040C39A
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0040C3A1
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 0040C552
HeapFree.KERNEL32(00000000), ref: 0040C559

Part of subcall function 0040B613: __EH_prolog.LIBCMT ref: 0040B618

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$FreeH_prologProcess$Deallocate
String ID:
API String ID: 4229974167-0
Opcode ID: 4d69f01add7aa088bf1e9d67f9b8ecf42228ac5c01eafc19789508b56e9849fa
Instruction ID: 9495dd5e030a742445197d8c10abf0d712dfe69155a7bf6ad3e76e4e361df243
Opcode Fuzzy Hash: 4d69f01add7aa088bf1e9d67f9b8ecf42228ac5c01eafc19789508b56e9849fa
Instruction Fuzzy Hash: 84C13A70C0024CDBCF14EFE5D991AEDBBB5AF18308F60816EE415B7292DB785A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0043BD9C, Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,0043BDCB,?,?,?,?,0040B18D,?,?), ref: 0043BDA8
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,?,?,0043BDCB,?,?), ref: 0043BDD8
GetLastError.KERNEL32(?,?,0043BDCB,?,?,?,?,0040B18D,?,?), ref: 0043BDE5
FindFirstFileExW.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,?,?,0043BDCB,?,?,?,?,0040B18D,?,?), ref: 0043BDFF
GetLastError.KERNEL32(?,?,0043BDCB,?,?,?,?,0040B18D,?,?), ref: 0043BE0C

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$ErrorFileFirstLast$Close
String ID:
API String ID: 569926201-0
Opcode ID: 813f813062f40298b53f8b7b0964e8c01f8b553a0f60951f7515f76e4bc32fc2
Instruction ID: 56da3507dae9d97d4095882fe21d223b31166efbeee73f1208710e195fc8d3ad
Opcode Fuzzy Hash: 813f813062f40298b53f8b7b0964e8c01f8b553a0f60951f7515f76e4bc32fc2
Instruction Fuzzy Hash: CF019231000545BFCB305F66DC0CD9B7F79EBCA720F20462AF764912A0D7358861DAAA

Uniqueness

Uniqueness Score: -1.00%

Function 00433F30, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00433F35
GetTimeZoneInformation.KERNEL32(?,73B024D0,00000000), ref: 00433F52

Part of subcall function 00412383: __EH_prolog.LIBCMT ref: 00412388

Part of subcall function 00412B27: __EH_prolog.LIBCMT ref: 00412B2C
Part of subcall function 00412B27: std::locale::_Init.LIBCPMT ref: 00412B4A

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00434097

Strings

h~G, xrefs: 0043407D, 00434085

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$InformationInitIos_base_dtorTimeZonestd::ios_base::_std::locale::_
String ID: h~G
API String ID: 3259846166-3766600641
Opcode ID: 1470ebf890b115a8ee68ecf8fa9b785132951a91e9411099771f1074f1da788f
Instruction ID: 713f6db98a0ff4f33ef621620150f420701f597d0afd3790d2633f0cfa2399f6
Opcode Fuzzy Hash: 1470ebf890b115a8ee68ecf8fa9b785132951a91e9411099771f1074f1da788f
Instruction Fuzzy Hash: 6C41BE70D04258CBDB11DFA9C8857EEBBB5AF44304F1081AED809B7241DB782B89CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004340EE, Relevance: 6.4, APIs: 4, Instructions: 353registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004340F3
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020119,?,?,?,00000000), ref: 00434191
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000000), ref: 004341DF
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 004341E8

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseDeallocateH_prologOpenQueryValue
String ID:
API String ID: 2130659939-0
Opcode ID: c1a0d08dcef7be247736a08d128f07a4ff51e7eab0d23917b563a7a83d19a5f9
Instruction ID: 5467250d5495fa538ebaa8f224955ed7f96e21c2ac8f6cbab0413431d85b955d
Opcode Fuzzy Hash: c1a0d08dcef7be247736a08d128f07a4ff51e7eab0d23917b563a7a83d19a5f9
Instruction Fuzzy Hash: A4D10670D002589FEF11CFA5D880BEEBB78AF59304F10516FD556B3282D7786A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004317EB, Relevance: 4.6, APIs: 3, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00000000,?,?,?,00432057,00000001,?,?,?,00432190), ref: 0043182C
GetProcAddress.KERNEL32(00000000,?), ref: 00431869
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,00432057,00000001,?,?,?,00432190), ref: 0043189D

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Library$AddressFreeLoadProc
String ID:
API String ID: 145871493-0
Opcode ID: ad2f2cbcefb50bbe3afd8e38885a31a3e327b95c4f60bdc611ed877506952675
Instruction ID: bcb03f3de29e8a9cbbae31be49233d3b75e660e7f4f88a88489b28518b632f13
Opcode Fuzzy Hash: ad2f2cbcefb50bbe3afd8e38885a31a3e327b95c4f60bdc611ed877506952675
Instruction Fuzzy Hash: 2C21F674E052899F9B09DFA898508FFBBB9EE4A344F04117DD845B3211EB348A05C76A

Uniqueness

Uniqueness Score: -1.00%

Function 0044488D, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0044488C,00000000,00000000,?,00000000,?,0044EC4C), ref: 004448AF
TerminateProcess.KERNEL32(00000000,?,0044488C,00000000,00000000,?,00000000,?,0044EC4C), ref: 004448B6
ExitProcess.KERNEL32 ref: 004448C8

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 61cc85caeaa79d5b3bd7c618bd33f18131517add86f9c694e73aba4014625ffd
Instruction ID: a77af6757ffe6cae1a2bd62c5ab8535a028b9554ae4963e05b92ffaaa6c25a0c
Opcode Fuzzy Hash: 61cc85caeaa79d5b3bd7c618bd33f18131517add86f9c694e73aba4014625ffd
Instruction Fuzzy Hash: 1DE04631000988AFEB123F54EC19A193F68FB90341B00042DF81596232DB7ADC51CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 00430780, Relevance: 68.8, APIs: 34, Strings: 5, Instructions: 545filestringmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00430785

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000048), ref: 004309B5
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00430A34
WriteFile.KERNEL32(00000000,?,00000010,?,00000000), ref: 00430A47
CloseHandle.KERNEL32(00000000), ref: 00430A4E
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00430A62
GetFileSize.KERNEL32(00000000,00000000), ref: 00430A71
GetProcessHeap.KERNEL32(00000000,00000800), ref: 00430A82
RtlAllocateHeap.NTDLL(00000000), ref: 00430A89
lstrlenA.KERNEL32 ref: 00430AA0
lstrcpynA.KERNEL32(00000000,00000001), ref: 00430AB5
lstrlenA.KERNEL32(?), ref: 00430AC2
lstrcpynA.KERNEL32(?,?,00000001), ref: 00430AD1
ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 00430AE8
lstrlenA.KERNEL32(?), ref: 00430AFE
lstrcpynA.KERNEL32(?,?,00000001), ref: 00430B11
WinHttpSetOption.WINHTTP(00000000,00000000,00000000,00000000,00000000), ref: 00430B22
WinHttpSetOption.WINHTTP(00000000,00000006,?,00000004), ref: 00430B43
WinHttpSetOption.WINHTTP(00000000,00000005,000F4240,00000004), ref: 00430B4E
WinHttpConnect.WINHTTP(00000000,00000000,000001BB,00000000,?), ref: 00430BED
WinHttpConnect.WINHTTP(00000000,00000000,00000050,00000000,?), ref: 00430C4E
WinHttpOpenRequest.WINHTTP(00000000,POST,00000000,00000000,00000000,00000000,00800100,?), ref: 00430CD4
WinHttpOpenRequest.WINHTTP(00000000,POST,00000000,00000000,00000000,00000000,00000100,?), ref: 00430D3C
WinHttpSendRequest.WINHTTP(00000000,00000000,000000FF,00000008,?,?,00000000,?), ref: 00430DA9
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 00430DD1

Part of subcall function 0043595A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,?,?,?,?,0043147A,?,00000080,00000000,?,0000000F), ref: 0043597F
Part of subcall function 0043595A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,0043147A,?,00000080,00000000), ref: 004359B4

WinHttpQueryDataAvailable.WINHTTP(00000000,?), ref: 00430DE7
WinHttpReadData.WINHTTP(00000000,00000000,?,?), ref: 00430E25
WinHttpCloseHandle.WINHTTP(00000000), ref: 00430EBC
WinHttpCloseHandle.WINHTTP(00000000), ref: 00430EC6
CloseHandle.KERNEL32(?), ref: 00430ECF
DeleteFileA.KERNEL32(?), ref: 00430ED8
WinHttpCloseHandle.WINHTTP(00000000), ref: 00430EDF
GetProcessHeap.KERNEL32(00000000,00000010), ref: 00430EE9
HeapFree.KERNEL32(00000000), ref: 00430EF0

Strings

"; filename=", xrefs: 004308BC
%[^:]://%[^/]%[^], xrefs: 00430B65
POST, xrefs: 00430CCE, 00430D36
`+No, xrefs: 00430EBC, 00430EC6, 00430EDF
https, xrefs: 00430B78

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Http$File$CloseHandle$Heap$OptionRequestlstrcpynlstrlen$ByteCharConnectCreateDataDeleteMultiOpenProcessReadWide$AllocateAvailableDeallocateFreeH_prologQueryReceiveResponseSendSizeWrite
String ID: "; filename="$%[^:]://%[^/]%[^]$POST$`+No$https
API String ID: 2499770551-692179977
Opcode ID: 1e6fc0b66a3034961baf47ab15d9adce1d6cb1dcf8a3a3e26eb3202988ca57f5
Instruction ID: 6fed158f3f9f44cf516d2b3fb4d9f9781e674f73073fce5f37d4e55622aba552
Opcode Fuzzy Hash: 1e6fc0b66a3034961baf47ab15d9adce1d6cb1dcf8a3a3e26eb3202988ca57f5
Instruction Fuzzy Hash: 1C22BD70C002599FDB11DBA4CD55BEEBBB4BF19304F0042AAE409B7251EB785E88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0043130D, Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 268fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00431312
WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,0000000F,00000000), ref: 0043134A
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000002,00000080,00000000,?,0000000F,00000000), ref: 0043136E
WinHttpConnect.WINHTTP(?,00000000,000001BB,00000000,?,00000080,00000000,?,0000000F,00000000), ref: 00431439

Part of subcall function 0043595A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,?,?,?,?,0043147A,?,00000080,00000000,?,0000000F), ref: 0043597F
Part of subcall function 0043595A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,0043147A,?,00000080,00000000), ref: 004359B4

WinHttpConnect.WINHTTP(?,00000000,00000050,00000000,?,00000080,00000000,?,0000000F,00000000), ref: 00431488
WinHttpOpenRequest.WINHTTP(00000000,GET,00000000,00000000,00000000,00000000,00800100,?,?,0000000F,00000000), ref: 004314FA
WinHttpOpenRequest.WINHTTP(00000000,GET,00000000,00000000,00000000,00000000,00000100,?,?,0000000F,00000000), ref: 0043155B
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0000000F,00000000), ref: 0043158B
WinHttpReceiveResponse.WINHTTP(00000000,00000000,?,0000000F,00000000), ref: 00431597
WinHttpQueryDataAvailable.WINHTTP(00000000,?,?,0000000F,00000000), ref: 004315A9
WinHttpReadData.WINHTTP(00000000,00000000,?,?,?,?,?,?,?,?,0000000F,00000000), ref: 004315D9
WriteFile.KERNEL32(?,00000000,00000000,C1C1DD4A,00000000,?,?,?,?,?,?,?,?,?,0000000F,00000000), ref: 004315F0
GetLastError.KERNEL32(?,0000000F,00000000), ref: 0043160D
WinHttpCloseHandle.WINHTTP(00000000,?,0000000F,00000000), ref: 00431614
WinHttpCloseHandle.WINHTTP(00000000,?,0000000F,00000000), ref: 0043161E
CloseHandle.KERNEL32(?,00000080,00000000,?,0000000F,00000000), ref: 00431627
WinHttpCloseHandle.WINHTTP(?,?,0000000F,00000000), ref: 0043162E

Strings

GET, xrefs: 004314F4, 00431555
%99[^:]://%99[^/]%99[^], xrefs: 00431394
`+No, xrefs: 00431614, 0043161E, 0043162E

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Http$CloseHandle$OpenRequest$ByteCharConnectDataFileMultiWide$AvailableCreateErrorH_prologLastQueryReadReceiveResponseSendWrite
String ID: %99[^:]://%99[^/]%99[^]$GET$`+No
API String ID: 4006077129-2781139399
Opcode ID: fb11d322aab1739ab8c58154d35ba2ff455bdb975650aac337324e029d3d90b8
Instruction ID: 1c01f850f0870dc88b7e3a1b637a72b4c309a6d7d05c8ea25c072e85805b2afb
Opcode Fuzzy Hash: fb11d322aab1739ab8c58154d35ba2ff455bdb975650aac337324e029d3d90b8
Instruction Fuzzy Hash: 2FA19071900219AFDB11DBA0DD85FEEB7B8FF09308F10406AE405A7251DBB85E49CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00430F27, Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00430F2C
WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,00488B48,00000000), ref: 00430F75
WinHttpConnect.WINHTTP(00000000,00000000,000001BB,00000000,?,?,?,?,00488B48,00000000), ref: 00431044

Part of subcall function 0043595A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,?,?,?,?,0043147A,?,00000080,00000000,?,0000000F), ref: 0043597F
Part of subcall function 0043595A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,0043147A,?,00000080,00000000), ref: 004359B4

WinHttpConnect.WINHTTP(00000000,00000000,00000050,00000000,?,?,?,?,00488B48,00000000), ref: 00431098
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00800100,?,?,?,?,00488B48,00000000), ref: 0043111B
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00000100,?,?,?,?,00488B48,00000000), ref: 0043118D
_strlen.LIBCMT ref: 004311BB
_strlen.LIBCMT ref: 004311C5
WinHttpSendRequest.WINHTTP(00000000,Content-Type: text/plain; charset=UTF-8,000000FF,?,00000000,00000000,00000000,?,?,?,00488B48,00000000), ref: 004311DC
WinHttpReceiveResponse.WINHTTP(00000000,00000000,?,?,?,00488B48,00000000), ref: 004311EE
WinHttpQueryDataAvailable.WINHTTP(00000000,?,?,?,?,00488B48,00000000), ref: 00431206
WinHttpReadData.WINHTTP(00000000,00000000,?,?,?,?,?,?,?,?,00488B48,00000000), ref: 0043123B
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,00488B48,00000000), ref: 004312E5
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,00488B48,00000000), ref: 004312EF
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,00488B48,00000000), ref: 004312F6

Strings

Content-Type: text/plain; charset=UTF-8, xrefs: 004311D6
%99[^:]://%99[^/]%99[^], xrefs: 00430F9D
`+No, xrefs: 004312E5, 004312EF, 004312F6

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Http$CloseHandleOpenRequest$ByteCharConnectDataMultiWide_strlen$AvailableH_prologQueryReadReceiveResponseSend
String ID: %99[^:]://%99[^/]%99[^]$Content-Type: text/plain; charset=UTF-8$`+No
API String ID: 3111926358-2212314863
Opcode ID: 40e765ad3ea992162b6a33c1829bcec4b6a53b731401ccebe6e3fe3a007023e5
Instruction ID: 5503aac3afa8554d78773588f8e2d7f5ec65dc89f9f546babbb0b89a0d28148e
Opcode Fuzzy Hash: 40e765ad3ea992162b6a33c1829bcec4b6a53b731401ccebe6e3fe3a007023e5
Instruction Fuzzy Hash: 2CC19F709012189FDB15DFA4CD45AEEBBB4FF09304F1041AEE805E7251EB789A85CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0043203C, Relevance: 28.6, APIs: 3, Strings: 16, Instructions: 102stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004317EB: LoadLibraryA.KERNEL32(?,?,?,00000000,?,?,?,00432057,00000001,?,?,?,00432190), ref: 0043182C
Part of subcall function 004317EB: GetProcAddress.KERNEL32(00000000,?), ref: 00431869
Part of subcall function 004317EB: FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,00432057,00000001,?,?,?,00432190), ref: 0043189D

Part of subcall function 00431C49: RegOpenKeyExW.KERNEL32(80000001,00432190,00000000,00020019,00432190,?,?,00432066,00000001,?,?,?,00432190), ref: 00431C6E
Part of subcall function 00431C49: RegEnumKeyExW.ADVAPI32 ref: 00431CFF
Part of subcall function 00431C49: RegCloseKey.ADVAPI32(00432190,?,?,00432066,00000001,?,?,?,00432190), ref: 00431D0C

Part of subcall function 00431D16: RegOpenKeyExW.KERNEL32(80000001,00432190,00000000,00020019,00432190,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431D3D
Part of subcall function 00431D16: RegEnumKeyExW.ADVAPI32 ref: 00431D68
Part of subcall function 00431D16: lstrlenW.KERNEL32(00432190,00000000,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431D7F
Part of subcall function 00431D16: lstrlenW.KERNEL32(?,00000000,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431D8C
Part of subcall function 00431D16: lstrcpyW.KERNEL32(00000000,00432190), ref: 00431DAD
Part of subcall function 00431D16: lstrcatW.KERNEL32(00000000,0047C064), ref: 00431DB9
Part of subcall function 00431D16: lstrcatW.KERNEL32(00000000,?), ref: 00431DC7
Part of subcall function 00431D16: lstrcatW.KERNEL32(00000000,?), ref: 00431DD3
Part of subcall function 00431D16: RegEnumKeyExW.ADVAPI32 ref: 00431E0D
Part of subcall function 00431D16: RegCloseKey.ADVAPI32(00432190,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431E22

Part of subcall function 0043261D: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,00000100,00000100,00000000,00000000,?), ref: 00432665
Part of subcall function 0043261D: RegQueryValueExW.KERNEL32(00000100,?,00000000,00000000,00000000,?), ref: 00432684
Part of subcall function 0043261D: RegQueryValueExW.KERNEL32(00000100,?,00000000,00000000,00000000,?), ref: 004326BF
Part of subcall function 0043261D: RegCloseKey.ADVAPI32(00000100), ref: 004326E0

lstrlenW.KERNEL32(00000000,?,?,?,00432190), ref: 0043209E
lstrcpyW.KERNEL32(00000000,00000000), ref: 004320B6
lstrcpyW.KERNEL32(00000000,\Accounts), ref: 004320C2

Part of subcall function 00431C49: lstrlenW.KERNEL32(00432190,?,?,00432066,00000001,?,?,?,00432190), ref: 00431C94
Part of subcall function 00431C49: lstrcpyW.KERNEL32(00000000,00432190), ref: 00431CB1
Part of subcall function 00431C49: lstrcatW.KERNEL32(00000000,0047C064), ref: 00431CBD
Part of subcall function 00431C49: lstrcatW.KERNEL32(00000000,?), ref: 00431CCB

Part of subcall function 004436E1: _free.LIBCMT ref: 004436F4

Strings

Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook, xrefs: 0043212A
Software\Microsoft\Internet Account Manager, xrefs: 00432084
\Accounts, xrefs: 004320BC
Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook, xrefs: 0043211C
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook, xrefs: 00432100
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook, xrefs: 00432154
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings, xrefs: 004320F5
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook, xrefs: 00432168
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 004320E3
\Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00432066
Identities, xrefs: 00432070
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook, xrefs: 00432138
Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook, xrefs: 0043210E
Software\Microsoft\Internet Account Manager\Accounts, xrefs: 0043205A
Outlook, xrefs: 0043207F
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook, xrefs: 00432146

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$lstrcpylstrlen$CloseEnumOpen$LibraryQueryValue$AddressFreeLoadProc_free
String ID: Identities$Outlook$Software\Microsoft\Internet Account Manager$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook$\Accounts$\Software\Microsoft\Internet Account Manager\Accounts
API String ID: 527226083-92925148
Opcode ID: d50edf6d6970c4d1acb825545db765d30e4cf2ccafa5fa13097266903facb991
Instruction ID: 82a37be0e5257f30cdacc7d49cc15ce2feca43b8d7eb9551cc6de7cc5ffb2a6e
Opcode Fuzzy Hash: d50edf6d6970c4d1acb825545db765d30e4cf2ccafa5fa13097266903facb991
Instruction Fuzzy Hash: 49313E71944209BEE704EBE1DDC3DEE73ACDB1A748F30546EF01522192AFBC2E049629

Uniqueness

Uniqueness Score: -1.00%

Function 00410027, Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 477librarystringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041002C

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

LoadLibraryA.KERNEL32(00000000), ref: 00410066
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000), ref: 0041009E
lstrcatW.KERNEL32(?,?), ref: 004100E1

Part of subcall function 0040C282: __EH_prolog.LIBCMT ref: 0040C287
Part of subcall function 0040C282: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0040C39A
Part of subcall function 0040C282: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0040C3A1

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Part of subcall function 0040C67C: __EH_prolog.LIBCMT ref: 0040C681

FreeLibrary.KERNEL32(00000000), ref: 004106AD

Strings

/gF\[@]V, xrefs: 0041060A
jn, xrefs: 00410644
Opera, xrefs: 004100EB
0+6=, xrefs: 0041063D
>:, xrefs: 00410492
8#>5, xrefs: 0041040A

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$FreeHeapLibrary$DeallocateEnvironmentFolderLoadPathProcessSpecialVariable_strcatlstrcat
String ID: /gF\[@]V$0+6=$8#>5$>:$Opera$jn
API String ID: 1063041688-1246527357
Opcode ID: d0e38640756b890881db13cba5fa7d59a08ac765f7f965d2a1ba349646014ae2
Instruction ID: a7359a1e55a42cccbe44533c249f4d2606b43d5727ace50e7fe4a5537cb13dfa
Opcode Fuzzy Hash: d0e38640756b890881db13cba5fa7d59a08ac765f7f965d2a1ba349646014ae2
Instruction Fuzzy Hash: E612D470D00209DFDF14EFA5C985BEEBBB4AF14309F10416EE40577282DB785A99CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00461E3E, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00461AF7: CreateFileW.KERNEL32(00000000,00000000,?,00461EE7,?,?,00000000,?,00461EE7,00000000,0000000C), ref: 00461B14

GetLastError.KERNEL32 ref: 00461F52
__dosmaperr.LIBCMT ref: 00461F59
GetFileType.KERNEL32(00000000), ref: 00461F65
GetLastError.KERNEL32 ref: 00461F6F
__dosmaperr.LIBCMT ref: 00461F78
CloseHandle.KERNEL32(00000000), ref: 00461F98
CloseHandle.KERNEL32(00458589), ref: 004620E5
GetLastError.KERNEL32 ref: 00462117
__dosmaperr.LIBCMT ref: 0046211E

Strings

H, xrefs: 004620A3

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: a2ab918b268326ed6d12ddd76ad3f347e090e0f58a2ccf069daa2d58901e68c2
Instruction ID: 09915bd9d0339093576449c97bffbc41ae11e3c9c779b3db6acc035d496bae27
Opcode Fuzzy Hash: a2ab918b268326ed6d12ddd76ad3f347e090e0f58a2ccf069daa2d58901e68c2
Instruction Fuzzy Hash: 6EA15B32A041449FDF19DF68DC517AE3BA0EB46324F18015EFC01AB3A2E7799D16CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D978, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 192filetimeCOMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0041DA3F
wsprintfA.USER32 ref: 0041DA99
wsprintfA.USER32 ref: 0041DABA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000010,00000000), ref: 0041DAE9
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0041DB5B
SetFileTime.KERNEL32(?,?,?,?), ref: 0041DB95
CloseHandle.KERNEL32(?), ref: 0041DBA5

Strings

:, xrefs: 0041DA73
%s%s, xrefs: 0041DAB4
%s%s%s, xrefs: 0041DA93

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$wsprintf$CloseCreateHandleTimeWrite_strcat
String ID: %s%s$%s%s%s$:
API String ID: 840165387-3034790606
Opcode ID: d87ac6ac1ea1a5690fa4f9f73ad915c6b3e6e60d952e8f95b76d82dcb37f6ee5
Instruction ID: 76b0c4d44bdaf7f51e2569e8fcad0bb5c978f7eb81ecf08387822187f667ad82
Opcode Fuzzy Hash: d87ac6ac1ea1a5690fa4f9f73ad915c6b3e6e60d952e8f95b76d82dcb37f6ee5
Instruction Fuzzy Hash: 146138F1D082089BCB21DF24C884BEB77A9AF45344F1041ABE4DA97251D778AEC5CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00435AE5, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?), ref: 00435AF7
OpenProcessToken.ADVAPI32(00000000), ref: 00435AFE
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00435B18
GetLastError.KERNEL32 ref: 00435B22
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00435B32
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 00435B46
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00435B5A
GlobalFree.KERNEL32 ref: 00435B7A

Strings

S-1-5-18, xrefs: 00435B67

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Token$GlobalInformationProcess$AllocConvertCurrentErrorFreeLastOpenString
String ID: S-1-5-18
API String ID: 857934279-4289277601
Opcode ID: c44014936695b38aca7376c6fa8ada0fb1acfe2052eafd2f0cf99a8379d8b802
Instruction ID: 01020f8eb93adfefab83419b90c86ea727b7d0a7b0db263145182134659ecc31
Opcode Fuzzy Hash: c44014936695b38aca7376c6fa8ada0fb1acfe2052eafd2f0cf99a8379d8b802
Instruction Fuzzy Hash: 85113D75A00508BFDB109FA1DC08FAFBF78EF48765F105065F901E1060EB749A14DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00431D16, Relevance: 15.1, APIs: 10, Instructions: 102stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00432190,00000000,00020019,00432190,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431D3D
RegEnumKeyExW.ADVAPI32 ref: 00431D68
lstrlenW.KERNEL32(00432190,00000000,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431D7F
lstrlenW.KERNEL32(?,00000000,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431D8C
lstrcpyW.KERNEL32(00000000,00432190), ref: 00431DAD
lstrcatW.KERNEL32(00000000,0047C064), ref: 00431DB9
lstrcatW.KERNEL32(00000000,?), ref: 00431DC7
lstrcatW.KERNEL32(00000000,?), ref: 00431DD3
RegEnumKeyExW.ADVAPI32 ref: 00431E0D
RegCloseKey.ADVAPI32(00432190,?,?,?,0043207A,Identities,00000001,?,?,?,00432190), ref: 00431E22

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Enumlstrlen$CloseOpenlstrcpy
String ID:
API String ID: 3646165539-0
Opcode ID: a3207345332e45b9df0891e319527263b2626cf9dba7619531803d50d71b554b
Instruction ID: 682fd365bd49df1a4e63cd25a4626de01840a21593636839d4f0da0240ced08e
Opcode Fuzzy Hash: a3207345332e45b9df0891e319527263b2626cf9dba7619531803d50d71b554b
Instruction Fuzzy Hash: D2314E71500149BBEB109F91DC88EFF7BBCEB86744F00006AF905E2210EB78AA519A66

Uniqueness

Uniqueness Score: -1.00%

Function 004574FD, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14f9e145135ec6f380c196397b153625a286dd2879a07ee0a7505f6561eb061
Instruction ID: 5306b8e490c5e10bf1624fe7beb597dddaf6ceeebc72f6c2e6ff11491fd69489
Opcode Fuzzy Hash: e14f9e145135ec6f380c196397b153625a286dd2879a07ee0a7505f6561eb061
Instruction Fuzzy Hash: 82C1F570E08209AFDF15DF99E885BAE7BB0AF49315F10406AEC0097393D778AD05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00412D24, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412D29
std::_Lockit::_Lockit.LIBCPMT ref: 00412D37
int.LIBCPMT ref: 00412D4E

Part of subcall function 00409F47: std::_Lockit::_Lockit.LIBCPMT ref: 00409F58
Part of subcall function 00409F47: std::_Lockit::~_Lockit.LIBCPMT ref: 00409F72

std::_Facet_Register.LIBCPMT ref: 00412D88
std::_Lockit::~_Lockit.LIBCPMT ref: 00412D9E
Concurrency::cancel_current_task.LIBCPMT ref: 00412DB3

Strings

L:A, xrefs: 00412D53, 00412D6A

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prologRegister
String ID: L:A
API String ID: 2251497708-2729640649
Opcode ID: 25b3eb20697e28002775a93233642cb538c444d0237f6ab081d3b51819e60a33
Instruction ID: 352acbcdb3d7d2a5d767bae46c77123d379d9568ab97169d88a23be55f79c0b0
Opcode Fuzzy Hash: 25b3eb20697e28002775a93233642cb538c444d0237f6ab081d3b51819e60a33
Instruction Fuzzy Hash: C711CE729001259BCB14EB65D915AEE7774EF44728F10452FF824B7281DBB89D00CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00431C49, Relevance: 10.6, APIs: 7, Instructions: 75stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00432190,00000000,00020019,00432190,?,?,00432066,00000001,?,?,?,00432190), ref: 00431C6E
lstrlenW.KERNEL32(00432190,?,?,00432066,00000001,?,?,?,00432190), ref: 00431C94
lstrcpyW.KERNEL32(00000000,00432190), ref: 00431CB1
lstrcatW.KERNEL32(00000000,0047C064), ref: 00431CBD
lstrcatW.KERNEL32(00000000,?), ref: 00431CCB
RegEnumKeyExW.ADVAPI32 ref: 00431CFF
RegCloseKey.ADVAPI32(00432190,?,?,00432066,00000001,?,?,?,00432190), ref: 00431D0C

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$CloseEnumOpenlstrcpylstrlen
String ID:
API String ID: 2943937744-0
Opcode ID: 1e489a97854d06cbe25712701f02efd73a01f1570e343bca682181b8e7a455b6
Instruction ID: 86a6f6f62856410c6e5e50ee577fa3bc7831f6f4e17b99f61a961d8668a7ca1a
Opcode Fuzzy Hash: 1e489a97854d06cbe25712701f02efd73a01f1570e343bca682181b8e7a455b6
Instruction Fuzzy Hash: 95216A76401128BFEB119F91DD48EEF7B7CEF0A355F0040A6F905E2110EA74AB50DEAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042E02C, Relevance: 9.5, APIs: 1, Strings: 5, Instructions: 474stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0043289E: GetCurrentProcess.KERNEL32(00020008,?), ref: 004328B6
Part of subcall function 0043289E: OpenProcessToken.ADVAPI32(00000000), ref: 004328BD
Part of subcall function 0043289E: GetUserProfileDirectoryA.USERENV(?,?,00000200), ref: 004328CF
Part of subcall function 0043289E: CloseHandle.KERNEL32(?,?,00000200), ref: 004328DC

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E752

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0042951B: __EH_prolog.LIBCMT ref: 00429520
Part of subcall function 0042951B: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0042954E
Part of subcall function 0042951B: GetDesktopWindow.USER32 ref: 00429554
Part of subcall function 0042951B: GetWindowRect.USER32 ref: 00429561
Part of subcall function 0042951B: GetWindowDC.USER32(00000000), ref: 00429568
Part of subcall function 0042951B: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00429588
Part of subcall function 0042951B: CreateCompatibleDC.GDI32(00000000), ref: 00429591
Part of subcall function 0042951B: CreateDIBSection.GDI32(?,00000028,00000001,?,00000000,00000000), ref: 004295DC
Part of subcall function 0042951B: DeleteDC.GDI32(00000000), ref: 004295F0
Part of subcall function 0042951B: DeleteDC.GDI32(?), ref: 004295F5
Part of subcall function 0042951B: GdiplusShutdown.GDIPLUS(?), ref: 0042971D

Part of subcall function 0040BED4: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,?,?,?,?,?,00000000,00000000,?), ref: 0040BEE7
Part of subcall function 0040BED4: DeleteFileTransactedA.KERNEL32 ref: 0040BEFE
Part of subcall function 0040BED4: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,?,?,?,00418431,00000012,00000000), ref: 0040BF09

Strings

], xrefs: 0042E7F2
0z, xrefs: 0042E611, 0042E64E, 0042E6F2
:, xrefs: 0042E33F
m, xrefs: 0042E050
w, xrefs: 0042E5BA, 0042E701, 0042E794, 0042E79F, 0042E7AE, 0042E7D9

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateDeleteWindow$GdiplusH_prologProcessTransaction$CapsCloseCommitCompatibleCurrentDesktopDeviceDirectoryEnvironmentFileHandleOpenProfileRectSectionShutdownStartupTokenTransactedUserVariable_strcatlstrlen
String ID: :$]$m$0z$w
API String ID: 770976548-3989473008
Opcode ID: ee883791ed95f9ec22b8f95cad1d18a7268d8f3d63184f1593e17f05f2f19aec
Instruction ID: f3a0844f6c003b919df41d57a3963a0c88c55c5e4afa7a0007df65931e678e6c
Opcode Fuzzy Hash: ee883791ed95f9ec22b8f95cad1d18a7268d8f3d63184f1593e17f05f2f19aec
Instruction Fuzzy Hash: 1C126B34A452A8DACF24EB65CCA6BDCB7705F25304F0400EEA559372C3DA791F89CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004357D2, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004357D7
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020119,?,73B024D0,00000000,00000000), ref: 00435858
RegQueryValueExA.KERNEL32(?,?,00000000,?,?,00000040), ref: 004358A7
RegCloseKey.KERNEL32(?), ref: 004358C8

Strings

@, xrefs: 00435811

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseH_prologOpenQueryValue
String ID: @
API String ID: 1233982722-2766056989
Opcode ID: 9da8022e61a37c3df1fc7f441767f099e0dc3ae2aff07a4b8969baff082f8cdf
Instruction ID: b7e32cc2314a5c0de5b6252da53b812068159864ebe3d2b5c7b4ee0bdff28ff3
Opcode Fuzzy Hash: 9da8022e61a37c3df1fc7f441767f099e0dc3ae2aff07a4b8969baff082f8cdf
Instruction Fuzzy Hash: A5418870D0125CDFDB11DFA8D980AEEBBB8BF09304F10516EE449B3202EB744A89CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004535BE, Relevance: 7.7, APIs: 5, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00456E3E: RtlAllocateHeap.NTDLL(00000000,0043C5A8,00000000,?,0043E9CE,00000002,00000000,?,?,?,00409826,0043C5A8,00000004,00000000,00000000,00000000), ref: 00456E70

_free.LIBCMT ref: 004536CD
_free.LIBCMT ref: 004536E4
_free.LIBCMT ref: 00453701
_free.LIBCMT ref: 0045371C
_free.LIBCMT ref: 00453733

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: fd28247c8caa39f5ea49148706bf41311fb03f046f82429c29a319f9996bed9d
Instruction ID: 2cf137ed7e32b4c02dd87b7ea7e9ab2e87873982227e1c7af0729e04e93f70e3
Opcode Fuzzy Hash: fd28247c8caa39f5ea49148706bf41311fb03f046f82429c29a319f9996bed9d
Instruction Fuzzy Hash: AE51D071A00704AFDB21DF29C841BAA77F4EF48766B14456EEC09D7352E739EA05CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0041D8B5, Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,?), ref: 0041D8C9
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041D8D7
_strcat.LIBCMT ref: 0041D93D
GetFileAttributesA.KERNEL32(00000000,00000000,?), ref: 0041D95A
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041D96E

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesCreateDirectoryFile$_strcat
String ID:
API String ID: 2481838186-0
Opcode ID: ca001c5a5a48e030ed37f07bc623ae4318933dd9efccb6ace202bd5980fc69f1
Instruction ID: 8b3a7ea9be6638ed6ef07da250d3149abca588a23539853492ae5ff7bd0a59dd
Opcode Fuzzy Hash: ca001c5a5a48e030ed37f07bc623ae4318933dd9efccb6ace202bd5980fc69f1
Instruction Fuzzy Hash: 7B1129F5D0071457CB206A785C88BDB776C5F56324F1402A7E561E32C2EAB84DC58A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00435D47, Relevance: 6.1, APIs: 4, Instructions: 71processCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00435D7C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00435E07
CloseHandle.KERNEL32(?), ref: 00435E10
CloseHandle.KERNEL32(?), ref: 00435E19

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseHandle$CreateFileModuleNameProcess
String ID:
API String ID: 2820832629-0
Opcode ID: c26a7c2eaeff277715efd929f57ef2b16c6f3d61418d3040a7e54852adebb0e1
Instruction ID: 079f66fdcc7f35f3ae98fe0168e5c17a7f738a2d2f35e493a4afb3c6356bcf07
Opcode Fuzzy Hash: c26a7c2eaeff277715efd929f57ef2b16c6f3d61418d3040a7e54852adebb0e1
Instruction Fuzzy Hash: 04218072D1064CBBEB018BA8DC85EEEB77CEF19308F005166F649B1021F6706A998B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF23, Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,004183BB,00000000), ref: 0040BF37
CreateDirectoryTransactedA.KERNEL32 ref: 0040BF50
CommitTransaction.KTMW32(00000000,?,004183BB,00000000), ref: 0040BF5B
RollbackTransaction.KTMW32(00000000,?,004183BB,00000000), ref: 0040BF63

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$Create$CommitDirectoryRollbackTransacted
String ID:
API String ID: 629542334-0
Opcode ID: 158c26d427eae19f32f05e9de73e276b4b4dba04ee7218db9c4d8c9f345e4641
Instruction ID: 35c23e92e9ecbea8ea6687bc2a7e9fcd8d571b33fc76cd65221d4350dc3a4c9c
Opcode Fuzzy Hash: 158c26d427eae19f32f05e9de73e276b4b4dba04ee7218db9c4d8c9f345e4641
Instruction Fuzzy Hash: B3F09072101116BFE71016A99C88C673B2CDB457B47200236F912F32E0A7B49C518AFF

Uniqueness

Uniqueness Score: -1.00%

Function 0042973C, Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000), ref: 0042974F
RemoveDirectoryTransactedA.KERNEL32 ref: 00429766
CommitTransaction.KTMW32(00000000,?,00000000), ref: 00429771
RollbackTransaction.KTMW32(00000000,?,00000000), ref: 00429779

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CommitCreateDirectoryRemoveRollbackTransacted
String ID:
API String ID: 1201024725-0
Opcode ID: 96aec554fd131828732fcca28137729baf3983f981fc7cce07a08cfd1ecaa28c
Instruction ID: 9d6c7fb89234dfb2b7da80a627c052a58c55c17b734c25fc8cc05724059cd34e
Opcode Fuzzy Hash: 96aec554fd131828732fcca28137729baf3983f981fc7cce07a08cfd1ecaa28c
Instruction Fuzzy Hash: 50F05471210520FFDB105B69AC08D67366CE7C5770F540625F912D22D0E6B45D418ABB

Uniqueness

Uniqueness Score: -1.00%

Function 0040BED4, Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,?,?,?,?,?,00000000,00000000,?), ref: 0040BEE7
DeleteFileTransactedA.KERNEL32 ref: 0040BEFE
CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,?,?,?,00418431,00000012,00000000), ref: 0040BF09
RollbackTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,?,?,?,00418431,00000012,00000000), ref: 0040BF11

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CommitCreateDeleteFileRollbackTransacted
String ID:
API String ID: 3802493581-0
Opcode ID: 8a1692ceb7c8e785c4e15fa7f1df9ef09bcde19464a01561b74476faa2ed77d3
Instruction ID: b20e7c24abbca299f4886384c40fd0f18d6c1ec2c726e9b6c70f9eb4685d86e5
Opcode Fuzzy Hash: 8a1692ceb7c8e785c4e15fa7f1df9ef09bcde19464a01561b74476faa2ed77d3
Instruction Fuzzy Hash: 36F03071100511ABDB101A699C08D67366CD786760B240A35F912E32D0E7B45D418ABF

Uniqueness

Uniqueness Score: -1.00%

Function 0043289E, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,?), ref: 004328B6
OpenProcessToken.ADVAPI32(00000000), ref: 004328BD
GetUserProfileDirectoryA.USERENV(?,?,00000200), ref: 004328CF
CloseHandle.KERNEL32(?,?,00000200), ref: 004328DC

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$CloseCurrentDirectoryHandleOpenProfileTokenUser
String ID:
API String ID: 1246687928-0
Opcode ID: 06460245509d9519c63c6540e410947e279762dcf9780fdc2d03f20ef9c2b1ac
Instruction ID: 277a262a90e71acb9dcef155da2c07437817cdf585eeb6e644afea71791051a1
Opcode Fuzzy Hash: 06460245509d9519c63c6540e410947e279762dcf9780fdc2d03f20ef9c2b1ac
Instruction Fuzzy Hash: D1F01CB1510214BBEB14AFA0DD49EAB7AACEB05240F140175E802E1110E6B4DE14AA6A

Uniqueness

Uniqueness Score: -1.00%

Function 00409EA6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00409EC3
std::_Lockit::~_Lockit.LIBCPMT ref: 00409F34

Part of subcall function 004436E1: _free.LIBCMT ref: 004436F4

Strings

L:A, xrefs: 00409EA6

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~__free
String ID: L:A
API String ID: 2189227594-2729640649
Opcode ID: bca26dbab975e666f9fe3643682765f5139a3f11e3725e5f52093b904a126a08
Instruction ID: 98d8e4cdeaf16e476ec83fbad1d86e13dba8e4bf4d18f39bfcffbd8e7f2faa7d
Opcode Fuzzy Hash: bca26dbab975e666f9fe3643682765f5139a3f11e3725e5f52093b904a126a08
Instruction Fuzzy Hash: 4A116031404B01EFD6369F0AE942617F7F4EF84B11B208A2FE05691A91CB39A946AF4C

Uniqueness

Uniqueness Score: -1.00%

Function 00455AB1, Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00455246: GetConsoleCP.KERNEL32(00443405,00000000,00000000), ref: 0045528E

WriteFile.KERNEL32(?,00000000,00000000,00483D78,00000000,00000000,00000000,00000000,00000000,00483D78,00000010,00443405,00000000,00000000,00000000,?), ref: 00455C02
GetLastError.KERNEL32 ref: 00455C0C
__dosmaperr.LIBCMT ref: 00455C51

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: c92ef604634ecd77fb2e66c07651433db38b2f6019c8c677a311b5d8b5ac1d0c
Instruction ID: 24d6bdc5123d86c2ab7e4f1bc00e81943fb2dc7835aa9c7cf436a2a5625c3fda
Opcode Fuzzy Hash: c92ef604634ecd77fb2e66c07651433db38b2f6019c8c677a311b5d8b5ac1d0c
Instruction Fuzzy Hash: F851C371900A09AFEF119BA4C895BFF7BB8EF0531AF150017E900A7253D638AD498B69

Uniqueness

Uniqueness Score: -1.00%

Function 00450276, Relevance: 4.6, APIs: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

_free.LIBCMT ref: 00450325
_free.LIBCMT ref: 00450353
_free.LIBCMT ref: 0045039B

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 17581fddd82f8c9a0644c0ec09c22c2070805e2c9cc7fdd68c4af41cd5b15490
Instruction ID: 9d0120cef7dad2a7d9509e269d07667168a44f3a1821887a5ff409a128564b67
Opcode Fuzzy Hash: 17581fddd82f8c9a0644c0ec09c22c2070805e2c9cc7fdd68c4af41cd5b15490
Instruction Fuzzy Hash: 50417A35600605AFD724DFACC885A6AB3E8FF49315B24056EFC05C7392D735EC189B48

Uniqueness

Uniqueness Score: -1.00%

Function 004503DA, Relevance: 4.6, APIs: 3, Instructions: 96COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00450406
__cftoe.LIBCMT ref: 00450438
_free.LIBCMT ref: 0045045E

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __cftoe$_free
String ID:
API String ID: 1303422935-0
Opcode ID: 0fce6a8d1eb35eb033ab67290ff2a7e71ff4337982566564e34bd3b4dfb26512
Instruction ID: ab5a0165ae2092a0106c5c33573c2a5a797848a84b7fc1b3df5ff1fff863be4b
Opcode Fuzzy Hash: 0fce6a8d1eb35eb033ab67290ff2a7e71ff4337982566564e34bd3b4dfb26512
Instruction Fuzzy Hash: 9D21D8768002087ADF219B96DC05EDF7BA8DF85765F20416BFD15D6182EB38CB08CA99

Uniqueness

Uniqueness Score: -1.00%

Function 0045E265, Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0045E26E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0045E2DC

Part of subcall function 004587DE: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,0045A814,?,00000000,00000000), ref: 00458880

Part of subcall function 00456E3E: RtlAllocateHeap.NTDLL(00000000,0043C5A8,00000000,?,0043E9CE,00000002,00000000,?,?,?,00409826,0043C5A8,00000004,00000000,00000000,00000000), ref: 00456E70

_free.LIBCMT ref: 0045E2CD

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: f05ca5a079a90a27ddba81c4cd500b0673ac99011216fc67ef5239efabbefb60
Instruction ID: ee69f126e37a1ef87d56a9dff14dae6dc3fa4d389c118bcddccf716999f6933c
Opcode Fuzzy Hash: f05ca5a079a90a27ddba81c4cd500b0673ac99011216fc67ef5239efabbefb60
Instruction Fuzzy Hash: 53014CB3A026113B632516B74C89C7B296CCEC6B66B14007FFD05D2207FE68CE0681B9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5C8, Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,?,0041D355,00000140,00000000,?,00000000), ref: 0041C5E5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000140,00000000,?,0041D355,00000140,00000000,?,00000000,?,0041DC01), ref: 0041C606
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,0041D355,00000140,00000000,?,00000000,?,0041DC01,?,?,00000244,0048813C), ref: 0041C640

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: c9d6a161c5b3eaf44631e7520433675f9e35921e691f7454907b032ec81ebb6c
Instruction ID: 522be3406a1d82bfff534acfdab9ad0e2a1ce094839a6f03dccb7d2f5c32b16b
Opcode Fuzzy Hash: c9d6a161c5b3eaf44631e7520433675f9e35921e691f7454907b032ec81ebb6c
Instruction Fuzzy Hash: A11182B0640715BEE7108F3DDC89B96BBD8EB09324F108625F924E72C1E3B4A8508B65

Uniqueness

Uniqueness Score: -1.00%

Function 0043A8B7, Relevance: 4.6, APIs: 3, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 0043A8EA
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,4876E7FF,?,?,00004098,00000000,?,0043B888,?,?,0042A2F6), ref: 0043A907
CloseHandle.KERNEL32(?,?,?,00004098,00000000,?,0043B888,?,?,0042A2F6), ref: 0043A917

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$CloseCreateHandleMappingView
String ID:
API String ID: 1187395538-0
Opcode ID: fd4b679c806ff1ceaad663414a4f3e8cec77f996e92eac8207f3ad8b1e7fdf5c
Instruction ID: d0eb96c907435e53eb56a7dd671017f7716b7751b752cfca02ab364f4ebd74d4
Opcode Fuzzy Hash: fd4b679c806ff1ceaad663414a4f3e8cec77f996e92eac8207f3ad8b1e7fdf5c
Instruction Fuzzy Hash: 3A11A5B0581B419ED7328B268814F57B7F8EF9D364F11992FE0C6A16A0E678D850CF1B

Uniqueness

Uniqueness Score: -1.00%

Function 004579B9, Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,00457A66,00000000,00000000,00000002,00000000), ref: 004579F2
GetLastError.KERNEL32(?,00457A66,00000000,00000000,00000002,00000000,?,00455B3A,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 004579FC
__dosmaperr.LIBCMT ref: 00457A03

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 4d551d12fa53eb2587e38968df0e4f98e7d00ac0599babb65ecd82239bec0516
Instruction ID: 390a449ea3b76039c341b62eb1118a6cca901879e9f36a0708916ff7259e9d3f
Opcode Fuzzy Hash: 4d551d12fa53eb2587e38968df0e4f98e7d00ac0599babb65ecd82239bec0516
Instruction Fuzzy Hash: A4019C336145157FDF059F56EC0589F3B29DB80321B34025AFC1197292E674DD018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00428768, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042876D

Part of subcall function 0040B384: __EH_prolog.LIBCMT ref: 0040B389

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Part of subcall function 004290A6: __EH_prolog.LIBCMT ref: 004290AB

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Strings

"\, xrefs: 00428973

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$Deallocate
String ID: "\
API String ID: 2428181759-2226538752
Opcode ID: 89103245ddd714de61fa1985c1eb5735bffb510f0186b971f3452512c9087955
Instruction ID: 84122b12127e9671a0bbc4f30dfbb45fbc092fcaaa01d58afc0b1c77e5f7753d
Opcode Fuzzy Hash: 89103245ddd714de61fa1985c1eb5735bffb510f0186b971f3452512c9087955
Instruction Fuzzy Hash: A2C10330E0526CCBDF14EFA5D9516EDBB71AF15304F50809ED04AB7242DF781A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00435F88, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00435F8D

Part of subcall function 00413D73: __EH_prolog.LIBCMT ref: 00413D78

Strings

Vz}l;.;*, xrefs: 00435FA3, 00436094

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: Vz}l;.;*
API String ID: 3519838083-2818383034
Opcode ID: 8a4f6f6c21ad9bd75a04a6d685c6c7e8b8a0c01da0ecc4ca670fdbb3e8278ff9
Instruction ID: 5fca9239dc4a6874b417de93939c726adeba8ea4a60bed48b832affc410d3a3b
Opcode Fuzzy Hash: 8a4f6f6c21ad9bd75a04a6d685c6c7e8b8a0c01da0ecc4ca670fdbb3e8278ff9
Instruction Fuzzy Hash: 0831D370D04245EFCB18CFA9D591AADBBB0AF08324F25815FE016A7381CB788A40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA85, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AA8A

Strings

Unknown exception, xrefs: 0040AAF1

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: Unknown exception
API String ID: 3519838083-410509341
Opcode ID: a0b0e22f77c64db163ae8f3bc47fc0d91fc71569d8047227ba377d8238f44bc0
Instruction ID: 4a0bab2d0e1fe7176b9712cb920923bc6baabdd535c7fd5c7c62679f6116c272
Opcode Fuzzy Hash: a0b0e22f77c64db163ae8f3bc47fc0d91fc71569d8047227ba377d8238f44bc0
Instruction Fuzzy Hash: CE21BD72900704AFCB24CF69D8406DABBB1FF08304F10C52EE94AAB641D375A615CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412F38, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412F3D

Part of subcall function 0040B1C1: __EH_prolog.LIBCMT ref: 0040B1C6

Part of subcall function 0040B30F: __EH_prolog.LIBCMT ref: 0040B314

Strings

0CA, xrefs: 00412F91

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: 0CA
API String ID: 3519838083-27611458
Opcode ID: ef6dc7774c67ac408ed2e9e28f1fc2f5955f736f7ff2ff7e639d3037f21be591
Instruction ID: 48ed8c5094b6b4fbf2ec9f084ee29a3da503342434529cf80bb884fe9070ff81
Opcode Fuzzy Hash: ef6dc7774c67ac408ed2e9e28f1fc2f5955f736f7ff2ff7e639d3037f21be591
Instruction Fuzzy Hash: 7A21AC71A006109FCB65EF69C98579EFBF0EF08304F0084AEE50AE7292CB749944CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412E96, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412E9B

Part of subcall function 0040B1C1: __EH_prolog.LIBCMT ref: 0040B1C6

Part of subcall function 0040B30F: __EH_prolog.LIBCMT ref: 0040B314

Strings

LCA, xrefs: 00412EEF

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: LCA
API String ID: 3519838083-1548664950
Opcode ID: a26f4eb0bb17e3854916e6ab47574f4947b945d305ec09d18896090b1250c98f
Instruction ID: 810354d2b8f2cdb5dcf156291ec0c8316ecf63044880d9549e5274359c321d0c
Opcode Fuzzy Hash: a26f4eb0bb17e3854916e6ab47574f4947b945d305ec09d18896090b1250c98f
Instruction Fuzzy Hash: 2611E071A00214AFCF15EFA9C9857DEBBB0EF08304F0080AEE409A7392CB749D44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00409CB5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409CBA

Strings

unknown error, xrefs: 00409D0F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: unknown error
API String ID: 3519838083-3078798498
Opcode ID: f4304a6ea3b865901973278fc4948ffb7944b3fbf44078f6caff66f41a7c1656
Instruction ID: 21d77a29c12f7fae9d55dac8022323064a4fad33921fb6818b10f0e12ab8059a
Opcode Fuzzy Hash: f4304a6ea3b865901973278fc4948ffb7944b3fbf44078f6caff66f41a7c1656
Instruction Fuzzy Hash: 8B019EB1B00644ABDB24AF9A8840A9BFAA9FF44718F50453FB445A3641C7BC9D4487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00412B6E, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412B73

Part of subcall function 00412BC4: __EH_prolog.LIBCMT ref: 00412BC9
Part of subcall function 00412BC4: std::locale::_Init.LIBCPMT ref: 00412C11

Strings

CA, xrefs: 00412B8E

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$Initstd::locale::_
String ID: CA
API String ID: 1266419734-1052703068
Opcode ID: 2a049a99ed9b969aad3d7e58f5d8ddcf7e30ce3744fc629307ca5013e760e1f7
Instruction ID: 26ee63793f3a9fe1ed021c5b11a4424dd0b950a6bcf0cf3a71d9f5e4addeed4c
Opcode Fuzzy Hash: 2a049a99ed9b969aad3d7e58f5d8ddcf7e30ce3744fc629307ca5013e760e1f7
Instruction Fuzzy Hash: 9AF0F4B4A146119FC729CF0CC54596ABBF4EB08314B40C56EF48AD7301D3B4E900CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00412C86, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412C8B

Part of subcall function 00412D24: __EH_prolog.LIBCMT ref: 00412D29
Part of subcall function 00412D24: std::_Lockit::_Lockit.LIBCPMT ref: 00412D37
Part of subcall function 00412D24: int.LIBCPMT ref: 00412D4E
Part of subcall function 00412D24: std::_Lockit::~_Lockit.LIBCPMT ref: 00412D9E

Strings

L:A, xrefs: 00412CAF

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prologLockitstd::_$Lockit::_Lockit::~_
String ID: L:A
API String ID: 1350124489-2729640649
Opcode ID: 10b81c5b6b50cda2da8c896699c6460ad28f161aa0f1fe259229fbad91706c95
Instruction ID: cbc5463dcc71b5fb85624521ebf0b6fe9c49a99b4cd99fb069d1cf96b57e6840
Opcode Fuzzy Hash: 10b81c5b6b50cda2da8c896699c6460ad28f161aa0f1fe259229fbad91706c95
Instruction Fuzzy Hash: F6F034B5A002049FCB08EFA4C585AADB7F5FB48308F54855EE406EB351DB38AD04CA29

Uniqueness

Uniqueness Score: -1.00%

Function 0040B384, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B389

Part of subcall function 00412E96: __EH_prolog.LIBCMT ref: 00412E9B

Strings

directory_iterator::directory_iterator, xrefs: 0040B3C3

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: directory_iterator::directory_iterator
API String ID: 3519838083-2645264736
Opcode ID: e7a3bbb4166fa8726ae55410eb0a50f4476ca4b47d773e9415e745ff34dd1bea
Instruction ID: 391e8f363eeb9fe8989b92ceda8300554707761c770487b9ac7b6fecbe5094ea
Opcode Fuzzy Hash: e7a3bbb4166fa8726ae55410eb0a50f4476ca4b47d773e9415e745ff34dd1bea
Instruction Fuzzy Hash: 41E06D71A107259FCB28EF68C80168ABBE5EB08358F10C93FB519E3740E77889008B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B613, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B618

Part of subcall function 00412F38: __EH_prolog.LIBCMT ref: 00412F3D

Strings

recursive_directory_iterator::recursive_directory_iterator, xrefs: 0040B652

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: recursive_directory_iterator::recursive_directory_iterator
API String ID: 3519838083-3545205060
Opcode ID: b2e24cdd168fb34cfb7fc98a00d08517dca12ec44900d9ddec57b28ba6f58eb6
Instruction ID: 2139b5e728e2ece433ed4468dbbb55d1aa2af39bd8f9f920b9ac896bc0d7e30a
Opcode Fuzzy Hash: b2e24cdd168fb34cfb7fc98a00d08517dca12ec44900d9ddec57b28ba6f58eb6
Instruction Fuzzy Hash: D4E06D71A106159FCB18EF68C40068ABAE9EB08318F10C53FA419E3740E77889008B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041A002, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

___std_fs_set_current_path@4.LIBCPMT ref: 0041A010

Part of subcall function 0040ADEC: __EH_prolog2.LIBCMT ref: 0040ADF3

Strings

current_path(const path&), xrefs: 0041A01E

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog2___std_fs_set_current_path@4
String ID: current_path(const path&)
API String ID: 2482923176-1163517728
Opcode ID: 1fdf791782817421d377030cf6e1ea08f7bb4e242552a876f97812b2fc04f253
Instruction ID: 28106dadcfeaf6d91b3e38f9eca3fc694d07d67cac779d51b1c27e70d18fbab1
Opcode Fuzzy Hash: 1fdf791782817421d377030cf6e1ea08f7bb4e242552a876f97812b2fc04f253
Instruction Fuzzy Hash: 78D01230716620478774BD6DA9484C361DE5F4E709710843FB945D7A01EB6CCCE157EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4DC, Relevance: 3.1, APIs: 2, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 0040B445: ___std_fs_get_stats@16.LIBCPMT ref: 0040B48F

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040B563

Part of subcall function 0043BD7B: FindNextFileW.KERNEL32(?,?,?,0040B10E,?,?,?,?,?,0040B19B,?,?,?,?,00000001), ref: 0043BD84

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040B5C4

Part of subcall function 0040B0E2: ___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040B109

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ___std_fs_directory_iterator_advance@8$FileFindNext___std_fs_get_stats@16
String ID:
API String ID: 224343835-0
Opcode ID: be89f3dac3f988a4e0dc351ffbb2b2fc9dc3bfc0d60ab1a425dc42609ecd1f31
Instruction ID: 16050e0c58408907ecbad331f4c885bc57ff5c937901e0a2a80af5627c950bc9
Opcode Fuzzy Hash: be89f3dac3f988a4e0dc351ffbb2b2fc9dc3bfc0d60ab1a425dc42609ecd1f31
Instruction Fuzzy Hash: 6941CC31500A14AFCB21DF19C895BAAB7F5FF40318F1444AEE056AB2D1DB39ED05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004556C9, Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00443405,00000000,00000000,?,00455BE6,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00455765
GetLastError.KERNEL32(?,00455BE6,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00483D78,00000010,00443405,00000000,00000000,00000000), ref: 0045578B

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 6c2976daf0216afb821a84fb55c17a61d0e256992d18b221f38250fe2621b225
Instruction ID: 7acf166fe159961333ebcd21aef73b4e07b625ee5b8155608814921ae9e638ae
Opcode Fuzzy Hash: 6c2976daf0216afb821a84fb55c17a61d0e256992d18b221f38250fe2621b225
Instruction Fuzzy Hash: 48219E34A00218DFCB15CF29DD90AEDB7B9EB4D306F2440AAE906D7212D6349D468B69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C9CA, Relevance: 3.1, APIs: 2, Instructions: 66windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001200,00000000,?,00000000,00000000,?,00000000), ref: 0043C9FA
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0043CA39

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ByteCharFormatMessageMultiWide
String ID:
API String ID: 988900531-0
Opcode ID: b8684e1362605cb92fc11380fe05193a2b15c9ca83cb71f3659c9d31f95af741
Instruction ID: b3947bb9edda47e919546fad5e9a227c0e5feb39d992201e51a3953f59f42065
Opcode Fuzzy Hash: b8684e1362605cb92fc11380fe05193a2b15c9ca83cb71f3659c9d31f95af741
Instruction Fuzzy Hash: 0A01F932B00169775B35BA5A9C88E7F2EADDFCEB51F10501FFA05D1360D6398C108769

Uniqueness

Uniqueness Score: -1.00%

Function 0040B11A, Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B11F
___std_fs_directory_iterator_open@12.LIBCPMT ref: 0040B188

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog___std_fs_directory_iterator_open@12
String ID:
API String ID: 2120191866-0
Opcode ID: b66ec15cc913e51b3730fec4498bc89229592f852da841f9039d04c3c9bc6cfa
Instruction ID: a5b6a8f5f878a71d6ada3214115c6d9e6f1d63c4bfe46d6908592d65b173f2c8
Opcode Fuzzy Hash: b66ec15cc913e51b3730fec4498bc89229592f852da841f9039d04c3c9bc6cfa
Instruction Fuzzy Hash: CF11E631610604ABDB24EA54DC51BDE73B5EF48794F14443FF801E61C0D778994587EE

Uniqueness

Uniqueness Score: -1.00%

Function 00412BC4, Relevance: 3.1, APIs: 2, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412BC9

Part of subcall function 0040A235: std::system_error::system_error.LIBCPMT ref: 0040A2A3

std::locale::_Init.LIBCPMT ref: 00412C11

Part of subcall function 0043C769: std::_Lockit::_Lockit.LIBCPMT ref: 0043C77B
Part of subcall function 0043C769: std::locale::_Setgloballocale.LIBCPMT ref: 0043C796
Part of subcall function 0043C769: _Yarn.LIBCPMT ref: 0043C7AC
Part of subcall function 0043C769: std::_Lockit::~_Lockit.LIBCPMT ref: 0043C7EC

Part of subcall function 00412C86: __EH_prolog.LIBCMT ref: 00412C8B

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prologLockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarnstd::system_error::system_error
String ID:
API String ID: 2895863627-0
Opcode ID: 4c6351e7176380d239209206a15970d6035f3149a39bda10d615bb252d52f1fb
Instruction ID: 155717bb80efb963f655335ddb71da450348cbb79dae65c0a3f506df48546a58
Opcode Fuzzy Hash: 4c6351e7176380d239209206a15970d6035f3149a39bda10d615bb252d52f1fb
Instruction Fuzzy Hash: E9113AB1A00B06BFD304DF6AC5C1649FBA4FF48324F50922FE01997A81D7B4A9608B94

Uniqueness

Uniqueness Score: -1.00%

Function 0041D300, Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,?,00000000,?,0041DC01,?,?,00000244,0048813C,00000000,?,0041DF7B), ref: 0041D31F
_strlen.LIBCMT ref: 0041D326

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CurrentDirectory_strlen
String ID:
API String ID: 942933051-0
Opcode ID: 692bf41ac650c9a33d4076837abad66292256cb0ceaadb9eebe893315bef5e53
Instruction ID: 1bef275501dbf6a77c6da6c980115e29e3b9fcab606534fec2be5ace63dcda7d
Opcode Fuzzy Hash: 692bf41ac650c9a33d4076837abad66292256cb0ceaadb9eebe893315bef5e53
Instruction Fuzzy Hash: 53014CB3504709AADB2856799C01FEF33E99B46710F10012FF866C7181EA7CADC2861E

Uniqueness

Uniqueness Score: -1.00%

Function 0043217A, Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043217F

Part of subcall function 0043203C: lstrlenW.KERNEL32(00000000,?,?,?,00432190), ref: 0043209E
Part of subcall function 0043203C: lstrcpyW.KERNEL32(00000000,00000000), ref: 004320B6
Part of subcall function 0043203C: lstrcpyW.KERNEL32(00000000,\Accounts), ref: 004320C2

_strlen.LIBCMT ref: 00432193

Part of subcall function 00410F1A: __EH_prolog.LIBCMT ref: 00410F1F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prologlstrcpy$_strlenlstrlen
String ID:
API String ID: 27009005-0
Opcode ID: 15ca8714b7a5b924fd71bfac50ee053ccda14fc8be9ac9a4951624da763143c5
Instruction ID: e257793169e98ea24ac69e7cbd624183f05d1f862c694421b625a0d9b483c1ed
Opcode Fuzzy Hash: 15ca8714b7a5b924fd71bfac50ee053ccda14fc8be9ac9a4951624da763143c5
Instruction Fuzzy Hash: BC113630A00119DAEF28EB25DD11EEEBB718F10304F0085AFE00663281EA780E49CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0043AAA5, Relevance: 3.0, APIs: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000001,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,0043B093,?,?,00000001,00000000), ref: 0043AAE8

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b53c18efe71da937d46e10460414e0e35e31d1cf10af320b18796a77341b90ba
Instruction ID: f6933d7de5fe479432ff379a16275d04f3c6f712475d292f6a78c5e3a84e449a
Opcode Fuzzy Hash: b53c18efe71da937d46e10460414e0e35e31d1cf10af320b18796a77341b90ba
Instruction Fuzzy Hash: F9019E71640B04AFE3215E7A98C8BA7FADDFB09354F00413FF3A692251D6B4AC509726

Uniqueness

Uniqueness Score: -1.00%

Function 00432DF7, Relevance: 3.0, APIs: 2, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00432AD6: GetUserNameA.ADVAPI32(?,?), ref: 00432AF1

OpenMutexA.KERNEL32 ref: 00432E48
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00432E55

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Mutex$CreateNameOpenUser
String ID:
API String ID: 1251385603-0
Opcode ID: 366085e7ba13daa8734a79eb2891f770bd85b9dcd9342a9772fb04f3d37417bf
Instruction ID: e7abf2e47613b81bed8d1b9955b4b19b78ef74c412c953cf5084fd8d61b47079
Opcode Fuzzy Hash: 366085e7ba13daa8734a79eb2891f770bd85b9dcd9342a9772fb04f3d37417bf
Instruction Fuzzy Hash: 04F04C305443587B9B00BBB81A464DF7FB8AE16350F0070A9E442A3242E1B4490AC76A

Uniqueness

Uniqueness Score: -1.00%

Function 00451FA7, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00451FEF

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 21d25ecbbf9ea9f93328aa0cadd386e1fe6aa0adc3fd3a3cbe0fb818797eaec8
Instruction ID: c246f9a6dbf01e8e7ed745c52a59b16bf10aad36628c3a3485874c8dd08161c7
Opcode Fuzzy Hash: 21d25ecbbf9ea9f93328aa0cadd386e1fe6aa0adc3fd3a3cbe0fb818797eaec8
Instruction Fuzzy Hash: B8E0E533646A1245D262663B6D027AE02458B81B7BF15033FFC20861F3DF6C494E81ED

Uniqueness

Uniqueness Score: -1.00%

Function 0043BA25, Relevance: 3.0, APIs: 2, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,B49F6420,?,?,?,0043BCBF,00000000,00418374,00000000,B49F6420,?,?,?,?,00418374), ref: 0043BA35
GetLastError.KERNEL32(?,0043BCBF,00000000,00418374,00000000,B49F6420,?), ref: 0043BA4B

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CopyErrorFileLast
String ID:
API String ID: 374144340-0
Opcode ID: 7fe25450b0cd014adbf295d8033cd723659ea563c3c6456fe1e62429e4d6d897
Instruction ID: 9bffcfc2047522413c594f841686ded503a0352d710aa594ec55ed13dafea1ee
Opcode Fuzzy Hash: 7fe25450b0cd014adbf295d8033cd723659ea563c3c6456fe1e62429e4d6d897
Instruction Fuzzy Hash: 3BE026305081C8FFDB008F64CC08F6E3FE89B04304F14C058F50491211D7B8C650DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5F9, Relevance: 2.6, APIs: 2, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 0040C552
HeapFree.KERNEL32(00000000), ref: 0040C559

Part of subcall function 00432540: __EH_prolog.LIBCMT ref: 00432545

Part of subcall function 0040BF92: __EH_prolog.LIBCMT ref: 0040BF97

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prologHeap$DeallocateFreeProcess
String ID:
API String ID: 1933738058-0
Opcode ID: 74ff05b6966e204e8639baff81674844f347ed850955fbe9f54af46ccd59399a
Instruction ID: 687b6858eace77d9839c840495ea6c0bc749df4bde78dc1f9f38988ff7b67587
Opcode Fuzzy Hash: 74ff05b6966e204e8639baff81674844f347ed850955fbe9f54af46ccd59399a
Instruction Fuzzy Hash: 05314C30C0025CDBDF24DBE4C995AEDBBB5AF18308F10419EE405B7292DB786B58DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00416038, Relevance: 1.8, APIs: 1, Instructions: 304COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041603D

Part of subcall function 0040B613: __EH_prolog.LIBCMT ref: 0040B618

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0040BF23: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,004183BB,00000000), ref: 0040BF37
Part of subcall function 0040BF23: CreateDirectoryTransactedA.KERNEL32 ref: 0040BF50
Part of subcall function 0040BF23: CommitTransaction.KTMW32(00000000,?,004183BB,00000000), ref: 0040BF5B

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Part of subcall function 0041497C: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,004173DC,?,?,?), ref: 00414992
Part of subcall function 0041497C: CopyFileTransactedA.KERNEL32 ref: 004149B8
Part of subcall function 0041497C: CommitTransaction.KTMW32(00000000,?,004173DC,?,?,?,?,?,00000000,00000000,UTC_,?,?,?,?,UTC_), ref: 004149C3

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CreateH_prolog$CommitDeallocateTransacted$CopyDirectoryFile_strcat
String ID:
API String ID: 766783516-0
Opcode ID: d2c10665a49dfa510c4598ecc5a508933827252464c822bdbb1ef6fadd824143
Instruction ID: 25bb1701324874ada0d7a3656a4b1434dd4c552ee64ca975ac8a21c297963937
Opcode Fuzzy Hash: d2c10665a49dfa510c4598ecc5a508933827252464c822bdbb1ef6fadd824143
Instruction Fuzzy Hash: 65C1E070D00258CBDF14EBA5C990BEDBB71BF55304F1081AEE449B7282DB785A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00428BB8, Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00428BBD

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 81128fe5dd8df81225d61a76fdc2ee523c73db48503efea23eafbdf43ce76f32
Instruction ID: da5fd4f720b7649ad24f402c2421854b224586b8be6fdabd0ae8e0a877e36e8d
Opcode Fuzzy Hash: 81128fe5dd8df81225d61a76fdc2ee523c73db48503efea23eafbdf43ce76f32
Instruction Fuzzy Hash: CE819B70C012AC9ADB01DFE8EA815EDFBB0BF69308F50925EE48477252DB740B89CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00410A9A, Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410A9F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 237229e9e60c1cfb08e3158495263ab91851586b20495e1ef9614258b5b63c0c
Instruction ID: ca6bcb20cf273e3a5a72ef51f6d00e0d61cdb6434f2f038f6cbb8363fb8d82d6
Opcode Fuzzy Hash: 237229e9e60c1cfb08e3158495263ab91851586b20495e1ef9614258b5b63c0c
Instruction Fuzzy Hash: EC516E71A00209DFCF18DFA9D5908EEBBB5EF14314F64065EE512A3281EBB8A9C5CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00413108, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041310D

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d3b34762abc2df4ba6956631b52cef20e60f9e3f7f1ac7e89fdfa81c5f99a073
Instruction ID: 7c3b3ffd1985d8fb605305e4eaeddb91a4ddf124c470f5206a9869d7675297d8
Opcode Fuzzy Hash: d3b34762abc2df4ba6956631b52cef20e60f9e3f7f1ac7e89fdfa81c5f99a073
Instruction Fuzzy Hash: 9351D134A00505AFCB24DFA8C9C18EDBBF1BF49725B24425AE521D7391C738DE81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00411279, Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78caa4f0e2c2bf212e2cc227f22a5e36eb3b156e639da51e24d3d1b85b9bf565
Instruction ID: 5dd8d9c35966b3dfc90405383c805dfb59f0cd6019fdfabf636b9a70415304d4
Opcode Fuzzy Hash: 78caa4f0e2c2bf212e2cc227f22a5e36eb3b156e639da51e24d3d1b85b9bf565
Instruction Fuzzy Hash: D4413874600709DFC715CF28C18099AFBF5FF4A314B108AAAE956DBB64E734B980CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0041C856, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 0041C67E: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0041C86D,00000002,00000000,00000000,00000000,?,?,0041C9A3,?,00000000,00000000), ref: 0041C6B1

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,00000000,00000000,?,?,0041C9A3,?,00000000,00000000), ref: 0041C886

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8fb0ecb98eff7123f4c08ac30e72945ab0a65a40b272b56b809e39a996e52648
Instruction ID: 2eed9961712295b11879aaceebee38a50204771a38a0dbf5461de68f520eaf5c
Opcode Fuzzy Hash: 8fb0ecb98eff7123f4c08ac30e72945ab0a65a40b272b56b809e39a996e52648
Instruction Fuzzy Hash: 2331F5B1E54205AFEB14DBA4CCC07EEBBA5AF81720F24416BD511E73C1DA789DC18B48

Uniqueness

Uniqueness Score: -1.00%

Function 00432E65, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00432E6A

Part of subcall function 00412B6E: __EH_prolog.LIBCMT ref: 00412B73

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c4b40d7fe2dfe8e8162b9f5616dbf1879c9c6dbd2f917971207e54f5dcc80863
Instruction ID: f9dcf6bc3df697a4ada980f83836a2c34ed3b1c6f59d035bddb442810f070557
Opcode Fuzzy Hash: c4b40d7fe2dfe8e8162b9f5616dbf1879c9c6dbd2f917971207e54f5dcc80863
Instruction Fuzzy Hash: 3C313D71A00214DFEB14DF55DD95FEAB7B4EB44304F1085AFE80AA7281D7745E88CE24

Uniqueness

Uniqueness Score: -1.00%

Function 00420C16, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00420C1B

Part of subcall function 00435AE5: GetCurrentProcess.KERNEL32(00000008,?,?,?), ref: 00435AF7
Part of subcall function 00435AE5: OpenProcessToken.ADVAPI32(00000000), ref: 00435AFE
Part of subcall function 00435AE5: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00435B18
Part of subcall function 00435AE5: GetLastError.KERNEL32 ref: 00435B22
Part of subcall function 00435AE5: GlobalAlloc.KERNEL32(00000040,00000000), ref: 00435B32
Part of subcall function 00435AE5: GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 00435B46
Part of subcall function 00435AE5: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00435B5A
Part of subcall function 00435AE5: GlobalFree.KERNEL32 ref: 00435B7A

Part of subcall function 0041DD64: __EH_prolog.LIBCMT ref: 0041DD69

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Token$GlobalH_prologInformationProcess$AllocConvertCurrentErrorFreeLastOpenString
String ID:
API String ID: 2888657697-0
Opcode ID: 5d2effa24750dbf310c9000823366435795ec91407d8d8961fe4ce9a1369a645
Instruction ID: fa2dd485757ec430129a4be6c744d0548826dafa258adc8a7ecdcae10b83b876
Opcode Fuzzy Hash: 5d2effa24750dbf310c9000823366435795ec91407d8d8961fe4ce9a1369a645
Instruction Fuzzy Hash: B4318DB0D02219EECB04EFF5D6815EDFB70BF18308F50455EE40567282DB786A95CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00442EF8, Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 00442FBC

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CallFilterFunc@8
String ID:
API String ID: 4062629308-0
Opcode ID: 6fe31ce4930a87109ca71088224d304d7de7bb168f28d00f53cd3835a6f159a3
Instruction ID: ff798fc2156e735b382d39802d53cd648978b67580c4281c9573b11ce329636a
Opcode Fuzzy Hash: 6fe31ce4930a87109ca71088224d304d7de7bb168f28d00f53cd3835a6f159a3
Instruction Fuzzy Hash: 7621F7729002104BEB14AF799D0236E73A19F85738FA5471FF8219B3D2DBBC5806975D

Uniqueness

Uniqueness Score: -1.00%

Function 004142DC, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 004098E5

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::exception::exception
String ID:
API String ID: 2807920213-0
Opcode ID: 104ef7bbc9445d07714525b93978cb66d4e141664db7f9d1e247c479bc44dec8
Instruction ID: 455021321c7cc1d1bbb4e5f1e776ef65e6579246ad59f73353b9cf0e7ba3361e
Opcode Fuzzy Hash: 104ef7bbc9445d07714525b93978cb66d4e141664db7f9d1e247c479bc44dec8
Instruction Fuzzy Hash: E8F0F97290021C67C714BB65D816D9E779C9E41718710413FB91897382EB39ED1587DD

Uniqueness

Uniqueness Score: -1.00%

Function 0043ADCD, Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,0043B424,?,00004000), ref: 0043AE38

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f4c9a1c3b16d5b91bcaa3263f1f22f426557a0de6320206a9c0b2215c6e51009
Instruction ID: f6fb9ca7520279520e2f4ecdc63732c9d48ae12e6e6fc4ec07605d1169871b04
Opcode Fuzzy Hash: f4c9a1c3b16d5b91bcaa3263f1f22f426557a0de6320206a9c0b2215c6e51009
Instruction Fuzzy Hash: 02118B31680515BBEB059F26C805B9ABBA4FF08724F10811AF8A897210DB74FD60DFDA

Uniqueness

Uniqueness Score: -1.00%

Function 0045854A, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00458584

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 845ff804393d8bd41cb0b483b6653791d8f92d17be7781a9320720bef7b5b31b
Instruction ID: 4bcffa0aa5409833929ac6c8f0cb53b99838f538a3976fe8e376e2b362f76bbb
Opcode Fuzzy Hash: 845ff804393d8bd41cb0b483b6653791d8f92d17be7781a9320720bef7b5b31b
Instruction Fuzzy Hash: 2B111875A0410AAFCF05DF59E94199F7BF4EF48304F0440AAF805AB352DA31EA15CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C67E, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0041C86D,00000002,00000000,00000000,00000000,?,?,0041C9A3,?,00000000,00000000), ref: 0041C6B1

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3334539efe16167db9c7b29786b900a0498ba7aca1b15e80c781fbf290d18a79
Instruction ID: 4dd9aaec76e72fb9ef871cf2a61cbda5ecf65c58225578297e69cfe26be83c7d
Opcode Fuzzy Hash: 3334539efe16167db9c7b29786b900a0498ba7aca1b15e80c781fbf290d18a79
Instruction Fuzzy Hash: 24014471684104AFEF24CA148CC5BB637999B5531CF349457E409C9251E22AC8D3EE5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041391D, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 00413974

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: dba4b58d4d1acad28155b80bb287fa30299511839a7a0365597e4a76b6bf1f2f
Instruction ID: a70d9e88f1839dcb3730efbfb21d5ae25a49e9fe594ff9c7a3e6134e6a4b67ec
Opcode Fuzzy Hash: dba4b58d4d1acad28155b80bb287fa30299511839a7a0365597e4a76b6bf1f2f
Instruction Fuzzy Hash: F701DFB2500205BFD7049F5AD88189ABBACFB48354B20051FF909C7281DA75AE9087F8

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6E9, Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,?,0000FFFF,00000000,?,0041C911,00000001,00000000,00000000,00000000,00000000), ref: 0041C70F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0713edc31afab36ce550a1baaba72538ed3d08c262ccb2ba92c92726ae25f763
Instruction ID: ceeee38f6d9e93e6e924ca73890b0bb0a6d78dc10905a3c5178a1124290aa483
Opcode Fuzzy Hash: 0713edc31afab36ce550a1baaba72538ed3d08c262ccb2ba92c92726ae25f763
Instruction Fuzzy Hash: E7015A72600106BFE708CF5ADC81AAAB7B9FB95344F14822AE40497690E3B0FD908BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00409A3B, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409A40

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 20debab81f288ed06389ee8acdb53ee762c1a149c1f2fecda0cf91794f44f637
Instruction ID: 12cbd1b258a651647d5040a3f0d1514c47f90948edca9da3540ddbd67e5d370a
Opcode Fuzzy Hash: 20debab81f288ed06389ee8acdb53ee762c1a149c1f2fecda0cf91794f44f637
Instruction Fuzzy Hash: 5A114831900209EFCB00EFA5CA819DDBBB4EF08308F50456EF805A3191DB75AE54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00442DC1, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8322c4ba49976ae527b5e235845f4001b9b558d3bc35969fe7f57831c24595
Instruction ID: 51c0560413ed89048c048d11db13709925b214d2f9c4731e8fb58715e61cfa8d
Opcode Fuzzy Hash: ec8322c4ba49976ae527b5e235845f4001b9b558d3bc35969fe7f57831c24595
Instruction Fuzzy Hash: 02F0F932901A1057F6323A2A9D0176B72989F4133AF60471FFC25961D2CBBCD80685AD

Uniqueness

Uniqueness Score: -1.00%

Function 004114E3, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004114E8

Part of subcall function 0041231F: __EH_prolog.LIBCMT ref: 00412324

Part of subcall function 00412B27: __EH_prolog.LIBCMT ref: 00412B2C
Part of subcall function 00412B27: std::locale::_Init.LIBCPMT ref: 00412B4A

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$Initstd::locale::_
String ID:
API String ID: 1266419734-0
Opcode ID: 5b6c8bce686a9a08ae9dce7adf31f820fcd4e99505b7e5d5ee66922490878975
Instruction ID: 807388eae7c63ebf0760714606e51efa4a736d83e1286d5c79f0e11425ea013a
Opcode Fuzzy Hash: 5b6c8bce686a9a08ae9dce7adf31f820fcd4e99505b7e5d5ee66922490878975
Instruction Fuzzy Hash: 051157B1A102069FC704DF59C984BAABBF8FF44319F50856EE11997640C7B8AE54CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1C1, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B1C6

Part of subcall function 0040B11A: __EH_prolog.LIBCMT ref: 0040B11F
Part of subcall function 0040B11A: ___std_fs_directory_iterator_open@12.LIBCPMT ref: 0040B188

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$___std_fs_directory_iterator_open@12
String ID:
API String ID: 1512400408-0
Opcode ID: e8b85fafbf5030f49c53b6cd80dc832debadaec5e3fcb868952a32dadec35d60
Instruction ID: 3af822c641e6ad0dffecd9a60001aba2a0deee9e71d7579afc6ecdd04f27f303
Opcode Fuzzy Hash: e8b85fafbf5030f49c53b6cd80dc832debadaec5e3fcb868952a32dadec35d60
Instruction Fuzzy Hash: 0801AD70905705AECB28CFA8C4856AEBBE4EF04314F10462EE45AA3381C774AA04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00452C70, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 004561BD: HeapAlloc.KERNEL32(00000008,?,00000000,?,0045501D,00000001,00000364,00000008,000000FF,?,0043E9CE,00000002,00000000,?,?), ref: 004561FE

_free.LIBCMT ref: 00452C90

Part of subcall function 00455C93: RtlFreeHeap.NTDLL(00000000,00000000,?,0045F0BB,?,00000000,?,00000002,?,0045F35E,?,00000007,?,?,0045F75F,?), ref: 00455CA9
Part of subcall function 00455C93: GetLastError.KERNEL32(?,?,0045F0BB,?,00000000,?,00000002,?,0045F35E,?,00000007,?,?,0045F75F,?,?), ref: 00455CBB

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocErrorFreeLast_free
String ID:
API String ID: 3091179305-0
Opcode ID: eb558d1bc333c2c5a3d4db829178aa3c0375441c877cbaeb9f41d5ec77c45286
Instruction ID: a6b3bfede799ef4bb3bd26f976222767fa155227a6c189c3879c535acf9fc912
Opcode Fuzzy Hash: eb558d1bc333c2c5a3d4db829178aa3c0375441c877cbaeb9f41d5ec77c45286
Instruction Fuzzy Hash: 5A0108B6D00619AFCB10DFA9C841A9EBBB8FB48710F10412BE914E7341E774AA45CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 004325B1, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004325B6

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeallocateH_prolog
String ID:
API String ID: 3708980276-0
Opcode ID: 0290707085cac40c03a6e2b424566191f091a67af8f96f76dd86124c79d50cc5
Instruction ID: d291b7327a1e85c30c9457478b9dffb5b434a71120071f0339e4d4ec67369071
Opcode Fuzzy Hash: 0290707085cac40c03a6e2b424566191f091a67af8f96f76dd86124c79d50cc5
Instruction Fuzzy Hash: 59F062726000146BCB04EF59CC519EEBB79EF48264F04422EF516A3291EA746E44C664

Uniqueness

Uniqueness Score: -1.00%

Function 0041218F, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412194

Part of subcall function 004134AA: __EH_prolog.LIBCMT ref: 004134AF
Part of subcall function 004134AA: std::_Lockit::_Lockit.LIBCPMT ref: 004134BD
Part of subcall function 004134AA: int.LIBCPMT ref: 004134D4
Part of subcall function 004134AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00413524

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prologLockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 1350124489-0
Opcode ID: d0ec3e2547c77d717db7ca5dbd597893536b526c37e47a46e4cb9ef1ce1667ed
Instruction ID: e6be24361141bee4d3f712ab391f5321389e7682946f9b64198033bf097bb33f
Opcode Fuzzy Hash: d0ec3e2547c77d717db7ca5dbd597893536b526c37e47a46e4cb9ef1ce1667ed
Instruction Fuzzy Hash: 1601A271610110AFDB04EB15C906BEEB7A5EF08708F00842EB505E7281DBB8ED54DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00461DB0, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00461E13

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d68a3bd22f305dbcdf3ffd64c52df88b5c137157129ae79b60548ab7b6333833
Instruction ID: e439b57295d29cc069ef1fc658c6d5d88ca51a056eaa009722cccb51d70cba62
Opcode Fuzzy Hash: d68a3bd22f305dbcdf3ffd64c52df88b5c137157129ae79b60548ab7b6333833
Instruction Fuzzy Hash: 4701E172C01159AFCF01AFA9CC019EE7FB5AB08314F14416AFD14A21A2E6358A65DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412244, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 00412271

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: a4085ff68fbb2eaecb1667fdf31d9b39c940187ae5255fb9d9554733ab3302bf
Instruction ID: f84c7a4e5f14b302fc4300e7cd6652cd96f6efd750720b4f70e16db599dfe560
Opcode Fuzzy Hash: a4085ff68fbb2eaecb1667fdf31d9b39c940187ae5255fb9d9554733ab3302bf
Instruction Fuzzy Hash: 88019E75209B00CFC329CF68E180956B7F1FF4A3103118A9EE88A8BB64C770B841CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBBB, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041DBC0

Part of subcall function 0041D300: GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,?,00000000,?,0041DC01,?,?,00000244,0048813C,00000000,?,0041DF7B), ref: 0041D31F
Part of subcall function 0041D300: _strlen.LIBCMT ref: 0041D326

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CurrentDirectoryH_prolog_strlen
String ID:
API String ID: 1906034785-0
Opcode ID: 1bbe1e2e3965cbe74d5b92616e91792455b8eb97a2e0fd76d66fa58ef9e7e1ab
Instruction ID: 443b2a88c54b46364fdfd713b516c90e44c956b9150f944a2dadd24db19a70f1
Opcode Fuzzy Hash: 1bbe1e2e3965cbe74d5b92616e91792455b8eb97a2e0fd76d66fa58ef9e7e1ab
Instruction Fuzzy Hash: A90186B0A11702AEC7189F39D90679AFAE4EB45334F10472FE039D72D1EBB89501C798

Uniqueness

Uniqueness Score: -1.00%

Function 0040A03A, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A03F

Part of subcall function 00409E30: __EH_prolog.LIBCMT ref: 00409E35
Part of subcall function 00409E30: std::_Lockit::_Lockit.LIBCPMT ref: 00409E45
Part of subcall function 00409E30: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00409E82

Part of subcall function 0040A007: __Getctype.LIBCPMT ref: 0040A022

Part of subcall function 00409EA6: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00409EC3
Part of subcall function 00409EA6: std::_Lockit::~_Lockit.LIBCPMT ref: 00409F34

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::_$H_prologLocinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 1713013424-0
Opcode ID: f40741f3d1b74779df025e8a77a28a3053fd78c565cf915b5adf29f66199f771
Instruction ID: dac7ce0be06efdb930e0db59d6ee9afda71f95e445ec65bb89618386ba3d906d
Opcode Fuzzy Hash: f40741f3d1b74779df025e8a77a28a3053fd78c565cf915b5adf29f66199f771
Instruction Fuzzy Hash: AFF06D72900618AADB10EFA9C842B9EB774AF50B18F10802FF805A72C1DB7C6911C69A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B08C, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040B0A6

Part of subcall function 0043BD7B: FindNextFileW.KERNEL32(?,?,?,0040B10E,?,?,?,?,?,0040B19B,?,?,?,?,00000001), ref: 0043BD84

Part of subcall function 0040B23D: __EH_prolog.LIBCMT ref: 0040B242

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileFindH_prologNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3477299189-0
Opcode ID: 89471f791871d928ce2fc60344fde946c292d30b5902073fa3f59b1c5f4f981a
Instruction ID: f0a085b9f92a2893bb3fb5ba2abd86c5330322c0672689396aed38602d2272f0
Opcode Fuzzy Hash: 89471f791871d928ce2fc60344fde946c292d30b5902073fa3f59b1c5f4f981a
Instruction Fuzzy Hash: 0AF0E9326006166BDB21A655CC85B6BF358DF44396F00007BD911A3281E774DC48C6DC

Uniqueness

Uniqueness Score: -1.00%

Function 0041231F, Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412324

Part of subcall function 00412B6E: __EH_prolog.LIBCMT ref: 00412B73

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bf0d4232632da6648b14aa36d21e90841b0f01789c3d3fbe1763c7d68e059cdf
Instruction ID: 9a5af7475918f0d995f67ad77aae7007e54cdaad612b4bf8c020c2c57afde545
Opcode Fuzzy Hash: bf0d4232632da6648b14aa36d21e90841b0f01789c3d3fbe1763c7d68e059cdf
Instruction Fuzzy Hash: C501F2B86106089FC724CF18C548EAABBF4FB08318B40859EE4999B701E3B5ED04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00456E3E, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0043C5A8,00000000,?,0043E9CE,00000002,00000000,?,?,?,00409826,0043C5A8,00000004,00000000,00000000,00000000), ref: 00456E70

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a6fb21d89fb4db277c153ff1d0ae5930977a4f4620132af269c727d48672cd39
Instruction ID: fbaa9c3599f4ca5e1f5eba663fea1c49717f1fd88810d3d420cf3afe039c794e
Opcode Fuzzy Hash: a6fb21d89fb4db277c153ff1d0ae5930977a4f4620132af269c727d48672cd39
Instruction Fuzzy Hash: DEE0E5399031605BEB213666EC0275B7A5CDB51BA2F974127FC14A7293DB2DCC08C5EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040B8F6, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

___std_fs_copy_file@12.LIBCPMT ref: 0040B91A

Part of subcall function 0040AE48: __EH_prolog2.LIBCMT ref: 0040AE4F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog2___std_fs_copy_file@12
String ID:
API String ID: 1952593469-0
Opcode ID: 6fd17b4b3b61844dd75c860f469c0768f1ce7cf0338004cea7b69a2492a8a2cc
Instruction ID: 42f4ff600cf6dab9c53c9dba5e9a36e71f3a866bd6077b2bc479eb01e8ebb465
Opcode Fuzzy Hash: 6fd17b4b3b61844dd75c860f469c0768f1ce7cf0338004cea7b69a2492a8a2cc
Instruction Fuzzy Hash: DBE0D87161160457C624594EAD0AA67B3AEDFC6725F10063FF958932C0EF746D1082FD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADEC, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog2.LIBCMT ref: 0040ADF3

Part of subcall function 0040AA85: __EH_prolog.LIBCMT ref: 0040AA8A

Part of subcall function 00440DA3: RaiseException.KERNEL32(E06D7363,00000001,00000003,00000000,?,?,0043C5B6,00000000,00483628,?), ref: 00440E03

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionH_prologH_prolog2Raise
String ID:
API String ID: 1276564762-0
Opcode ID: c4723b1eb7f8446ac748d715a39d25ccebf062545432b285f0abc7009e6d322a
Instruction ID: 341701a67567f130c4766d159a25524fe3d75e632a24429cbae51c3afabf9dcd
Opcode Fuzzy Hash: c4723b1eb7f8446ac748d715a39d25ccebf062545432b285f0abc7009e6d322a
Instruction Fuzzy Hash: 5DF05E71810208ABCF14EBA1C946FDEBB78AF55304F40405EB605771A2EA386948CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0E2, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040B109

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID:
API String ID: 2610647541-0
Opcode ID: a72144a2fa1c2bf3595e9816ee56f23d235cf8e7134905ae3a0fa4baca44babc
Instruction ID: 8968a5a887799a895831fca2ac220310a7bb011452b9d706e7f76c006e90893d
Opcode Fuzzy Hash: a72144a2fa1c2bf3595e9816ee56f23d235cf8e7134905ae3a0fa4baca44babc
Instruction Fuzzy Hash: D5E0263920062054EA306162986297311A8CAC1BE4F00483BED45AB3C1E7799C82D1FC

Uniqueness

Uniqueness Score: -1.00%

Function 00412665, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 00412674

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: 5a9b96229d7971af7c1bf39474fc078e8aba01c3d5201b042ebb9b87d523046d
Instruction ID: 28595259af0ef1b9fb59a1abe12ce7545709556883ab507bb5cd518fd8cad32f
Opcode Fuzzy Hash: 5a9b96229d7971af7c1bf39474fc078e8aba01c3d5201b042ebb9b87d523046d
Instruction Fuzzy Hash: 19D05E320142008FF3345E08F2017A277E6EB01315F20090EE0C1C65C1D7AA68C45698

Uniqueness

Uniqueness Score: -1.00%

Function 00461AF7, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00461EE7,?,?,00000000,?,00461EE7,00000000,0000000C), ref: 00461B14

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 37f07d10316231a3e6927486e7b454c93d54a57270a455bfb4fa70b0880c2275
Instruction ID: 09d5df6aac0d09fbcca49880e00712c4e9ba879e9b6c824d555ccd458945d788
Opcode Fuzzy Hash: 37f07d10316231a3e6927486e7b454c93d54a57270a455bfb4fa70b0880c2275
Instruction Fuzzy Hash: 3FD06C3204010DBBDF028F84DC06EDA3BAAFB48714F114050FA1866120C772E831AB96

Uniqueness

Uniqueness Score: -1.00%

Function 00432AD6, Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00432AF1

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 9f78afeab412ba5f0fd3c9db364dbe7792eb239234d5aa7894e88aaff16fba57
Instruction ID: 7c7851cc52fc085232fcf294151c1b581f97f1e25a18ffa0b7055b06b0ba1da9
Opcode Fuzzy Hash: 9f78afeab412ba5f0fd3c9db364dbe7792eb239234d5aa7894e88aaff16fba57
Instruction Fuzzy Hash: 5AD0C97480810DEBCF50DF90D949AC9B7BCAB00308F0004A294C1E3140EAF4ABD99F91

Uniqueness

Uniqueness Score: -1.00%

Function 004436E1, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004436F4

Part of subcall function 00455C93: RtlFreeHeap.NTDLL(00000000,00000000,?,0045F0BB,?,00000000,?,00000002,?,0045F35E,?,00000007,?,?,0045F75F,?), ref: 00455CA9
Part of subcall function 00455C93: GetLastError.KERNEL32(?,?,0045F0BB,?,00000000,?,00000002,?,0045F35E,?,00000007,?,?,0045F75F,?,?), ref: 00455CBB

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 8925af9abd318a9b441ad8db1b29933847fc925d80e1c06ca58724dd69863e2c
Instruction ID: 1747c66b8cc0f02fa9ac83ab396e6f2457250ac362440d80f2aa9ff6e381899c
Opcode Fuzzy Hash: 8925af9abd318a9b441ad8db1b29933847fc925d80e1c06ca58724dd69863e2c
Instruction Fuzzy Hash: 74C08C31000308BBCB019F42C906A8E7BB8DB80768F200058F81017241CBB1EF049680

Uniqueness

Uniqueness Score: -1.00%

Function 00427CE5, Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00427CF4

Part of subcall function 004276D8: CoCreateInstance.OLE32(0046AAC0,00000000,00000015,0046AAE0,?), ref: 004276F8

Part of subcall function 004275E4: lstrlenW.KERNEL32(?), ref: 0042760A
Part of subcall function 004275E4: lstrlenW.KERNEL32(00000002), ref: 0042761B
Part of subcall function 004275E4: CredEnumerateW.SECHOST(Microsoft_WinInet_*,00000000,00000000,?), ref: 00427644
Part of subcall function 004275E4: CryptUnprotectData.CRYPT32(?,00000000,0000004A,00000000,00000000,00000001,?), ref: 0042768A
Part of subcall function 004275E4: LocalFree.KERNEL32(?), ref: 004276B4
Part of subcall function 004275E4: CredFree.ADVAPI32(?), ref: 004276CD

Part of subcall function 004277AD: GetVersionExW.KERNEL32(?), ref: 004277F5
Part of subcall function 004277AD: LoadLibraryW.KERNEL32(vaultcli.dll), ref: 00427819
Part of subcall function 004277AD: GetProcAddress.KERNEL32(00000000,?), ref: 00427866
Part of subcall function 004277AD: GetProcAddress.KERNEL32(00000000,?), ref: 004278A2
Part of subcall function 004277AD: GetProcAddress.KERNEL32(00000000,?), ref: 004278D9

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$CredFreelstrlen$CreateCryptDataEnumerateInitializeInstanceLibraryLoadLocalUnprotectVersion
String ID:
API String ID: 1367598280-0
Opcode ID: b315948353a761549921f6798a6b2ee79d603c6e99298b510c0a02b1dce7ef57
Instruction ID: 20f44f36103e1b03a85b6771c31268e899ff51706b8b0ac7eb8c0d8afcc4a8c7
Opcode Fuzzy Hash: b315948353a761549921f6798a6b2ee79d603c6e99298b510c0a02b1dce7ef57
Instruction Fuzzy Hash: 75E0C23012C2046BD204EB11DD07B6AB3A4EB80B19F40861DF89C421D0BF74BD04DA4B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040C07D, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C082
BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040C0E8
BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040C106
BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040C127
LocalAlloc.KERNEL32(00000040,?), ref: 0040C17E
BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040C1A9
BCryptCloseAlgorithmProvider.BCRYPT(00000000,00000000), ref: 0040C210
BCryptDestroyKey.BCRYPT(00000000), ref: 0040C220

Strings

ChainingMode, xrefs: 0040C0FE
ChainingModeGCM, xrefs: 0040C0F9
AES, xrefs: 0040C0E2

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Crypt$AlgorithmProvider$AllocCloseDecryptDestroyGenerateH_prologLocalOpenPropertySymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 709062000-1213888626
Opcode ID: 2473cbb2120fa2fb59ae4a17894be6e17f2d823af5500eef10aeb6e614adaf4c
Instruction ID: c74cfcac7bfb770e89fc6720bec81c0ba0d7900a0f5d1e3a47e4c834caaf7175
Opcode Fuzzy Hash: 2473cbb2120fa2fb59ae4a17894be6e17f2d823af5500eef10aeb6e614adaf4c
Instruction Fuzzy Hash: 96516BB1900208EFDB10DF95D985AEEBBB8EF08704F10456EF505F6291E7789A44CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00420358, Relevance: 16.3, APIs: 4, Strings: 5, Instructions: 595COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042035D
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000001,00000000), ref: 00420389

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0040B384: __EH_prolog.LIBCMT ref: 0040B389

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

sqlite3_finalize.NSS3(?), ref: 00420B52
sqlite3_close.NSS3(?), ref: 00420B5F

Strings

?, xrefs: 00420980
Profiles, xrefs: 0042039B
R}, xrefs: 00420B06
B, xrefs: 00420864
?3%, xrefs: 0042064C

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$Deallocate$FolderPath_strcatsqlite3_closesqlite3_finalize
String ID: ?$?3%$B$Profiles$R}
API String ID: 1363784328-3138528640
Opcode ID: eed21e832e67d5cfa2298167edc5187d4b260c4058bc0a5a79ea169fe9a07257
Instruction ID: ae35ff57b9fb93ce7ac143f51976f7252c32bd776fd5eb5c4bf24c6958226ef8
Opcode Fuzzy Hash: eed21e832e67d5cfa2298167edc5187d4b260c4058bc0a5a79ea169fe9a07257
Instruction Fuzzy Hash: BA42EF30D042A8DFDF14DBA8D981BDDBBB1AF59304F1081AED44977292DB741E88CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041E578, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140encryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041E57D
_strlen.LIBCMT ref: 0041E5EA
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,00001FA0,00000000,00000000), ref: 0041E5F2
PK11_GetInternalKeySlot.NSS3(?,00000000,00000001,?,00001FA0,00000000,00000000,?,logins,logins), ref: 0041E600
PK11_FreeSlot.NSS3(?,?,00001FA0,00000000,00000000,?,logins,logins), ref: 0041E6D9

Strings

\9.., xrefs: 0041E6C3

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: K11_Slot$BinaryCryptFreeH_prologInternalString_strlen
String ID: \9..
API String ID: 1828113442-1559541242
Opcode ID: 030d03c89206aa14f797ed1fc7b29f33fb26f62418efe496a2e80dd2fa595aa9
Instruction ID: 60fefd1d15142abf8133cdc0768c1f05f328de52c51962787db3ff5ab5b697ea
Opcode Fuzzy Hash: 030d03c89206aa14f797ed1fc7b29f33fb26f62418efe496a2e80dd2fa595aa9
Instruction Fuzzy Hash: 6851D274D05259AFCB10CFAA9C905FEFBB9BB15300F90446EE805E3241D7388A45CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004149DE, Relevance: 10.4, APIs: 2, Strings: 3, Instructions: 1618COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004149E3

Part of subcall function 004130B1: _memcmp.LIBVCRUNTIME ref: 004130D5

GetDriveTypeA.KERNEL32(?,?,?,00000018,00000000,00000001,Function_00087A34,?,?,0047734B,0047734B), ref: 00414C12

Part of subcall function 004359C0: __EH_prolog.LIBCMT ref: 004359C5

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Part of subcall function 0041491C: ___std_fs_get_stats@16.LIBCPMT ref: 0041493C

Part of subcall function 0041497C: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,004173DC,?,?,?), ref: 00414992
Part of subcall function 0041497C: CopyFileTransactedA.KERNEL32 ref: 004149B8
Part of subcall function 0041497C: CommitTransaction.KTMW32(00000000,?,004173DC,?,?,?,?,?,00000000,00000000,UTC_,?,?,?,?,UTC_), ref: 004149C3

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Strings

0, xrefs: 00415FD8
t, xrefs: 00414C83
, xrefs: 00415775

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeallocateH_prologTransaction$CommitCopyCreateDriveFileTransactedType___std_fs_get_stats@16_memcmp
String ID: $0$t
API String ID: 1200102914-2857914723
Opcode ID: a5e342cb22ce34ddb8a690c0332e4b78d784469fe8f0be85c9533ad6721b414a
Instruction ID: d502c93fa29c36c54b342a0feb0db6c6a62b6bce6095e2985e7b5fd8a3c95895
Opcode Fuzzy Hash: a5e342cb22ce34ddb8a690c0332e4b78d784469fe8f0be85c9533ad6721b414a
Instruction Fuzzy Hash: 85E2C030D00258DBCF24EBA5D991BEDBBB1AF54308F10419EE446A7282DB785FC9CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004282DB, Relevance: 9.3, APIs: 6, Instructions: 325fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004282E0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004283F1
CloseHandle.KERNEL32(00000000), ref: 004283FF
GetFileSize.KERNEL32(00000000,00000000), ref: 0042843D
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00428466
CloseHandle.KERNEL32(00000000), ref: 0042846D

Part of subcall function 0040BED4: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,?,?,?,?,?,00000000,00000000,?), ref: 0040BEE7
Part of subcall function 0040BED4: DeleteFileTransactedA.KERNEL32 ref: 0040BEFE
Part of subcall function 0040BED4: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,?,?,?,00418431,00000012,00000000), ref: 0040BF09

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$CloseCreateHandleTransaction$CommitDeleteH_prologReadSizeTransacted
String ID:
API String ID: 604483397-0
Opcode ID: 31b2ca8230e5a1c7b28c45c423f12c4f6d9c2a86cd23f02e532b726528c9da02
Instruction ID: 6696c0bffb043b999de245498b04f813fa23b35e5f332b168a717001b505ebb7
Opcode Fuzzy Hash: 31b2ca8230e5a1c7b28c45c423f12c4f6d9c2a86cd23f02e532b726528c9da02
Instruction Fuzzy Hash: CFD1C230D012ACDBDB21DBA5DE91BEEBB74AF15304F1081AEE44977242DB781B88CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0046076D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00460A8B,00000002,00000000,?,?,?,00460A8B,?,00000000), ref: 00460806
GetLocaleInfoW.KERNEL32(?,20001004,00460A8B,00000002,00000000,?,?,?,00460A8B,?,00000000), ref: 0046082F
GetACP.KERNEL32(?,?,00460A8B,?,00000000), ref: 00460844

Strings

OCP, xrefs: 004607C1
ACP, xrefs: 0046078B

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fe37b3f20c298d1294622ac8bc57f3db454fec07df9815b5810f89b62ad7014e
Instruction ID: c38cfdab87cbbff9ca0710bffbb6711ed3b8f0d94689ba64e150ddd5b54326d3
Opcode Fuzzy Hash: fe37b3f20c298d1294622ac8bc57f3db454fec07df9815b5810f89b62ad7014e
Instruction Fuzzy Hash: B321F532A00201AADB34EF14CD01A9773A6FF50B15B56C476E90ADB300F73AED41C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00460942, Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

Part of subcall function 00454E7B: _free.LIBCMT ref: 00454EDD
Part of subcall function 00454E7B: _free.LIBCMT ref: 00454F13

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00460A4E
IsValidCodePage.KERNEL32(00000000), ref: 00460A97
IsValidLocale.KERNEL32(?,00000001), ref: 00460AA6
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00460AEE
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00460B0D

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 01ce4bc8b87094837545d199504338aa031a6f493751301b237effd40e428fdb
Instruction ID: 0b15c0b75042871f7762ac7b573314a576d4c3c7857d7f88776463ccd0e721b3
Opcode Fuzzy Hash: 01ce4bc8b87094837545d199504338aa031a6f493751301b237effd40e428fdb
Instruction Fuzzy Hash: 17517A72A10305AFEB10DFA5CC41AAB73B8BF18740F14406AE915E7291F7789E44CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C274, Relevance: 6.5, Strings: 5, Instructions: 273COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 0041C2DE
invalid window size, xrefs: 0041C2FD
need dictionary, xrefs: 0041C576
incorrect header check, xrefs: 0041C34B
incorrect data check, xrefs: 0041C47D

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: incorrect data check$incorrect header check$invalid window size$need dictionary$unknown compression method
API String ID: 0-2151277842
Opcode ID: 73f8775dc121dd4aed272c7774825fb4d6ee0178dd31d652e60af6b21037d3d4
Instruction ID: 8586f4d2a39389ca0e4a474fbac285b844dec42037ac3661b1d5c800eb6372e7
Opcode Fuzzy Hash: 73f8775dc121dd4aed272c7774825fb4d6ee0178dd31d652e60af6b21037d3d4
Instruction Fuzzy Hash: 9BB1F5B1644B00CFD374CF19C890A62B7F4EB49314B248A6ED8EACB751D735E886CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004603F4, Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

Part of subcall function 00454E7B: _free.LIBCMT ref: 00454EDD
Part of subcall function 00454E7B: _free.LIBCMT ref: 00454F13

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00460448
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00460492
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00460558

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 0dc0cd1960c37f579d22049ede8cc10772ba08b19187dc88ff6527a55a461d0d
Instruction ID: c9a6894db70f35beb2cbe178f71e93ce92edbe77e9b9bc0da1c73435dc73cc3d
Opcode Fuzzy Hash: 0dc0cd1960c37f579d22049ede8cc10772ba08b19187dc88ff6527a55a461d0d
Instruction Fuzzy Hash: 5E617071900107AFEB28DF25CC82BAB77A8EF44304F1440BAE906C6285F778D955CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004442B1, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0043C5A8), ref: 004443A9
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0043C5A8), ref: 004443B3
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,0043C5A8), ref: 004443C0

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2e71a2b0d2e04ecbf775991bbe3dcf047b42ff819173dc03f58dc7d381e92a22
Instruction ID: 9904c30c2ec1d831e29f22ef3724a8f63b0c73bf5f61f736c0528cef7e3781c1
Opcode Fuzzy Hash: 2e71a2b0d2e04ecbf775991bbe3dcf047b42ff819173dc03f58dc7d381e92a22
Instruction Fuzzy Hash: 1131E574901228DBCB21DF65DC8878DBBB8BF08714F5041EAE41CA72A0E7749F958F49

Uniqueness

Uniqueness Score: -1.00%

Function 004869E8, Relevance: 4.2, Instructions: 4178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7892e192bd8ad68038ddd770443ccaa52462b9c2e226f1295ff39502d4b8e16d
Instruction ID: 7a874799a7e19084385e868c7ea259600172a5f589d93de5b0cc04350a55d267
Opcode Fuzzy Hash: 7892e192bd8ad68038ddd770443ccaa52462b9c2e226f1295ff39502d4b8e16d
Instruction Fuzzy Hash: 3533336244EBC25FD307AB748A36255BF70AE17204B2E49CBC4D1CF1F3E6285929D366

Uniqueness

Uniqueness Score: -1.00%

Function 004164BE, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 544COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004164C3

Part of subcall function 004198F5: __EH_prolog.LIBCMT ref: 004198FA

Part of subcall function 0043295D: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 004329A9

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0041497C: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,004173DC,?,?,?), ref: 00414992
Part of subcall function 0041497C: CopyFileTransactedA.KERNEL32 ref: 004149B8
Part of subcall function 0041497C: CommitTransaction.KTMW32(00000000,?,004173DC,?,?,?,?,?,00000000,00000000,UTC_,?,?,?,?,UTC_), ref: 004149C3

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

Strings

w, xrefs: 00416679

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$DeallocateTransaction$CommitCopyCreateEnvironmentFileTransactedVariable_strcat
String ID: w
API String ID: 3245203895-4254319369
Opcode ID: 3b070f65919a9f70f003ca512e6cb7e008b7c23afc7b96c1ff0803f01eb1bba6
Instruction ID: 42b3ec2479d9ec4edfd0bcc7d21a6cc37510bd5d79db4883e3e6e0051bd08996
Opcode Fuzzy Hash: 3b070f65919a9f70f003ca512e6cb7e008b7c23afc7b96c1ff0803f01eb1bba6
Instruction Fuzzy Hash: 6C32B070D0426CCADF25EBA5D951BEDBBB1AF18308F10419ED049B7282DBB81AC9CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00448112, Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217bf73ddf463bc762fcec89334ad9f14e28ca49a26b4bf2c465a16c4d568b37
Instruction ID: ad9ba43dba18e3c44285bf81dd9020d02f5f894481c70a95b0235e4f9ab4a2ff
Opcode Fuzzy Hash: 217bf73ddf463bc762fcec89334ad9f14e28ca49a26b4bf2c465a16c4d568b37
Instruction Fuzzy Hash: 9FF14E71E002199FDF14CFA9C9806AEB7B1FF88314F15826ED919A7345DB35AE01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004329EE, Relevance: 3.1, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004329F3
GetLogicalDriveStringsA.KERNEL32 ref: 00432A4A

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DriveH_prologLogicalStrings
String ID:
API String ID: 3681778021-0
Opcode ID: ff4a720e0bb43d99c20feb5d580ba78940a2bdd53a5bcc871d792d56b65f2b0f
Instruction ID: db8fc146f9846fe42d0b223a001fa272dae6056b04dacd443a3dad84fdf09618
Opcode Fuzzy Hash: ff4a720e0bb43d99c20feb5d580ba78940a2bdd53a5bcc871d792d56b65f2b0f
Instruction Fuzzy Hash: 26319A71D0024A9FDB10EFA8C5417EEBFF4AF08314F14405AE548E7381E7B40A44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00460647, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

Part of subcall function 00454E7B: _free.LIBCMT ref: 00454EDD
Part of subcall function 00454E7B: _free.LIBCMT ref: 00454F13

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0046069B

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: b9dce82c0f56c97c2e5428602f60ee81d3dd0acb5ae15c277feb6992267bfaec
Instruction ID: 02afe226550463723c623d009bd6c0b72fa6771187b83c0e972e5fb7c5112380
Opcode Fuzzy Hash: b9dce82c0f56c97c2e5428602f60ee81d3dd0acb5ae15c277feb6992267bfaec
Instruction Fuzzy Hash: 4021A171614206ABEB289B66DC42A7B33A8EB44319F10017FFD02C7241FB79AD548B5A

Uniqueness

Uniqueness Score: -1.00%

Function 004602CE, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

EnumSystemLocalesW.KERNEL32(004603F4,00000001,00000000,?,-00000050,?,00460A22,00000000,?,?,?,00000055,?), ref: 00460340

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1cdaf15339017216afb931a6b61134c7087fd389f44d2e4f8ee3cac0ae3ca77b
Instruction ID: 9f9106c871d540403b48fae7a095f7d2baea85da482e9314067baec35435a6e9
Opcode Fuzzy Hash: 1cdaf15339017216afb931a6b61134c7087fd389f44d2e4f8ee3cac0ae3ca77b
Instruction Fuzzy Hash: 15110C376007059FDB289F39C8A55BBB791FF84359B14442EE98787740E379B942C744

Uniqueness

Uniqueness Score: -1.00%

Function 00460873, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00460610,00000000,00000000,?), ref: 0046089F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1ded45ef729148539cfebcfbc65f73f1508366a3f960e32c25641f2bda24fdf0
Instruction ID: 683bc355e5b8f81f9a22087a7355196a96ececfc33c1b8a5daa6c5d399b28a9b
Opcode Fuzzy Hash: 1ded45ef729148539cfebcfbc65f73f1508366a3f960e32c25641f2bda24fdf0
Instruction Fuzzy Hash: 7EF0A932500215BBDB24A7258C457BB7758FB40759F15452BEC06B3280FA78FD51C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 004601DC, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

Part of subcall function 00454E7B: _free.LIBCMT ref: 00454EDD
Part of subcall function 00454E7B: _free.LIBCMT ref: 00454F13

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00460230

Strings

utf8, xrefs: 0046019F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free$InfoLocale
String ID: utf8
API String ID: 2003897158-905460609
Opcode ID: 09abb289ac1d42095351cd9c8466ce6e27163b73b72b34d8bb10bf77996e918e
Instruction ID: 4af8af5563199bfb7126bb9fd4aaa07dcfe801dfa9f7cc0cb5a39669b9cf19ce
Opcode Fuzzy Hash: 09abb289ac1d42095351cd9c8466ce6e27163b73b72b34d8bb10bf77996e918e
Instruction Fuzzy Hash: 37F02D326101059BD714AB74DC5AABB3398EF45319F1400BEF502DB242EA78AD058759

Uniqueness

Uniqueness Score: -1.00%

Function 00460369, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

EnumSystemLocalesW.KERNEL32(00460647,00000001,00000006,?,-00000050,?,004609E6,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004603B3

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c33f8c20e18b2ae528e758e21cccec5273a49ebf7d9418f957e151f12fd09844
Instruction ID: 51255be822afc10ea0905569ce20bdb1768efa2fa02681918a8acd5a0f6af5af
Opcode Fuzzy Hash: c33f8c20e18b2ae528e758e21cccec5273a49ebf7d9418f957e151f12fd09844
Instruction Fuzzy Hash: 27F046362003045FDB245F35D881A7B7B90EF8036CF04442EFD468B780E2BAAC82CA44

Uniqueness

Uniqueness Score: -1.00%

Function 00456227, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 004501A5: EnterCriticalSection.KERNEL32(-0004EC90,?,00451AAB,00000000,00483BF8,0000000C,00451A72,?,?,004561F0,?,?,0045501D,00000001,00000364,00000008), ref: 004501B4

EnumSystemLocalesW.KERNEL32(0045621A,00000001,00483DD8,0000000C,004566F9,00000000), ref: 0045625F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 45d6a418a00e68f6782a227117a220be6eb23375aedaf5e9965882a5a5473df6
Instruction ID: e5548ee0ad26bbe187c5a6f37174df7ebd5b9ee9d5cba1f771430849982c5430
Opcode Fuzzy Hash: 45d6a418a00e68f6782a227117a220be6eb23375aedaf5e9965882a5a5473df6
Instruction Fuzzy Hash: E7F03C72A44204DFE700EF98E842B9C77F0EB89726F10456BF4109B2A1C77959048F99

Uniqueness

Uniqueness Score: -1.00%

Function 00460283, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00454E7B: GetLastError.KERNEL32(?,00000000,?,004427A1,00000000,00000000,?,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454E80
Part of subcall function 00454E7B: SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044EC4C,00000000,00000000,00000000,00000000,?), ref: 00454F1E

EnumSystemLocalesW.KERNEL32(004601DC,00000001,00000006,?,?,00460A44,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004602BA

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: be6f3b163be9e0aa0343dec0b5b3fb3af0fc05b99bbeceb288bab48a80a439a4
Instruction ID: 08f26b5068844f06d1bfd48a623847b2dfbe4d0c14911600935323e227629b41
Opcode Fuzzy Hash: be6f3b163be9e0aa0343dec0b5b3fb3af0fc05b99bbeceb288bab48a80a439a4
Instruction Fuzzy Hash: DBF05C393002055BCB049F36D8596677F90EFC2724B06409AEE058B291D2799C43C755

Uniqueness

Uniqueness Score: -1.00%

Function 00456854, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00453E2D,?,20001004,00000000,00000002,?,?,00453418), ref: 00456888

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6e2c210601d53546fd4158de5809423171226595ec21c9dea422ac0404ce70e9
Instruction ID: cdf1d9c6663fb5a3604a860de745c15abb5146ad1ebd95da2ccf17b7f2074b09
Opcode Fuzzy Hash: 6e2c210601d53546fd4158de5809423171226595ec21c9dea422ac0404ce70e9
Instruction Fuzzy Hash: F8E01A31501528BBCB122F61DC05EAE3A26AF44756F458026FD05662229B7A8D21AA9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043E1B9, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0003E1C5,0043DACC), ref: 0043E1BE

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 81eda8363011532c6196788014fb50433491206a29f45392786200c9e098fb79
Instruction ID: 9ab1b7c4dbdd5921b6c75399513b6366a559b5fc487ce98294f7de32cbae106d
Opcode Fuzzy Hash: 81eda8363011532c6196788014fb50433491206a29f45392786200c9e098fb79
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 004400A5, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 1237a50fac957224679fed6deb89258fd9596a6ec914c0358ea5f0ae057b66a7
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 6D9188321090A34AF7694679853803FFFE16A523A1719079FD5F2CA2C5FD78C974E624

Uniqueness

Uniqueness Score: -1.00%

Function 00440360, Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 1776a61df825a619bb16825365e4f16bbedc63f37e7eeb5c25b03265f2ad73f5
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: C09158721090A30AFB698639857403FFFE15A923A171A079FD5F2CB2C5ED38D574EA24

Uniqueness

Uniqueness Score: -1.00%

Function 0044614A, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b75d9d503d8c8b04733e8d47583c683926272d8ff4e5aa939aa8914898996e4
Instruction ID: 5225456a1c24b2b347d0b19129890969d29294259aa750429a9cabfa1d3de2bf
Opcode Fuzzy Hash: 7b75d9d503d8c8b04733e8d47583c683926272d8ff4e5aa939aa8914898996e4
Instruction Fuzzy Hash: 9A518271E00119AFEF04CF99C940AAEBBB2FF89304F19809DE405AB341D7799E51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00458229, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb172ce001702cbae715284c9e339cb8c26e3d36247048699c13b5ef8f54ff9
Instruction ID: b15bcb644dfc20744a82c28ba5f152e9f21207994148c46fe75706c80c670b13
Opcode Fuzzy Hash: 0bb172ce001702cbae715284c9e339cb8c26e3d36247048699c13b5ef8f54ff9
Instruction Fuzzy Hash: F321B373F205394B7B0CC47E8C522BDB6E1C68C601745823EE8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 00458109, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5b8d276a371b64a7c76a5d1bae022ad8b91c8e5ac9259a771730c26e4159da
Instruction ID: b61782163bf8ec383de369ea6a05a382db8a3631f3ee2feb01699900e9092cf6
Opcode Fuzzy Hash: 6e5b8d276a371b64a7c76a5d1bae022ad8b91c8e5ac9259a771730c26e4159da
Instruction Fuzzy Hash: 85117323F30C256A775C816D8C172BAA5D2EBD825070F533ED826E7284E9A4DE23D390

Uniqueness

Uniqueness Score: -1.00%

Function 00440A90, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 666b3133522dda16a73644d9b8dd9584ab87051ec794c0c931674c69d7725977
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 8A115B7724028143FA04C67DC8B86BBF395EBE532472D837BC3415B744D13AA965D60C

Uniqueness

Uniqueness Score: -1.00%

Function 0043A467, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a714770d643b9cfe08e9b086170367a8b311287801241f4c2e7fb05fb85fa1
Instruction ID: 147fdf68f3721375d77733f12ca4ebe36309f7866c68b2f8b3ac3a6eab7ea368
Opcode Fuzzy Hash: 38a714770d643b9cfe08e9b086170367a8b311287801241f4c2e7fb05fb85fa1
Instruction Fuzzy Hash: 2D2136755240B15A861C4B3EAC21477BFD0DB4B20338B42BBE9DBE90C2C52ED965D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0045888B, Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004588B5
_free.LIBCMT ref: 0045898E
_free.LIBCMT ref: 004589BB

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 75777c648ca23e67883a79795551d9355426dc0162c537e9236774bade84c787
Instruction ID: c7a90f5ce7afc20f434bff2451650a8cd913e8cca49b22637eb1055d14ffa908
Opcode Fuzzy Hash: 75777c648ca23e67883a79795551d9355426dc0162c537e9236774bade84c787
Instruction Fuzzy Hash: 06D106B1900301AFDB25AF659842A7E77B8EF00716F14456FED11A7283EF3C99088B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0045EA62, Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 374COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045EAAA
_free.LIBCMT ref: 0045EACE
_free.LIBCMT ref: 0045EADB
_free.LIBCMT ref: 0045EB00
_free.LIBCMT ref: 0045EB0D
_free.LIBCMT ref: 0045EB16
_free.LIBCMT ref: 0045EDF1
_free.LIBCMT ref: 0045EDF9

Strings

TaH, xrefs: 0045EA90, 0045ED76

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID: TaH
API String ID: 269201875-2417347642
Opcode ID: 6c4ddcbdd47d889d28cb29831bf8bd30135e0a023ea57bd310dade0d39418a96
Instruction ID: 43bc982d6508e2d7968fda36ce6eeda0b3c3f815a485bfc9d138bcccb8e5fa14
Opcode Fuzzy Hash: 6c4ddcbdd47d889d28cb29831bf8bd30135e0a023ea57bd310dade0d39418a96
Instruction Fuzzy Hash: 3DC14472D40209ABDB20DBA9CC42FEE77F8EB09705F144466FE05EB383D6749A4587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0044C6F3, Relevance: 19.7, APIs: 2, Strings: 9, Instructions: 403COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044C799
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044C7BD

Strings

Line: , xrefs: 0044C9D9
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 0044CAFC
Assertion failed!, xrefs: 0044C717
..., xrefs: 0044C818, 0044C937, 0044C989, 0044CACD, 0044CB50, 0044CB83
Expression: , xrefs: 0044CA53
File: , xrefs: 0044C863
<program name unknown>, xrefs: 0044C7C7
Program: , xrefs: 0044C75B
(Press Retry to debug the application - JIT must be enabled), xrefs: 0044CB26

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program:
API String ID: 4146042529-1508414584
Opcode ID: 6ff47f07c74ecc7c6a74c7add80d3ef628018f43c4e930d32e285e50c3d32f73
Instruction ID: 458bed8546bbd68c4d687da7544179e3192303124860fecc4cd1c5d8d9af4537
Opcode Fuzzy Hash: 6ff47f07c74ecc7c6a74c7add80d3ef628018f43c4e930d32e285e50c3d32f73
Instruction Fuzzy Hash: 21C12C75A0111667EB60AA25ACC7FBB3268DF65709F0800AFFC05E2243F738AE49C55D

Uniqueness

Uniqueness Score: -1.00%

Function 0043A6CE, Relevance: 16.7, APIs: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000001,?,00000001,?,00000000), ref: 0043A6E2
GetFileSize.KERNEL32(?,00000000), ref: 0043A762
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0043A779
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0043A78C
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0043A799
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0043A7AC
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0043A7CD
ReadFile.KERNEL32(?,0043AB8E,00000004,?,00000000), ref: 0043A7E0

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: 33c9b64bcc09fd42cb497482ad631428a2d2c7ca53691dcff5fed853e036cc87
Instruction ID: 58c3769802bc6da27f55bbde3769d0a5075a5879b660ea456ace9cd1e746eb6f
Opcode Fuzzy Hash: 33c9b64bcc09fd42cb497482ad631428a2d2c7ca53691dcff5fed853e036cc87
Instruction Fuzzy Hash: D05184B1A40218BFEB18DF68DC95BBF77B8EB48704F11442AF942E7280D6749D058B66

Uniqueness

Uniqueness Score: -1.00%

Function 0043A5B9, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 79COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043A5BE

Strings

.arj, xrefs: 0043A635
.gz, xrefs: 0043A646
.zoo, xrefs: 0043A602
.zip, xrefs: 0043A5F1
.arc, xrefs: 0043A613
.lzh, xrefs: 0043A624
.tgz, xrefs: 0043A657

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _strlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 4218353326-51310709
Opcode ID: 5983c19f885e3b4811a97f44a20d162349ce9eba8c774676e53a8613ac3e9cb8
Instruction ID: ab7517950f5f5e4c2ce3ade5099bd2c74791d4a81370c342d7994d0d4225687e
Opcode Fuzzy Hash: 5983c19f885e3b4811a97f44a20d162349ce9eba8c774676e53a8613ac3e9cb8
Instruction Fuzzy Hash: 531154562C8F52787625B1256847F9B06899F46774B3C102FE4C8645D3EE8CA856406F

Uniqueness

Uniqueness Score: -1.00%

Function 00456424, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 0045647B
ext-ms-, xrefs: 0045648F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 04ef15f02f3086ad0261fdd332b31fa6ddba8ed9a993d8becedaf392117ead97
Instruction ID: ed9fc1eef018643aded2bd9fb3a4961ae92b75b4ea6a201e7c09155e2e8f15a7
Opcode Fuzzy Hash: 04ef15f02f3086ad0261fdd332b31fa6ddba8ed9a993d8becedaf392117ead97
Instruction Fuzzy Hash: 2F21D871A01224BBCB314B25DC40B2B37689F42B66F634162ED15B7392E678EC19C6DE

Uniqueness

Uniqueness Score: -1.00%

Function 0042415E, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00424163

Strings

m_it.object_iterator != m_object->m_value.object->end(), xrefs: 004241D9
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042416F, 0042417F, 004241B4, 004241D8
m_it.array_iterator != m_object->m_value.array->end(), xrefs: 004241B5
m_object != nullptr, xrefs: 00424180
cannot get value, xrefs: 004241FA

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$cannot get value$m_it.array_iterator != m_object->m_value.array->end()$m_it.object_iterator != m_object->m_value.object->end()$m_object != nullptr
API String ID: 3519838083-3858235212
Opcode ID: 27980b1268b2519b115341660f8e83bf90745abd6ada311e8a7ed06d1e95467b
Instruction ID: 5821af80812d78a3a31bdc2b4f516c44dac2699d0c77b021a73195ad30933a46
Opcode Fuzzy Hash: 27980b1268b2519b115341660f8e83bf90745abd6ada311e8a7ed06d1e95467b
Instruction Fuzzy Hash: B221F3347002009BC714EB99D889EAA77A4EF90714F54801FE48A97291D76CAE90CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00432710, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,73B769A0), ref: 00432741
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000,?,73B769A0), ref: 00432760
lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,73B769A0), ref: 00432783
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,KsG,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,73B769A0), ref: 004327AF

Strings

KsG, xrefs: 004327A6, 0043274B, 00432759

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ByteCharMultiWide$lstrcpylstrlen
String ID: KsG
API String ID: 3705784190-1864647989
Opcode ID: a0f43de8070e261bf7328609507c989a3093a7cec3aefaf8b9619bec1e8fc4cc
Instruction ID: 6e5353272bc5eff7c577ba2b159a5a9a3dcb75a95ddf2767ce89d4a3a4d63d04
Opcode Fuzzy Hash: a0f43de8070e261bf7328609507c989a3093a7cec3aefaf8b9619bec1e8fc4cc
Instruction Fuzzy Hash: F0218E75900211AFEB299F64DD0AABABAF9FB48300F14452EF841D6250EBB49D40DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00442272, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 004422C2

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 92702a7b8ed6e28c5361de1aeb194af747686c0a4c8e5b2cfe3b663adac8b1a3
Instruction ID: 1caa5b2ec5837e5fc42f25a24d2a34505263649788b60a24e531a29dcc082229
Opcode Fuzzy Hash: 92702a7b8ed6e28c5361de1aeb194af747686c0a4c8e5b2cfe3b663adac8b1a3
Instruction Fuzzy Hash: BA11E931A01621ABEB218F35DD40A5F7764AB01760B510262FD05B7390E7F8EC01D6EA

Uniqueness

Uniqueness Score: -1.00%

Function 004448CF, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004448C4,?,?,0044488C,00000000,00000000,?), ref: 004448E4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004448F7
FreeLibrary.KERNEL32(00000000,?,?,004448C4,?,?,0044488C,00000000,00000000,?), ref: 0044491A

Strings

mscoree.dll, xrefs: 004448DD
CorExitProcess, xrefs: 004448EF

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 248d97604ef844b277bd9179f488a53211341c4b072b839e5044c7f088c77912
Instruction ID: f92ad9c9b82783c5399bf2aa36d1979ea390f0737fe6e18496a1e56133c87a76
Opcode Fuzzy Hash: 248d97604ef844b277bd9179f488a53211341c4b072b839e5044c7f088c77912
Instruction Fuzzy Hash: 6FF08230500618FBEB119B51DC0ABDE7A68EF40756F100071E500B2261EBB98E10EA9A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A668, Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0045A6EC
__alloca_probe_16.LIBCMT ref: 0045A7B2
__freea.LIBCMT ref: 0045A81E

Part of subcall function 00456E3E: RtlAllocateHeap.NTDLL(00000000,0043C5A8,00000000,?,0043E9CE,00000002,00000000,?,?,?,00409826,0043C5A8,00000004,00000000,00000000,00000000), ref: 00456E70

__freea.LIBCMT ref: 0045A827
__freea.LIBCMT ref: 0045A84A

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 050b8053bd2b07fe039706d465f9347275c33229386715c504bc0f1541e99802
Instruction ID: 0322caf3b7be1dc21c3b627a1af9e280acddc266b209453039ef4c0a8a725a8c
Opcode Fuzzy Hash: 050b8053bd2b07fe039706d465f9347275c33229386715c504bc0f1541e99802
Instruction Fuzzy Hash: 3951F972500206AFDB205F55DC41EBF36A9DF44715F25422BFD04A7242EB3CDC2587AA

Uniqueness

Uniqueness Score: -1.00%

Function 00420313, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 264COMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?), ref: 0041FDE7

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Part of subcall function 0040B8F6: ___std_fs_copy_file@12.LIBCPMT ref: 0040B91A

Part of subcall function 00412448: _Deallocate.LIBCONCRT ref: 0041245D

NSS_Shutdown.NSS3(?,00000001,?,?,?), ref: 004202EE

Strings

5, xrefs: 00420144
VLWM, xrefs: 0042003A
a{, xrefs: 00420184

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate$InitShutdown___std_fs_copy_file@12
String ID: 5$VLWM$a{
API String ID: 967476354-2687788112
Opcode ID: 77acce12d59d71852662520b556b8e7f862bb9f8968f1a6e1298f38de3b85f3f
Instruction ID: ab4dcb7f4c9304df97d49674ea4c85db6c5ec66982c7f3828c8e0a391f10b887
Opcode Fuzzy Hash: 77acce12d59d71852662520b556b8e7f862bb9f8968f1a6e1298f38de3b85f3f
Instruction Fuzzy Hash: 34C17930D042A8CAEF25CBA4D951BEDBBB1AF19304F5041EED44977292EB741BC9CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0042480F, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00424814

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00424894
+hB, xrefs: 004248D0, 00424913
is_contiguous, xrefs: 00424899

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: +hB$A:\_Work\rc-build-v1-exe\json.hpp$is_contiguous
API String ID: 3519838083-207641284
Opcode ID: 574517e6e3d9b1d849ddfc958bad32796f36144dfb607f0f2bd0b985b2cca47d
Instruction ID: feab4ac5c2f2f2642b3116b18fee4218955f98b35afbbd1ac686680932088f3c
Opcode Fuzzy Hash: 574517e6e3d9b1d849ddfc958bad32796f36144dfb607f0f2bd0b985b2cca47d
Instruction Fuzzy Hash: FE4114B5E042499FCB09CFA8D4816AEFBF0EF88310B24C06ED859E7341D6349941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00424517, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042451C

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042453A
cannot compare iterators of different containers, xrefs: 00424584
m_object != nullptr, xrefs: 0042453F

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$cannot compare iterators of different containers$m_object != nullptr
API String ID: 3519838083-339906781
Opcode ID: ee54ac9806fc14dc2d4ecf77e9c3e972e3202b622dee2c64ded0efad066be465
Instruction ID: bfd2544fa95378f2d6947161eddde4ec98b8e699f642730026dd32d726161beb
Opcode Fuzzy Hash: ee54ac9806fc14dc2d4ecf77e9c3e972e3202b622dee2c64ded0efad066be465
Instruction Fuzzy Hash: A111C271A00114ABC710DF69D981A9AB7F4EF50354FA0881BE994E3650D33CFE80CA59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A235, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

std::system_error::system_error.LIBCPMT ref: 0040A2A3

Strings

ios_base::failbit set, xrefs: 0040A261, 0040A29D
ios_base::badbit set, xrefs: 0040A257, 0040A277
ios_base::eofbit set, xrefs: 0040A266

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2416138045-1866435925
Opcode ID: af54656431699b557a3af9f2c2a736072bf21ab5fdfc7d620795856fa65ea991
Instruction ID: ea35c02470cb5f65d0f4e260d20680ebe1ecd67e195af59ef20685c9da30b629
Opcode Fuzzy Hash: af54656431699b557a3af9f2c2a736072bf21ab5fdfc7d620795856fa65ea991
Instruction Fuzzy Hash: 8B0128729043186BC710E954C802BDE7B589B00350F44C07FFE49762C2E63D9D11CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 004644BE, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0046458E
_free.LIBCMT ref: 004645B7
SetEndOfFile.KERNEL32(00000000,00461D8C,00000000,00458589,?,?,?,?,?,?,?,00461D8C,00458589,00000000), ref: 004645E9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00461D8C,00458589,00000000,?,?,?,?,00000000), ref: 00464605

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 70f39c1b7cd71bf037d1ed3eaa6897e841d577ad04d5e5a03e2650fe691bb6ff
Instruction ID: a4ee9e4e2f971a779a1a7883cc4ee37a9d1e752152b330cd1459fd6804da23f5
Opcode Fuzzy Hash: 70f39c1b7cd71bf037d1ed3eaa6897e841d577ad04d5e5a03e2650fe691bb6ff
Instruction Fuzzy Hash: 6A410872900640ABDF15ABB9CC02AAF37B5AF85328F15011BF925E7292F63CCD44476A

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7E6, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E752

Part of subcall function 004324C4: __EH_prolog.LIBCMT ref: 004324C9
Part of subcall function 004324C4: _strcat.LIBCMT ref: 00432521

Part of subcall function 0040BED4: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,?,?,?,?,?,00000000,00000000,?), ref: 0040BEE7
Part of subcall function 0040BED4: DeleteFileTransactedA.KERNEL32 ref: 0040BEFE
Part of subcall function 0040BED4: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,?,?,?,00418431,00000012,00000000), ref: 0040BF09

Strings

], xrefs: 0042E7F2
0z, xrefs: 0042E6F2
w, xrefs: 0042E701, 0042E794, 0042E79F, 0042E7AE, 0042E7D9

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CommitCreateDeleteFileH_prologTransacted_strcatlstrlen
String ID: ]$0z$w
API String ID: 2985377347-1118305849
Opcode ID: b40ce92505a4b439e9cb29df7320cd0adedeaf06ec1a02db48f937bef908d5f6
Instruction ID: 3d08126debbc36ad59607df92a365394fb8aeab3897529408ad9eba71dac68e8
Opcode Fuzzy Hash: b40ce92505a4b439e9cb29df7320cd0adedeaf06ec1a02db48f937bef908d5f6
Instruction Fuzzy Hash: F3318E70A011589ACF18E7B1C855BEDB7B55F54308F1081EFA505732C2EF781B49CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041497C, Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,004173DC,?,?,?), ref: 00414992
CopyFileTransactedA.KERNEL32 ref: 004149B8
CommitTransaction.KTMW32(00000000,?,004173DC,?,?,?,?,?,00000000,00000000,UTC_,?,?,?,?,UTC_), ref: 004149C3
RollbackTransaction.KTMW32(00000000,?,004173DC,?,?,?,?,?,00000000,00000000,UTC_,?,?,?,?,UTC_), ref: 004149CB

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CommitCopyCreateFileRollbackTransacted
String ID:
API String ID: 2868256026-0
Opcode ID: ef3bd1602192d500b1cbc2ab896a1476c7f18235841f2f0bbab2466a3e4d3165
Instruction ID: 706e76bf096f8118776603dbc7d2d6e44794d91effc1ec2320793649dd24f9c4
Opcode Fuzzy Hash: ef3bd1602192d500b1cbc2ab896a1476c7f18235841f2f0bbab2466a3e4d3165
Instruction Fuzzy Hash: 29F0A4B1220110BFB7045A749C88DB7376DEB863617200626FD12D22D0E6A49CD18AB7

Uniqueness

Uniqueness Score: -1.00%

Function 004643BB, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,004610CF,00000000,00000001,00000000,00000000,?,0045561B,00000000,00443405,00000000), ref: 004643D2
GetLastError.KERNEL32(?,004610CF,00000000,00000001,00000000,00000000,?,0045561B,00000000,00443405,00000000,00000000,00000000,?,00455B6F,00000000), ref: 004643DE

Part of subcall function 004643A4: CloseHandle.KERNEL32(FFFFFFFE,004643EE,?,004610CF,00000000,00000001,00000000,00000000,?,0045561B,00000000,00443405,00000000,00000000,00000000), ref: 004643B4

___initconout.LIBCMT ref: 004643EE

Part of subcall function 00464366: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00464395,004610BC,00000000,?,0045561B,00000000,00443405,00000000,00000000), ref: 00464379

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,004610CF,00000000,00000001,00000000,00000000,?,0045561B,00000000,00443405,00000000,00000000), ref: 00464403

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1933cfb0267be48cf9ac2989c51ed86be4ed32e23342bd5df446837686ed8b04
Instruction ID: b613d059a2d6300824211cc644f5862202073b203b6cefc3bbc53cc7e34d6700
Opcode Fuzzy Hash: 1933cfb0267be48cf9ac2989c51ed86be4ed32e23342bd5df446837686ed8b04
Instruction Fuzzy Hash: D2F01C36501659BBCF225FD1DC05A8A3F66FB497A0F014025FA08A6221EA3288709BDA

Uniqueness

Uniqueness Score: -1.00%

Function 004527E2, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004527EB

Part of subcall function 00455C93: RtlFreeHeap.NTDLL(00000000,00000000,?,0045F0BB,?,00000000,?,00000002,?,0045F35E,?,00000007,?,?,0045F75F,?), ref: 00455CA9
Part of subcall function 00455C93: GetLastError.KERNEL32(?,?,0045F0BB,?,00000000,?,00000002,?,0045F35E,?,00000007,?,?,0045F75F,?,?), ref: 00455CBB

_free.LIBCMT ref: 004527FE
_free.LIBCMT ref: 0045280F
_free.LIBCMT ref: 00452820

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 996f8e5cdb257ebadedf99124e433bb30977756956aa52648a54fccf1245ff77
Instruction ID: fc7794280bdd97063119a73b600b67719dbae2f15273f7a5043a79469b74f00b
Opcode Fuzzy Hash: 996f8e5cdb257ebadedf99124e433bb30977756956aa52648a54fccf1245ff77
Instruction Fuzzy Hash: F3E0B671800B21AEC6426F15FE1249D3A75E784F55349083FF80416A37C73916569BCD

Uniqueness

Uniqueness Score: -1.00%

Function 0045058D, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0045061D

Strings

pow, xrefs: 004505F5, 00450612

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 57d01269f056e7f7e63193843bd2daccb7471543ab08e9ab1da84346818c733a
Instruction ID: 1d155efcdf17cf0ed8f6432fa362694f5efb423f39c3c31daae1d3e617202e04
Opcode Fuzzy Hash: 57d01269f056e7f7e63193843bd2daccb7471543ab08e9ab1da84346818c733a
Instruction Fuzzy Hash: C5517C659083028EDB127718D99136B2B94DB40703F244D6FECD9863A7EB3D8CDD9A4E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A188, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A18D

Part of subcall function 0041A2B8: __EH_prolog.LIBCMT ref: 0041A2BD

Part of subcall function 0041A095: __EH_prolog.LIBCMT ref: 0041A09A

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Part of subcall function 0041A060: std::exception::exception.LIBCONCRT ref: 0041A081

Strings

parse_error, xrefs: 0041A1BA
parse error, xrefs: 0041A1EB

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog$Deallocatestd::exception::exception
String ID: parse error$parse_error
API String ID: 3877490255-1820534363
Opcode ID: d79446fb7aca96bfb8ec6bfd73fa21566f9401f2f1881bcb02a2c5242868ca70
Instruction ID: 4a14863d1bc30708f0da087ce0f75a0c3284db6101028023354febcc36ad9c1a
Opcode Fuzzy Hash: d79446fb7aca96bfb8ec6bfd73fa21566f9401f2f1881bcb02a2c5242868ca70
Instruction Fuzzy Hash: 72317230900258DFCB14EFA5C992BEDBBB5BF14308F50405EE045A7292DBB81B99CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004242B1, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004242B6

Strings

object != nullptr, xrefs: 00424371
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042436C

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr
API String ID: 3519838083-2355325030
Opcode ID: b53437aaae7cc532ccad2fcfef2cbceb6d56d4d6be6743e05da045e84c9ab52f
Instruction ID: ee0200edb1922b842a91b1feb7164505da331811d2fe56ede398b8bad7406fcf
Opcode Fuzzy Hash: b53437aaae7cc532ccad2fcfef2cbceb6d56d4d6be6743e05da045e84c9ab52f
Instruction Fuzzy Hash: 2E21F571B00A169BC701DF6AE041AAEFBB0FF95314F50811BE859A3B51D738DA40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2B8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A2BD

Part of subcall function 00412665: _Deallocate.LIBCONCRT ref: 00412674

Strings

, column , xrefs: 0041A326
at line , xrefs: 0041A310

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeallocateH_prolog
String ID: at line $, column
API String ID: 3708980276-191570568
Opcode ID: 225866104d26b0d63c22828ffa0f93e718c8d94a8cdede6299ff788fb56e506f
Instruction ID: f15b85272232b02e5c3df74df3a74a75e384e36d21d1b44caa95ad744433b932
Opcode Fuzzy Hash: 225866104d26b0d63c22828ffa0f93e718c8d94a8cdede6299ff788fb56e506f
Instruction Fuzzy Hash: C921A571A10118DACB19EBA5D891EEDB778EF95318F40411FE012A3281EF781F49CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004246A2, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004246A7

Strings

object != nullptr, xrefs: 004246E9
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 004246E4

Memory Dump Source

Source File: 00000001.00000002.692928390.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr
API String ID: 3519838083-2355325030
Opcode ID: ce60a0d7bbbcd6554629e131259f09dd20aa280dd01a394b1a9384b2b855f0b8
Instruction ID: 3d0336f62cb363293b9b394aeb6fb25419cf4be9c593d0811956fc0264479639
Opcode Fuzzy Hash: ce60a0d7bbbcd6554629e131259f09dd20aa280dd01a394b1a9384b2b855f0b8
Instruction Fuzzy Hash: A2F06272E006149BC721EF6995026CEBBF4DB54B54F10457FE509E7280EBB8860487D9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 7SlKt2Puui.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Raccoon Stealer

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre